CA1162311A - Two-channel data processing system for railway safety purposes - Google Patents
Two-channel data processing system for railway safety purposesInfo
- Publication number
- CA1162311A CA1162311A CA000369570A CA369570A CA1162311A CA 1162311 A CA1162311 A CA 1162311A CA 000369570 A CA000369570 A CA 000369570A CA 369570 A CA369570 A CA 369570A CA 1162311 A CA1162311 A CA 1162311A
- Authority
- CA
- Canada
- Prior art keywords
- data processing
- processing system
- output
- pulse
- amplifier
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/16—Error detection or correction of the data by redundancy in hardware
- G06F11/1629—Error detection by comparing the output of redundant processing systems
- G06F11/1633—Error detection by comparing the output of redundant processing systems using mutual exchange of the output between the redundant processing components
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B61—RAILWAYS
- B61L—GUIDING RAILWAY TRAFFIC; ENSURING THE SAFETY OF RAILWAY TRAFFIC
- B61L7/00—Remote control of local operating means for points, signals, or trackmounted scotch-blocks
- B61L7/06—Remote control of local operating means for points, signals, or trackmounted scotch-blocks using electrical transmission
- B61L7/08—Circuitry
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0796—Safety measures, i.e. ensuring safe condition in the event of error, e.g. for controlling element
Abstract
ABSTRACT OF THE DISCLOSURE
In a data processing system constructed in accordance with safety principles - e.g. for a railway control system, one microcomputer is provided for each processing channel.
The items of information to be emitted to the process are determined by means of the two microcomputers and conducted in pairs to two comparators (which do not need to be of special safe design) each of which controls an AND gate. Each of the AND gates is connected to an amplifier, the power supply of one AND gate being provided by a battery and the power supply of the other amplifier being provided by the output signals, coupled via a transformer, of the first mentioned amplifier. The items of information required for the process are conducted via at least one further amplifier whose power supply is provided by the output signals, coupled via a transformer, of the second amplifier. In the event of a signal discrepancy between the two microcomputers, no items of information which could lead to danger are emitted to the process.
In a data processing system constructed in accordance with safety principles - e.g. for a railway control system, one microcomputer is provided for each processing channel.
The items of information to be emitted to the process are determined by means of the two microcomputers and conducted in pairs to two comparators (which do not need to be of special safe design) each of which controls an AND gate. Each of the AND gates is connected to an amplifier, the power supply of one AND gate being provided by a battery and the power supply of the other amplifier being provided by the output signals, coupled via a transformer, of the first mentioned amplifier. The items of information required for the process are conducted via at least one further amplifier whose power supply is provided by the output signals, coupled via a transformer, of the second amplifier. In the event of a signal discrepancy between the two microcomputers, no items of information which could lead to danger are emitted to the process.
Description
The inVention relates to a two-channel data processing system particularly, though not exclusively, for railway safety purposes~comprising two microcomputers which process the same data and each of which is assigned a comparator for comparison of ~nformation from the two microcomputers, which comparators each emit a switching signal in the event that the information is identical.
Switching mechanisms employed for railway safety purposes must assume responsibility for a number of safety functions. This applies to signalling devices, llne devices for controlling the trains or devices on the rail vehicles themselves.- For this reason data processing systems, which to an increasing extent are being constructed in the form of microcomputers, must operate in accordance with recognised safety principles in accordance with which, in the event of possible technical errors, the process- i.e. the railway which is to be controlled - is brought into a condition which is harmless to human beings. This can be effected for example in that, employing the safety philosophy known for many years in the area of railway safety, all those signals which are recognised as being dangerous are assigned a high signal level or an alternating voltage which, in the event of a disturbance in the relevant data processing system, is shut off on all the output channels. However this re~uires the use of devices which can recognise faulty data processing sufficiently promptly to prevent the control
Switching mechanisms employed for railway safety purposes must assume responsibility for a number of safety functions. This applies to signalling devices, llne devices for controlling the trains or devices on the rail vehicles themselves.- For this reason data processing systems, which to an increasing extent are being constructed in the form of microcomputers, must operate in accordance with recognised safety principles in accordance with which, in the event of possible technical errors, the process- i.e. the railway which is to be controlled - is brought into a condition which is harmless to human beings. This can be effected for example in that, employing the safety philosophy known for many years in the area of railway safety, all those signals which are recognised as being dangerous are assigned a high signal level or an alternating voltage which, in the event of a disturbance in the relevant data processing system, is shut off on all the output channels. However this re~uires the use of devices which can recognise faulty data processing sufficiently promptly to prevent the control
-2--- 116?31l commands established by a faulty data processing system reaching the pro-ceclure being controlled.
