Title:
DIGITAL INFORMATION TRANSFER SYSTEM HAVING INTEGRITY CHECK
United States Patent 3577187


Abstract:
A digital information transfer system for selecting and then enabling a remote utilization device by a digital address including means for assuring system integrity. A selector is actuated to energize one comparator input and generate a unique digital address to enable one utilization device. The digital complement of the enabled utilization device address is generated and transmitted to a decoder at the selector. If the correct utilization device is enabled, the digital complement is decoded to energize the second comparator input. Simultaneous energization of two comparator inputs enables means for operating the utilization device. If a system malfunction occurs, inputs to two different comparators are energized, thereby blocking further operation.



Inventors:
BENSON RALPH A
Application Number:
04/756995
Publication Date:
05/04/1971
Filing Date:
09/03/1968
Assignee:
GENERAL ELECTRIC CO.
Primary Class:
Other Classes:
340/3.54, 340/3.7
International Classes:
G08C25/00; H04L1/14; H04Q9/14; (IPC1-7): G08C25/00; H04L1/14; H04L1/12; H04Q9/14; H04g001/00; H04g003/00; H04g005/00
Field of Search:
340/163,151,147
View Patent Images:
US Patent References:
2944247Supervisory control system1960-07-05Breese



Primary Examiner:
Pitts, Harold I.
Claims:
I claim

1. In a digital information transfer system including a plurality of addressed, energizable utilization device control means, a plurality of utilization device selection means, digital message generating means for producing a unique digital address upon actuation of each selection means, digital message processing and handling means and decoding means responsive to receipt of a digital address for enabling one of the control means, the improvement of means for assuring the system is highly secure comprising:

2. A digital information transfer system as recited in claim 1 wherein the unique digital address contains first and second address characters, said address complement generating means producing the complement for each character of the enabled control means address and said address complement decoding means having first and second character decoders, said first character decoder providing an enabling input to said second character decoder and said second character decoder energizing one of said indicating means second inputs.

3. A digital information transfer system as recited in claim 2 wherein the control means are divided into groups, the first address character designating a group and the second character designating a control means in that group, said first character decoder enabling said second character decoder whenever any control means in the selected group is energized.

4. In a supervisory control system including a master station and a plurality of digitally addressed remote stations, each of said remote stations having digitally addressed, two-condition actuators adapted to be enabled by a first signal and energized by a second concurrent signal to control a utilization device and each remote station being connected to the master station by communication means, means for controlling a specific utilization device from the master station comprising:

5. A supervisory control system as recited in claim 4 wherein said point selector means comprises a latch means having an output connected to said digital address generating means and to said security indicating means and switching means for selectively grounding an input of said latch means to thereby cause selection of a utilization device control actuator.

6. A supervisory control system as recited in claim 5 wherein said digital address generating means comprises a remote station address encoder and a plurality of control actuator address encoders, each control actuator address encoder being associated with all point selector means for a given remote station and having an output individually connected to an input of said remote station address encoder thereby grounding the latch input causes the control actuator address and a remote station address to be generated to thereby uniquely define a specific utilization device control actuator.

7. A supervisory control system as recited in claim 6 wherein said master station digital message handling means includes common busses connected between circuitry in said master station, a parallel-serial converter coupled to said common busses and a transceiver connected to said parallel-serial converter and said communications means and wherein said remote station digital message handling means includes a transceiver connected to said communication means, a parallel-serial converter connected to said transceiver and remote station common busses connected to said parallel-serial converter, all of said common busses, said parallel-serial converters, said transceiver and said communication means being operative to handle and process the digital message and its complement.

8. A supervisory control system as recited in claim 7 wherein the two-condition actuators include first and second serially connected switching means and a latch adapted for energization by the first signal and connected to said remote point address complement encoder for causing the energization thereof.

9. A supervisory control system as recited in claim 7 wherein said actuator address complement generating means includes a remote station address digital complement encoder and an actuator address digital complement encoder, said remote station address digital complement encoder being energized by said remote station address decoder and said point address complement encoder being energized by energization of said actuator latch.

10. A supervisory control system as recited in claim 9 wherein said master station decoder means includes a remote station address digital complement decoder and a plurality of actuator address digital complement encoders, receipt of said remote station address digital complement at said master station enabling one of said actuator address digital complement decoders.

11. A supervisory control system as recited in claim 10 wherein said security indicating means are constituted by a plurality of comparator circuits, each of said comparator circuits being individually connected to one of said point selector latch means and one of said actuator address digital complement decoder outputs.

