NL8000473A - FAULT-PROOF DIGITAL CONTROL DEVICE WITH KEYBOARD INPUTS. - Google Patents

Description

r »· '* 49 334 / AH / AS - έ έ tor ings safe digital controller with keyboard inputs.

The invention relates to a digital control device which responds to keyboard commands supplied successively by supplying a special output configuration based on the keyboard commands, which device is used in particular, but not exclusively, in modern rail transport technology.

Modern rail transport systems use construction techniques related to a 10 cycle control and variety of safety to protect against unsafe conditions. The cycle check involves continuous testing of a device, chain or computer order to ensure that it is fully functional. The variety implies the use of two or more channels to provide a lawful output, the channels being chosen so that a single break cannot lead to identical disturbances in all channels and all channels must match in that a permissible 20 output is accepted. These safety engineering techniques are aimed at promoting a fail-safe operation, where any failure that may occur will result in a condition that is no longer dangerous (or conversely at least as safe) as if it were not a failure occurred.

Known fail-safe systems of this kind are known, inter alia, from United States patents 4,090,173, 3,995,173 and United States patent applications 873,574 and 002,765.

Applicant's U.S. Pat. No. 4,090,173 discloses a fail-safe digital communications system in which the digital logic, implemented using hard-wired logic or microprocessor logic, is checked with fail-safe circuits before an output is allowed, 8000473 t - 2 - protecting the system against malfunction. To this end, this known system uses an encoder and a decoder to communicate through a set of 5 predetermined messages, each formed by a pair of digital complementary words separated by frame bits of a predetermined bit pattern, the predetermined bit pattern certain messages are repeatedly issued by the encoder to the decoder.

In a favorable embodiment of the applicant's known interference-proof digital communication system, the decoding unit uses a microprocessor to decode each message and then to go through a number of control operations in order to determine the correct operation of the microprocessor. These control operations include applying a predetermined bit pattern to the output terminals of the microprocessor and supplying this output bit pattern to the input terminals of the microprocessor via a buffer such that the output bit position when fed to the input terminals with shifted one bit to the left.

The predetermined bit pattern is cycled through the microprocessor until its initial position is reached, after which the presence of the bit pattern and its initial position and the number of cycles required to achieve this state are used to provide one in the control operation-i; e use terminal test word. The terminal test word is then arithmetically combined with a modified version of the received message word, the output being used for addressing in a flow table, stored in a memory, to obtain a further quantity, which is added to the previous result. . This final result, which appears as a bit pattern, has a predetermined bit pattern. Since it is not stored in the microprocessor, it can only be supplied with proper microprocessor operation or a very unlikely sequence of failures. It

8 0 0 0 4 7 J

»Tt - 3 - control word thus supplied is then applied to an external logic circuit to determine its presence, which results in the output of a validity signal, with which then certain 5 outputs can be made active according to the command determined by the input message .

Thus, the above-described communication system appears to use repetitive input messages with control operations, where the microprocessor outputs are continuously processed to confirm the validity of the operation of the system.

However, this known digital communication system is not aimed at an application in which literally hundreds of relays have to be operated by means of manually entered keyboard commands. In such a case, persistent delays may occur between successive keyboard commands or between successive keypresses of the keyboard when programming a particular command, so that the system must be capable of reliably verifying valid operation under different operating conditions with including a backup state, in which no keyboard commands are provided.

In addition, continuous processing of all microprocessor inputs and / or outputs during audit operation can become very difficult in an application case where literally hundreds of bits of information are continuously being developed. In this case, the program and construction requirements of the system may become impeding not to mention the cycle time delays experienced in processing all the information data in order to refine the validity of the operation of the system.

The object of the invention is to provide an improved digital control system which responds to manually entered key-board inputs.

Another object of the invention is to provide an improved fail-safe control device with key-board inputs, in which the cycle control forms a 8000473 t-4 variety of key features.

