GB2062307A - A Vital Timer - Google Patents

Abstract

In a microprocessor timer for energizing a relay at the end of a preselected time interval plural data words corresponding to a preselected time interval are generated, loaded into a plurality of registers within a microprocessor, which are decremented by means of a program loop for the duration of the time interval determined by the magnitude of the numbers loaded therein. The microprocessor includes checking routines for verifying that the selected time interval has correctly been read, that the microprocessor interval primary clock bears a predetermined relationship to the external auxiliary clock, and that the plurality of registers diversely count base time signals formulated from the internal primary clock for the duration of the preselected time interval correctly. Plural predetermined checkwords indicative of correct timer performance, are produced and a relay is activated only in the event that each prescribed checkword is generated in the correct sequence. <IMAGE>

Description

SPECIFICATION A Vital Timer This invention relates to a vital timer for energizing an output relay at the end of a preselected time interval.

In the rail industry, it is often necessary to activate an output device a predetermined time interval after the occurrence of a particular event.

For example, it may be desired to open the doors of a passenger car a predetermined time after the car has come to a stop. For this application, it is critically important that the output relay controlling the opening of the passenger car doors is not prematurely activated if the safety of the rail system is not to be compromised.

Aside from the application to the opening of the doors of a rail car, there are numerous other instances in which it is desired to activate an output device after the passage of a predetermined time period, and only after the time period has in fact expired. This is true for the electronic controls provided for rail switching and signalling, and virtually any application where safety is a prime consideration.

In the past, mechanical means have been used to perform the necessary timing function, and motor time element relays have long been used in the rail industry. While the mechanical timers have been suitable for many purposes, they exhibit relatively limited programability and therefore have a relatively limited performance range. Furthermore, while the accuracy of the mechanical timers has been adequate for many applications, in other instances where high accuracy is a requirement, it is necessary to find alternative means for generating the time interval.

Thus, as the rail industry in particular rushes into the electronic age, it is desirable to develop a reliable, safe and relatively inexpensive electronic replacement for the mechanical timer of the past.

Recently, attempts have been made to apply computer techniques to fulfil the function of a vital timer. While the details are somewhat sketchy at this time, the general approach seems to be to utilize completely redundant minicomputers produced by different manufacturers and programmed by different programming teams to redundantly process the vital timer time interval and then activate an output device only in the event that the redundant mini-computer systems are in agreement as to the time of activation. The prevailing wisdom is that if you have different programming teams providing different programs for different computers, the likelihood of a common failure is slim and represents an acceptable risk.Nevertheless, since this technique of employing independently redundant mini-computer systems makes no provision for internal checking of the processing of either system, a fatal combination of failures is a distinct possibility. Furthermore, the independent redundancy concept necessarily entails considerable recurring and non-recurring costs to bring these systems to market, which represents a further compromise in the utility of that approach.

Accordingly, one object of this invention is to provide a novel vital timer capable of energizing an output relay at the end of a preselected time interval, in which activation of the output relay is reliably done only after the expiration of the time interval.

According to one aspect of the present invention, a vital timer for producing a predetermined output at the end of a preselected time interval comprises: data generation means for forming time data words corresponding to the preselected time interval; processing means coupled to said data generation means for generating said preselected time interval based on said time data words, said processing means comprising checking means for producing plural predetermined checkwords indicative of failurefree timer processing of said preselected time intervals; and output means coupled to said processing means for producing said predetermined output at the end of said preselected time interval only after production of said plural predetermined checkwords.

According to another aspect of the invention, a vital timer for producing a predetermined output at the end of a preselected time interval, comprises data generation means for forming diverse time data words corresponding to the preselected time interval; processing means coupled to said diverse data generation means for generating said preselected time interval based on said diverse time data words, comprising, a vital counter having diverse counting registers each loaded with respective diverse time data words after formation of said diverse time data words, primary clock means for producing primary clock signals at a predetermined clock rate to clock said diverse counting registers to change the state thereof, said counting registers maintaining a predetermined register output correspondence during clocking thereof, and checking means for verifying at least that said vital counting registers maintain said predetermined correspondence during clocking thereof; and output means coupled to said processing means for producing said predetermined output when said counting registers reach a predetermined state at the end of said preselected time interval only so long as said counters maintain said predetermined register output correspondence.

According to a further aspect of the invention, a vital timer for producing a predetermined output at the end of a preselected time interval, comprises data generation means for producing time data words representative of said preselected time interval; processing means comprising, primary clock means for producing primary clock signals at a predetermined clock rate, vital counter means having vital counter registers coupled to said data generation means and said clock means for counting said primary clock signals for the preselected time interval represented by said time data, and checking means coupled to said selector means and said vital counter means for producing plural predetermined checkwords indicative of failurefree production of said time data words and vital counter means counting; and output means for producing said predetermined output at the end of said preselected time interval only after production of said plural predetermined checkwords.

According to a further aspect of the invention, a vital timer for producing a predetermined output at the end of a preselected time interval, comprises: data generation means for producing diverse time data words representative of said preselected time interval; reset means for initializing generation of said preselected time interval; processing means comprising, vital counting registers coupled to said data generation means and said reset means such that said diverse time data words are loaded into said registers upon initialization by said reset means; primary clock means for producing primary clock signals to clock said vital counter registers at a predetermined clock rate after loading of said diverse time data words; checking means for verifying that said vital counter registers maintain a predetermined correspondence during clocking by said primary clock means, output means for producing said predetermined output when said vital counting registers reach a predetermined state at the end of said preselected time interval only so long as said checking means verifies that said vital counter registers maintain said predetermined correspondence.

According to a yet further aspect of the invention, a vital timer for producing a predetermined output at the end of a preselected time interval, comprises: data generation means for forming diverse time data words corresponding to the preselected time interval; processing means coupled to said data generation means for generating the preselected time interval based on said time data words, reset means for causing said processor means to read said time data words and initiate generation of said preselected time interval; said processing means comprising, primary clock means for generating a primary clock signal at a predetermined clock rate, diverse counting registers clocked by said primary clock signals and coupled to said data generation means for reading said diverse time data words and for diversely counting for a period of time corresponding to the preselected time interval based on said time data words, checking means for verifying at least that said time data has correctly been formed and read, that said primary clock has said predetermined clock rate, and that said diverse counting registers diversely count said base time clocks during said preselected time interval in a predetermined sequence, said checking means producing plural predetermined checkwords indicative of vital timer performance; and output means for producing said predetermined output at the end of said preselected time interval only after production of said plural predetermined checkwords.

These and other objects are achieved according to the invention by providing a novel vital timer which includes a matrix selector switch for establishing the timing interval, and a digital processor for scanning the matrix selector switch, converting the switch settings to time select data, generating a time interval corresponding to thek selected timer presented by the time select data, and energizing an output device at the end of the selected time interval.