12. A supervisory control system as recited in claim 11 wherein said second energizing signal generating means includes command encoder means connected to all of said comparator outputs to be enabled when one of said comparator outputs is energized, said command encoder additionally including actuation selection means and means for generating a command code onto said common busses for transmission to the remote station and means responsive to said command message for decoding said message and energizing all of said two-condition actuators with the second energizing signal whereby only one of said actuators is energized by both said second and first energizing signals.

13. A supervisory control system as recited in claim 5 wherein said actuators and said point selector means are grouped according to remote station and wherein a plurality of said actuators may have the same actuator address, each of said remote stations having a unique address so that the combination of said remote station address and said actuator address define a specific actuator, each of said groups having a single actuator address complement generating means responsive to the energization of said latch means for generating the actuator address digital complement and simultaneously energizing one input to a remote station address complement encoder to generate the appropriate remote station address digital complement.

14. A supervisory control system as recited in claim 13 additionally including means for monitoring the two-condition actuator for responding to a fault therein to thereby prohibit system operation.

Description:
BACKGROUND OF THE INVENTION

This invention is directed to digital information transfer systems and more specifically to such systems requiring high security data transmission.

There are many applications where it is necessary to assure the integrity or security of a digital message transferred between locations. Supervisory control systems constitute one application requiring actuation at a utilization device at a remote location. With electrical power systems dispatchers operate remotely located circuit breakers. In another application, gas pipeline valves in a remote pumping station are controlled from a central location. Both specific examples utilize a digital message which selects a utilization device for actuation.

The need for high security message transmission is evident in these applications. If a malfunction occurs, without safeguards, it would be possible for the wrong utilization device to be selected and actuated. There are several diverse schemes which assure message integrity, and parity is the most common. Variations have been developed to assure that no digital bits are lost or added to a message. However, none of the schemes assures the overall operating security of the system.

Therefore, in the prior art, parity has been complemented with a check-back system. For example, when a "double rail" system has been incorportated in a supervisory control system, a message is received by a transmitter and then sent over one message handling and processing means as the message and its complement. After the message is received at a remote location a check-back message and its complement are generated and processed by a second message handling and processing means. However, this procedure is usually incorporated at the remote station or at the master station, but not between these stations.

Two complete message handling and processing means are required in the double rail system. Further, a complete systems check is not attained because correct transmission can occur even though the system might malfunction.

Therefore, it is an object of this invention to provide a digital message transfer system which assures high security message transmission.

Another object of this invention is to provide a digital message transfer system including means for checking the entire system.

Another object of this invention is to provide a digital message transfer system adapted for utilizing single rail logic.

Yet another object of this invention is to provide a digital message transfer system wherein the number of interconnecting conductors is reduced without loss of message security.

SUMMARY

In accordance with one aspect of this invention means are initiated to generate a digital address which is transmitted from a master station to a remote station to enable one utilization device. When a utilization device is enabled, its digital address is complemented and is transmitted to the master station for decoding over the same communications channels and by the logic and internal system conductors used in processing the digital address. If the correct utilization device is energized the returned message is the complement of the digital address. Means for generating a command code are thereby enabled to permit actuation of the utilization device.

This invention has been pointed out with particularity in the appended claims. A more thorough understanding of the above and further objects and advantages of this invention may be obtained by referring to the following detailed description taken in conjunction with the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is the schematic diagram of an embodiment of a supervisory system master station adapted to utilize this invention;

FIG. 2 is a schematic diagram of an embodiment of a supervisory system remote station adapted to utilize this invention;

FIG. 3 is a schematic diagram of one embodiment of the master station point selector and point address complement decoder shown in FIG. 1;

FIG. 4 is a schematic diagram of one embodiment of a remote point including a latch, command switch and utilization circuit shown in FIG. 2;

FIG. 5 is a schematic diagram of one embodiment of the address decoder and complement encoder adapted for use in the remote station in FIG. 2;

FIG. 6 is a schematic diagram of one embodiment of the remote point address complement encoder adapted for use in the remote station of FIG. 2; and

FIG. 7 is a schematic diagram of one embodiment of a remote station address complement decoder adapted for use in the master station of FIG. 1.

