Fail-Safe Solid State Logic

This invention pertains to fail safe control circuitry, particularly for vehicle transportation control, and it more especially relates to fail safe solid state logic circuitry for such purposes.

A basic requirement imposed on logic circuitry for controlling transportation systems and the like is that the system be fail safe; that is to say, if a malfunction should occur this should result in the activation of a signal or the application of emergency equipment in such a way as to protect the passage of the vehicle and the security of its passengers. Accordingly, the logic control circuity is so designed that any failure will produce a protective control signal.

It is highly desirable in such control circuitry to employ solid state logic devices, involving transistors and the like, forming AND and OR gates which are extremely small and inexpensive as compared to relay and other control circuitry that has been used for many decades. However, solid state devices can also fail and their failures are often random in occurrence and are sometimes difficult to recognize, thereby making it problematical to forecast accurately the effect of a malfunction.

Solutions to the aforestated difficulties have been proposed heretofore and one example may be seen in U.S. Pat. No. 3,471,689 which involves such transistorized switching circuits, but which judiciously includes a check on the proper functioning of the switching means involved in the logic circuitry. In other words, in addition to providing the needed indications of train absence and of train presence in the particular context of a railroad crossing system, that patent also provides what may be termed a parity checking method. That particular patent also embodies solid state "stick circuits" which are analogous to stick relays and which are initially energized from a first signal in conjunction with a second signal, being subsequently held in the energized state by the second signal. Thus, a stick circuit of this kind requires a defined signal pattern in order to keep the stick circuit in its set state or condition.

The present invention provides a logic circuit concept and a technique envisioned for use therewith. However, unlike logic circuitry known in the prior art, the present invention essentially provides that an output circuit connected to the logical block will accept only an AC signal which differs substantially from an AC signal at the logical block's input. In other words, a fundamental conversion or modification must occur within the logical block in order for the proper output signal to be generated. More particularly, in accordance with a specific aspect of the present invention, a logical AND gate is provided which is capable of producing an output when two or more inputs are present, means being provided which make it impossible for the proper AC output signal to appear unless the proper number of inputs appear, regardless of predetermined failures in the individual components of the AND gate.

Accordingly, it is a primary object of the present invention to provide a fail safe logical circuitry system which does not depend upon self checking or like arrangements and thus does not complicate the logical layout because of the need for such checking.

Another object of the invention is to provide such circutiry embodying reliable, conventional or standard components.

It is yet another object of the present invention to preclude certain types of unsafe failures that could exist in conventional prior art systems due to feed-throughs of a particular signal from input to output.

The above and other objects are achieved and implemented by reason of the aforesaid logical AND gate concept; that is, the concept of requiring an altered or modified AC output signal which will be ultimately accepted at a vital driver; only that signal and no other will be so accepted. Specifically, the logical AND gate in accordance with a preferred embodiment of the present invention uses an AC input signal of a predetermined frequency and an output circuit which accepts only a signal having half that frequency. Another input effectively acts to convert the input signal of predetermined frequency appearing at the one input to the required AC output signal having half that frequency.

One example of the manner in which the concept of the present invention is realized is by means of an inexpensive and reliable device that is readily available and which operates to change as indicated the character of an AC signal. Such device is a toggle flip-flop which effectively enables division of the frequency of the AC input signal by two. However, this basic element or logical block in accordance with the invention is so arranged that DC is applied as one of the logical inputs. Thus, the standard toggle flip-flop device is so utilized in the logical system as to have what is a normally applied fixed voltage source, selectively connected as a logical source or input; that is, connected to the logical DC input terminal only upon the occurrence of a predetermined event. This particular arrangement will become clear as the description proceeds.

The significant advantage obtained by the provision of a logical AND gate in accordance with the present invention is that the basic logical block is bound to fail in a safe manner, that is to say, the toggle flip-flop serving as the logical gate must fail safe because no failure can cause it to divide by a factor of more than two per stage. For example, the most likely failures to be encountered are shorts or feed-throughs from the input to output, or a failure to toggle. However, both of the aforenoted faults would result in the signal frequency not being changed, whereas what is required for proper acceptance at the output is that the input frequency be changed to half its value.