It is also an object of the invention to provide an improved digital fail-safe control device with key-board inputs, in which the execution of the control operations and declarations of validity of the system are continuously prepared regardless of any reserve conditions, in which keyboard commands do not appear.

In addition, it is an object of the invention to provide an improved fault-proof control device under the control of a central processor unit with a number of output terminals, wherein the validation check concentrates on the output terminals, which correspond to certain input messages, provided by a assigning board command.

Another object of the invention is to provide an improved digital fail-safe controller using fault-checking controls to verify a failure-free backup state of the system in the absence of keyboard commands.

Yet another object of the invention is to provide an improved fail-safe digital controller with keyboard inputs, using control operations, which are continuously updated during the subsequent supply of keyboard commands.

A further object of the invention is to provide an improved fail-safe digital control device with keyboard inputs, displaying keyboard commands to the system and incorporating a failure-safety test, ensuring that the completed commands correspond to the commands received from the keyboard .

Yet a further object of the invention is to provide an improved fail-safe digital control device with keyboard inputs using a central processor unit 8000473 t ♦ * - 5 - with multiple output lines, applying multiplexing or bundling techniques to selected output lines so that a central processor unit with reduced capacity can be used.

Finally, it is an object of the invention to provide an improved keyboard-operated, fail-safe digital control device, which will not provide a faulty output in the event of a failure, with the exception of a negligible number of unlikely situations.

In order to achieve the above objects, according to the invention there is provided an improved keyboard-operated, fail-safe digital control device for actuating selected output devices in response to a manually operated keyboard selection of a predetermined number of consecutive edit commands wherein the keyboard encoder is provided to provide editing commands. A fail safe decoder 20 is coupled to the keyboard encoder and decodes the keyboard commands to provide different input messages and copy words, output words, different picture words based on the input words, and different picture echo words based on the picture words. The mapping words are coupled to a mapping device to allow the operator to verify that the mapping words actually correspond to the programmed edit commands. While the operator manually verifies his choice, the fail safe decoder sequentially delivers several multi-bit control words based on predetermined ones provided by the system. These predetermined words give an indication of the performance of the system and contain at least message and copy words, the picture words and the picture deco words. Subsequently, the decoder checks that consecutive checkwords are different and compares each supplied checkword with a predetermined 800047 - 6 - multi-bit constant pattern to provide a validity signal if the checkwords are different and correspond to a predetermined constant pattern of multiple bits. If the fail safe decoder verifies correct system performance and provides a validity signal based thereon, the outputs corresponding to the manually programmed operation commands are energized but only in the presence of the validity signal.

The fail-safe decoder according to the invention is provided with a central processing unit with an input terminal to which the keyboard messages are applied, a plurality of address output terminals 15 for selecting certain output means to be selected, and a number of command output terminals for identifying certain ones selected by the selected output organs operation to be performed. The central processor unit supplies at least one address output word and at least one command output word corresponding to the keyboard operation commands and passes these words to respective selected address and command line access lines. Likewise, the central processor unit is provided with a display output line, which is coupled to the display unit, with which display output words supplied by the central processor unit are displayed.

The central processor unit includes a display echo input terminal, and a plurality of address and command echo input terminals, the number of which corresponds to the address and command output terminals. The display output terminal, the address output terminals and the command output terminals are connected to the respective echo input terminal through isolation circuits, which couple each output bit of each output terminal to an input bit of an echo input terminal when shifted to the left. The isolation circuits are used during terminal troubleshooting and also facilitate the return of modified output words to the central processor unit 8000473 r * * - 7 - for control purposes as will be explained later.

In addition to the above words, the various multi-bit control words provided by the fail-safe decoder may also be based on predetermined computational combinations of different address and command input words from the keyboard, error-seeking terminal test words, output terminal signs and system-10 toe words.

To provide the required different checkwords, the fail safe decoder or more accurately a central processor unit is provided with an addressable memory, in which a number of normalization or DELTA words are stored, each words corresponding to a particular address of the memory.