The integrity of the digital processor is checked during each of the vital tasks performed thereby by a combination of techniques, including cycle checking and diversity within each task, and general tests performed on processor clock memory, and I/O. To that end, the digital processor of the invention includes a primary clock, an auxiliary clock, diverse data entry means clocked by the primary clock for forming diverse time data words based on the time select data, means for forming a base time clock based on multiple cycles of the primary clock, and diverse counting registers in which the diverse time data words are loaded, and which are subsequently alternately decremented by the base time clock for the period of the preselected time interval.

The digital processor is further provided with checking routines verifying that the time select data has correctly been read, that the base time clock has a period extending for a predetermined number of cycles of the auxiliary clock, and that the diverse registers diversely count the base time clocks during the preselected time interval in a predetermined sequence. To that end, the checking routines produce plural predetermined checkwords indicative of the vital time performance, and stores these checkwords in a memory. Stored in another memory of the digital processor is an output program organized as groups of output instructions, each of which is addressable by a key number based on a predetermined checkword.The groups of output instructions are stored in a predetermined order, with each group separated from another group by a lock-up instruction which precludes output activation in the event that the groups of output instructions are not addressed in a predetermiried sequence. Each of the checkwords stored in the checking memory is converted into a key number by means of a key table, with the key numbers then being used to access respective output program instruction groups to produce the output signal for activation of the output device.

The checking routines of the digital processor of the invention test the vital driver output test instruction, purge and test the data memory, verify the accuracy of the primary clock by means of the auxiliary clock, monitor and verify data entry, and otherwise assure failure free performance of the vital timer of the invention.

The vital timer of the invention is further provided with a binary coded decimal (BCD) display of the amount of time remaining in the selected time interval before activation of the output device, and also a second display indicating the passage of each second of the time interval. Advantageously, the display of the invention can further be utilized to indicate fault conditions in the event that a failure is detected.

A more complete appreciation of the invention and many of the attendant advantages thereof will be readily obtained as the same becomes better understood by reference to the following detailed description when considered in connection with the accompanying drawings, wherein; Figure 1 is a block diagram of the vital timer of the invention; and Figure 2 is a circuit diagram illustrating in more detail the circuit elements of the vital timer of the invention shown in Figure 1.

Referring now to the drawings, wherein like reference numerals designate identical or corresponding parts throughout the several views, and more particularly to Figure 1 thereof, the vital timer of the invention is seen to include a digital processor 10, a time selector 12, a clock check circuit 14, voltage regulator 16, reset circuit 18, tuned vital driver 20, and display 22.

The digital processor 10 is implemented using an Intel single chip microprocessor type 8748 which performs the vital timing logic. Internal to the microprocessor 10 are plural registers utilized for counting purposes, including registers for generating a basic time clock of 0.040 milliseconds and data registers clocked by the base clock to count a number of cycles of the base clock equal to a preselected time interval manually determined by the time selector 12. The microprocessor 10 further internally includes plural memories including a memory for storing checkwords, a memory containing plural groups of output instructions for generating a 10 Khz signal for driving the-tuned vital driver 20, and various other table memories utilizing the checking routines for verifying failure free microprocessor performance, as described in more detail hereinafter.

Since the vital timer of the invention is intended to replace the conventional time element relays presently used in the rail industry, which typically provide an output a preselected time period after application of power thereto, and since the vital timer of the invention is to be a direct mechanical and electrical replacement, a feature of the vital timer of the invention resides in initiation of the preselected time interval upon application of power thereto.For that purpose, the voltage regulator 1 6 of the invention, shown in more detail in Figure 2, applies voltage not only to the microprocessor 10, but also to the reset circuit 18, which includes a relaxation oscillator formed by capacitor 24, resistor 26, and inverter 28, connected to the RESET input terminal of microprocessor 1 0. The reset circuit 1 8 further includes an inverter 30 connected in series with capacitor 32, resistor 34, buffer amplifier 36, and resistor 38. At the junction between capacitor 32 and resistor 34 is connected resistor 40, the other side of which is connected to the five volt regulated output of the voltage regulator 1 6.The input to the inverter 30 is connected to the output of one stage of a buffer hex latch 42 having inputs connected to an I/O port 44 of the microprocessor 1 0. The hex latch 42 serves as an expander port for the microprocessor 10 and is clocked by a PROG signal output by the microprocessor at terminal 46. Provision of the hex latch 42 is a way of expanding the I/O capability of the Intel ID 8748 microprocessor selected for use in accordance with Applicant's invention.

The reset circuit 1 8 operates in conjunction with the voltage regulator 16, which is of conventional design and the details of which are shown in Figure 2, as follows. Upon application of DC voltage to the input terminals of the voltage regulator, and the generation of a five volt output at the output terminals of the voltage regulator, this five volt output is applied to capacitor 24 of the reset circuit and momentarily impressed upon the input terminal of inverter 28, causing the output of inverter 28 to be at a logic "0" level, causing reset of the microprocessor 10 for a period determined by the time constant of capacitor 24 and resistor 26, approximately 10 msec.As the capacitor 24 charges, the voltage level at the input to the inverter 28 drops below the threshold of the gate 28, causing the output of the inverter 28 to change state to the logical "1" level. Thereafter, the microprocessor 10 periodically generates a RUN signal which is applied through the hex latch expander port 42 to inverter 30, capacitor 32, resistor 34, amplifier 36 and resistor 38 to the junction of the capacitor 24 and the input to the inverter 28, maintaining the input of the inverter 28 at a level below the threshold of the inverter 28. Thus, once voltage is applied to the voltage regulator, the microprocessor 10 is initially reset for the duration of the time constant established by capacitor 24 and resistor 26, and is thereafter enabled for processing of the selected time interval.

The hex latch or expander port 42 is also used for the purpose of applying the appropriate drive signals to the display of the invention. As shown in Figure 1, the vital timer of the invention includes a conventional BCD display 48 for displaying the amount of time remaining before expiration of the preselected time interval. BCD time data is applied directly to the display 48 via the I/O port 44, while appropriate clocks and strobes to the display 48 are applied thereto via the expander port 42. The display of the invention further includes a pulse lamp display 50 coupled to the expander port 42, which includes the series connection of inverter 52, amplifier 54, LED 56, and resistor 58 connected to the five volt output of the voltage regulator 16.Connected to the junction of the output of the amplifier 54 and the cathode of LED 56 is resistor 60, the other side of which is connected to the low voltage output of the regulator 16. By means of the expander port 42, the LED 56 is periodically pulsed at each second of the preselected time interval to produce a pulsed visual display indicating processing of the preselected time interval.

