Title:
FAIL-SAFE ELECTRONIC ENCODER FOR SELECTIVELY OPERATING RAILWAY SIGNAL INDICATOR
United States Patent 3885228


Abstract:
A fair-safe electronic encoder for selectively producing code tones having different frequencies for transmission to a frequency-responsive signal indicator. The encoder is composed of a high-frequency primary source whose output is applied through a first checking device to a programmable frequency divider whose operating ratio is selectable to produce any one of a plurality of code tones. The output of the frequency divider is fed to the output or driver stage through a second checking device. The first checking device transfers the output of the primary source to the divider only if the frequency thereof lies within a narrow tolerance range, whereas the second checking device transfers the code tone produced by the divider only if the frequency thereof has a proper value, whereby no output is yielded by the encoder should a defect arise in the primary frequency source, in the divider or in any other stage of the encoder.



Inventors:
Katz, Martin J. (Old Bethpage, NY)
Gesualdi, William A. (Smithtown, NY)
Application Number:
05/367109
Publication Date:
05/20/1975
Filing Date:
06/05/1973
Assignee:
KATZ; MARTIN J.
GESUALDI; WILLIAM A.
Primary Class:
Other Classes:
327/22, 327/43, 340/7.49, 455/702
International Classes:
B61L1/18; H03B19/00; H03K21/08; (IPC1-7): B61L7/08
Field of Search:
325/134,184,163,55,64 340
View Patent Images:
US Patent References:



Primary Examiner:
Curtis, Marshall M.
Attorney, Agent or Firm:
Ebert, Michael
Claims:
We claim

1. A fail-safe electronic encoder system adapted to selectively produce code tones of different frequency for operating a frequency-responsive railway signal indicator, said indicator displaying signals whose aspect is determined by the frequency of the applied code tone except for the most restrictive aspect which is presented only in the absence of a code tone, said system comprising:

2. An electronic encoder as set forth in claim 1, wherein said check means includes a first-checking device interposed between said primary source and said divider to interrupt the connection therebetween in the event the frequency of said source deviates from said narrow tolerance range, whereby the divider then produces a zero output and no code tone is supplied to said indicator.

3. A system as set forth in claim 1, wherein said check means includes a second checking device interposed between said divider and said driver stage to interrupt the connection therebetween in the event the frequency of the code tone yielded by the divider differs from its normal value.

4. A system as set forth in claim 1 wherein said primary source is constituted by a stable high-frequency oscillator.

5. A system as set forth in claim 1, wherein said divider is constituted by a plurality of successively connected stages each dividing by a ratio determined by associated programming lines responsive to external circuits.

6. A system as set forth in claim 5 wherein said programmable frequency divider includes at least five programming lines.

7. A system as set forth in claim 1, wherein said first checking device includes an active filter having a very narrow bandwidth so that only the desired frequency is passed at full amplitude, the amplitude diminishing sharply as the frequency departs from its assigned value.

8. A system as set forth in claim 7, further including a Schmitt trigger coupled to the output of said active filter, said trigger being set to produce an output only when the amplitude of the signal from the filter exceeds a predetermined threshold level.

9. A system as set forth in claim 3, wherein said second checking device includes a first single shot device coupled to the output of said divider and a second single shot coupled to the output of said first single shot, and an adjustable time delay network associated with each single shot to provide a time delay interval dependent on the selected code tones.

10. A system as set forth in claim 9 further including a switching circuit operatively coupled to said first and second single shot devices and switched thereby to pass a code tone to said driver stage only when the code tone has a normal frequency value.

Description:
BACKGROUND OF THE INVENTION

This invention relates generally to railway signalling systems, and more particularly to an electronic encoder adapted to selectively generate code tones having different frequencies for transmission to a frequency-responsive signal indicator.

In modern railroad practice, train control is effected mainly by a signalling system whose function is to permit trains on a line to move at the highest possible speed and with the minimum acceptable distance from the train ahead, thereby expediting the flow of traffic. Basic to the rail signalling arrangement is the subdivision of track into distinct sections or blocks. The presence of trains is detected as being in one or more blocks, the last block occupied by the last car of a train causing the following blocks to transmit various signals.

