General Signal Corporation

Henry C Sibley

John H Auer, Jr

Willis R Smith

David B Rutherford

Leslie C Stewart

David B Rutherford, Jr

A method for vital memory management of data. A method is disclosed for clearing on specified conditions and for assuring the clearing is effected. Both random access and stack operation are implemented. Clearing the memory area requires reading the contents of a given location and, assuming expected data is read, going on to process the next memory location. In one embodiment the contents of the given location are used to access the next location, thereby assuring that if unexpected data is read the process will not proceed normally.

Memory management method and apparatus for initializing and/or clearing

A vital communication system connects an input location to an output location using a non-vital communication link. In addition to transmitting, from the input location to the output location, a word with a bit dedicated to each different input, a system check word is transmitted. Each different input is assigned a unique multi-bit value, and the system check word comprises a linear combination of the unique multi-bit values for each of the inputs in a given binary state. Thus, there is a relationship between the transmitted words with bits dedicated to each input line and the system check word. At the output location, this correspondence is checked for. In addition, a further check is employed which first produces an output check word made up of a linear combination of the unique names for each output which are not in the given binary state. This output check word is then linearly combined with the received system check word. In the absence of a failure, the result of this linear combination of the output check word and the system check word should be constant regardless of the particular condition of different inputs and outputs, so long as the output and inputs actually correspond. Apparatus is provided to check for this constant result.

Vital message system with unique function identification

A vital communication system includes a conventional, that is non-vital, communication link, a transmitter and a receiver. The transmitter is responsive to input data, and provides for encoding and transmission as well as checking of its own input arrangement. The encoding and transmission is effected by a program driven device, but as loaded the program is incomplete. The checking produces certain check words which are used to complete the program so that only in those instances in which the checks are passed, will an appropriate message be transmitted. The receiver includes a decoder logic as well as a decoder check logic. The messages are decoded and applied to an output device. The decoder check logic checks that the information supplied to the output device corresponds to the decoded information, and if the check is passed, the output device is enabled to output the information to the outside world.

Vital communication system for transmitting multiple messages

As a component in a vital processing system, the vital driver includes hardware and software elements that enable it to produce a time sensitive output in response to receipt, on a batch basis, of check words. The number, content and rate of the check words are checked and used by the vital driver to produce a time sensitive output which can have parameters such as carrier frequency, modulation rate and duty cycle which are determined in part by the number, content and rate of receipt of the check words, and in part by the flawless execution of its own software. The vital driver software includes a number of significant elements including a vital starting delay, as well as modular components for producing different portions of the time sensitive output. Because of its modular nature, the software allows the production of an identical time sensitive output from groups of check words which are different in number and content, enabling the same vital driver to perform a checking function on primary processors which are running significantly different software.

Modular output driver for vital processor systems

A vehicle carried profile generator generates a speed profile to control a vehicle governor at the transition from a higher to lower speed limit. The speed profile is calculated and checked to ensure it starts at a valid speed limit, continually decreases and is above a wayside speed limit. The governor is modified or controlled to inhibit brake application or a requirement for a brake application so long as actual speed is below profile speed.

Microprocessor based over/under speed governor

Apparatus and method for vital memory management of data. Method and apparatus is disclosed for clearing memory on specified conditions and for assuring the clearing is effected. Both random access and stack operation are implemented. Furthermore, an intentional delay may be provided to ensure that data using apparatus properly interprets the signals provided thereto. Included is a word testing method and apparatus which is also arranged to be self-checking.

A vital timer for energizing a vital relay at the end of a preselected time interval generated by a vitally programmed microprocessor. Diverse time data words of the preselected time interval are generated, loaded into diverse registers within the microprocessor, and are incremented by means of a program loop for the duration of the time interval determined by the magnitude of the diverse time data words. The microprocessor includes checking routines for verifying that the selected time interval has correctly been read, that a microprocessor primary clock bears a predetermined relationship to an external auxiliary clock, and that the diverse registers maintain a predetermined count relationship for the duration of the preselected time interval. Checking routines produce plural predetermined checkwords indicative of vital timer performance, which checkwords are utilized to address an output program formed of groups of instructions each corresponding to a respective checkword, and each of which must be accessed in predetermined sequence in order to produce a predetermined time varying output to the tuned vital relay driver. Thus, the tuned vital relay driver is activated only in the event that each prescribed checkword is generated to verify failure free timer performance.

Vital timer

A vital contact checking circuit which senses the state of the back contact of a relay in either a dynamic or static situation. In the former, a signal is coupled from its source to a detector by a coupling device, such as a transformer, and an additional winding on the transformer is connected to the heel and back contact of the relay whose contact is being checked. When a circuit is established through the back contact the additional winding is short circuited, thereby preventing the signal from the source from reaching the detector and effectively eliminating it. A variation of this scheme, also for use in a dynamic situation, involves using the coil structure in a resonant circuit, the sensing winding causing detuning when the back contact is closed so that again, the detector does not receive the signal from the source. For performing a vital check on a static contact, another scheme is utilized because a failure in the oscillator or detector circuit of the schemes already described would give the same indication as a closed back contact. Therefore, the primary and secondary windings of the main transformer are wound on separate cores and the sensing winding links the individual cores so that the detector produces an output only if the sensed contact is indeed closed.