As noted earlier, the microprocessor 10 is implemented by means of an Intel ID 8748 single chip microprocessor provided with a crystal processor 3 MHz clock source 62. For the purposes of clock checking, a crystal oscillator 64 separate from the processor clock 62, and a frequency divider 66 provide an independent time reference used in vital clock check routines as discussed in detail hereinafter.

The output device to be activated by the vital timer according to the invention in the rail signalling application for which the timer is intended is a vital relay driver tuned to a 10 kHz signal. The vital relay is driven by the tuned vital driver 20 tuned to a 10 kHz frequency and connected to an output terminal To of the microprocessor 10. The tuned vital driver 20, which is of conventional design and the details of which are shown in Figure 2, produces an output to the vital relay only upon the provision of a 10 kHz signal at the input thereof, as produced by the microprocessor 10, after expiration of the preselected time interval and upon verification of failure-free system performance.The tuned relay driver is used for this application because the driver isolates the relay from the DC energy supply by means of a transformer since the vital relay will only be activated if the signal of the correct frequency is applied to the input of the driver 20.

A primary consideration of the time data selector 12 is that it must be safe from changing to a setting different from the one selected, as a result of vibration, mechanical failure, or high contact resistance. Thus, since rotary switches, including thumb wheel types, must be examined to determine the effect of a broken detent, and coding switches can produce the changed signal as a result of electrical failure of a contact, these switches are not suitable for utilization in the vital timer of the invention. Also, since most commercially available switches have no provision for locking except through the knob or control shaft, and since in many examples a mechanical failure can allow the contacts to change independently of the shaft, these types of switches have also been judged with prejudice for the vital timer application.It has therefore been determined that a puli-to-set switch, such as that provided by AMP, Incorporated (part No.

435625-1) is highly suited for application in the vital timer of the invention. The time data selector 12 is shown schematically in Figure 2 to be formed of a matrix of horizontal and vertical lines which are interconnectable by means of manually positioned captive pin selectors (not shown). Each vertical line is connectable to only a single horizontal line, or to none of the horizontal lines, by means of a captive selector pin. Thus, the pullto-set switch used for the time data selector 12 has positive indexing and can be locked by simply closing a cover against the handles.

The software for producing a vital product, in this case the vital time interval, must prove the correct operation of all hardware involved in producing a safe output. Furthermore, software must also prove that it has in fact verified correct operation. To that end, the software of the invention utilizes cycle checking and diversity techniques to prove correct operation. Cycle checking is used on individual bits, entire memories, individual instructions, and entire subroutines. Diversity is used when the output of a process can have many values. Basically, if the same output is produced by totally diverse means, that output is accepted. The checking features according to the invention are proved by generating data bytes called checkwords. The checkwords do not exist in processor memory, and they are generated as a result of successful completion of vital software checks.The output relay cannot be energized unless a full complement of correct checkwords has been generated. This is true because the vital output program which generates the 10 kHz signal for the vital relay driver does not exist in the processor until all of the tests and tasks have been completed, and the appropriate checkwords thereby form the word in data memory. Then, a further test is performed verifying that all the checkwords previously stored in memory are correct, which results in the production of another checkword which is also stored in memory. The list of checkwords thus generated comprises the addresses of program instructions which are then accessed to generate the vital output.

The vital timer software performs the following tasks: read the time data selector switches, display selected time, generate selected time interval, energize the output relay.

Because all the above tasks except the display are vital, these tasks are subject to the following constraint: energize the output relay only if no unsafe failure has occurred.

The integrity of the processor is checked during each of the vital tasks by a combination of techniques: cycle checking and diversity within the task period, general tests performed on processor clock, memory, and input/output.

One of the general tests performed is a data memory test on the data memory of the microprocessor 10. This data memory is a 64 byte read/write register array located internal to the processor. It is used for temporary storage of data generated during the program cycle, including checkwords. It is vital that the contents of this memory be cleared at the start of the program. Therefore, this memory is cleared of all data by loading a set of known (but meaningless to the time program) data into the read/write register array of the data memory. After the data are loaded, they are summed to produce a memory sum checkword which verifies that the test was made and that the memory worked correctly. Furthermore, the amount of time taken in the generation of the memory sum checkword is further indicative of whether or not the routine has been correctly performed.Since the microprocessor 10 is clocked internally, the utilization of the output of the divider 66 employed in the clock check routing, discussed in more detail hereinafter, provides a way of timing the memory sum checkword routine. Thus, outputs from the divider 66 are applied to a counting register internal to the microprocessor 10 for the duration of the generation of the memory sum checkword to produce a second checkword indicative of the time taken during the memory sum checkword generation. This second checkword, called the memory time checkword, is then also stored in the read/write register array forming the data memory of the data processor 10.

It is noted that since the vital timer of the invention is not energized when it is not being used, it is virtually impossible for useful data to remain in the data memory of the microprocessor 1 0. However, clearing the data memory at the start of the program execution ensures that if the vital timer is restarted during a cycle because of a power interruption or noise, a full timed cycle will be run.

Since time is a vital parameter in the vital timer of the invention, a general test performed by the vital timer is to ensure that the 3 MHz crystal clock produces a machine cycle of 5.0 msec. This is accomplished by comparing the time required to execute a known number of instructions for the time interval defined by the auxiliary clock formed by the clock check circuit 14. As was done in the generation of the memory time checkword, for the duration of the known number of instructions performed by the microprocessor 10, a counter inside the processor counts the 50 kHz pulses produced at the output of the divider 66. This internal counter may be preset, started, read and stopped by program instructions.

The clock check is used in two ways according to the invention. Firstly, it may be used to time a program segment which runs only once, such as, for example, the timing of the formation of the memory sum checkword. When used in this way, the number of auxiliary clock pulses counted while the program segment is run is used to generate a checkword. The clock check is also used in a second way to time the running of a program loop which generates a vital time base clock which is the primary task of the vital timer of the invention. Since the program loop by which the time base clock is generated may be executed a few hundred times to generate time intervals of a few seconds or tens of thousandths of times to generated minutes, a time check count similar to that performed during verification of the memory sum checkword cannot easily be used to form a clock check checkword per se.Instead, the program loop generating the time base clock utilizes diversity techniques for verifying failure free operation, as is now described.

Generation of the base time clock is accomplished by means of a pair of counting registers within the microprocessor 10. Upon beginning the program loop for the generation of the base time clock, the counting registers provided for that purpose are loaded with logically complementary preset numbers and are alternately decremented by instructions timed by the internal clock of the microprocessor 10. Thus, during the time cycle in which a base time clock is generated, the numbers stored in the true and complementary counting registers should be exactly complementary, which fact is checked and verified to ensure correct processing of the time base clock.Furthermore, as the program loop for generation of the time base clock is exited, the count of the clock check counting register is then compared to a reference value by a subroutine to verify that the exit count of these counting registers is equal to a predetermined reference value. If the final value of the time base clock check counting registers differs from the reference value, then the processor stops timing and displays a time error. Through each pass of the time base clock program loop, the preset and reference values of the time base clock counting registers are changed to ensure that for each time check, new and different counting register values are required to allow the program to continue to run.However, the difference between the preset and the reference is always the same, because the same number of machine cycles are always being counted in the repetitive generation of the time base clock.