When formulating the control words, this memory is addressed with a predetermined word of the predetermined words on which the control words 20 are based in order to read from the memory a certain arithmetic normalization word with the other performance words for a given system to ensure that control words of the constant multi-bit pattern only are provided in the case of valid system operation.

The address and command output terminals of the central processor unit are divided into groups, each input terminal of each group containing a number of bits and each bit connected to a dedicated fail-safe relay. During operation, only selected groups of output terminals corresponding to the keyboard command are released, the digital level of the individual bits associated with the selected groups determining the energization of the associated fail-safe relays, but only in the presence of the validity signal supplied by the fail safe decoder.

The system according to the invention further contemplates 8000473-8 - the use of output bundling (multiplex) chains on selected address and command output terminals of the central processor unit, a selected bits of elte terminal, outputted by means of the selected address-5 and command bits connected relay with one relay per bit of selected bundled output terminals. The beam relays have multiple contacts, each of which is connected on one side to a first signal such as a return signal and is connected on their other side to an associated address or command relay, which is operable only in the event that the appropriate output terminal of the central processor unit is selected and if the validity signal is supplied. Each bundling relay may optionally include a control contact which is connected in series with the control contacts of the other bundling relays to provide a back control signal to be used by the central processing unit to supply the control words. By providing the control contacts, use can be made of non-fail safe relays.

The fail safe decoder provides output terminal words used in providing checkwords by subjecting the contents of the terminals, identity plus outputs, to a cyclic redundancy check, dividing a series current of the terminal bits by a chosen polynomial. The rest of this distribution consists of a sign that is unambiguous for the terminal content and is used on the output terminal sign. Likewise, in the system rest period, that is, in the absence of keyboard commands or during the period between keyboard commands, the system will provide a debugging character based on the contents of the memory, that the normalization table, the decoding table, commands and may include a read / write memory to likewise provide debugging characters used in providing the system check words.

The invention will be explained in more detail below with reference to the drawing, which shows by way of example a favorable embodiment of the digital control device according to the invention. Herein shows: FIG. 1 is an overview block diagram of the fail-safe digital control device with keyboard inputs according to the invention,

Fig. 2 is a block diagram illustrating in more detail the address and command output formats of the Storing-10 secure digital controller according to the invention,

Fig. 3 is a circuit diagram illustrating in more detail the interrelationship between the isolation circuits, the fail-safe relays and the fail-safe switches shown in FIG. 2,

Fig. 4 is a block diagram showing further details of the fail-safe decoding unit according to the invention, FIG. 5 is a block diagram illustrating the output terminal pair bundling techniques of the invention, and

Fig. 6 is a circuit diagram of a modified embodiment of the isolation circuits shown in FIG. 3.

The parts in the different figures which correspond to each other are indicated with the same reference numerals.

As Fig. 1 shows, the fail safe digital control device according to the invention includes a keyboard 10 and an encoder 12 coupled to the keyboard 10, a central processing unit 14, and optionally an information transfer system 16, through which the encoder 12 is connected to the central processor unit 14. The information transfer system 16, which is only required if the encoder 12 is disposed a considerable distance from the central processor unit 14, contains a UART transmitter 16, which is connected with a ÜART receiver 20 @ anr * z τ O v '. - o - 10 - is connected through a double wire transmission line 22. The output of the UART receiver 20 is "connected to a message input terminal 24 of the central processor unit 14.

Input instructions are manually entered into the keyboard 10 and encoded by the encoder, for example, using a "three out of eight" code.

Each coded keyboard command contains various input message forms, which may consist of a message word and a copy word, which is the complement of the message word, inverting one of the zeros of the copy word from that of the message word. On the other hand, the keyboard command can be translated into other different message constructions, which are known to the skilled person. In any case, the keyboard commands supplied by the central processor unit 14 are decoded by the central processor unit in two different forms as message input words and copy input words and are stored in a memory in the central processor unit.

