Abstract: The invention describes a method and apparatus for effecting vital functions notwithstanding the fact that non-vital hardware is employed. A vital processor is implemented using non-vital hardware in the form of a digital computer which may for example be a microprocessor. The vital processor accepts binary input values and, based on a series of logical expressions relating output values to input values, determines the appropriate output values. Rather than employing a single bit to represent the condition of a particular input or output, unique multibit binary values or names are used. Each input or output has assigned to it at least two unique multibit values, each satisfying the code rules of a different code. Thus rather than representing a closed contact as a single 1 bit, and an open contact as a single 0 bit, in accordance with the invention the closed contact is represented by a unique multibit name which satisfies the code rules of a first code.

Abstract: The invention describes a method and apparatus for effecting vital functions notwithstanding the fact that non-vital hardware is employed. A vital processor is implemented using non-vital hardware in the form of a digital computer which may for example be a microprocessor. The vital processor accepts binary input values and, based on a series of logical expressions relating output values to input values, determines the appropriate output values. Rather than employing a single bit to represent the condition of a particular input or output, unique multibit binary values or names are used. Each input or output has assigned to it at least two unique multibit values, each satisfying the code rules of a different code. Thus rather than representing a closed contact as a single 1 bit, and an open contact as a single 0 bit, in accordance with the invention the closed contact is represented by a unique multibit name which satisfies the code rules of a first code.

Abstract: Continuous verification of vital (fail-safe) outputs from an information processing system is obtained without the need for large computing capacity (overhead). Multibit test sequences are provided continuously during successive subparts of the processor system cycle to vital output interfaces which invert the bits of the signals or do not pass them depending upon the state of the output. A compiler including a random access memory (RAM) addressed by a read only memory (ROM) is configured to divide each sequence by direct and inverse polynomials on alternately occurring parts of the system cycle to provide compressed data. After each part of the system cycle, checkwords are constructed using the resultant compressed data corresponding to each output which must be proven to be in its `off` state.

Abstract: A vehicle carried profile generator generates a speed profile to control a vehicle governor at the transition from a higher to lower speed limit. The speed profile is calculated and checked to ensure it starts at a valid speed limit, continually decreases and is above a wayside speed limit. The governor is modified or controlled to inhibit brake application or a requirement for a brake application so long as actual speed is below profile speed.

Abstract: A tachometer signal provides input to first and second parallel connected channels, each of the channels comprising in series operational amplifier, threshold detector, and counting devices. A comparator checks that the same count is registered by the counters of both channels. Each of the threshold detectors is biased to require a minimum amplitude over and under tachometer pulse input in order to deliver an output to the pulse counter of the associated channel. Attenuating circuits act on the inputs of the operational amplifiers of both channels during predetermined intervals to check that the amplitude of the tachometer pulses is sufficient to be counted by the tachometer counters. Dynamic checking circuits are provided to check the integrity of the attenuating system.

Abstract: A fail-safe time delay circuit is provided to produce an output a predetermined time, and no less than a predetermined time after an input stimulus. The circuit includes a driving circuit for a pair of relays which are operated at slightly greater than 50% duty cycle and out of phase such that, except when the circuit is de-energized, at least one of the relays is always energized. The contacts of the two relays are employed in a balanced voltage amplifier to produce a bi-polar signal, with the magnitude of both polarities increasing, with the time required for the increase to a defined threshold establishing the time delay. A pair of threshold circuits are coupled to the output of the balanced voltage amplifier such that each threshold circuit (one responding to the positive portion, and the other the negative portion of the bi-polar output) is energized when the respective portion of the bi-polar signal is detected to reach the associated threshold.