Other and further objects, advantages and features of the present invention will be understood by reference to the following specification in conjunction with the annexed drawing, wherein like parts have been given like numbers.

FIG. 1 is a block diagram of a logical AND gate involving a toggle flip-flop or similar component;

FIG. 2 is a block schematic diagram illustrating a so-called safe latching device or circuit;

FIG. 3 is a block diagram of the clock circuit which is adapted to be connected to the circuit of FIG. 2; and

FIG. 4 is a pulse diagram illustrating the pulse trains or forms appearing at various points in the circuit of FIG. 2.

Referring now to the figures of the drawing, there will be seen a preferred embodiment of the solid state, fail-safe logic device. In FIG. 1 the principle of the invention is illustrated by an exemplary logical AND gate constructed in fulfillment of the fundamental object of the present invention. Specifically, there is shown a logical gate 10 in single block form. As already explained, this logical gate comprises a well-known, off-the-shelf, item, namely, a dual D type flip-flop of the integrated circuit family known as CMOS manufactured by RCA. The details of such a dual flip-flop device, including the schematic diagram therefor, can be appreciated by reference to a current RCA brochure on integrated circuits (File No. 479); such details are incorporated herein by reference.

For convenience, in FIG. 1 the upper half of the block is referred to as 10A, thus indicating the upper flip-flop of the aforesaid dual flip-flop; the lower half being designated 10B. Furthermore, for simplicity, the two terminals normally referred to as data and clock, have been combined (i.e., terminals D1, CL1 and D2, CL2) to constitute what hereinafter will be referred to respectively as terminals T.sub.1 and T.sub.2. By this designation of a toggle terminal it is understood that there is always provided a feedback connection 12 from, for example, the output terminal Q.sub.1 to the data terminal D1. Similarly, it will be understood that a feedback connection 14 is provided for the other half, or other flip-flop, of the device 10.

It should be noted that the conventionally available dual D type flip-flop is normally provided with a great variety of terminals so that multiple functions can be achieved. However, for purposes of the present invention, certain of these terminals are unused. Accordingly, these unused terminals have not been indicated in the block diagram of FIG. 1. These terminals, for example, are for set and reset purposes and the like.

An AC logic input such as a clock pulse is supplied to the toggle terminal T.sub.1 by way of the line or connection 16. Also connected to the device 10 are a number of DC voltage supplies. At the top of the figure it will be seen that a source of positive DC (DC+) is provided by the connection 18 to the upper voltage terminal V.sub.DD for the several components of device 10. Similarly, a source of negative voltage (DC-) is supplied as the other supply or reference voltage, it being understood that these upper and lower supply voltages can take on a variety of values. The lower reference voltage terminal is designated V.sub.SS and the connection is by way of line 20.

It should be especially noted that the supply of DC- selectively furnished by reason of the operation of switch 22 which generally designates any means, such as relay contacts or the like, for providing connection of DC- upon the occurrence of particular events. It will therefore be understood that the logic output which is provided at the output Q.sub.1 is an output which results from the occurrence of a logic input to toggle T1, that is, an AC signal of appropriate frequency, AND the further occurrence of closure of switch 22 so as to connect the source DC- to V.sub.SS and hence to provide suitable voltage to each of the components of the dual flip-flop 10.

It will be understood that in the simple example selected for illustration in FIG. 1, the dual flip-flop has only one-half of its circuitry utilized for the purpose of performing the logical AND function. However, it will be appreciated as the description proceeds that both halves of this off-the-shelf item can be used in certain other contexts, although only one independent logic stage can be realized.