In a known data processing system of the type referred to in the introduction (German Offenlegungschrift 2 319 753 of Prinz, et al, laid open Nov. 3, 1973), in order to increase the availability of the overall system, following the occurrence of an error in a first of two data process-ing systems, a switch-over is effected to another data processing system which constantly operates in parallel operation and in respect of which is assumed not to become defective at the same time. In these known 2v2 sys-tems, only with a particularly high outlay can it be established, in the event of a disturbance, which of the two data processing systems supplied an lncorrect result.
In view of the safety which is necessary, it is not possible to implement a limitation to the effect that only specific components of a duplicated data processing system are disconnected as this does not involve a sufficiently reliable fault recognition mechanism. Neither would there be any purpose in continuing operation with only one computer, recognized as being definitely intact, as if this were to operate alone it could cause danger to human beings and to material due to a lack of a reliable fault reco-gnition mechanism.
According to the present invention there is provided a two-channel data processing system comprising two microcomputers arranged to process the same items of -- . l 16231 l lnput data and each of which is assigned a comparator for comparing items of output information from the two micro-computers, the comparators each being arranged to emit from its output a switching signal in the event that the items of information are identical~ respective gating means controlled by the comparators so as to permit the passage of pulses from a pulse source to a respective pulse amplifier, a first one of said pulse amplifiers being arranged to receive the power required for its operation from a supply source and the second being arranged bo receive its power fr~m the output signals of the first mentioned pulse amplifier via a transformer and rectifier arrangement, and output circuits arranged to convey output signals from one of the microcomputers to output terminals for connection to devices to be controlled by the data processing system, the power supply for the output signals being derived via a transformer and rectifier arrangement from the output circuit of the second pulse amplifier.
- The gating means may be AND gates. The pulses fed to the AND gates can conveniently be obtained from the clock pulse source of the assigned m~crocomputer. The two-channel data processing arrangement described has a particularly simple logic-linking of the two channels via the power supply of the pulse amplifiers so that even as a result of component breakdowns in these assemblies correct conditions cannot be simulated in an undesirable fashion.
In a pxefexxed furthex development of the invention the outputs of the AND gates are each connected to an input of the assigned mlcrocomputer. This feedback of the pulses ~hich are present at the outputs of the two AND gates when the overall switching mechanism is operating correctly to the assigned processing unit ailows a channel-specific check to be undertaken periodically.
The duration of the check must be shorter than the shortest reaction time of the control components of the railway -lnstallation being controlled by the data processing system.
An ex~emplary embodiment of the invention will nowbe described with reference to the accompanying drawing which is a block diagram of a data processing system.
On the left hand side the block diagram illustrates two microcomputers MRl and MR2 of a two-channel data processing arrangement which receives all those items of information necessary for the control of (for example) a railway safety installation via input lines EN (four are shown, but of course in practice there will be rather more).
Output data from the micro~omputer MR2 is fed via a plurality of lines to feed data output terminals: for clarity only one ~ine (DG), with associated terminals Kl and K2 is shown ; in the drawing. The output terminals are assumed to be connected to a control element of the railway safety system.
Various outputs of the microcomputer MRl are referenced lLl, lL2 to lLn and in the case of the microcomputer MR2 are reference 2Ll, 2L2 to 2Ln. These outputs can conduct many different kinds of signals, e.g. items of data and/or items of control information or addresses. All these items of information are suitable to be compared in pairs so that any discrepancy in the de of operation of the two micro-computers MRl and MR2 can be rapidly recognised. Forpurposes of fault recognition the two microcomputers MRl and MR2 are assigned two comparators VRl and VR~. These are connected to the outputs lLl to lLn and 2Ll to 2Ln of the microcomputers MRl and MR2. An essential feature of the 2v2 system in question is that with the aid of the comparators YRl, VR2 - which need not necessarily consist of error protected modules - it is possible to produce switching signals which in the event of an error ensure that no signal for the control element which is to be controlled (not shown) is emitted at the terminals Kl and K2.
Thus the comparators VRl, VR2 are connected to AND gates UDl, UD2 respectively whose second inputs El, E2 are connected via aontrol lines IGl, IG2 to the microcomputers MRl, MR2 respectively of the processing channel in question.
Via the control lines IGl,~IG2 the assigned AND gates UDl, UD2 respectively are supplied with information-free pulses from the clock pulse source of the assigned micro-computer MRl, MR2; however a separate common pulse source would also be possible. This circuitry measure ensures that rectangular signals occur at the output of the AND
gates UD1, UD2 whenever the relevant comparator VRl, VR2 has established correct conditionsl and thus identical signals are obtained from the two mic~ocomputers MRl and MR2. The rectangula~ signals which in thi~ case are emitted from the AND gates UDl and UD2 are fed to respective first and second pulse amplifiers IRl, IR2. The pulse amplifier IRl obtains its power supply from an existing voltage source; this is indicated by a plus sign contained ,in brackets. The second pulse amplifier IR2 is not fed from this voltage ~ource; in fact it receives its power from the output circuit of the pulse amplifier IRl (provided the system is functioning correctly) which for this purpose must of course be operated with rectangular signals. For the purpose of this power supply, the output circuit of the pu~se amplifier IRl contains a transformer Ul having a primary winding Ull and a secondary winding U12. The latter is connected to a rectifier circuit GGl ; which in turn feeds the pulse amplifier IR2 and the primary winding U21 of a transformer U2 arranged in the output circuit of the last metioned amplifier IR2. Finally via a further rectifier circuit GG2 the secondary winding U22-of this transformer feeds a pulse amplifier IR3 which is connected to the data output line DG, and the primary winding U31 of a further transformer U3 whose secondary winding U32 is connected to the terminals K1 and K2 which form the data output. Naturally in practical operation considerably more output lines corresponding to the data output line DG will be provided. Likewise a plurality of pulse amplifiers will be used which are preferably supplied ~ 16231 1 with power vla the xectifiex cixcuit GG2.