The keyboard command supplied by the central processor unit 14 is translated into an image construction, which is likewise stored in the memory in the central processor unit 14. The contents of this stored image information are transferred via an image output line 26 to an isolation chain 28 via multi-wire cables 30 to a conventional display unit 32. Furthermore, the central processing unit 14 is provided with an image echo input terminal 34, connected to the isolation circuit 28, with which display words supplied by the central processing unit 14 are returned in response to the keyboard commands to the central processing unit for fail-safe operation system processing. Thus, the central processor unit represents output coil isolator circuit / central processor unit echo input terminal organization and fail-safe terminal configuration to ensure valid system operation.

As further shown in Figure 1, the central processor unit 14 includes at least one output 8000473 ✓ * - 11 - terminal 36 coupled through isolation circuits 38 and fail safe relays 40. As with the image isolation circuits 28, the output circuits 38 return the output from the central processor unit at the output terminals 36 to the central processor unit 14 by means of an output echo input terminal 42. The keyboard commands, which are stored in the form of message and copy words , are converted into output words by the central processor unit 14, fed to the output terminal 10 36 for controlling the fail safe relays 40. Each relay 40 is provided with a plurality of contacts, the operation of which results in fail safe system outputs corresponding to the keyboard commands .

As further shown in Fig. 1, the central processor unit 14 is provided with an additional output 44, which is connected to a signal generator 46, which supplies sign words indicating the state and / or performance of the system and these sign words are the central processor unit 14 is returned via the input terminal 48.

As will be explained in more detail below, the central processor unit 14 provides several control words, which indicate valid system performance. These control words appear.;.

25 to the output terminal 50 and are applied to a control word processor 52. The processor 52 verifies the variety of consecutively supplied central processor unit control words and that the control words correspond to a constant multi-bit pattern 30 and provide at least one interference-free plus signal in case of fail-safe system performance, the fail safe plus signal is delivered to at least one fail safe plus switch 54.

As shown in more detail in Figs. 3 and 4, the device according to the invention is accommodated under the fail-safe relays 44. In Fig. 1, however, the output terminal 56 of the central processor unit is schematically shown, which output terminal is connected to a group selector 58, which is a particular group of fault prevention devices.

8 ö Θ 0 k 1 S

- 12 - release switches 54, which correspond to certain output terminals 36. Thus, in the case of system validity by the control word processor 52, a selection by the group selector 58 will produce a fail safe plus signal from the check word processor 52 via the fail safe plus switch on the fail safe relays of the selected output terminals, wherein only the two selected bits of each selected terminal associated relay are energized to provide fail safe system outputs.

After the operator has entered his commands manually into the keyboard and visually verified by the display unit 32 that the displayed commands correspond to the intended operation, the operator actuates an operation push button 60 which is switched between the B + lines of the system, then the fail safe relay 62 and the B line of the system. Relay 62 includes a first pair of contacts 64 and 66 with an associated contact arm 68, and a second pair of contacts 70 and 72 with an associated contact arm 74. The first switch represented by elements 64, 66 and 68 is used in the applying a fail safe plus sign signal to the fail safe command relay 25 as shown in Fig. 4 and will be explained in more detail later, while the second switch represented by the elements 70, 72 and 74 is connected to the input terminals 76, 78 to signaling to the central processor unit 14 that the operator agrees to the mapped commands, after which the central processor unit 14 updates the control words supplied by the control word terminal 14 such that these control words, which are additionally based on an operation signal, are provided by the operation 35 switch 60.

As shown in more detail in Fig. 2, the output terminals 36 of the central processor unit and the output echo input terminals 72 are organized as output terminals 36A, address output echo input terminals 8000473 if * - 13 - 42a, command output terminals 36C, and command output echo input terminals 42C. The address and command output words supplied by the central processor unit are output through respective isolation circuits 38A and 38C to respective address and command relays 40A and 40C, the isolation circuits 38A, 38C return respective address and command output words to the output echo input terminals 42A, 42C.