DESCRIPTION OF AN ILLUSTRATIVE EMBODIMENT

The following discussion of a digital information transfer system is presented in terms of a specific embodiment of a supervisory control system. Only one remote station and a few associated control points are disclosed. The actual number of remote stations and control points in each remote station may vary in actual applications. Means for adding remote stations and control points will be discussed hereinafter.

In the following discussion like numerals refer to like elements throughout. In FIG. 1 a supervisory control system master station is divided into two portions. A MASTER COMMON 11 including circuitry for selecting diverse actuating and readout circuits is illustrated with a POINT SELECTOR 12 for a first remote station, REMOTE STATION- 1 as an example. The MASTER COMMON 11 also includes circuitry for processing and handling digital messages such as COMMON BUSSES 13 tied to a PARALLEL-SERIAL CONVERTER 14 which converts information in parallel format on the COMMON BUSSES 13 to serial form for transmission by a TRANSCEIVER 15 onto a data transmission means 16 such as an electrical conductor or microwave transmission system. The TRANSCEIVER 15 and the PARALLEL-SERIAL CONVERTER 14 also respond to incoming signals on the transmission means 16 to place the information onto the COMMON BUSSES 13 in parallel form. The entire system is usually under control of a programmer which provides a series of timing pulses. As means for generating such timing pulse sequences are known to those of ordinary skill in the art, the various FIGS. merely show timing pulse inputs where necessary. Other circuits may also be tied to the COMMON BUSSES 13 and be controlled by the programmer. These circuits normally do not require the high degree of security provided by this invention. Therefore, this invention is described only in terms of point selection where a control action is to be commanded. Also in the MASTER COMMON 11 is a REMOTE STATION ADDRESS COMPLEMENT DECODER 20. A COMMAND ENCODER 21 is responsive to switches 22 and 23 to generate an appropriate command signal and place it on the COMMON BUSSES 13 in conjunction with the programmer.

The POINT SELECTOR 12 includes a plurality of circuits for each remote station; all point selectors are connected to the COMMON BUSSES 13 at 24. Branch busses 25 interconnect POINT SELECTOR 12 which the point selectors for other remote stations. Each point selector is similar so the POINT SELECTOR 12 for REMOTE STATION-1 is the only detailed circuit. Each remote station may include a plurality of control points. In FIG. 1 three points are shown and designated as PT-1, PT-2 and PT-n. PT-1 has a point select switch 30 which energizes a latch 31 and one input of a master station POINT ENCODER 32. Similarly, PT-2 has a point select switch 33 and a latch 34; and PT-n, a point select switch 35 and a latch 36. Each latch is individually connected to one input of the POINT ENCODER 32. When the POINT ENCODER 32 is activated by a point select switch, it energizes one of a plurality of inputs to the REMOTE STATION ADDRESS ENCODER 17 and acts in conjunction with the COMMAND ENCODER 21 to select and actuate a specific utilization device such as a circuit breaker or a pipeline valve by generating a unique digital address and command.

For example, assume during an operation that the point select switch 30 is depressed thereby grounding the input of the latch 31 and one input of the POINT ENCODER 32. The programmer starts a point selection and control sequence to produce a series of timing pulses. Simultaneously, the POINT ENCODER 32 causes the REMOTE STATION ADDRESS ENCODER 17 to be energized to provide the address for REMOTE STATION-1. A first timing pulse T1 opens the gate of the REMOTE STATION ADDRESS ENCODER 17 to place the remote station address on the COMMON BUSSES 13. This address is processed by the PARALLEL-SERIAL CONVERTER 14 and transmitted after a sync pulse is generated thereby. Timing pulse T2 causes the signal generated by POINT ENCODER 32 to be impressed on the COMMON BUSSES 13 immediately after the remote station address has been removed. The POINT ENCODER 32 also may be programmed to generate a command signal. As a result, a digital message of the following format could be serially transmitted to the remote station:

Sync Bit 1 bit

Remote Address 5 bits

Command 5 bits

Point Address 5 bits

Logic Parity 5 bits

This is an example of a message sent by a system having multiple function capabilities. If only control functions were to be used in the system, the command character could be eliminated. Additional parity might also be generated. In accordance with this invention, only the remote station and control point address characters are used to attain security. Either binary, binary-coded-decimal or other code forms may be used. If 5-bit binary codes are used for the remote address, a theoretical limit of 32 stations exists. Similarly, a theoretical limit of 32 points at each remote station exists if the addresses are binary. Additional control points at each remote station can be obtained by cascading the points. For example, 100 points could be controlled with a two-digit, binary-coded decimal point address, by properly controlling the timing pulses.