A characteristic of the abo~e described two channel data processing arrangement is that the output of signals is discontinued not only when one of the microcomputers MR1, MR2 is operating faultily but also when, due to an error in one of the comparators VRl, VR2, the following AND gate UDl, UD2 is disabled. Thus even in the event of an error in the last mentioned AND gates or in one of the following pulse amplifiers IR1, IR2, data output, which in the event of a fault is undesirable, is discontinued.
The outputs of the AND gates UD1 and UD2 are connected to respective lines RL1, RL2 connected to the associated microcomputer MRl, MR2. Feedback of this kind allows the functioning capacity of the comparator VRl, VR2 and of the AND gate UDl, UD2.in question to be : periodically checkedl channel specifically, by intentionally non-identical output data, so that it is ensured that in the presence of an antivalent pair of signals in the : 20 event of a fault, the compa~ator in question is really prevented from emitting an output signal so that the following pulse amplifier IRl, IR2 is disabled. The duration of this test must be shorter than the shortest reaction time of the control element which is connected to the terminals Kl and K2.
On the basis of the described test procedure it is advantageously possible for the two-channel data ~ 16231 1 processing arrange~ent to be continuously checked at regular intervals of time for correct operation independently of operatin~ factors, thus independently of the data flow/ and in this way it is possible to effect an early discovery of a first fault in one of the circuit comp~nents VRl, VR2, UDl and UD2. Then, via a data exchange line DLG which connects the two microcomputers MRl and MR2, a data exchange can take place which leads to the disconnection of the overall system. This is possible for example by bringing the two comparators VRl and VR2 into a predetermined dissimilar state in respect of their input signals, which state is maintained even when the two microcomputers MRl and MR2 are disconnected.
If the microcomputers MRl and MR2 receive non-identical signals via the lines RLl and RL2 outside of the ; test intervals, they can adopt a determinate state, e.g.
processing halt, which includes the blockage of the information-free pulses via the lines JGl and JG2. For such time as at least one of the information-free pulses 20 fails to appear via one of the lines JGl, JG2 or at least one of the comparators VRl, VR2 continuously reports "non-identical", and blocks the following AND gate UDl, UD2, the input of the associated pulse amplifier JRl, JR2 remains continuously blocked as a result of which the rectifier circuit GGl, is no longer supplied with power.
This applies in particular to the rectifier circuit GG2 .
The 1nvention can thus provide a two-channel _g_ l 1623~ l data processing syste~ of the t~pe referred to in the introduction e.g. for use in the sphere of railway safety, to the extent that, without the need for special fail-safe comparators or special modules, it is ensured that in the event of an established signal discrepancy between the two data processing systems no signals are emitted which would endanger the process.
In a known data processing system of the type referred to in the introduction (German Offenlegungschrift 2 319 753 of Prinz, et al, laid open Nov. 3, 1973), in order to increase the availability of the overall system, following the occurrence of an error in a first of two data process-ing systems, a switch-over is effected to another data processing system which constantly operates in parallel operation and in respect of which is assumed not to become defective at the same time. In these known 2v2 sys-tems, only with a particularly high outlay can it be established, in the event of a disturbance, which of the two data processing systems supplied an lncorrect result.
In view of the safety which is necessary, it is not possible to implement a limitation to the effect that only specific components of a duplicated data processing system are disconnected as this does not involve a sufficiently reliable fault recognition mechanism. Neither would there be any purpose in continuing operation with only one computer, recognized as being definitely intact, as if this were to operate alone it could cause danger to human beings and to material due to a lack of a reliable fault reco-gnition mechanism.
According to the present invention there is provided a two-channel data processing system comprising two microcomputers arranged to process the same items of -- . l 16231 l lnput data and each of which is assigned a comparator for comparing items of output information from the two micro-computers, the comparators each being arranged to emit from its output a switching signal in the event that the items of information are identical~ respective gating means controlled by the comparators so as to permit the passage of pulses from a pulse source to a respective pulse amplifier, a first one of said pulse amplifiers being arranged to receive the power required for its operation from a supply source and the second being arranged bo receive its power fr~m the output signals of the first mentioned pulse amplifier via a transformer and rectifier arrangement, and output circuits arranged to convey output signals from one of the microcomputers to output terminals for connection to devices to be controlled by the data processing system, the power supply for the output signals being derived via a transformer and rectifier arrangement from the output circuit of the second pulse amplifier.