In the block system, operations are based on the principle that a block occupied by a train causes the following block or blocks to permit speed limits to ensure that the following train is at all times a safe-braking distance removed from the last block occupied by the leading train. Block lengths may vary from a minimum of 35 meters in some urban transit systems to a maximum of 1,600 meters on main-line railroads.

Information regarding the location of a given train is transmitted to following trains by means of wayside signal indicators which are spaced along the track to indicate whether the blocks ahead are occupied. In railroad signal terminology, the "aspect" of a signal refers to its nature or color, whereas "indication" refers to its meaning. Thus the fact that a signal is "green" is its aspect, whose meaning or indication is to "proceed".

In practice, a signalling system may have two or more aspects depending on particular control requirements. Typically, a three aspect system as used on urban rapid transit lines has green, amber and red lights, whereas in a five aspect wayside signal system used on conventional railroads, the light pattern is composed of green over green, green over amber, amber over amber, amber over red and red over red.

Train control is enforced in only one case. The most restrictive signal which is a stop indication is ensured by mechanical trippers carried on the front of a train, these being engaged by trip stops located adjacent one of the running rails at the wayside signal indicator. The engagement of the carborne tripper by a wayside trip stop atuomatically initiates the application of an emergency brake.

Train circuits used for train detection are also employed to transmit signalling data to the cab of the train operator. With a cab-signalling system, the train operator is provided with a continuous display of the signal aspect. Thus when an aspect becomes less restrictive while a train is in a block, say a change from amber over amber to green over amber, the operator of a train equipped with cab signals can take immediate advantage of this fact, whereas with wayside systems, the operator cannot become aware of a signal change until he can actually see the next wayside signal. In some instances, signals may be transmitted to the locomotive of a train to effect automatic train control. Fineness of train control depends on the number of aspects provided.

A more detailed discussion of modern railroad signaling practice may be found in the article entitled "Good News for Commuters" appearing in the Feb. 1972 issue of the IEEE Spectrum and in the Traffic Engineering Handbook -- Washington Institute of Traffic Engineers -- 1965.

One of the basic criteria of signal system configurations as well as of other components is that they must be of failsafe design. Redundancy is generally unacceptable in meeting this criterion. A primary requirement of a fail-safe design concept is that the signal system enforces train separation of at least safe-breaking distance. For two successive trains operating on the same track and in the same direction, this train separation is the distance from the rear of the "leader" train to the front of the "follower" train. The safe-braking distance is that required for the follower to stop safely under the worst set of assumptions, i.e., the longest possible human and equipment reaction times and the smallest possible deceleration rate.

In modern railway signalling systems, the wayside and cab indicators are of the frequency-responsive type, the aspect presented by the indicator being determined by the frequency or tone of the applied voltage. Then when a 50 cycle-per-minute code voltage is fed to the signal indicator, the resultant aspect is different from that presented when say a 75 cycle-per-minute code voltage is applied.

Because of the stringent fail-safe requirements which prevail in railroad signal systems, it has heretofore been the practice to generate the necessary code voltages by means of heavy duty electromagnetic tone generators, usually of the vibratory reed type. While such generators are designed to withstand the environment and to satisfy the severe requirements imposed on railroad equipment, they are cumbersome and expensive.

Moreover, while electromechanical and electronic encoders of the type heretofore known are provided with fail safe circuits, such circuits introduce a problem of their own since they usually operate only upon a failure in the encoder being protected thereby. If the failure arises in the safety circuit itself, the system is then unable to cope with this contingency and this may lead to serious consequences.

SUMMARY OF THE INVENTION

In view of the foregoing, it is the main object of this invention to provide an improved solid-state electronic encoder for selectively producing code tones to actuate frequency-responsive railway signal indicators, the encoder meeting or exceeding the most stringent fail-safe requirements.

More particularly, it is an object of the invention to provide an electronic encoder adapted to selectively generate a plurality of code tones and possessing true fail-safe characteristics such that if any circuit in the encoder or a component thereof fails, the output of the encoder will be zero and the signal indicator associated therewith will present its most restrictive aspect.

A significant feature of the present invention resides in the fact that the electronic encoder includes two check stages in series with the signal path, the arrangement being such that a failure or defective operation of any of the encoder or check circuits results in a zero output.

Also, an object of the invention is to provide a solidstate encoder which lends itself to integrated circuit design whereby the entire structure may be made highly compact and enclosed in a small box protected from the environment.