FIG. 2 illustrates a portion of REMOTE STATION-1. The message from the master station is received in serial form on the transmission means 16 by a REMOTE TRANSCEIVER 40 and is converted to parallel form by a PARALLEL-SERIAL CONVERTER 41 to be impressed upon remote station COMMON BUSSES 42 for transmission to various circuits in the REMOTE COMMON 43 and the REMOTE CONTROL POINTS 44. Each remote station also includes a timing pulse generating programmer energized by the sync bit. If parity is included in the message, the programmer initially acts in conjunction with the REMOTE TRANSCEIVER 40 and the PARALLEL-SERIAL CONVERTER 41 to complete a parity check. If a parity check is obtained, the message is transferred onto COMMON BUSSES 42 in synchronism with the timing pulses. A timing pulse T3 permits the remote station address to be applied to a REMOTE STATION ADDRESS DECODER 45. When the timing pulse T3 is applied to the gate and the address is accepted, a signal is transferred to a REMOTE POINT ADDRESS DECODER 46. Simultaneously with a timing pulse T4, the point address on the COMMON BUSSES 42 is read into the REMOTE POINT ADDRESS DECODER 46 which responds by energizing one of a plurality of outputs individually connected to enable a single utilization device control means. A first control point, designated PT-1, includes a latch 47 and a command switch 50. Similarly, a latch 52 is coupled to the REMOTE POINT ADDRESS DECODER 46 for controlling a utilization device 53 in conjunction with a command switch 54 at PT-2. A PT-n utilization device 55 is controlled in response to signals from a latch 56 and a command switch 57. Each of the latches 47, 52 and 56 is also individually connected to energize one of a plurality of inputs to a REMOTE POINT ADDRESS COMPLEMENT ENCODER 60. Whenever one latch, such as latch 47, is energized thereby enabling the control means, a unique code is generated by the REMOTE POINT ADDRESS COMPLEMENT ENCODER 60. If the encoded point address was that of the latch 47, then in accordance with this invention, the unique code is the complement of the point address.

After this sequence has been completed, T5 is applied to the gate of a REMOTE STATION ADDRESS COMPLEMENT ENCODER 61 to apply the remote station address complement to the remote station COMMON BUSSES 42 for transmission back to the master station. This is followed by a timing pulse T6 to the gate of the REMOTE POINT ADDRESS COMPLEMENT ENCODER 60 so that the remote point address complement is transferred onto the remote COMMON BUSSES 42. T5 and T6 may be delayed to permit a command response to be generated by other code generating means connected to the remote station COMMON BUSSES 42. Therefore, a message is transmitted across the transmission means 16 which might have the following format:

Sync 1 bit

Command Response 5 bits

Remote Address Complement 5 bits

Point Address Complement 5 bits

Logic Parity 8 5 bits

Means may also be provided for generating additional parity.

Referring again to FIG. 1, the master station receives the message and responds to the sync bit by production, at an appropriate time, a timing pulse T7 applied to the gate of the REMOTE STATION ADDRESS COMPLEMENT DECODER 20. When the remote station address is decoded, a signal appears on one output of the REMOTE STATION ADDRESS COMPLEMENT DECODER 20 to enable a POINT ADDRESS COMPLEMENT DECODER 62 for REMOTE STATION-1. One point complement decoder is associated with the point selection equipment for each remote station. When the POINT ADDRESS COMPLEMENT DECODER 62 is enabled and a timing pulse T8 is applied, the point address complement is coupled thereto. Each of a plurality of outputs is responsive to the particular code group and is connected to a COMPARATOR circuit associated with each point select switch. A single COMPARATOR circuit is energized by two signals when the decoded message is actually the complement of the remote station and control point addresses generated by the point select switch. For example, a COMPARATOR circuit 63 is connected to the POINT ADDRESS COMPLEMENT DECODER 62 and the latch 31. Therefore, if the point select switch 30 has been depressed and if the decoded remote station and control point address complements are actually the complements of the point address for PT-1 at REMOTE STATION-1, both inputs of the COMPARATOR circuit 63 are energized. This indicates that the system is operative.