- The gating means may be AND gates. The pulses fed to the AND gates can conveniently be obtained from the clock pulse source of the assigned m~crocomputer. The two-channel data processing arrangement described has a particularly simple logic-linking of the two channels via the power supply of the pulse amplifiers so that even as a result of component breakdowns in these assemblies correct conditions cannot be simulated in an undesirable fashion.
In a pxefexxed furthex development of the invention the outputs of the AND gates are each connected to an input of the assigned mlcrocomputer. This feedback of the pulses ~hich are present at the outputs of the two AND gates when the overall switching mechanism is operating correctly to the assigned processing unit ailows a channel-specific check to be undertaken periodically.
The duration of the check must be shorter than the shortest reaction time of the control components of the railway -lnstallation being controlled by the data processing system.
An ex~emplary embodiment of the invention will nowbe described with reference to the accompanying drawing which is a block diagram of a data processing system.
On the left hand side the block diagram illustrates two microcomputers MRl and MR2 of a two-channel data processing arrangement which receives all those items of information necessary for the control of (for example) a railway safety installation via input lines EN (four are shown, but of course in practice there will be rather more).
Output data from the micro~omputer MR2 is fed via a plurality of lines to feed data output terminals: for clarity only one ~ine (DG), with associated terminals Kl and K2 is shown ; in the drawing. The output terminals are assumed to be connected to a control element of the railway safety system.
Various outputs of the microcomputer MRl are referenced lLl, lL2 to lLn and in the case of the microcomputer MR2 are reference 2Ll, 2L2 to 2Ln. These outputs can conduct many different kinds of signals, e.g. items of data and/or items of control information or addresses. All these items of information are suitable to be compared in pairs so that any discrepancy in the de of operation of the two micro-computers MRl and MR2 can be rapidly recognised. Forpurposes of fault recognition the two microcomputers MRl and MR2 are assigned two comparators VRl and VR~. These are connected to the outputs lLl to lLn and 2Ll to 2Ln of the microcomputers MRl and MR2. An essential feature of the 2v2 system in question is that with the aid of the comparators YRl, VR2 - which need not necessarily consist of error protected modules - it is possible to produce switching signals which in the event of an error ensure that no signal for the control element which is to be controlled (not shown) is emitted at the terminals Kl and K2.
Thus the comparators VRl, VR2 are connected to AND gates UDl, UD2 respectively whose second inputs El, E2 are connected via aontrol lines IGl, IG2 to the microcomputers MRl, MR2 respectively of the processing channel in question.
Via the control lines IGl,~IG2 the assigned AND gates UDl, UD2 respectively are supplied with information-free pulses from the clock pulse source of the assigned micro-computer MRl, MR2; however a separate common pulse source would also be possible. This circuitry measure ensures that rectangular signals occur at the output of the AND
gates UD1, UD2 whenever the relevant comparator VRl, VR2 has established correct conditionsl and thus identical signals are obtained from the two mic~ocomputers MRl and MR2. The rectangula~ signals which in thi~ case are emitted from the AND gates UDl and UD2 are fed to respective first and second pulse amplifiers IRl, IR2. The pulse amplifier IRl obtains its power supply from an existing voltage source; this is indicated by a plus sign contained ,in brackets. The second pulse amplifier IR2 is not fed from this voltage ~ource; in fact it receives its power from the output circuit of the pulse amplifier IRl (provided the system is functioning correctly) which for this purpose must of course be operated with rectangular signals. For the purpose of this power supply, the output circuit of the pu~se amplifier IRl contains a transformer Ul having a primary winding Ull and a secondary winding U12. The latter is connected to a rectifier circuit GGl ; which in turn feeds the pulse amplifier IR2 and the primary winding U21 of a transformer U2 arranged in the output circuit of the last metioned amplifier IR2. Finally via a further rectifier circuit GG2 the secondary winding U22-of this transformer feeds a pulse amplifier IR3 which is connected to the data output line DG, and the primary winding U31 of a further transformer U3 whose secondary winding U32 is connected to the terminals K1 and K2 which form the data output. Naturally in practical operation considerably more output lines corresponding to the data output line DG will be provided. Likewise a plurality of pulse amplifiers will be used which are preferably supplied ~ 16231 1 with power vla the xectifiex cixcuit GG2.
A characteristic of the abo~e described two channel data processing arrangement is that the output of signals is discontinued not only when one of the microcomputers MR1, MR2 is operating faultily but also when, due to an error in one of the comparators VRl, VR2, the following AND gate UDl, UD2 is disabled. Thus even in the event of an error in the last mentioned AND gates or in one of the following pulse amplifiers IR1, IR2, data output, which in the event of a fault is undesirable, is discontinued.