In order to prove that the clock check is capable of detecting a failure in the generation of the time base clock, the clock check includes an error generation routine in which erroneous preset values are stored into the time base clock counting registers, thereby simulating an error condition. Upon detection of the fault in the error routine, a flag is set within the microprocessor verifying the preprogram system performance.

Later in the time interval generation routine, the fault is cleared and a program status checkword is produced verifying failure detection, setting of the flag, and clearing of the flag. The program status checkword is also stored in the data memory of the data processor 10 for utilization in the output program, as discussed in more detail hereinafter.

Another general test performed during vital times processing involves verification of the microprocessor output to the tuned vital driver.

Since the vital relay is to be energized upon production of a 10 kHz output signal applied to the tuned vital driver via the expander port 42, this output by;te should be maintained at a constant logic level at all times except during output of the 10 kHz signal and only after generation of the preselected time interval.

Accordingly, the state of the output byte from the expander port 42 is sensed by the To input to the microprocessor 10. If the To byte changes state before the time cycle has been completed, the program branches to a memory task, leaving the main program, such that the hardware and software used in this safeguard are tested during the starting phase of the program.

In addition to the I/O port 44, the microprocessor 10 further includes another I/O port 70, and a bus port 72. These three ports are used to read the time setting established in the time data selector 12, and are arranged to provide a 10 byte output word, a 10 byte input word, and a 4 byte input word. The two 10 byte words are connected to each other through the buses of the time data selector switch which enables program testing of the microprocessor ports.

The time data selector 12, as noted above, is a matrix switch for generating time data signals indicative of the preselected time interval to be generated by the vital timer of the invention. The time data selector switch 12 is marked in decimal minutes and seconds, with ten horizontal buses, byte lines, carrying decimal values and four vertical buses representing the digits, that is, seconds, tens of seconds, minutes, and tens of minutes, of the time interval to be generated. The preselected time interval is established by connecting the captive pin of each vertical line with the horizontal line corresponding to the desired time interval value.For example, if a ten minute time interval were to be selected, the captive pin of the ten minute vertical line would be connected to the unit '1' digit byte, while the remaining captive pins of the vertical lines would be connected to the "0" digit horizontal line.

The time data selector 12 is read by means of two program segments. The two readings are used to load respective counting registers utilized in two vital counting routines which use diversity as one of its vital program techniques, as discussed in more detail hereinafter. During a first program segment, during which selected time data is entered into the microprocessor 10, each of the byte lines is scanned sequentially by placing a logical "1" on one line and a logical "0" on all other lines. Then, the four vertical lines of the selector switch 12 are tested at port 70 for the presence of a logical "1 " for each scanned digit.If a logical "1" is detected at any digit, a BCD number corresponding thereto is generated by the microprocessor 10 and stored therein for later loading into the display and a number equal to the digit value expressed in numbers of time base clocks, i.e. 40 msec loops through the program loop utilized in generation of the time base clock, is added into a true vital counting register internal to the microprocessor 1 0. The logical "1" scan continues until the "1" byte is scanned from the first horizontal digit line to the last horizontal digit line, signifying that all lines have been read.

After completion of the "logical 1" or "true scan" of the time data selector switch 12, a second scan of the time data selector switch is performed in which a logical "0" is formed on one of the horizontal lines of the time selector switch, while the logical "1" signal is applied to all other lines of the time data selector switch. The logical "O" is then sequentially scanned from digit "0" to digit "9", as was done during the logical "1" or true scan, resulting in generation of a complementary data word, which is the logical complement of the true data word generated during the true scan of the time selector switch! The complementary data word is then stored in a complementary counting register within the microprocessor 10 for generation of the preselected vital time interval.

Control of the true and complementary data scans is achieved by means of an I/O sequence enabled by the configuration of the output lines from ports 44 and 70 being fed through the time data selector switch 12 and back to the bus I/O port 72. However, the byte lines fed back into the bus port 72 have offset connections to that port, i.e. digit byte 9 output wired to digit byte 8 input, byte 8 output to byte 7 input,... byte 0 output to byte 9 input. Thus, each time the output/input sequence is repeated, the logical "1" byte during the true scan or the logical "0" byte during the complementary scan is read with an offset at the bus input port 72 by which the microprocessor then controls the next digit output byte to which the logical "1" or logical "0" signal is applied during the respective true and complementary scans.Thus, each time the out/in sequence is repeated, a true or complementary byte progresses through the lines dependent upon the positioning of the respective true or complementary bytes being read through the time selector at ports 70 and 72. At the end of the true and complementary scans, a scan counter which counts the number of times a logical "1" and/or a logical "0" signal is applied to a horizontal digit line, is read and as a result used as a scan count checkword. This arrangement tests the ports and the byte lines. Any short or open circuit conditions will cause an error in the scan counter.A second checkword indicative of the time taken to perform the true and complementary scans is obtained from the clock check counter internal to the microprocessor 10, and this scan time checkword verifies that the correct number of machine cycles was run during the true and complementary data scans. Also, since the captive selector pins of the time data selector 12 each can contact only a single horizontal digital line from the microprocessor, the logical "1" or the logical "O" signal can only be read once for each vertical line input to the port 70 during a respective true or complementary scan. Thus, a further checkword, designated a digit count checkword, is formed verifying that the sum of the logical "1 " value is fed into the port 70 through the time data selector switch during the true scan of the switch 12. Alternately, a similar digit count can be compiled during the complementary scan of the time selector switch 12. The scan count, scan time, and digit count checkwords are stored in the data memory of the microprocessor 10 after generation thereof.

From the above description, it is seen that a true time data word and a complementary time data word are respectively formed during the true and complementary scans of the time data selector switch 1 2. The true and complementary time data words are respectively stored in true and complementary vital counting registers which count a number of time base clocks corresponding to the true and complementary time data words respectively stored in these registers. The vital counters are therefore diverse since the true and complementary time data words initially stored therein are logically complementary. The true and complementary time data counters each count 25 time base clocks produced by the vital tirne loop for each second of the preselected time interval.Since the true and complementary time data counters are alternately decremented, counter comparison tests are made upon every second time base clock to verify that the decremented numbers stored in the true and complementary vital counters are exactly logically complementary at each second time base clock. If the numbers loaded into the counter registers are not exactly complementary at the start and during half of the comparison tests, the vital program of the vital timer of the invention will lock up. Thus, this vital test feature is used not only to prove that the routine is counting properly, but to ensure that the time setting from the time data selector switch 1 2 was loaded properly.

