摘要:
A method and apparatus for effecting vital functions notwithstanding the fact that non-vital hardware is employed. A vital processor is implemented using non-vital hardware in the form of a digital computer which may for example be a microprocessor. The vital processor accepts binary input values and, based on a series of logical expressions relating output values to input values, determines the appropriate output values. Rather than employing a single bit to represent the condition of a particular input or output, unique multibit binary values or names are used. Each input or output has assigned to it at least two unique multibit values, each satisfying the code rules of a different code. Thus rather than representing a closed contact as a single 1 bit, and an open contact as a single 0 bit, the closed contact is represented by a unique multibit name which satisfies the code rules of a first code. At any point in the processing the value representing the contact can be checked to see if it satisfies the code rules, and if it does not a potential error is detected and handled. Although it is highly unlikely that a hardware failure would result in generating one of the few multibit names satisfying the code rule, that occurrence is not unlikely enough to be considered vital. Before actually controlling output devices in accordance with the processing, further tests are implemented which ensure that the multibit value computed for a particular output not only satisfies the predetermined code rule which is required, but is also correct bit for bit. Logic equations describing the relationship between output and input are actually computed using the multibit values as opposed to single bit values.
摘要:
The functions to be performed by a digital overspeed controller are implemented by application of two concepts, namely "diverse channels" and "even/odd systems cycles"; in accordance with the first concept, two channels are maintained throughout the overspeed controller, beginning with two independent tachometer inputs; all of the functions involve operations to be performed in each of the two channels separately. The numerical results for each of the channels are different and the numerical difference between the two channels is used to prove the integrity of the functions described. The second concept of "even/odd system cycles" involves a "system cycle time", denoted T.sub.CYC, that is nominally 100 milliseconds. All of the functions of the controller are performed each system cycle. In order to be able to vitally distinguish data results between adjacent cycles, the cycles are denoted EVEN and ODD, and the results of each of the operations produce different numerical values on even and odd cycles.
摘要:
Apparatus for insuring a vehicle operator's attentiveness at potentially dangerous locations along a path of travel. A signalling device is provided in advance of a potentially dangerous location, in the direction of travel of the vehicle. A vehicle carried signal responsive device responds to the signalling device when within the effective zone of the signalling device. The vehicle includes warning apparatus, for example, an alarm and a buzzer. The vehicle also includes an operator actuatable push button and a speed sensing apparatus. A control device responds to the push button and to the vehicle carried signal responsive device to operate either the buzzer or the alarm. If the operator evidences his alertness to the potentially dangerous location by actuating the push button prior to reaching the signalling device (within some constraint), the control apparatus merely sounds the buzzer when the signalling device is detected and resets itself. On the other hand, if the operator fails to actuate the push button in advance of detection of the signalling device, or, if his actuation is too far in advance of detection, then the alarm is energized and will remain energized until the vehicle is brought to a stop, or a low speed, at which point, push button actuation can cancel the alarm.
摘要:
A vital microcompressor-based rate decoder for use in a vital processing system in on-board main line railroad and rapid transit automatic train protection systems; the design is such that a method is incorporated for tolerating specific kinds of signal disruption and in such a way that the probability of a wrongside failure has a calculable upper bound. A pickup coil transmits external or wayside signals to an arrangement which involves two channels and which provides period and duty cycle measurement of the pulses resulting from demodulation of the external signals. A counter is employed in each of the channels and a tolerance accumulation rate decoding device is included, the maximum amount of tolerance accumulated, and the minimum time required to accumulate it, being functions of the rate code selected.
摘要:
The present device, a vital power controller with forgiveness, is a subsystem of a larger vital processing system, the function of the subsystem being to verify the proper operation of the larger system and to provide power to the system outputs only when the larger system functions correctly; the larger system periodically delivers checkword sets to the vital power controller (VPC); the checkwords verify the correct operation of the larger system, a valid checkword set enabling the VPC to generate vital power for a limited time; the forgiveness feature allows the VPC to tolerate an occasional bad checkword set and yet continue to provide vital power if the rate at which bad checkword sets is encountered is below a specified rate, thereby providing improved performance in the presence of noise which tends to produce occasional bad checkwords and which would otherwise cause loss of vital power.
摘要:
A microprocessor based vital delay circuit is provided which is arranged to emit an output no less than a predetermined time after an input stimulus. The predetermined time, which corresponds to the delay, is controlled by selecting the relationship between two quantities. A digital processor performs a series of computations on the two quantities, each computation is arranged to take unit time and by selecting the proper relationship between the two quantities, the total series of computations takes a predetermined amount of time. Before the output is allowed to occur, several checks are performed to insure that no hardware or software failures have erroneously generated the result. One novel checking technique insures that the clock frequency has not changed, and this technique is applicable to a wide variety of devices in which digital techniques are employed.