The outputs of the AND gates UD1 and UD2 are connected to respective lines RL1, RL2 connected to the associated microcomputer MRl, MR2. Feedback of this kind allows the functioning capacity of the comparator VRl, VR2 and of the AND gate UDl, UD2.in question to be : periodically checkedl channel specifically, by intentionally non-identical output data, so that it is ensured that in the presence of an antivalent pair of signals in the : 20 event of a fault, the compa~ator in question is really prevented from emitting an output signal so that the following pulse amplifier IRl, IR2 is disabled. The duration of this test must be shorter than the shortest reaction time of the control element which is connected to the terminals Kl and K2.
On the basis of the described test procedure it is advantageously possible for the two-channel data ~ 16231 1 processing arrange~ent to be continuously checked at regular intervals of time for correct operation independently of operatin~ factors, thus independently of the data flow/ and in this way it is possible to effect an early discovery of a first fault in one of the circuit comp~nents VRl, VR2, UDl and UD2. Then, via a data exchange line DLG which connects the two microcomputers MRl and MR2, a data exchange can take place which leads to the disconnection of the overall system. This is possible for example by bringing the two comparators VRl and VR2 into a predetermined dissimilar state in respect of their input signals, which state is maintained even when the two microcomputers MRl and MR2 are disconnected.
If the microcomputers MRl and MR2 receive non-identical signals via the lines RLl and RL2 outside of the ; test intervals, they can adopt a determinate state, e.g.
processing halt, which includes the blockage of the information-free pulses via the lines JGl and JG2. For such time as at least one of the information-free pulses 20 fails to appear via one of the lines JGl, JG2 or at least one of the comparators VRl, VR2 continuously reports "non-identical", and blocks the following AND gate UDl, UD2, the input of the associated pulse amplifier JRl, JR2 remains continuously blocked as a result of which the rectifier circuit GGl, is no longer supplied with power.
This applies in particular to the rectifier circuit GG2 .
The 1nvention can thus provide a two-channel _g_ l 1623~ l data processing syste~ of the t~pe referred to in the introduction e.g. for use in the sphere of railway safety, to the extent that, without the need for special fail-safe comparators or special modules, it is ensured that in the event of an established signal discrepancy between the two data processing systems no signals are emitted which would endanger the process.
Claims (4)
EXCLUSIVE PROPERTY OR PRIVILEGE IS CLAIMED
ARE DEFINED AS FOLLOWS:
1. A two-channel data processing system comprising two microcomputers arranged to process the same items of input data and each of which is assigned a comparator for comparing items of output information from the two micro-computers, the comparators each being arranged to emit from its output a switching signal in the event that the items of information are identical, respective gating means controlled by the comparators so as to permit the passage of pulses from a pulse source to a respective pulse amplifier, a first one of said pulse amplifiers being arranged to receive the power required for its operation from a supply source and the second being arranged to receive its power from the output signals of the first mentioned pulse amplifier via a transformer and rectifier arrangement, and output circuits arranged to convey output signals from one of the mirco computers to output terminals for connection to devices to be controlled by the data processing system, the power supply for the output circuits being derived via a transformer and rectifier arrangement from the output circuit of the second pulse amplifier.
2. A data processing system as claimed in claim 1, in which the pulse sources for each gating means is the clock pulse source of the assigned microcomputer.
3. A data processing system as claimed in claim 1 in which each gating means is an AND gate.
4. A data processing system as claimed in claim 3, in which the outputs of the AND gates (UD1, UD2) are each connected to an input of the assigned microcomputer.