As an added measure to protect against erroneous data entry from the time data selector switch 12, prior to reading of the switch the microprocessor 10 loads the vital counting registers which are subsequently loaded with the true and complementary time data words with offset words which would cause the vital program to lock up if the count routine were prematurely or erroneously entered, or if erroneous data is entered into the microprocessor. Different offset words are loaded into the true and complementary vital time counters. After loading of the different offset words into the respective true and complementary data counters a sum is formed of the offset words located in these counters, with the sum forming an offset sum checkword which is then stored in the data memory of the microprocessor 10. A correct offset sum checkword verifies that the offset words were properly loaded.

Since different offset words are loaded into the true and complementary data counters, these words would cause the program to lock up if the count routine were prematurely or erroneously entered, since non-complementary values would be formed in the counters upon each alternate decrement thereof. Upon loading of the true and complementary time data words to the true and complementary vital counting registers in the microprocessor 10, these numbers are added to the offset numbers previously stored in these counters, with the sum of the offset numbers and the true and complementary time data words being used to address a table memory in the microprocessor 10.This table memory stores numbers proportional to the number of counts that are needed to produce a certain time interval, plus a negative offset corresponding to the offset words respectively stored in the true and complementary time data counting registers.

Then, the addressed number in the table memory is added to the number stored in the respective time data counting register, with the result that the initially loaded offsets are cancelled from the true and complementary time data words derived from the true and complementary time data selector scans, respectively.

When the diverse vital counting registers which decrement the true and complementary time data words complete counting the correct number of vital time base clocks to produce the preselected time interval called for by the switches, the vital program according to the invention forms a signature analysis of the previously formed checkwords stored in the data memory of the microprocessor 10. The signature analysis is performed by means of a cyclic redundancy check of the stored checkwords, in a fashion discussed by Schweber et a/, "Software Signature Analysis Identifies and Checks PROMs", Edn. November 5, 1978, pp. 79-81, as described in U.S. Patent Application Serial No.

007,184 filed January 29, 1979. The signature analysis is performed by converting memory contents into a serial byte stream, and passing the byte stream through a 1 6-byte shift register (in software). The byte stream is divided by a preselected polynomial, with the remainder from the division process forming a unique signature.

Remainders are formed by means of the cyclic redundancy check for each page of program memory and are used to generate additional signature checkwords which validate program memory. After generation of the signature checkwords and verification of the correctness of the prior checkwords stored in the data memory of the microprocessor 10, the output routine is entered by which the 10 kHz output signal to the tuned vital driver is generated.

The output routine, according to the invention, alternately sets and resets an output port bit to generate the requisite 10 kHz signal. The program for the output routine resides in a program memory in a form that cannot run. The instructions are arranged in three groups, and the groups are stored in program memory in an incorrect order, each group separated from any other group by a lock-up instruction. The output program will run only if the groups of instructions are accessed in the correct order. The correct order, in turn, is stored in the table called KEY.

The checkwords previously formed and stored in the memory are used to access the KEY table. The checkwords are generated during the running of the timer cycle as discussed above, and are an assurance that all vital tests and checks have been made and were passed. Since the output instructions are located at addresses whose value exists only in the key table, if an incorrect checkword accesses a memory area outside of the key table it will use an instruction code or immediate byte as a branch address. None of these values on the page is an output instruction address, which will preclude output of the 10 kHz signal to the tuned vital driver.

As noted earlier, the output to the vital driver is maintained at a predetermined logic level until execution of the output program. The checkwords formed during processing of the preselected time interval are utilized to address respective output instructions which alternately vary the output to the tuned vital driver from a logic "1 " level to a logic "0" level at a 10 kHz rate. However, a further feature of the vital timer of the invention resides in the fact that the checkwords formed initially, i.e. first formed in time, each correspond to a key number which accesses an output instruction which would maintain the logic level at the vital output to the tuned vital driver at the initial logic level, i.e. logic "1".It is only upon the formation of the signature checkwords which correspond to key numbers which change the output state of the vital driver output of the microprocessor 10 to a logic "0" level that any instructions which would change the output level to the tuned vital driver to a different logic level can be addressed. In this way, it is further ensured that the means for producing the 1 OkHz output to the tuned vital driver is not formed until the last possible moment, after generation of the preselected time interval, to preclude premature generation of any time varying signal at the input of the tuned vital driver.

A further feature of the invention resides in the inherent capability of the vital timer of the invention utilized at display for diagnostic testing purposes. For example, if an error is detected during generation of the preselected time interval, the fact of an error detection is easily indicated by display of a nonsense word by the BCD display, e.g. "99 99". Furthermore, depending upon the capabilities of the microprocessor 10, or the degree of sophistication desired or permissible within economic constraints, it is readily conceivable that the microprocessor 10 can be configured with means for interrogating the contents of various registers and for displaying these contents via the BCD display. Such a capability would be highly useful for determining which of the checkwords indicates a fault, and therefore for fault isolation.

To recapitulate, the vital timer of the invention implements a vital time element relay using a microprocessor of the Intel 8748 type. Salient features of the vital timer of the invention are: timing of program segments as an assurance of their having run correctly, timing of loops vitally, use of checkwords to address the instructions in an output vital driver routine, testing of vital routines, and vital reading of a matrix switch.

Since the vital timer of the invention does not use mechanical means for timing, one model can cover a wide performance range, can be used over a wide voltage range, and is not limited to a particular contact arrangement.

Additional features of the vital timer of the invention are the ease of time setting provided by the matrix time-data selector switch. Also, system accuracy of +0.1% of the set time plus the relay operating time is easily implemented, with any time used during vital processing and checkword formation being easily accounted for in the software. The vital timer of the invention eliminates the need for a check contact.

Furthermore, the vital timer of the invention readily permits display of time-to-go in the preselected time interval, completion of generation of the time interval, the progression of each second of the generated time interval, and the display of fault conditions.

The vital timer of the invention may be used with any output relay or as a voltage output device. The output circuit can be designed to produce the required power.

When used as a time element relay, the vital timer of the invention delivers output power at the end of a selected time interval. The time interval may be increased by failures (momentary interruption of power, for example), but never shortened. The timer electronics can be used to generate a new product which will provide a vital time duration, for example, allowing something to happen only so long as the output is present. This use then requires a change in the order of certain program segments which would be a simple task if there is a need for such a timer.

Obviously, numerous modifications and variations of the present invention are possible in the light of the above teachings. For example, to a certain extent the particular checkwords generated by the software, and their particular utilization in the output instruction addressing, are a matter of choice in view of the safety redundancy provided by some of the checkwords.