Furthermore, the apparatus of the present invention includes address group selectors 58A and command group selector 58C, which address fault-proof positive switches 54A ep, respectively. Release fail-safe positive switches 54C. Thus, by selecting words output from 15 output terminals 56A and 56C and in accordance with the keyboard commands, the central processor unit 14 controls group selectors 58A, 58C to release specific fail safe plus switches 54A, 54C corresponding to specific addresses. and command output terminals 36A, 36C, so that only 20 can receive the fail safe address and command relays associated with the selected output terminals, possibly fail safe address or command plus sign signals generated by the check word processor 52 and output through the respective store safe plus switches 54.

Fig. 3 shows in more detail a single stage of the fail-safe output terminal configuration shown in FIGS. 1 and 2. More specifically, it is noted that each output terminal 36 contains multiple separate bits S0b ^ 30, usually 8 or 16 such bits, each are connected to an assigned optical isolation chain SSb ^. Each optical insulator in turn contains a pair of insulators and I2, each of which contains a light-emitting diode, which is optically coupled to an associated photosensitive transistor. As shown in FIG. 3, a digital low or "zero" level of a given output terminal bit results in current conduction through the diode of the insulator 1 ^, which then emits light which is detected by its associated 8000473 - 14 - hearing transistor. The transistor of the insulator 1 ^ is then switched to a saturated conduction state such that the light emitting diode of the insulator I2 conducts a current and emits light to its associated transistor, which in turn is switched to a saturated current conductor. status. The collector of the transistor of the isolator I2 is in turn connected to the output echo input terminal 42b ^ of the central processor unit, thereby feeding an output at the output terminal 36b ^ through the isolator circuits 1 ^ and I2 to an associated echo input terminal bit 42b ^ .

Connected to the anode of the diode of the insulator I2 is the cathode of a blocking diode 80, the anode of which is connected to one side of the energization test of a fail-safe relay 54b1> A suppression diode 82 is connected in parallel with the relay coil, the anode of which is connected to the anode of the diode 80. A fault-proof positive switch 54 and a test circuit 84 are connected to the cathode of the diode 82 and the other side of the fail-safe relay 54bi.

Further connected to the anode of the diode of the insulator I2 is a resistor 86 to which is connected a test + 25 signal supplied by the central processor unit 14 during the troubleshooting as will be explained in more detail later.

As shown in FIG. 3, the fail safe + switch means consists of a PNP switch transistor 86, to which the fail safe + signal is applied, which is output from the check word processor 52 as shown in FIG. 4. With the transistor 86, resistors are 88 and 90, the resistor 88 being connected between the emitter and the base of the transistor 86 and the resistor 90 on one side thereof is connected to the base of the transistor 86. The other side of the resistor 90 is connected to an isolator circuit I2 and more particularly to the collector of the photosensitive transistor of the isolator circuit. The 8000473 * - 15 - anode of the light emitting diode of the isolator chain is connected via a resistor to the B + line of the system, while the cathode of this diode is connected to the pinch point 88 at the output of the 5 port 90 and the input of gate 92. The input at gate 90 is in turn connected to a group terminal selector signal from an associated group terminal selector 58, while the output of gate 92 is connected to the cathode of a light-emitting diode, which belongs at 10 a further optical isolator circuit 1 ^. The cathode of the diode of the isolator circuit is connected via a resistor to the line B +. The photosensitive transistor of the isolator circuit 1, on the other hand, is connected to the collector of the transistor 86 and to all other fail-safe relays 54bif associated with the respective output terminal. The emitter of the transistor of the isolator circuit is connected to a common collection line R as well as the emitter of the photosensitive transistor of the isolator circuit 1 ^.