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| DE3003291A DE3003291C2 (en) | 1980-01-30 | 1980-01-30 | Two-channel data processing arrangement for railway safety purposes |
| DEP3003291.8 | 1980-01-30 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CA1162311A true CA1162311A (en) | 1984-02-14 |
Family
ID=6093273
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CA000369570A Expired CA1162311A (en) | 1980-01-30 | 1981-01-28 | Two-channel data processing system for railway safety purposes |
Country Status (12)
| Country | Link |
|---|---|
| US (1) | US4400792A (en) |
| EP (1) | EP0033436B1 (en) |
| JP (1) | JPS56121151A (en) |
| AR (1) | AR227170A1 (en) |
| AT (1) | ATE3127T1 (en) |
| CA (1) | CA1162311A (en) |
| DE (1) | DE3003291C2 (en) |
| DK (1) | DK148560C (en) |
| FI (1) | FI70650C (en) |
| IN (1) | IN152462B (en) |
| YU (1) | YU42999B (en) |
| ZA (1) | ZA81603B (en) |
Families Citing this family (53)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| DE3137450C2 (en) * | 1981-09-21 | 1984-03-22 | Siemens AG, 1000 Berlin und 8000 München | Safety output circuit for a data processing system |
| EP0112837A1 (en) * | 1982-02-11 | 1984-07-11 | Zf-Herion-Systemtechnik Gmbh | Electronic control with safety mechanisms |
| DE3303791C2 (en) * | 1982-02-11 | 1992-04-16 | ZF-Herion-Systemtechnik GmbH, 7990 Friedrichshafen | Electronic control with safety devices |
| FR2540685A1 (en) * | 1983-02-03 | 1984-08-10 | Jeumont Schneider | INTERFACE FOR CONNECTING A COMPUTER SYSTEM TO AN ACTUATOR DEVICE |
| GB8401806D0 (en) * | 1984-01-24 | 1984-02-29 | Int Computers Ltd | Data storage apparatus |
| DE3412049A1 (en) * | 1984-03-30 | 1985-10-17 | Licentia Patent-Verwaltungs-Gmbh, 6000 Frankfurt | SIGNAL-SAFE DATA PROCESSING DEVICE |
| JPS6182201A (en) * | 1984-09-29 | 1986-04-25 | Nec Home Electronics Ltd | Fail-safe controlling circuit |
| US4665522A (en) * | 1985-01-28 | 1987-05-12 | The Charles Stark Draper Laboratory, Inc. | Multi-channel redundant processing systems |
| AU568977B2 (en) * | 1985-05-10 | 1988-01-14 | Tandem Computers Inc. | Dual processor error detection system |
| DE3522418A1 (en) * | 1985-06-22 | 1987-01-02 | Standard Elektrik Lorenz Ag | DEVICE FOR REPORTING THE OCCUPANCY CONDITION OF TRACK SECTIONS IN THE AREA OF AN ACTUATOR |
| JPS62130429A (en) * | 1985-12-02 | 1987-06-12 | Nec Home Electronics Ltd | Recognizing device for read data |
| IT1213344B (en) * | 1986-09-17 | 1989-12-20 | Honoywell Information Systems | FAULT TOLERANCE CALCULATOR ARCHITECTURE. |
| DE3700986C2 (en) * | 1987-01-15 | 1995-04-20 | Bosch Gmbh Robert | Device for monitoring a computer system with two processors in a motor vehicle |
| DE3708055A1 (en) * | 1987-03-12 | 1988-09-22 | Siemens Ag | SAFETY SWITCHGEAR WITH MULTIPLE MICROCOMPUERS PROCESSING THE SAME DATA |
| JPH061402B2 (en) * | 1987-03-20 | 1994-01-05 | 住友電気工業株式会社 | Multiple system control circuit |
| SE457391B (en) * | 1987-04-16 | 1988-12-19 | Ericsson Telefon Ab L M | PROGRAM MEMORY MANAGED REAL TIME SYSTEM INCLUDING THREE MAINLY IDENTICAL PROCESSORS |
| US4907228A (en) * | 1987-09-04 | 1990-03-06 | Digital Equipment Corporation | Dual-rail processor with error checking at single rail interfaces |
| US4916704A (en) * | 1987-09-04 | 1990-04-10 | Digital Equipment Corporation | Interface of non-fault tolerant components to fault tolerant system |
| DE3854026D1 (en) * | 1987-09-04 | 1995-07-27 | Digital Equipment Corp | Fault-tolerant computer system with error limitation. |
| EP0306211A3 (en) * | 1987-09-04 | 1990-09-26 | Digital Equipment Corporation | Synchronized twin computer system |
| US5185877A (en) * | 1987-09-04 | 1993-02-09 | Digital Equipment Corporation | Protocol for transfer of DMA data |
| GB8729901D0 (en) * | 1987-12-22 | 1988-02-03 | Lucas Ind Plc | Dual computer cross-checking system |
| US4903191A (en) * | 1987-12-23 | 1990-02-20 | E. I. Du Pont De Nemours And Company | Centrifuge control system having dual processors |
| DE3801123A1 (en) * | 1988-01-16 | 1989-07-27 | Philips Patentverwaltung | MEDIATION SYSTEM |
| JPH07117905B2 (en) * | 1989-02-09 | 1995-12-18 | 日本電気株式会社 | Microprocessor |
| GB2228114B (en) * | 1989-02-13 | 1993-02-10 | Westinghouse Brake & Signal | A system comprising a processor |
| US5068851A (en) * | 1989-08-01 | 1991-11-26 | Digital Equipment Corporation | Apparatus and method for documenting faults in computing modules |