Similar COMPARATOR circuits 134 and 135 are associated with the point selection equipment for PT-2 and PT-n respectively. Whenever a single COMPARATOR circuit is energized by signals at both inputs, the COMMAND ENCODER 21 is enabled. This permits subsequent operation of the switch 22 or 23 to generate a command code which may then be impressed upon the COMMON BUSSES 13 by a timing signal T9 for transmission to a POINT COMMAND DECODER 66 shown in FIG. 2 at the remote station which is responsive to a timing pulse T10. When the command code is received, a signal is applied to all the command switches simultaneously. As both inputs of the command switches must be energized simultaneously to actuate a utilization device, only one utilization device is actuated.

In accordance with this invention, therefore, selection of a point generates a digital address which enables one of a plurality utilization device control means. The digital complement of the enabled control means address is generated and transferred by the same logic and communications equipment to the selection means. If a system fault exists, both messages cannot be processed correctly to energize a signal comparator.

Many circuits utilized in the master station shown in FIG. 1 and the remote station shown in FIG. 2 are well known in the art. For example, the PARALLEL-SERIAL CONVERTERS 14 and 41 and the TRANSCEIVERS 15 and 40 are standard circuits. Further, many circuit embodiments are adapted for generating and processing complementary codes. However, to facilitate a complete understanding of this invention, a detailed discussion of a specific system follows. To make this discussion more meaningful, it will be assumed that the binary address for REMOTE STATION-1 is 10000, while control points PT-1, PT-2 and PT-n are address as 10000, 01000 and 11100, respectively so PT-n is PT-7 assuming that the bits are transmitted in the order B1, B2, B4, B8 and Bx. These designations are used to identify specific busses, inputs and logic bits in the following detailed discussion. Further, it will also be assumed that ground potential is a logic 0 while a positive potential is logic 1.

Referring to FIGS. 1 and 3, depressing the point select switch 30 grounds the input to a NAND circuit 70 which, with another NAND circuit 71 constitutes the latch 31. The resultant logic 1 on the output of the NAND circuit 70 is coupled to one input of the NAND circuit 71. The other input is responsive to a logic 0 reset signal RE. Therefore, the output of the NAND circuit 71 and second input to the NAND circuit 70 are at a logic 0. After the latch 31 is set, release of the point select switch 30 does not shift the latch output from a logic 1. Latches 34 and 36 are similarly constructed.

Each latch output is individually connected to one of a plurality of inputs to the master station POINT ENCODER 32 to generate the point addresses 10000, 01000 and 11100 for PT-1, PT-2 and PT-7, respectively. The REMOTE STATION ADDRESS ENCODER 17 responds to the POINT ENCODER 32 to generate the REMOTE STATION-1 address 10000. Several schemes have been evolved to generate digital address codes. One such circuit is similar to the POINT ADDRESS COMPLEMENT ENCODER 60 described hereinafter. Thereafter, a command word is generated under control of the programmer having the following form:

110000XXXXX10000PPPPP

where XXXXX designates a binary command character and PPPPP, a parity character. This message is processed by COMMON BUSSES 13 and 42, PARALLEL-SERIAL CONVERTERS 14 and 41 and TRANSCEIVERS 15 and 40 shown in FIGS. 1 and 2. Assuming proper system operation, the latch 47 at REMOTE STATION-1 is energized by a signal designated as PTSEL-1.

As specifically shown in FIG. 4, the latch 47 includes a NAND circuit 72 energized by PTSEL-1 and a NAND circuit 72 energized by RE. The output of the NAND circuit 73 is coupled through a inverter 74 to an NPN transistor 75 to convert the logic signal to a driving signal. The emitter 75e is grounded while the collector 75c is directly coupled to one input of the REMOTE POINT COMPLEMENT ENCODER 60. Proper base bias is provided by a resistor 76 coupling the base 75b to a positive terminal 77. The voltage on the collector 75c is supplied from a voltage source. In the specific embodiment, this bias is supplied from a COMMAND SWITCH FAULT INDICATOR 78 described in detail hereinafter. When the latch is reset, the output of the NAND circuit 73 goes to logic 1 which, after inversion to a logic 0, turns off the transistor 75 so the input to the POINT COMPLEMENT ENCODER 60 is logic 1. PTSEL-1 applies a logic 0 to the NAND circuit 72 and shifts the output of NAND circuit 73 to logic 0 to turn on the transistor 75 to ground the input to the POINT COMPLEMENT ENCODER 60 and enable the COMMAND SWITCH 50.