From the preceding description, it will be appreciated by those skilled in the art that the device 10 in FIG. 1 is exploited to convert an AC input signal to a different AC output signal; that is, to one having an entirely different frequency, and that this is accomplished by reason of the fact that the DC input so causes the gate device to convert this AC input signal. Furthermore, that in the particular example illustrated of a toggle flip-flop, the frequency of the input signal is divided by two. This divided-by-two output signal is the only signal that will be accepted at the final or ultimate stage in what is known as a vital driver. Such a vital driver is a device well-known to those in the signaling arts, particularly in railroad signaling, and one example of a vital driver is disclosed in U.S. Pat. No. 3,958,782 the details of which are incorporated herein by reference. From a practical standpoint it has been determined that a useful frequency is 10 kHz for such a vital driver. Accordingly, in the example of FIG. 1, the logic input connected by line 16 to T1 would have a frequency of 20 kHz in order that the logic output would have a frequency of 10 kHz.

Although the general principle of the fail-safe logic concept of the present invention has been illustrated in FIG. 1 by the example of a toggle flip-flop involving frequency division by two, the frequency division could be different, or even frequency multiplication could be invoked. Moreover, this same type of logic could be implemented using modulators instead of frequency dividers or multipliers. In the former case, the inputs would be two AC signals having widely different frequencies.

Referring now to FIGS. 2 and 3 of the drawing, there is illustrated in these two figures a more sophisticated logic subsystem that might typically be used in connection with a highway crossing system or the like. Such a logic sub-system uses clock outputs as indicated in FIG. 3 coming from a source or oscillator 30. Frequency dividers are used in connection with the basic or fundamental oscillator output, which is 160 kHz, so as to obtain the other clock outputs, namely, 80, 40 and 20 kHz. The divided values result from the process already described, that is, frequency division by two by means of connecting the output of the oscillator 30 to a first dual flip-flop 32 by which the fundamental is changed to 80 kHz; then by further division to 40 kHz by means of the upper half, and thereafter to 20 kHz in the lower half, of the dual flip-flop 34. Thus, the dual flip-flop 34 has its first output Q.sub.1 connected to the toggle input T2 of the lower half of the device 34, thereby further dividing to obtain the 20 kHz output.

It will be understood that the various clock inputs to the chain of logic illustrated in FIG. 2 are derived from the several clock outputs of FIG. 3, the latter being selected either from the oscillator directly so as to provide 160 kHz, or from one of the divider stages illustrated in accordance with the number of logic gates ahead of a particular vital driver in the logic chain. If it were found to be desirable not to employ the dividers 32 and 34 as part of the clock outputs, these frequency dividers could be added instead in a particular logic chain when required.

The so-called safe latch illustrated in FIG. 2 is an arrangement which provides that when a set input is provided to the line 40, seen at the lower left, the concurrence of this Dc input AND the designated AC input signal, namely, clock 40, to the toggle input T1 of the upper flip-flop of device 50, will result in obtaining 20 kHz at the upper output Q.sub.1, this output in turn being connected to the toggle input T2 of the lower half of device 50. Again, frequency division by two takes place with the result that a frequency of 10 kHz is provided at the lower output Q.sub.2 and is transmitted on line 52.

It will be apparent to those skilled in the art that the signal appearing at the set input is a necessary precondition for the hold input signal, which is provided in the upper channel or path of the safe latch, to be rendered effective or enabled to reach the vital driver 54 at the upper right in FIG. 2. The reason for this is that the vital driver controls the enabling of the dual flip-flop gate device 58 by means of feedback path 56 which transmits a DC potential designated DC--, commonly referred to as super-minus, meaning that it is much more negative than the regular supply voltages. Typically, DC-- would have a value of -6 volts, whereas DC- would be 0 volts and DC+ would be +6volts.

Accordingly, this super-minus value of voltage must be fed back to the dual flip-flop gate device 58 in order to enable this device so as to permit the hold input signal to be fed through and affect the vital driver. In other words, a signal at the hold input is ineffective unless and until the set input has caused the enablement of the upper pathway or channel such that the hold signal can be gated through to the vital driver 54. However, once this enablement has been accomplished with respect to the device 58, the input signal at the set input can terminate and the vital driver will then still be supplied with an input signal so long as the hold input signal (also DC--) remains.