| DE69027491T2 (en) * | 1989-08-01 | 1997-02-06 | Digital Equipment Corp | Software error handling procedures |
| US5163138A (en) * | 1989-08-01 | 1992-11-10 | Digital Equipment Corporation | Protocol for read write transfers via switching logic by transmitting and retransmitting an address |
| US5153881A (en) * | 1989-08-01 | 1992-10-06 | Digital Equipment Corporation | Method of handling errors in software |
| US5251227A (en) * | 1989-08-01 | 1993-10-05 | Digital Equipment Corporation | Targeted resets in a data processor including a trace memory to store transactions |
| US5068780A (en) * | 1989-08-01 | 1991-11-26 | Digital Equipment Corporation | Method and apparatus for controlling initiation of bootstrap loading of an operating system in a computer system having first and second discrete computing zones |
| US5048022A (en) * | 1989-08-01 | 1991-09-10 | Digital Equipment Corporation | Memory device with transfer of ECC signals on time division multiplexed bidirectional lines |
| US5065312A (en) * | 1989-08-01 | 1991-11-12 | Digital Equipment Corporation | Method of converting unique data to system data |
| DE3938501A1 (en) * | 1989-11-20 | 1991-05-23 | Siemens Ag | METHOD FOR OPERATING A MULTI-CHANNEL FAILSAFE COMPUTER SYSTEM AND DEVICE FOR IMPLEMENTING THE METHOD |
| JPH03293906A (en) * | 1990-04-10 | 1991-12-25 | Mitsubishi Electric Corp | Train-operation control-command transmitter |
| DE59006247D1 (en) * | 1990-09-07 | 1994-07-28 | Siemens Ag | Device for controlling an electronic signal box organized according to the area computer principle. |
| DE4032033A1 (en) * | 1990-10-09 | 1992-04-16 | Siemens Ag | Electric control and monitoring for underground plant - triggering safety-relevant signals for transmission over independent paths and processing by redundant systems |
| EP0575942A3 (en) * | 1992-06-23 | 1995-10-25 | Hitachi Ltd | Display apparatus and method |
| JP3343143B2 (en) * | 1992-12-02 | 2002-11-11 | 日本電気株式会社 | Failure diagnosis method |
| FR2704329B1 (en) * | 1993-04-21 | 1995-07-13 | Csee Transport | Security system with microprocessor, applicable in particular to the field of rail transport. |
| US5485379A (en) * | 1994-07-25 | 1996-01-16 | Kelsey Hayes Company | Method and system for detecting the proper functioning of an ABS control unit utilizing substantially identical programmed microprocessors |
| JP3412349B2 (en) * | 1994-12-28 | 2003-06-03 | 株式会社日立製作所 | Control device |
| JP3216996B2 (en) * | 1996-07-19 | 2001-10-09 | 三菱電機株式会社 | Dual electronic interlocking device |
| US7302587B2 (en) * | 2001-06-08 | 2007-11-27 | Matra Transport International | Secure computer system |
| ITTO20040179A1 (en) † | 2004-03-17 | 2004-06-17 | Sab Wabco Spa | BRAKING CONTROL SYSTEM OF A RAILWAY OR RAILWAY VEHICLE WITH INTEGRATED FUNCTIONS OF ANTI-SKATING AND ANTI-LOCKING OF ROUTES |
| ITTO20040325A1 (en) * | 2004-05-14 | 2004-08-14 | Ansaldo Segnalamento Ferroviario Spa | DEVICE FOR THE SAFE TRANSMISSION OF DATA TO BOE FOR RAILWAY SIGNALING |
| GB0602641D0 (en) * | 2006-02-09 | 2006-03-22 | Eads Defence And Security Syst | High speed data processing system |
| JP4874698B2 (en) * | 2006-04-14 | 2012-02-15 | 日本電子株式会社 | Electronic probe microanalyzer |
| DE502008002379D1 (en) * | 2008-03-03 | 2011-03-03 | Sick Ag | Safety device for safe control of connected actuators |
| EP2796999B1 (en) * | 2013-04-24 | 2016-04-13 | ALSTOM Transport Technologies | Inherent fail safe enabling control and command unit with two out of two architecture |
| DK3131192T3 (en) | 2015-08-14 | 2018-12-03 | Thales Man & Services Deutschland Gmbh | Control device and method for controlling a safety-relevant component |
| DE102018115759B3 (en) * | 2018-06-29 | 2019-08-29 | Scheidt & Bachmann Gmbh | Balisensteuerungsvorrichtung |
Family Cites Families (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US3618028A (en) * | 1970-04-20 | 1971-11-02 | Ibm | Local storage facility |
| DE2064837A1 (en) * | 1970-12-24 | 1972-08-10 | Licentia Gmbh | Circuit arrangement for the implementation of logical functions |
| FR2182259A5 (en) * | 1972-04-24 | 1973-12-07 | Cii | |
| DE2636352C3 (en) * | 1976-08-12 | 1979-12-20 | Kraftwerk Union Ag, 4330 Muelheim | Protection system for a nuclear reactor |
| DE2651314C2 (en) * | 1976-11-10 | 1982-03-25 | Siemens AG, 1000 Berlin und 8000 München | Safety output circuit for a data processing system that emits binary signals |