In accordance with this invention, a REMOTE STATION ADDRESS COMPLEMENT ENCODER 61, shown in FIG. 5 with the REMOTE STATION ADDRESS DECODER 45, is energized by the timing pulse T5 to place the complement of the remote station address on the COMMON BUSSES 42. To understand this specific embodiment of a remote station address complement encoder, it is necessary to discuss its operation beginning with the command word as it is received from the master station. All characters which appear on the COMMON BUSSES 42 are applied in parallel to inverters 80, 81, 82, 83 and 84 respectively connected to the B1, B2, B4, B8 and Bx busses. Each of the inverters 80 through 84 energizes a NAND circuit, such as NAND circuits 85 and 86 associated with the B1 and B2 busses. Further, each of the COMMON BUSSES 42 impresses a signal on a second plurality of NAND circuits such as NAND circuits 87 and 90. Switches 91 and 92 are representative of selector switches to set the remote station address. This detailed discussion is limited to the circuitry energized by the B1 and B2 busses as this circuitry represents the processing of both logic 1 and logic 0 inputs.

Selector switch 91 ground the second input to the NAND circuit 87 while the second input to the NAND circuit 85 floats at logic 1. Therefore, when the B1 bus is a logic 1, NAND circuits 85 and 87 are each energized by a logic 1 signal and a logic 0 signal so both NAND circuits 85 and 87 go to logic 1. Grounding the second input of the NAND circuit 86 through the selector switch 92 causes both outputs of the NAND circuits to go to logic 1 when the B2 bus is at logic 0. An analysis of the remaining circuitry indicates that the input to a NAND circuit 93 is at logic 1 only when a digital message 10000 appears on the COMMON BUSSES 42. An output conductor 94 energized through a latch including NAND circuit 95 and 96 is therefore maintained at a logic 1 if the common input to the NAND circuit 93 is at logic 1 when T3 is generated. Conductor 94 remains at logic 1 until RE is applied to the NAND circuit 96.

The conductor 94 also serves as one input to a plurality of three-input NAND circuits 100 through 104. A second input is provided from the second input of each NAND circuit in the REMOTE STATION ADDRESS DECODER energized by the inverters 80 through 84. Specifically, the second input to the NAND circuit 100 is a logic 1 because it is not grounded by the switch 91. The second input of the NAND circuit 101 is maintained at a logic 0 signal from the grounded input of the NAND circuit 86. Similarly, second inputs of the NAND circuits 102 through 104 are at logic 0. Therefore, when timing pulse T5 is applied simultaneously to a third input of all the NAND circuits 100 through 104, a logic 1 is generated by the NAND circuits 101, 102, 103 and 104 while the NAND circuit 100 generates a logic 0. Therefore, the remote station address is complemented and transmitted as 01111.

FIG. 6 illustrates means for generating a digital complement of the point address. Latches 47, 52 and 56 are shown in addition to a fourth latch 105, in phantom. Each latch is individually connected to one or more of a plurality of NAND circuits 110, 111, 112, 113 and 114. The latch 47 is only connected to the NAND circuit 110; the latch 52, to the NAND circuit 111; the latch 56, to the NAND circuits 110, 111 and 112; and the latch 105 is adapted for connection to the NAND circuits 110 and 113. If binary-coded decimal addresses are used, the gate 114 is not energized so that it always energizes the Bx bus with a logic 1. If binary addresses were used, the NAND circuit would be connected to latches for PT-16 and above. As previously explained, when a particular latch is selected, a logic 0 is generated. The output from the latch 47, in this particular example is, therefore, a logic 0 while all other latches have a logic 1 output. Therefore, the outputs of the gates 110 through 114 will be 1, 0, 0, 0 and 0 respectively. These signals are inverted by NAND circuits 115 through 119 when the timing pulse T6 is applied to produce an output transmitted as 01111 which is the complement of the binary point address 10000. If latches 52, 56 or 105 are selected, point address complements of 10111, 00011 or 01101 are generated. Similar logic circuits may be used to construct the REMOTE STATION ADDRESS AND POINT ENCODERS 17 and 32 shown in FIG. 1.