Briefly stated, these objects are attained in an electronic encoder provided with a primary frequency source whose output is applied through a first checking device to a programmable frequency divider whose operating ratio is selectable to afford any one of a plurality of different low-frequency code tones for transmission to a frequency-responsive railway signal indicator. The output of the frequency divider is fed to the output driver stage of the encoder through a second checking device.

The first checking device is adapted to feed the output of the primary frequency source to the divider only if the frequency thereof lies within a very narrow bandwidth representing the tolerance of the system. Should the frequency of the source lie outside of the tolerance range, no voltage will be applied to the divider and the output of the encoder will be zero, as a consequence of which the signal indicator will present its most restrictive aspect.

The second checking device functions to determine whether each code tone yielded by the divider is at its assigned frequency, and should any tone deviate therefrom, the second checking device effectively decouples the divider from the driver stage so that a zero output will be yielded and the signal indicator will again present its most restrictive aspect.

Thus the first checking device is interposed between the primary source and the divider and the second checking device is interposed between the divider and the driver stage, such that the primary frequency will only be transferred to the divider if it is acceptable and the code tone from the divider will be transferred to the output only if it is acceptable. A failure in the primary frequency source or in the divider or in either of the checking devices will interrupt the circuit path leading to the output stage as a result of which a zero output is provided to produce the most restrictive aspect in the associated signal indicator.

OUTLINE OF THE DRAWINGS

For a better understanding of the invention as well as other objects and further features thereof, reference is made to the following detailed description to be read in conjunction with the accompanying drawings, wherein:

FIG. 1 is a block diagram of an electronic encoder in accordance with the invention;

FIG. 2 is a schematic circuit of the encoder shown in FIG. 1;

FIG. 3 is a series of graphs representing the wave form of the voltages or signals produced at various points in the encoder circuit; and

FIGS. 4 A and B show in side-by-side relation the graphs of voltages produced in the system when the code tone is normal and when the code tone is abnormal.

DESCRIPTION OF THE INVENTION

Referring now to FIG. 1, the basic stages of an electronic encoder in accordance with the invention are illustrated. The primary frequency source 10 includes a stable high-frequency oscillator whose output is fed through a first checking device 11 to the input of a programmable frequency divider 12. The function of the first checking device is to effectively break the interconnection between the primary frequency source and the divider in the event the frequency of the source deviates from its assigned value to an extent going beyond a narrow tolerance range.

The output of divider 12 depends on which of the several programming lines P1, P2, etc. is selected by an external circuit. By way of example, six lines P1 to P6 are shown to provide code tones of 50, 75, 120, 180, 270 and 420 cycles-per-minute (cpm) respectively. Thus when line P1 is activated the divider functions to divide the frequency of clock pulses derived from the primary source to produce a 50 cpm output, when line P2 is active, the output is 75 cpm and so on. It is to be understood that the particular frequency values and the number of programming lines given herein is merely for purposes of illustration and that in practice a smaller or greater number of lines may be used with different frequency values.

If none of the lines is selected or if no clock pulses are applied to the divider stage because the primary source is inoperative or because its output has been cut off by the first checking device as a result of an unacceptable frequency deviation, then divider 12 yields no output.

The output of divider 12 is fed through a second checking device 13 to a driver output stage 14 whose output is carried by suitable lines to the frequency-responsive railway signal indicator. In the example given, six code tones are generated to produce any one of six aspects. The absence of any tone represents the most restrictive aspect; hence the system is adapted to operate a seven aspect wayside or cab signal indicator. These seven aspects in regard to the code tones may have the following relationship:

I. Code tone 50 cpm - green/green II. Code tone 75 cpm - green/amber III. Code tone 120 cpm - green/red IV. Code tone 180 cpm - amber/green V. Code tone 270 cpm - amber/amber VI. Code tone 420 cpm - amber/red VII. Code tone zero cpm - red/red

The function of the second checking device is to effectively break the connection between divider 12 and the driver stage 14 should the code tone yielded by the divider not have its proper value, in which event the output is zero and the indicator produces its most restrictive aspect.