| DE2701924B2 (en) * | 1977-01-19 | 1981-03-19 | Standard Elektrik Lorenz Ag, 7000 Stuttgart | Control device for track-bound vehicles |
| US4270168A (en) * | 1978-08-31 | 1981-05-26 | United Technologies Corporation | Selective disablement in fail-operational, fail-safe multi-computer control system |
| US4309768A (en) * | 1979-12-31 | 1982-01-05 | Bell Telephone Laboratories, Incorporated | Mismatch detection circuit for duplicated logic units |
-
1980
- 1980-01-30 DE DE3003291A patent/DE3003291C2/en not_active Expired
- 1980-12-11 IN IN1370/CAL/80A patent/IN152462B/en unknown
-
1981
- 1981-01-07 AT AT81100056T patent/ATE3127T1/en not_active IP Right Cessation
- 1981-01-07 EP EP81100056A patent/EP0033436B1/en not_active Expired
- 1981-01-16 US US06/225,798 patent/US4400792A/en not_active Expired - Fee Related
- 1981-01-21 AR AR284009A patent/AR227170A1/en active
- 1981-01-28 JP JP1030381A patent/JPS56121151A/en active Granted
- 1981-01-28 CA CA000369570A patent/CA1162311A/en not_active Expired
- 1981-01-29 DK DK40281A patent/DK148560C/en not_active IP Right Cessation
- 1981-01-29 FI FI810262A patent/FI70650C/en not_active IP Right Cessation
- 1981-01-29 ZA ZA00810603A patent/ZA81603B/en unknown
- 1981-01-30 YU YU254/81A patent/YU42999B/en unknown
Also Published As
| Publication number | Publication date |
|---|---|
| ZA81603B (en) | 1982-02-24 |
| DE3003291A1 (en) | 1981-08-06 |
| DK148560B (en) | 1985-08-05 |
| AR227170A1 (en) | 1982-09-30 |
| FI70650C (en) | 1986-09-24 |
| FI70650B (en) | 1986-06-06 |
| YU42999B (en) | 1989-02-28 |
| ATE3127T1 (en) | 1983-05-15 |
| DK40281A (en) | 1981-07-31 |
| JPS626263B2 (en) | 1987-02-09 |
| IN152462B (en) | 1984-01-21 |
| DK148560C (en) | 1985-12-30 |
| EP0033436B1 (en) | 1983-04-20 |
| YU25481A (en) | 1983-12-31 |
| FI810262L (en) | 1981-07-31 |
| JPS56121151A (en) | 1981-09-22 |
| DE3003291C2 (en) | 1983-02-24 |
| US4400792A (en) | 1983-08-23 |
| EP0033436A1 (en) | 1981-08-12 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CA1162311A (en) | Two-channel data processing system for railway safety purposes | |
| CA1078967A (en) | Digital data processing arrangement | |
| US6385562B1 (en) | Method and apparatus for monitoring a plant with several functional units | |
| US4503496A (en) | Multi-microcomputer system with direct store access | |
| CA1198802A (en) | Computer based interlocking system | |
| US7783814B2 (en) | Safety module and automation system | |
| DE69534349D1 (en) | Control device with fail-safe function, automatic control device for trains and systems using them | |
| DE3273362D1 (en) | Computer peripheral control apparatus | |
| CA1258115A (en) | System for indicating track sections in an interlocking area as unoccupied or occupied | |
| US7149925B2 (en) | Peripheral component with high error protection for stored programmable controls | |
| PL167413B1 (en) | Method of and circuitry for controlling and monitoring operation of engineering equipment automatic control systems | |
| KR102029735B1 (en) | High-speed railway track side function module dual automatic transfer system | |
| Mongardi | Dependable computing for railway control systems | |
| DE69317507T2 (en) | Fault-tolerant computer system with a fault detector provided in each processor module | |
| CA1300251C (en) | Method and electrical circuit for the reliable detection of process states within freely couplable units | |
| ES2008185A6 (en) | Device for the fail-safe transmission, in a reliable manner as regards signalling techniques, of serial data between fail-safe computers operating preferably on two channels by means of a twin-loop bus system. | |
| GB2228114A (en) | Processor testing system | |
| Chandra et al. | A fail-safe interlocking system for railways | |
| US6725773B2 (en) | Monitoring device for printer | |
| GB2104267A (en) | Combining replicated sub-system outputs | |
| HU193090B (en) | High-reliability data-processing apparatus with at least two processing channels of computers | |
| Akita et al. | Safety and fault-tolerance in computer-controlled railway signalling systems | |
| HU197244B (en) | Automatic controls for controlling actuating units depending on sensor state | |
| ES2208609T3 (en) | PERIPHERAL COMPONENT WITH HIGH SECURITY AGAINST ERRORS FOR PROGRAMMABLE MEMORY CONTROLS. | |
| JPH10338133A (en) | Signal safety control device for train |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| MKEX | Expiry |