FIG. 7 is a logic diagram for one embodiment of the REMOTE STATION ADDRESS COMPLEMENT DECODER 20. Assuming REMOTE STATION-1 responds to the command word, the complemented address 01111 appears on the COMMON BUSSES 13. Inverters 120, 121, 122, 123 and 124 are individually connected to the B1, B2, B4, B8 and Bx busses. One NAND circuit is then wired to the inverters for each of the remote stations to be responsive to a correct complement and go to logic 0. NAND circuit 125 is wired for REMOTE STATION-1 by being connected to the output of the inverter 120 and the inputs of the inverters 121 through 124. When the message 01111 is applied with T7, the output of the NAND circuit 125 goes to logic 0 and provides an enabling signal to the POINT ADDRESS COMPLEMENT DECODER 62. All the remaining NAND circuits, specifically NAND circuits 126 through 128, remain at logic 1. If the circuitry processing the B1 bit were defective so that an open occurred, the returning complemented message would be 11111. The output from the inverter 120 would be a logic 0 causing the output of the NAND circuit 125 to stay at logic 1 so that the POINT ADDRESS COMPLEMENT DECODER 62 is not enabled. Another NAND circuit might respond. However, as will be described, such a response does not enable the COMMAND ENCODER 21 in FIG. 1. NAND circuit 126 goes to logic 0 if the address for REMOTE STATION-2, 01000, is complemented to be returned as 10111 as all the inputs are connected directly to the busses with the exception of one input connected to the B2 bus through the inverter 121. The NAND circuit 127 goes to logic 0 when the busses are energized with 00111, the complement of the address for REMOTE STATION-3. Additional NAND circuits such as NAND circuit 128 may be wired to the inverters 120 through 124 and the busses to be responsive to the complement of any given remote station address.

Whenever one of these NAND circuits, such as the NAND circuit 125, goes to logic 0, it enables one POINT ADDRESS COMPLEMENT DECODER. For example, in FIG. 3, the signal from the REMOTE STATION ADDRESS COMPLEMENT DECODER 20, RS-1, in FIG. 1, is applied through an inverter 130 to NAND circuits 131, 132 and 133. Each NAND circuit is individually coupled through an inverter to one COMPARATOR. Specifically, NAND circuits 131, 132 and 133 are connected to COMPARATORS 63, 134 and 135 through inverters 136, 137 and 138 respectively. The digital complement of the enabled point address on the COMMON BUSSES 13 is transmitted to the inputs of the NAND circuits 131 through 133 by a circuit comprising inverters 140, 141, 142, 143 and 144 individually connected to the B1, B2, B4, B8 and Bx busses. The NAND circuit 131 has its inputs connected to the inverter 140 and the B2, B4, B8 and Bx busses. Its output goes to logic 0 with the simultaneous occurrence of the timing pulse T8, the enable signal RS-1 and the message 01111. If the point select switch 30 has been closed, a NAND circuit 145 in the COMPARATOR 63 goes to logic 0 because the logic 0 output from the NAND circuit 131 is inverted. All COMPARATOR outputs are coupled together in a common conductor 146 which is pulled to logic 0 to enable the COMMAND ENCODER 21. Thereafter one of the switches 22 or 23 in FIG. 1 may be closed to actuate the COMMAND ENCODER 21 to place another command word on the COMMON BUSSES 13. This command word is then transmitted to the remote stations to energize one of a pair of control transistors to actuate a utilization device as described more fully hereinafter.

To illustrate how an error is detected to prevent operation of an improperly selected device, assume first that system malfunction occurs so that when point select switch 30 is closed, REMOTE STATION-2 responds to PT-1. The REMOTE STATION-2 address, 01000, will be complemented and returned as 10111 to energize the REMOTE STATION COMPLEMENT DECODER 20. The address 10111 causes the NAND circuit 126, in FIG. 7, to be energized. Therefore, the POINT ADDRESS COMPLEMENT DECODER 62 is not enabled; and, the COMPARATOR 63 is not properly energized to enable the COMMAND ENCODER 21.

If a failure should occur which disrupts the points address, it is detected. For example, if a failure occurred in the components so that the address for PT-1 were received as 01000, latch 52 would be energized. From FIG. 6, it will be evident that the complemented address, 10111 would be returned and applied to the POINT ADDRESS COMPLEMENT DECODER 62 shown in FIG. 3 simultaneously with the timing pulse T8 and the signal RS-1 from the REMOTE STATION ADDRESS COMPLEMENT DECODER 20. However, the NAND circuit 132 would go to logic 0 and energize the COMPARATOR 134. Both the COMPARATORS 63 and 134 are thereby each energized one input at a logic 1 signal and a logic 0 signal so the conductor 146 remains at logic 1. As a result, COMMAND ENCODER 21 is not enabled.