It will be accordingly appreciated that the devices 50 and 58, as well as device 60, are applications of the principle already explained in connection with FIG. 1; that is, these are all frequency-coverting logical AND gates whose operation is dependent upon the occurrence of both a clock or AC signal at a toggle input AND the presence of DC resulting from certain predetermined events in order to produce the proper AC output signal. In the case of device 58, as explained, the event is dependent upon the occurrence of a signal (DC-) at the set input of device 50 in order to provide a super-minus (DC--) feedback sigal that will enable the device 58. Hence it will be appreciated that once this feedback signal has been initiated, then so long as the AC input clock signal is provided at the input T.sub.1 of device 58, a signal will continue to be supplied to the input of vital driver 54. However, once the signal at the hold input terminates, and the set signal has already terminated, the whole system reverts to its initial condition. Thereafter, it is required that another signal occur at the set input to recommence the operation as just described.

The middle portion of the safe latch circuit of FIG. 2 has been designated OR and this middle portion provides the required function. However, this function requires special consideration and treatment because the phase relation between two frequency dividers is not determined. Thus there might occur the possibility of an out-of-phase relationship between the output on line 52 from the device 50 which provides frequency division and the output on the line 64 coming from the output Q.sub.2 of frequency dividing device 58. This is so even though each of these output lines is provided with an output frequency of 10 kHz. It will be appreciated that the clock 80 signal goes through three halving divisions since it goes through the upper stage of device 60 and through the two flip-flop stages of device 58. On the other hand, the 10 kHz output on line 52 results from two halving divisions from the originating clock signal designated clock 40.

In order to overcome the aforesaid phase relationship difficulty, an additional line 66 is taken from the Q.sub.2 output of device 58 and a further line 68 is connected to the Q.sub.2 output of device 50. Such arrangement insures that the ultimate inputs will not only be of the same frequency, but will correspond in phase. This is accomplished through frequency doubling by means of the full wave rectifiers, designated 70 in the upper channel and 72 in the lower channel. It will be seen from the pulse diagram of FIG. 4, assuming that a pulse form occurs at the input T2 of the device 58 as shown at the top of the figure, that the pulse forms Q.sub.2 and Q.sub.2 will appear at those respective outputs of device 58 and hence they will so appear on the lines 64 and 66. Due to the capacitors 74 and 76 in these lines, a differential or spike form will result at the points A and B. Accordingly, at the output of the frequency doubler 70, the pulse form C will result. When this pulse form is applied to flip-flop device 80, the consequence will be the pulse output seen at point D. This device 80 is a conventional flip-flop; that is to say, it does not perform logic but simply has the two plus and minus voltage supplies so conventional fixed biases connected to the components of such flip-flop.

Since the pulse forms present on the output lines 52 and 68 are either duplicates or complements of the respective pulse forms A and B shown in FIG. 4, then the output of flip-flop 80 accurately carries out or performs the OR function from the two parallel channels; that is to say, the output of the flip-flop 80 corresponds with the OR function of the inputs at point C from both of the channels. Furthermore, since the pulses at the point C (FIG. 4) occur at a frequency twice that of the inputs A and B to the frequency doubler, the AND gates defined by the devices 50 and 58 divide by four such that there is minimum danger that stray coupling of an input frequency can cause an acceptable output. Since most readily available logic flip-flops such as the dual flip-flop discussed occur in these packages having two halves or stages and since only one stage in a package can be used for logic, it is not inconvenient to require that some AND gates divide by four while others divide by two.

It will be clear from the preceding description that the safe latch device of FIG. 2 is simply one illustration of a fairly sophisticated circuit involving the principle of the present invention and that other further and even more sophisticated logic schemes can be envisioned. Moreover, that such logic schemes would be incorporated in systems such as railroad crossing systems and like arrangements.

While there has been shown and described what is considered at present to be the preferred embodiment of the present invention, it will be appreciated by those skilled in the art that modifications of such embodiment may be made. It is therefore desired that the invention not be limited to this embodiment, and it is intended to cover in the appended claims all such modifications as fall within the true spirit and scope of the invention.