Clearly, the checkwords can be formed and utilized in various combinations, as may be desired for a particular application. It is therefore to be understood that within the scope of the appended claims the invention may be practised otherwise than as specifically described herein.

Claims (47)

Claims

1. A vital timer for producing a predetermined output at the end of a preselected time interval comprising: data generation means for forming time data words corresponding to the preselected time interval; processing means coupled to said data generation means for generating said preselected time interval based on said time data words, said processing means comprising checking means for producing plural predetermined checkwords indicative of failure-free timer processing of said preselected time interval; and output means coupled to said processing means for producing said predetermined output at the end of said preselected time interval only after production of said plural predetermined checkwords.

2. A vital timer for producing a predetermined output at the end of a preselected time interval, comprising: data generation means for forming diverse time data words corresponding to the preselected time interval; processing means coupled to said diverse data generation means for generating said preselected time interval based on said diverse time data words, comprising, a vital counter having diverse counting registers each loaded with respective diverse time data words after formation of said diverse time data words, primary clock means for producing primary clock signals at a predetermined clock rate to clock said diverse counting registers to change the state thereof, said counting registers maintaining a predetermined register output correspondence during clocking thereof, and checking means for verifying at least that said vital counting registers maintain said predetermined correspondence during clocking thereof; and output means coupled to said processing means for producing said predetermined output when said counting registers reach a predetermined state at the end of said preselected time interval only so long as said counters maintain said predetermined register output correspondence.

3. A vital timer for producing a predetermined output at the end of a preselected time interval, comprising: data generation means for producing time data words representative of said preselected time interval; processing means comprising, primary clock means for producing primary clock signals at a predetermined clock rate, vital counter means having vital counter registers coupled to said data generation means and said clock means for counting said primary clock signals for the preselected time interval represented by said time data, and checking means coupled to said selector means and said vital counter means for producing plural predetermined checkwords indicative of failure-free production of said time data words and vital counter means counting; and output means for producing said predetermined output at the end of said preselected time interval only after production of said plural predetermined checkwords.

4. A vital timer for producing a predetermined output at the end of a preselected time interval, comprising: data generation means for producing diverse time data words representative of said preselected time interval; reset means for initializing generation of said preselected time interval; processing means comprising, vital counting registers coupled to said data generation means and said reset means such that said diverse time data words are loaded into said registers upon initialization by said reset means; primary clock means for producing primary clock signals to clock said vital counter registers at a predetermined clock rate after loading of said diverse time data words;; checking means for verifying that said vital counter registers maintain a predetermined correspondence during clocking by said primary clock means, output means for producing said predetermined output when said vital counting registers reach a predetermined state at the end of said preselected time interval only so long as said checking means verifies that said vital counter registers maintain said predetermined correspondence.

5. A vital timer for producing a predetermined output at the end of a preselected time interval, comprising: data generation means for forming diverse time data words corresponding to the preselected time interval; processing means coupled to said data generation means for generating the preselected time interval based on said time data words, reset means for causing said processor means to read said time data words and initiate generation of said preselected time interval;; said processing means comprising, primary clock means for generating a primary clock signal at a predetermined clock rate, diverse counting registers clocked by said primary clock signals and coupled to said data genelation means for reading said diverse time data words and for diversely counting for a period of time corresponding to the preselected time interval based on said time data words, checking means for verifying at least that said time data has correctly been formed and read, that said primary clock has said predetermined clock rate, and that said diverse counting registers diversely count said base time clocks during said preselected time interval in a predetermined sequence, said checking means producing plural predetermined checkwords indicative of vital timer performance; and output means for producing said predetermined output at the end of said preselected time interval only after production of said plural predetermined checkwords.

6. A vital timer according to Claim 2 or Claim 4, wherein said checking means produces plural predetermined checkwords indicative of failurefree timer processing of said time interval; and said output means produces said predetermined output only after production of said plural predetermined checkwords.

7. A vital timer according to Claim 1, 3, 5 or 6, further comprising: memory means for storing said checkwords and an output program organized as groups of output instructions, each instruction group being addressable by a key number based on a predetermined checkword, said groups of instructions stored in a predetermined order om which selected groups are separated from any other group by a lock-up instruction which precludes production of said predetermined output, said output means producing said predetermined output only when each output instruction group is accessed in a predetermined sequence, means for forming plural key numbers based on respective checkwords, and means for accessing said groups of output instructions in said predetermined sequence by respective key numbers to produce said output at the end of said preselected time interval;; wherein said output is produced only in the event that errorless vital timer performance is verified by errorless production and application of each of said predetermined key numbers.

8. A vital timer according to Claim 1, 3, 5 or 6, wherein said checking means further comprises: means for verifying that said plural checkwords are produced during processing of said preselected time interval, and means for disabling production of said output if an invalid checkword is produced.

9. A vital timer according to Claim 3, 5 or 6, further comprising: clock check means for verifying the predetermined clock rate of said primary clock signals; and memory means for storing plural words including said checkwords.

10. A vital timer according to Claim 9, wherein said clock check means comprises: auxiliary clock means for generating auxiliary clock signals, and means for comparing the period of said auxiliary clock signals with the period of said primary clock signals and for producing a clock check checkword based thereon and storing said clock check checkword in said memory means.

11. A vital timer according to Claim 10, further comprising: a true base counter clocked by said primary clock signals, a complementary base counter clocked by said primary clock signals, means for loading said true and complementary base counters with a predetermined true base word and a predetermined complementary base word bearing a predetermined logical correspondence to said true base word, respectively, means for incrementing said true and said complementary base counters at each primary clock signal for a predetermined number of said primary clock signals, and means for producing a time base block for clocking of said vital registers each time said base counters are incremented said predetermined number of primary clock signals, said checking means verifying that said true and complementary base counters maintain said predetermined logical correspondence during clocking by said primary clock signals.

12. A vital timer according to Claim 11, wherein said clock check means comprises, auxiliary clock means for generating auxiliary clock signals having a predetermined frequency, and an auxiliary counter clocked by said auxiliary clock signals; said memory means storing predetermined associated pairs of clockcheck preset and clockcheck verification words; and further comprising: means for loading said auxiliary counter with one of said preset words upon loading of said time base counters; and means for verifying that when each time base clock is generated, said auxiliary counter has an output state corresponding to the clockcheck verification word associated with the preset word loaded in said auxiliary counter.

13. A vital timer according to Claim 12, wherein said clock check means selects different associated pairs of clockcheck words for checking of successive time base clocks.

14. A vital timer according to Claim 9 or Claim 11, wherein said data generation means comprises: selector means coupled to said processing means for producing time select data representative of said preselected time interval, and diverse data entry means clocked by said primary clock signals for forming said time data words based on said time select data.