Therefore, it can be seen by referring to FIGS. 1 and 2 that a complete systems check has been provided using signal rail logic. All the circuitry from the latch 31 to the latch 47 is involved in the transmission of the command word and the generation of a digital address complement. Included are the COMMON BUSSES 13 in the master station and the COMMON BUSSES 42 in the remote station. PARALLEL-SERIAL CONVERTERS 14 and 41 and the TRANSCEIVERS 15 and 40 also process both the command word and the digital address complement. Therefore, if any open or shorted lines exist and a bit passes through the faulty lines, its complement will not be returned for decoding. Hence, the fault is detected. There is a high degree of assurance that circuit failures will be sensed by the system and prevent actuation of an incorrect utilization device.

Thereafter, one of the switches 22 or 23 in FIG. 1 may be closed to actuate the COMMAND ENCODER 21. A TRIP or CLOSE command is placed on the COMMON BUSSES 13 with timing pulse T9 and then transferred to the COMMON BUSSES 42 as shown in FIG. 4. The actuation command is received by the POINT COMMAND DECODER 66 at a timing pulse T10 to energize a TRIP or CLOSE output. Assuming that the COMMAND switch 50 is enabled, the utilization device is actuated. In the specific illustrated embodiment a TRIP command is decoded to forward bias a transistor 150. The emitter 150e is coupled to the collector 75c by a diode 151 while the collector 150c is energized from a positive terminal 152 through a load device represented as a relay coil 153. Similarly a relay coil 154 is energized in response to a CLOSE command when a transistor 155 is forward biased. The collector 155c is connected through the relay coil 154 to the positive terminal 152. A diode 156 couples the emitter 155e to the collector 75c. Energization of the relay coil 153 or the relay coil 154 causes operation of TRIP contacts 153a or CLOSE contacts 154a specifically shown as normally closed and normally open contacts.

Even though employment of the complemented address technique provides a complete digital information transfer system checkup to the collector 75c, two additional failures may not be detected in this specific embodiment. First it is possible for one of the transistors in the COMMAND SWITCH 50 to be shorted. If this occurred, mere selection and setting of a latch would energize a utilization device before a systems check could be achieved. However, a short circuit would place the voltage at the terminal 152 on the collector 75c. Also connected to the collector 75c is the COMMAND SWITCH FAULT INDICATOR 78. It is responsive to the voltage on terminal 152 to produce an ERROR signal. Many circuits may respond to such an over-voltage. One specific example would be a Zener diode which beaks down if either transistor 150 or 155 short circuits with the resultant current energizing a means for generating the ERROR signal.

A second possible malfunction is the setting of two latches by selecting one latch while the latching transistor of another is shorted. As described earlier, some means for forward biasing the latching transistors must be provided to enable the latch to be set. In one specific embodiment, this bias may be provided by a voltage resistively coupled to each latching transistor collector. For example, each collector could be resistively coupled to a common point; and the common point, to the positive voltage source through a single resistor. Voltage sensing means could then be coupled to the common point. If two or more latches are energized, then the voltage at the common will decrease each time another latch is energized. Means, such as Zener diodes, can also be used to sense any decrease at the common point voltage below that produced by a single latch. Again, such a decrease could be used to generate the ERROR signal and such a signal could be used to block selection or actuation. For example, ERROR could be coupled to some circuit in the REMOTE STATION COMMON such as the programmer or to the PARALLEL-SERIAL CONVERTER to block further processing of the remote station and point addresses and also to generate an error code to be transmitted back to the master station.

By adding some embodiment of a COMMAND SWITCH FAULT INDICATOR 78, a complete systems check is obtained to assure that proper selection has occurred and no malfunctions have occurred in the COMMAND SWITCH. Therefore, in accordance with this invention, high security data transmission is realized. Actuation of a selection means causes a digital address to be transmitted to enable a utilization device control means. Thereafter, the address of the enabled control means is complemented and transmitted back to be compared to the original at the selection means. If the selected and enabled control circuits are the same, the digital addresses are complementary. Means respond to this signal to enable a command encoder which, when actuated, sets the utilization device control circuit to its second, or energized state.

This discussion has been with reference to a specific digital information transfer system embodiment especially adapted for use in supervisory applications. It will be obvious that this invention is adaptable to any of the specific system where a high degree of security is required. Further, it will be obvious that the disclosed circuits are illustrative only. Many circuit embodiments may be substituted to perform similar functions. Therefore, it is the object of the appended claims to cover all such modifications and variations as come within the true spirit and scope of this invention.

What is new and desired to be secured by Letters Patent of the United States is: