Abstract: A method for vital memory management of data. A method is disclosed for clearing on specified conditions and for assuring the clearing is effected. Both random access and stack operation are implemented. Clearing the memory area requires reading the contents of a given location and, assuming expected data is read, going on to process the next memory location. In one embodiment the contents of the given location are used to access the next location, thereby assuring that if unexpected data is read the process will not proceed normally.

Abstract: A vital communication system connects an input location to an output location using a non-vital communication link. In addition to transmitting, from the input location to the output location, a word with a bit dedicated to each different input, a system check word is transmitted. Each different input is assigned a unique multi-bit value, and the system check word comprises a linear combination of the unique multi-bit values for each of the inputs in a given binary state. Thus, there is a relationship between the transmitted words with bits dedicated to each input line and the system check word. At the output location, this correspondence is checked for. In addition, a further check is employed which first produces an output check word made up of a linear combination of the unique names for each output which are not in the given binary state. This output check word is then linearly combined with the received system check word.

Abstract: A vital communication system includes a conventional, that is non-vital, communication link, a transmitter and a receiver. The transmitter is responsive to input data, and provides for encoding and transmission as well as checking of its own input arrangement. The encoding and transmission is effected by a program driven device, but as loaded the program is incomplete. The checking produces certain check words which are used to complete the program so that only in those instances in which the checks are passed, will an appropriate message be transmitted. The receiver includes a decoder logic as well as a decoder check logic. The messages are decoded and applied to an output device. The decoder check logic checks that the information supplied to the output device corresponds to the decoded information, and if the check is passed, the output device is enabled to output the information to the outside world.

Abstract: As a component in a vital processing system, the vital driver includes hardware and software elements that enable it to produce a time sensitive output in response to receipt, on a batch basis, of check words. The number, content and rate of the check words are checked and used by the vital driver to produce a time sensitive output which can have parameters such as carrier frequency, modulation rate and duty cycle which are determined in part by the number, content and rate of receipt of the check words, and in part by the flawless execution of its own software. The vital driver software includes a number of significant elements including a vital starting delay, as well as modular components for producing different portions of the time sensitive output.

Abstract: A vehicle carried profile generator generates a speed profile to control a vehicle governor at the transition from a higher to lower speed limit. The speed profile is calculated and checked to ensure it starts at a valid speed limit, continually decreases and is above a wayside speed limit. The governor is modified or controlled to inhibit brake application or a requirement for a brake application so long as actual speed is below profile speed.

Abstract: Apparatus and method for vital memory management of data. Method and apparatus is disclosed for clearing memory on specified conditions and for assuring the clearing is effected. Both random access and stack operation are implemented. Furthermore, an intentional delay may be provided to ensure that data using apparatus properly interprets the signals provided thereto. Included is a word testing method and apparatus which is also arranged to be self-checking.

Abstract: A vital timer for energizing a vital relay at the end of a preselected time interval generated by a vitally programmed microprocessor. Diverse time data words of the preselected time interval are generated, loaded into diverse registers within the microprocessor, and are incremented by means of a program loop for the duration of the time interval determined by the magnitude of the diverse time data words. The microprocessor includes checking routines for verifying that the selected time interval has correctly been read, that a microprocessor primary clock bears a predetermined relationship to an external auxiliary clock, and that the diverse registers maintain a predetermined count relationship for the duration of the preselected time interval.

Abstract: A vital communication system includes a conventional, that is non-vital, communication link, a transmitter and a receiver. The transmitter is responsive to input data, and provides for encoding and transmission as well as checking of its own input arrangement. The encoding and transmission is effected by a program driven device, but as loaded the program is incomplete. The checking produces certain check words which are used to complete the program so that only in those instances in which the checks are passed, will an appropriate message be transmitted. The receiver includes a decoder logic as well as a decoder check logic. The messages are decoded and applied to an output device. The decoder check logic checks that the information supplied to the output device corresponds to the decoded information, and if the check is passed, the output device is enabled to output the information to the outside world.

Abstract: A vital contact checking circuit which senses the state of the back contact of a relay in either a dynamic or static situation. In the former, a signal is coupled from its source to a detector by a coupling device, such as a transformer, and an additional winding on the transformer is connected to the heel and back contact of the relay whose contact is being checked. When a circuit is established through the back contact the additional winding is short circuited, thereby preventing the signal from the source from reaching the detector and effectively eliminating it. A variation of this scheme, also for use in a dynamic situation, involves using the coil structure in a resonant circuit, the sensing winding causing detuning when the back contact is closed so that again, the detector does not receive the signal from the source.

Abstract: A vital digital control system with keyboard inputs for activating at least one output device in response to a manual keyboard selection of a sequence of the predetermined number of operation instructions, including a keyboard encoder for generating a message based on the operation instructions, a vital decoder coupled to the keyboard encoder for identifying each pair of message words and for producing diverse output words and diverse display words based on the message words and diverse display echo words based on the display words, and a display coupled to the decoder for displaying a representation of the display words. The vital decoder includes means for sequentially producing diverse multi-bit checkwords based on predetermined words generated by the system indicative of system performance, these predetermined words including the display words and the display echo words.

Abstract: A tachometer signal provides input to first and second parallel connected channels, each of the channels comprising in series operational amplifier, threshold detector, and counting devices. A comparator checks that the same count is registered by the counters of both channels. Each of the threshold detectors is biased to require a minimum amplitude over and under tachometer pulse input in order to deliver an output to the pulse counter of the associated channel. Attenuating circuits act on the inputs of the operational amplifiers of both channels during predetermined intervals to check that the amplitude of the tachometer pulses is sufficient to be counted by the tachometer counters. Dynamic checking circuits are provided to check the integrity of the attenuating system.

Abstract: A contact monitoring circuit for producing a dynamic signal representative of the state of a contact. The circuit includes a control signal generator for generating a pair of optical pulse streams comprised of alternate and sequential optical pulses. A pair of gating means, each responsive to one of the pair of pulse streams, connects each of two conductors to one of a positive and negative source of potential in time coincidence with the associated pulse stream. A circuit means, including an optical coupler, the contact being monitored and a fixed potential, has a complete supply circuit during times coincident with only one of the pulse streams, the condition of the contact determines which of the pulse streams will complete the supply circuit. Therefore, the optical coupler produces a dynamic signal representative of the contact state.

Abstract: An electronic system which emulates the operation of a polar relay for applying coded pulses to railway tracks has separate signaling circuits having signaling devices responsive to a separate inputs which provide operating power to the circuits. The circuits are interlocked by connecting the inputs to the signaling devices in inverse relationship. One input excludes the other. The signaling devices may be light emitting isolators with switching transistors which control the application of current pulses through the rails of the track while isolating the track battery which supplies the current for these pulses from the local battery which provides the inputs to the signaling circuits. The signaling circuits establish current paths through the light emitting signaling devices at predetermined times after the inputs are applied to emulate the pickup and drop away time of the polar relay.

Abstract: A vital rate decoder for actuating one of a plurality of output relays in correspondence with the frequency of an input signal applied thereto, comprising a main rate decoding processor for evaluating the frequency and duty cycle of the input signal by establishing permissible rate windows defined by predetermined tolerances such that the output device corresponding to a frequency can be actuated only when the input signal has a rate code falling in a respective rate window with a predetermined duty cycle tolerance. The rate decoding processor produces plural checkwords having predetermined values based on failure-free rate decoding of the input signal. The checkwords are processed by a checking processor which produces a relay actuating signal only if valid checkwords are produced. The checking processor uses the checkwords to select and load predetermined bytes into a pair of vital counting registers which are then successively decremented.

Abstract: A code generator including a programmed microprocessor for transmitting a selected fixed frequenccy signal through optical isolators to tuned vital relay drivers. Feedback information from these drivers monitors their operation and checks operation of output circuitry. External time delays are provided to check program delays within the system and to ensure against the generation of erroneous codes due to cyclical resetting of the system. A rate selector is provided to permit selection of particular output code rates and is cycle checked continuously to ensure that the system is always certain of the selected code. Unique programming functions are also provided for self checking and for checking the operation of the microprocessor against the operation of external components to provide total system integrity and total system reliability. Diversity and cycle checking are used throughout the system to provide vital qualities. The system has no failure bias and is entirely self checking.

Abstract: An apparatus for sensing vehicular mechanical motion, which includes a motion transducer for sensing a vehicular displacement, and which generates plural groups of transducer signals based on the sensed displacements, with the transducer signals of each group bearing a predetermined relative phase relationship with respect to the transducer signals of the other groups. The plural groups of transducer signals are respectively applied to plural latching switch circuits, each of which is capable of being set to a first motion sensitive output state and latched to a second output state upon the application thereto of a signal from a respective group of signals. Connected to the plural latching switch circuits is a circuit for detecting when all the latching switch circuits are in the second latched output state and for then generating a motion detected signal indicative of the fact that a predetermined vehicular displacement has occured.

Abstract: A vital relay driver whose response time can be readily controlled such that the release time of the relay may be varied, yet may be held to very close tolerances. The vital relay driver is controlled by a microprocessor dedicated to this function, such processor generating a dynamic signal of fixed frequency in dependence on a cycle number which is continually replenished; otherwise the microprocessor stops producing the dynamic signal and the relay is released in a closely known time.

Abstract: There is disclosed a circuit for energizing a vital relay in response to an input signal that is modulated between two frequencies. A discriminator circuit responds to the modulated frequencies and alternately produces an output patented of one polarity and then a reverse polarity in response to the modulated signals. Coupled between the discriminator and the vital relay is a relay driver which responds to the output of the discriminator and energizes the vital relay. A d.c. power supply is coupled to the relay driver. The vital relay includes two windings. Failure of the modulation, the d.c. source or virtually any circuit element, will result in release of the vital relay. The disclosed embodiment uses photoresistors as switching elements.

Abstract: A fail-safe solid state logic system based on the use of an AC input signal of one type, and a DC input which causes a logical gate to convert the AC input signal to a totally different AC output signal; that is, to one adapted to be received by a vital driver or the like, which is tuned to accept only that different AC output signal and no other. Accordingly, the failures which are most likely to occur, namely, shorts from input to output or failure to toggle, result in the AC signal frequency not being changed and as a consequence, the system fails safe.

Abstract: A vital relay driver whose response time can be readily controlled such that the release time of the relay may be varied, yet may be held to very close tolerances. The vital relay driver is controlled by a microprocessor dedicated to this function, such processor generating a dynamic signal of fixed frequency in dependence on a cycle number which is continually replenished; otherwise the microprocessor stops producing the dynamic signal and the relay is released in a closely known time.