1 5. A vital timer according to Claim 14, wherein said processing means further comprises: true and complementary time data counting registers clocked by said primary clock signals and coupled to said data generation means, means for loading said diverse time data words into said true and complementary time data counting registers, said true and complementary time data counting registers being alternately incremented by said primary clock signals, means for verifying that after clocking by a predetermined number of primary clock signals, said time data counting registers have output states which bear a predetermined correspondence, and means for discontinuing further processing of said preselected time interval if the output states of said time data counting registers do not bear said predetermined correspondence.

16. A vital timer according to Claim 14, wherein said processing means further comprises: true and complementary time data counting registers clocked by said time base clock and coupled to said data generation means, means for loading said time data words into said true and complementary time data counting registers, said true and complementary time data words being logically complementary, said true and complementary time data counters being alternately incremented by said time base clock, means for verifying that upon alternate increments of said time data counting registers said time data counters have counts exactly complementary, and means for discontinuing further processing of said preselected time interval if the counts of said data counting registers are not complementary upon alternate increments.

17. A vital timer according to Claim 15, wherein said processing means further comprises at least one n-bit output port, at least one n-bit input port, and at least one m-bit input port, the bits of the n-bit output port being coupled to the bits of the n-bit input port with a one-bit offset in the position of the bits connected; said selector means comprises an nxm matrix switch having n inputs connected to the n-bit 6utput port, m outputs connected to the m-bit input port, and a pin selector for connecting selected ones of said n inputs to said m outputs;; and said diverse data entry means further comprises, means for sequentially scanning said n-bit output port by sequentially applying a true logic level to one of said n-bits while applying a complementary logic level to the others of said nbits, means for reading at said m-bit input port for each application of said true logic level whether said true logic level is present on any of the bits of said m-bit input port.

means for controlling the true scan of said n-bit output port based on the bit position of the true logic level read at the n-bit input port, means for repeating the scan of the n-bit output port by sequentially applying a complementary logic level to one of said n-bit output port bits while maintaining the remaining bits of said n-bit output port at a true logic level, the repeat scan being controlled by the position of said complementary bit read at the n-bit input port; and means for converting the data read at the m-bit input port during the true logic level scan and during the complementary logic scan into said true time data word and said complementary time data word, respectively.

18. A vital timer according to Claim 17, wherein said checking means comprises: scan counting means for counting the number of times the true logic level and the complementary logic level is applied to one of the bits of said n-bit output port, and means for forming a scan count checkword based on the count formed by said scan counting means and for storing said scan count checkword in said memory means.

19. A vital timer according to Claim 18, wherein said checking means further comprises: auxiliary clock means for generating auxiliary clock signals; scan count timing means clocked by said auxiliary clock means for measuring the amount of time taken to perform the true logic level scan and the complementary logic level scan; and means for forming a scan time checkword based on the time measured by said scan count timing means and for storing said scan time checkword in said memory means.

20. A vital timer according to Claim 9, wherein said checking means comprises: a table memory for storing plural preprogrammed dummy words; means for clearing said memory means upon initiation of the generation of said predetermined time interval, means for fetching said dummy words from said table memory and temporarily loading said dummy words in said memory means after initialization clearing of said memory means; means for reading the contents of said memory means and forming the sum of said dummy words stored in said memory means after loading of said dummy words in said memory means; and means for forming a memory sum checkword based on the sum of the dummy words temporarily loaded into the memory means and for storing said memory sum checkword in said memory means.

21. A vital timer according to Claim 20, wherein said checking means comprises: auxiliary clock means for generating auxiliary clock signals; memory check counting means clocked by said auxiliary clock means for measuring the amount of time taken to form said memory sum checkword, and means for forming a memory time checkword based on time taken to form said memory sum checkword and for storing said memory time checkword in said memory means.

22. A vital timer according to Claim 15, wherein said checking means comprises, offset means for loading predetermined different offset words into said true and complementary time data counting registers, means for adding said time data words to said offset words loaded in said time data counters to form time address data words, a table memory addressed by said time address data words for storing basic count words equal to said time data words minus respective offset words, and means for adding said basic count words to the offset words stored in respective true and complementary time data counting registers such that after addition thereto, only said time data words are stored in said true and complementary time data counting registers.

23. A vital timer according to Claim 22, wherein said checking means further comprises: summing means for adding the contents of the true and complementary time data counting registers after loading of the respective offset words therein, and means for forming an offset sum checkword based on the sum of the offset words added by said summing means and for storing said offset sum checkword in said memory means.

24. A vital timer according to Claim 23, wherein said checking means further comprises: auxiliary clock means for generating auxiliary clock signals; offset time counting means clocked by said auxiliary clock means for measuring the amount of time taken from loading of said offset words until said time data words are stored in said true and complementary time data counting registers; and means for forming an offset time checkword based on the amount of time measured by said offset time counting means and for storing said offset time checkword in said memory means.

25. A vital timer according to Claim 9, wherein said checking means further comprises: means for performing a cyclic redundancy check on the checkwords stored in said memory means, wherein a serial stream of bits is derived from said checkwords and divided by at least one preselected polynomial to produce at least one remainder word, and means for producing at least one signature checkword based on the at least one remainder word and for storing said at least one signature checkword in sand memory means.

26. A vital timer according to Claim 9, wherein said checking means further comprises: failure simulation means for simulating a vital timer fault condition and for setting a flag indicating that the simulated fault is detected by said checking means, means for verifying the setting of said flag and for thereupon resetting said flag without interruption of said processing means when said flag is verified, said flag verifying means otherwise interrupting the processing of the preselected time interval when said flag is not verified; and means for forming a flag checkword based on the verification of the flag setting and for storing said flag checkword in said memory means.

27. A vital timer according to any preceding claim, further comprising: a vital driver tuned to a predetermined frequency, said output means producing at the end of said time interval a square wave output signal having a frequency equal to the tuned frequency of said tuned vital driver at an output signal port, and said tuned vital driver producing said predetermined output upon generation of said output signal.

28. A vital timer according to Claim 7, further comprising: a vital driver tuned to a predetermined frequency, said output program stored in said memory means being organized in such manner that when said groups of instructions are repetitively accessed in said predetermined sequence, a square wave output signal having a frequency equal to the tuned frequency of said tuned vital driver is produced at an output signal port, and said tuned vital driver producing said predetermined output upon generation of said output signal,

29.A vital timer according to Claim 28, wherein said key number forming means first form only key numbers corresponding to respective output group instructions which maintain the output signal port at an initial logic level corresponding to the logic level of said output signal port prior to initiation of the generation of said preselected time interval, and only then form key numbers corresponding to output group instructions which change the logic level of the output signal port to a logic level opposite to the logic level of said output signal port prior to initiation of the generation of said preselected time interval.

