Abstract: The invention describes a method and apparatus for effecting vital functions notwithstanding the fact that non-vital hardware is employed. A vital processor is implemented using non-vital hardware in the form of a digital computer which may for example be a microprocessor. The vital processor accepts binary input values and, based on a series of logical expressions relating output values to input values, determines the appropriate output values. Rather than employing a single bit to represent the condition of a particular input or output, unique multibit binary values or names are used. Each input or output has assigned to it at least two unique multibit values, each satisfying the code rules of a different code. Thus rather than representing a closed contact as a single 1 bit, and an open contact as a single 0 bit, in accordance with the invention the closed contact is represented by a unique multibit name which satisfies the code rules of a first code.

Abstract: A vital microcompressor-based rate decoder for use in a vital processing system in on-board main line railroad and rapid transit automatic train protection systems; the design is such that a method is incorporated for tolerating specific kinds of signal disruption and in such a way that the probability of a wrongside failure has a calculable upper bound. A pickup coil transmits external or wayside signals to an arrangement which involves two channels and which provides period and duty cycle measurement of the pulses resulting from demodulation of the external signals. A counter is employed in each of the channels and a tolerance accumulation rate decoding device is included, the maximum amount of tolerance accumulated, and the minimum time required to accumulate it, being functions of the rate code selected.

Abstract: The invention describes a method and apparatus for effecting vital functions notwithstanding the fact that non-vital hardware is employed. A vital processor is implemented using non-vital hardware in the form of a digital computer which may for example be a microprocessor. The vital processor accepts binary input values and, based on a series of logical expressions relating output values to input values, determines the appropriate output values. Rather than employing a single bit to represent the condition of a particular input or output, unique multibit binary values or names are used. Each input or output has assigned to it at least two unique multibit values, each satisfying the code rules of a different code. Thus rather than representing a closed contact as a single 1 bit, and an open contact as a single 0 bit, in accordance with the invention the closed contact is represented by a unique multibit name which satisfies the code rules of a first code.

Abstract: The functions to be performed by a digital overspeed controller are implemented by application of two concepts, namely "diverse channels" and "even/odd systems cycles"; in accordance with the first concept, two channels are maintained throughout the overspeed controller, beginning with two independent tachometer inputs; all of the functions involve operations to be performed in each of the two channels separately. The numerical results for each of the channels are different and the numerical difference between the two channels is used to prove the integrity of the functions described. The second concept of "even/odd system cycles" involves a "system cycle time", denoted T.sub.CYC, that is nominally 100 milliseconds. All of the functions of the controller are performed each system cycle. In order to be able to vitally distinguish data results between adjacent cycles, the cycles are denoted EVEN and ODD, and the results of each of the operations produce different numerical values on even and odd cycles.

Abstract: The present device, a vital power controller with forgiveness, is a subsystem of a larger vital processing system, the function of the subsystem being to verify the proper operation of the larger system and to provide power to the system outputs only when the larger system functions correctly; the larger system periodically delivers checkword sets to the vital power controller (VPC); the checkwords verify the correct operation of the larger system, a valid checkword set enabling the VPC to generate vital power for a limited time; the forgiveness feature allows the VPC to tolerate an occasional bad checkword set and yet continue to provide vital power if the rate at which bad checkword sets is encountered is below a specified rate, thereby providing improved performance in the presence of noise which tends to produce occasional bad checkwords and which would otherwise cause loss of vital power.

Abstract: A method and apparatus for effecting vital functions notwithstanding the fact that non-vital hardware is employed. A vital processor is implemented using non-vital hardware in the form of a digital computer which may for example be a microprocessor. The vital processor accepts binary input values and, based on a series of logical expressions relating output values to input values, determines the appropriate output values. Rather than employing a single bit to represent the condition of a particular input or output, unique multibit binary values or names are used. Each input or output has assigned to it at least two unique multibit values, each satisfying the code rules of a different code. Thus rather than representing a closed contact as a single 1 bit, and an open contact as a single 0 bit, the closed contact is represented by a unique multibit name which satisfies the code rules of a first code.

Abstract: Continuous verification of vital (fail-safe) outputs from an information processing system is obtained without the need for large computing capacity (overhead). Multibit test sequences are provided continuously during successive subparts of the processor system cycle to vital output interfaces which invert the bits of the signals or do not pass them depending upon the state of the output. A compiler including a random access memory (RAM) addressed by a read only memory (ROM) is configured to divide each sequence by direct and inverse polynomials on alternately occurring parts of the system cycle to provide compressed data. After each part of the system cycle, checkwords are constructed using the resultant compressed data corresponding to each output which must be proven to be in its `off` state.

Abstract: A vehicle carried profile generator generates a speed profile to control a vehicle governor at the transition from a higher to lower speed limit. The speed profile is calculated and checked to ensure it starts at a valid speed limit, continually decreases and is above a wayside speed limit. The governor is modified or controlled to inhibit brake application or a requirement for a brake application so long as actual speed is below profile speed.

Abstract: A tachometer signal provides input to first and second parallel connected channels, each of the channels comprising in series operational amplifier, threshold detector, and counting devices. A comparator checks that the same count is registered by the counters of both channels. Each of the threshold detectors is biased to require a minimum amplitude over and under tachometer pulse input in order to deliver an output to the pulse counter of the associated channel. Attenuating circuits act on the inputs of the operational amplifiers of both channels during predetermined intervals to check that the amplitude of the tachometer pulses is sufficient to be counted by the tachometer counters. Dynamic checking circuits are provided to check the integrity of the attenuating system.

Abstract: Apparatus for insuring a vehicle operator's attentiveness at potentially dangerous locations along a path of travel. A signalling device is provided in advance of a potentially dangerous location, in the direction of travel of the vehicle. A vehicle carried signal responsive device responds to the signalling device when within the effective zone of the signalling device. The vehicle includes warning apparatus, for example, an alarm and a buzzer. The vehicle also includes an operator actuatable push button and a speed sensing apparatus. A control device responds to the push button and to the vehicle carried signal responsive device to operate either the buzzer or the alarm. If the operator evidences his alertness to the potentially dangerous location by actuating the push button prior to reaching the signalling device (within some constraint), the control apparatus merely sounds the buzzer when the signalling device is detected and resets itself.

Abstract: A microprocessor based vital delay circuit is provided which is arranged to emit an output no less than a predetermined time after an input stimulus. The predetermined time, which corresponds to the delay, is controlled by selecting the relationship between two quantities. A digital processor performs a series of computations on the two quantities, each computation is arranged to take unit time and by selecting the proper relationship between the two quantities, the total series of computations takes a predetermined amount of time. Before the output is allowed to occur, several checks are performed to insure that no hardware or software failures have erroneously generated the result. One novel checking technique insures that the clock frequency has not changed, and this technique is applicable to a wide variety of devices in which digital techniques are employed.

Abstract: A fail-safe time delay circuit is provided to produce an output a predetermined time, and no less than a predetermined time after an input stimulus. The circuit includes a driving circuit for a pair of relays which are operated at slightly greater than 50% duty cycle and out of phase such that, except when the circuit is de-energized, at least one of the relays is always energized. The contacts of the two relays are employed in a balanced voltage amplifier to produce a bi-polar signal, with the magnitude of both polarities increasing, with the time required for the increase to a defined threshold establishing the time delay. A pair of threshold circuits are coupled to the output of the balanced voltage amplifier such that each threshold circuit (one responding to the positive portion, and the other the negative portion of the bi-polar output) is energized when the respective portion of the bi-polar signal is detected to reach the associated threshold.