Vital contact checking circuit

A vital digital control system with keyboard inputs for activating at least one output device in response to a manual keyboard selection of a sequence of the predetermined number of operation instructions, including a keyboard encoder for generating a message based on the operation instructions, a vital decoder coupled to the keyboard encoder for identifying each pair of message words and for producing diverse output words and diverse display words based on the message words and diverse display echo words based on the display words, and a display coupled to the decoder for displaying a representation of the display words. The vital decoder includes means for sequentially producing diverse multi-bit checkwords based on predetermined words generated by the system indicative of system performance, these predetermined words including the display words and the display echo words. The checkwords are produced in response to receipt of the message words and may be based additionally on diagnostic testing routines formed before, during, and after receipt of the keyboard instructions. The vital decoder compares each of the generated checkwords to a predetermined constant multi-bit pattern and produces a validation signal if sequential ones of the checkwords are complementary and are identical to the milti-bit pattern, whereupon the vital decoder activates output devices in accordance with the specific keyboard instructions, but only in the event that valid system operation is indicated by means of the presence of the validation signal.

Keyboard controlled vital digital communication system

A tachometer signal provides input to first and second parallel connected channels, each of the channels comprising in series operational amplifier, threshold detector, and counting devices. A comparator checks that the same count is registered by the counters of both channels. Each of the threshold detectors is biased to require a minimum amplitude over and under tachometer pulse input in order to deliver an output to the pulse counter of the associated channel. Attenuating circuits act on the inputs of the operational amplifiers of both channels during predetermined intervals to check that the amplitude of the tachometer pulses is sufficient to be counted by the tachometer counters. Dynamic checking circuits are provided to check the integrity of the attenuating system.

Speed control systems for governing the speed of a vehicle

A contact monitoring circuit for producing a dynamic signal representative of the state of a contact. The circuit includes a control signal generator for generating a pair of optical pulse streams comprised of alternate and sequential optical pulses. A pair of gating means, each responsive to one of the pair of pulse streams, connects each of two conductors to one of a positive and negative source of potential in time coincidence with the associated pulse stream. A circuit means, including an optical coupler, the contact being monitored and a fixed potential, has a complete supply circuit during times coincident with only one of the pulse streams, the condition of the contact determines which of the pulse streams will complete the supply circuit. Therefore, the optical coupler produces a dynamic signal representative of the contact state.

Vital contact isolation circuit

An electronic system which emulates the operation of a polar relay for applying coded pulses to railway tracks has separate signaling circuits having signaling devices responsive to a separate inputs which provide operating power to the circuits. The circuits are interlocked by connecting the inputs to the signaling devices in inverse relationship. One input excludes the other. The signaling devices may be light emitting isolators with switching transistors which control the application of current pulses through the rails of the track while isolating the track battery which supplies the current for these pulses from the local battery which provides the inputs to the signaling circuits. The signaling circuits establish current paths through the light emitting signaling devices at predetermined times after the inputs are applied to emulate the pickup and drop away time of the polar relay. The switching circuits use complementary symmetry power transistors which provide fail safe operation in the signaling system in the event of a short-circuit failure mode throughout. Dual sets of bridge circuits and transient absorbers protect against voltage surges from the track such as may be due to lightning. Operating windings for local circuit relays are connected in series with the power transistors and operate only in response to actual signaling conditions. The signaling circuits and the switching circuits are arranged so that operating current for a circuit which functions to produce track current pulses of one polarity is available only if the circuit which would provide track current pulses of the opposite polarity is inoperative so as to guard against unsafe signaling conditions.

Electronic track current switching relay system

A vital rate decoder for actuating one of a plurality of output relays in correspondence with the frequency of an input signal applied thereto, comprising a main rate decoding processor for evaluating the frequency and duty cycle of the input signal by establishing permissible rate windows defined by predetermined tolerances such that the output device corresponding to a frequency can be actuated only when the input signal has a rate code falling in a respective rate window with a predetermined duty cycle tolerance. The rate decoding processor produces plural checkwords having predetermined values based on failure-free rate decoding of the input signal. The checkwords are processed by a checking processor which produces a relay actuating signal only if valid checkwords are produced. The checking processor uses the checkwords to select and load predetermined bytes into a pair of vital counting registers which are then successively decremented. The checking processor then compares the decremented counter register contents at each step to verify that the contents thereof bear a predetermined relationship such that the output device corresponding to the rate code of the input signal is actuated only until the counting registers reach a predetermined count and only so long as the comparison of the contents of the pair of counting registers bear the predetermined relationship.

Vital rate decoder

A code generator including a programmed microprocessor for transmitting a selected fixed frequenccy signal through optical isolators to tuned vital relay drivers. Feedback information from these drivers monitors their operation and checks operation of output circuitry. External time delays are provided to check program delays within the system and to ensure against the generation of erroneous codes due to cyclical resetting of the system. A rate selector is provided to permit selection of particular output code rates and is cycle checked continuously to ensure that the system is always certain of the selected code. Unique programming functions are also provided for self checking and for checking the operation of the microprocessor against the operation of external components to provide total system integrity and total system reliability. Diversity and cycle checking are used throughout the system to provide vital qualities. The system has no failure bias and is entirely self checking. Any component or program failure or malfunction causes the system to shut down completely.

Growing community of inventors

Adams Basin, NY, United States of America

Henry C Sibley