30. A vital timer according to Claim 13, wherein said data generation means comprises: selector means coupled to said processing means for producing time select data representative of said preselected time interval and diverse data entry means clocked by said primary clock signals for forming said time data words based on said time select data.

31. A vital timer according to Claim 30, wherein said processing means further comprises: true and complementary time data counting registers clocked by said primary clock signals and coupled to said data generation means, means for loading said diverse time data words into said true and complementary time data counting registers, wherein said true and complementary time data counting registers are alternately incremented by said primary clock signals, means for verifying that after clocking by a predetermined number of primary clock signals, said time data counting registers have output states which bear a predetermined correspondence, and means for discontinuing further processing of said preselected time interval if the output states of said time data counting registers do not bear said predetermined correspondence.

32. A vital timer according to Claim 31, wherein said processing means further comprises at least one n-bit output port, at least one n-bit input port, and at least one m-bit input port, the bits of the n-bit output port being coupled to the bits of the n-bit input port with a one-bit offset in the position of the bits connected; said selector means comprises an nxm matrix switch having n inputs connected to the n-bit output port, m outputs connected to the m-bit input port, and a pin selector for connecting selected ones of said n inputs to said m outputs;; and said diverse data entry means further comprises, means for sequentially scanning said n-bit output port by sequentially applying a true logic level to one of said n-bits while applying a complementary logic level to the others of said nbits, means for reading at said m-bit input port for each application of said true logic level whether said true logic level is present on any of the bits of said m-bit input port, means for controlling the true scan of said n-bit output port based on the bit position of the true logic level read at the n-bit input port, means for repeating the scan of the n-bit output port by sequentially applying a complementary logic level to one of said n-bit output port bits while maintaining the remaining bits of said n-bit output port at a true logic level, the repeat scan being controlled by the position of said complementary bit read at the n-bit input port; and means for converting the data read at the m-bit input port during the true logic level scan and during the complementary logic scan into said true time data word and said complementary time data word, respectively.

33. A vital timer according to Claim 32, wherein said checking means comprises: scan counting means for counting the number of times the true logic level and the complementary logic level is applied to one of the bits of said n-bit output port, and means for forming a scan count checkword based on the count formed by said scan counting means and for storing said scan count checkword in said memory means.

34. A vital timer according to Claim 33, wherein said checking means further comprises: scan count timing means clocked by said auxiliary clock means for measuring the amount of time taken to perform the true logic level scan and the complementary logic level scan; and means for forming a scan time checkword based on the time measured by said scan count timing means and for storing said scan time checkword in said memory means.

35. A vital timer according to Claim 1 7 or 34, wherein said checking means further comprises: digit counting means for counting the number of times a true logic level appears upon said m-bit input port during the true scan of said n-bit output port; and means for forming a digit count checkword based on the count produced by said digit counting means and for storing said digit count checkword in said memory means.

36. A vital timer according to Claim 17 or 34, wherein said checking means further comprises: digit counting means for counting the number of times a complementary logic level appears upon said m-bit input port during the complementary scan of said n-bit output port, and means for forming a digit count checkword based on the count produced by said digit counting means and for storing said digit count checkword in said memory means.

37. A vital timer according to Claim 34, wherein said checking means comprises: a first table memory for storing plural preprogrammed dummy words; means for clearing said memory means upon initiation of the generation of said predetermined time interval, means for fetching said dummy words from said first table memory and temporarily loading said dummy words in said memory means after initialization clearing of said memory means; means for reading the contents of said memory means and forming the sum of said dummy words stored in said memory means after loading of said dummy words in said memory means; means for forming a memory sum checkword based on the sum of the dummy words temporarily loaded into the memory means and for storing said memory sum checkword in said memory means.

38. A vital timer according to Claim 37, wherein said checking means comprises: memory check counting means clocked by said auxiliary clock means for measuring the amount of time taken to form said memory sum checkword, and means for forming a memory time checkword based on time taken to form said memory sum checkword and for storing said memory time checkword in said memory means.

39. A vital timer according to Claim 38, wherein said checking means comprises, offset means for loading predetermined different offset words into said true and complementary time data counting registers, means for adding said time data words to said offset words loaded in said time data counters to form time address data words, a second table memory addressed by said time address data words for storing basic count words equal to said time data words minus respective offset words, and means for adding said basic count words to the offset words stored in respective true and complementary time data counting registers such that after addition thereto, only said time data words are stored in said true and complementary time data counting registers.

40. A vital timer according to Claim 39, wherein said checking means further comprises: summing means for adding the contents of the true and complementary time data counting registers after loading of the respective offset words therein, and means for forming an offset sum checkword based on the sum of the offset words added by said summing means and for storing said offset sum checkword in said memory means.

41. A vital timer according to Claim 40, wherein said checking means further comprises: offset time counting means clocked by said auxiliary clock means for measuring the amount of time taken from loading of said offset words until said time data words are stored in said true and complementary time data counting registers; and means for forming an offset time checkword based on the amount of time measured by said offset time counting means and for storing said offset time checkword in said memory means.

42. A vital timer according to Claim 41, wherein said checking means further comprises: means for performing a cyclic redundancy check on the checkwords stored in said memory means, wherein a serial stream of bits is derived from said checkwords and divided by at least one preselected polynomial to produce at least one remainder word, and means for producing at least one signature checkword based on the at least one remainder word and for storing said at least one signature checkword in said memory means.

43. A vital timer according to Claim 42, further comprising: a vital driver tuned to a predetermined frequency, said output means producing at the end of said time interval a square wave output signal having a frequency equal to the tuned frequency of said tuned vital driver at an output signal port, and said tuned vital driver producing said predetermined output upon generation of said output signal.

44. A vital timer according to Claim 43, wherein said checking means further comprises: failure simulation means for simulating a vital timer fault condition and for setting a flag indicating that the simulated fault is detected by said checking means, means for verifying the setting of said flag and for thereupon resetting said flag without interruption of said processing means when said flag is verified, said flag verifying means otherwise interrupting the processing of the preselected time interval when said flag is not verified; and means for forming a flag checkword based on the verification of the flag setting and for storing said flag checkword in said memory means.

45. A vital timer according to any of Claims 1 to 29 and 44, further comprising: display means for producing and displaying display signals indicative of the status of the generation of said preselected time interval.

46. A vital timer according to Claim 45, wherein said display means comprises: a digital display for displaying the amount of time remaining in said preselected time interval before energization of said output relay, and a pulsed lamp display indicating each second generated in the preselected time interval.

47. A vital timer according to Claim 46, wherein said display means further comprises: fault display means coupled to the digital display for providing signals indicative of a fault condition to the digital display upon detection of said fault condition by said checking means.