The system is altogether fail-safe, for a zero output is always produced to cause the associated signal indicator to present its most restrictive aspect should primary frequency source 10 depart from its acceptable tolerance or should divider 12 not yield a proper code tone or should one or more stages in the system including the first and second checking devices fail, for in each of these instances, a zero output will result. With this arrangement, if the generated code tone fails to conform to the selection because of a defect of any nature developed at any point in the system, a zero output will be yielded and the signal indicator will be caused to present its most restrictive aspect. In short, the encoder system when operating properly, will supply to the associated indicator selected code tones producing signals having the desired aspect and should the system not operate properly for any reason, the associated indicator will automatically present its most restrictive aspect and thereby avoid danger to the train guided by the indicator.

Referring now to FIG. 2, there is illustrated the schematic circuit of the encoder system which is constituted by the series of stages shown in FIG. 1. The primary frequency source 10 includes a programmable unijunction transistor oscillator provided with a transistor 15 and a frequency-adjusting potentiometer 16. The output of this oscillator yields periodic sharp pulses or spikes at a frequency of 2,520 Hz, with a temperature stability of ±1%. These spikes are converted by flip-flop FF1 to a square wave whose frequency is 1,260 Hz.

The output of the flip-flop FF1 is fed to the first checking device 11 which includes an active filter having an amplifier 17 and a filter-adjusting potentiometer 18. The filter has a very narrow bandwidth, so that only the desired frequency of 1,260 Hz is passed at full amplitude, the amplitude decreasing sharply as the frequency departs from its assigned value.

For example, should a signal at 1,260 Hz with an amplitude of 4 volts be applied to the active filter, then the output of the filter would be 4 volts. But if the signal frequency were to shift to 1,245 Hz, then the output amplitude would drop to 2 volts. The output of the active filter is applied to a Schmitt trigger including a pair of transistors 20 and 21 which are set to produce an output only when the amplitude of the input signal exceeds a predetermined threshold level, which in the example given must be slightly above 2 volts.

Thus the Schmitt trigger will produce an output at 1,260 Hz but not at 1,245 Hz, for in the latter instance the amplitude is below the prescribed threshold. But assuming that the active filter provided an output exceeding 2 volts in a tolerance range of 1,255 to 1,265 Hz which encompasses the assigned 1,260 Hz value, then above or below this range there would be no output. In this way, the system is assured of always operating within its acceptable frequency tolerance.

The failure of any component or circuit within the primary frequency source or in its associated checking device will inhibit the output due to the inherent nature of the checking device and by virtue of the failure. In order to generate an output, each element of the primary frequency source and of the associated checking device must perform during each cycle. In the present system, there are no passive circuits which wait for a failure to occur before being actuated, for each and every element must operate correctly in each cycle for an output to be developed.

The output of the Schmitt trigger in the first checking device 11 is a square wave at 1,260 Hz, as illustrated in graph A of FIG. 3. This square wave is used to clock the divider 12 which is constituted by three successive stages D1, D2 and D3. The divider is of the programmable type such as that manufactured and sold by Motorola.

The output of divider 12 depends upon which of the six programming lines P1 to P6 is selected by external circuits. In none of these lines is selected, the output of the third divider stage D3 is held in the high state, thus inhibiting any signal by virtue of the fact that this stage is trying to divide by zero.

By selecting one of the six programming lines, each divider stage is automatically programmed to divide by a certain number. The basic clock frequency is successively divided by the three divider stages, the ratio of which depends on the code tone selected. Examples are shown in graphs B, C and D in FIG. 3, where B illustrates the output of divider stage D1 at 420 Hz, graph C the output of divider stage D2 at 84 Hz and graph D the output of divider stage D3 at 14 hz.

The output of third stage D3 of divider 12 is fed to a flip-flop FF2 which divides by 2 and converts the signal to a square wave as shown in graphs E and F of FIG. 3 where graph E is the output at the Q terminal and graph F is the complementary output at the Q terminal of flip-flop FF2.

Thus, to produce a code tone of 420 cpm, the clock pulses at 1,260 Hz (graph A) derived from the primary source are divided in stage D2 to produce an 84 Hz output that is divided in stage D3 to produce a 14 Hz output. The 14 Hz pulse output is applied to flip-flop FF2 which divides by 2 to produce a 7 Hz output square wave. This 7 Hz (pulses per second) output is equal to the desired 420 cycles per minute code tone (7 × 60 = 420).

The Q output of flip-flop FF2 is used to trigger a binary stage FF3 and the differentiated Q output is used to reset flip-flop FF4 in a switching circuit included in the second checking circuit 13.

The second checking circuit 13 includes two singleshot devices SS1 and SS2, each operating in conjunction with an R-C time delay network arranged to introduce a delay whose duration depends on the code tone selected. The time delay network associated with single shot SS1 is formed by capacitors C1 and C2 in combination with one of resistors R1 to R6. When code tone 50 cpm is selected, resistor R1 is operative to provide a predetermined delay interval, when code tone 75 cpm is selected, resistor R2 is operative to provide another delay period and so on with respect to code tones 120, 180, 270 and 420 cpm which are respectively related to resistors R3, R4, R5 and R6.

The time delay network associated with single shot SS2 is formed by capacitor C3 in combination with one of resistors R7 to R12. When code tone 50 cpm is selected, resistor R7 is operative, when code tone 75 cpm is selected resistor R8 is operative and so on with respect to code tones 120, 180, 270 and 420 cpm which are respectively related to resistors R9, R10, R11 and R12.

The Q output of flip-flop FF2 (Graph E- FIG. 3), triggers single shot SS1 whose Q output is shown in graph G - FIG. 3. After the selected delay, single shot SS1 triggers single shot SS2 whose Q output is shown in graph H and whose Q output is shown in graph I. The time delays of both single shots are, as indicated previously, dependent upon the selected code tones. The actual times are selected so that the Q output of single shot SS2 (Graph H - FIG. 3) brackets the positive-going leading edge of the output Q of flip-flop FF2 (graph F - FIG. 3) when flip-flop FF2 is switching at the proper rate.

When the positive-going edge of the Q output of flip-flop FF2 (Graph F - FIG. 3) occurs during the period that the Q output of single shot SS2 (graph H - FIG. 3) is high, then the Q output of flip-flop FF3 (Graph L - FIG. 3) switches to its high state. When flip-flop FF3 switches to the high state, flip-flop FF4 is concurrently switched to its high state.

Thus the output of Q of flip-flop FF4 (Graph M - FIG. 3) is a replica of the Q output of flip-flop FF2 (Graph F - FIG. 3) when this Q output meets the criteria imposed by single shot SS1, single shot SS2 and flip-flop FF2, which expressed mathematically is:

Ff4q = ff2q

when:

Td ss1 ≤ (1/ff 2q) ≤ tdssi + td ss2

where:

Td ss1 = time Delay SS1

Td ss2 = time Delay SS2

In order, therefore, to realize a switching output, the frequency must meet the stability criteria imposed by the output switching circuits.

FIGS. 4 A and B illustrate how the output switching circuits in the second checking device 13 inhibit the output when a failure occurs causing the code tone yielded by the divider to be lower than the normal frequency.

For example, if the normal tone is 75 cpm when programming line P2 is activated, it is important that the output be inhibited should actuation of line P2 produce say 55 cpm tone. FIG. 4 shows what happens in the outputs of single shots SS1 and SS2 and flip-flops FF2, FF3 and FF4 when the code has its normal value, while FIG. 4 B shows what happens when the frequency of the code is less than normal. It will be noted that the Q outputs of both flip-flops FF3 and FF4 are set to the low state and are kept in that state because the transition in the Q output of FF2 takes place while SS2-1 is in the low state. But if the frequency generated by the divider is higher than the normal tone value, the transition in the Q output of flip-flop FF2 would occur in advance of the window of SS2-1, and again the Q output at the flip-flop FF4 would be kept in the low state.

If more than one code is selected by the external programming controls, the system will inhibit its output. The rejection mechanism in this instance is inherent in the system design. Selecting two or more code tones simultaneously will always lower the output frequency of the dividers and will consequently shorten the timing cycle of the single shot SS1 and SS2. These combined actions appear to the switching circuits as if the frequency generated is lower than the code selected. Thus the output is suppressed by the same mechanism that checks for a failure in the frequency generating or divider circuits.

Thus no checking devices are exercised during every cycle of output, for the output signal is the actual output of the check circuit itself. Hence both the input to the check circuit and the check circuit itself must be functioning if there is to be an output.

While there have been shown and described preferred embodiments of an Electronic Encoder for Railway Signaling, it will be appreciated that many changes and modifications may be made therein without, however, departing from the essential spirit thereof.