The test circuit 84, as shown in figure 3, consists of an optical isolator circuit I ^, the diode of which with its anode is connected via a resistor 94 to a test2 + signal, supplied by the central processor unit 14. The cathode of the diode of the isolator circuit is connected to the collector of the transistor 86, the fail safe relay 54b, associated with the respective output terminal, in the collector of the transistor of the isolator circuit. The photosensitive transistor of the isolator circuit Ig is connected with its emitter 30 to the common connection line of the processor, while the collector is connected via a resistor 96 to the line B +, which collector is further connected to a group echo input terminal (not shown in more detail). from the central processor unit 14.

35 During operation, if it is assumed that the group terminal selection signal applied to the gate 90 is at a digital high level or logic level ^ a **, a fault valid signal will be connected via the transistor 86 to the fail safe 3000473 - 16 - relay 541 ^. If a digital level "zero" is provided by the central processor unit 14 at the respective output terminal bit 36b, associated with the relay 54bir, this information will be connected through the isolator circuits 5 and I2 and through the diode 80 to the other side of the fail safe relay 54b ^. This results in a fail safe + voltage, which is pushed over the relay 54b, whereby the relay coil will be energized and the associated relay contacts 98 will be switched.

The troubleshooting of the circuits shown in Fig. 1 is accomplished by means of test ^ and test2 + signals supplied by the central processor unit 14. First, the test1 + 15 signal within logic level becomes "one" together with the test2 "with a logic level" zero "supplied, ensuring that the fail safe relay 54b ^ remains de-energized. An error in the isolator circuit ^ or I2 will be detected when it is applied to the output echo input terminal 42bi of the central processor unit, on when appropriate action is taken by the central processor unit 14 to stop operation and indicate the presence of an error If this first test 25 indicates that there is no error, the test2 + signal is applied to a logic level "a". If subsequently the diode of the isolator circuit 1, - becomes current-conducting, which indicates an error, this information is then coupled to the input terminal via the transistor of the isolator circuit I5. Optionally, the collectors of the transistors of the isolator circuits I2 and I5, which are the inputs to the main and group echo terminals, can be daisy chained to a single input, which is fed to the echo input terminal 42b of the central processor unit.

The fail-safe terminal configuration, as described above with respect to the output terminal 36, the isolation circuit 38 and the input terminal 42, is also used for the interconnection between the image 8000473-17 output terminal 36, the image isolation circuit 28 and the image echo input terminal 34, which is also designed to be safe This fail safe clamping configuration is used in particular by the system of the invention 5 for controlling the central processor unit I / O to determine that it is actually under the control of the central processor unit 14. To accomplish this control, the output of each output terminal is connected to the corresponding echo input through the respective isolator chains with a predetermined shift to the right or left, for example, the output port bit 1 connected to the input port bit 2, the output port bit 2 connected to the input port bit 2, etc. The central processor unit 15 releases a clamp control by feeding a bit in the first bit position of, for example, an output terminal and then reading this bit at the associated echo input terminal. The echo input is then transferred to the output terminal and the operation 20 is repeated until the input bits have cycled through the output terminals. The central processor unit therefore cycles through the input readout and transfers the input to the output and determines how many cycles are required for the bit 25 to be returned to the initial position. Then, central processing unit 14 is stored in memory a clamp test word corresponding to the count obtained in the clamp test.

In the absence of the keyboard commands 30 and intermediate keyboard commands, various fail-safe operations are performed by the fail-safe system according to the invention to verify the behavior of the system. As explained above, the clamp test operation applicable to each of the fail safe terminals (output / echo input) and the output test operation include the test ^ and test2 + signals, which are test operations, which release signals for these terminals. Since in the system according to the invention a normalization table is used, stored in a memory in the central processor unit 14 to provide control values as will be explained in more detail below, the system according to The invention is a debugging operation that uses cyclic redundancy checks to verify the contents of the normalization table.

The cyclic redundancy checks, which are described in more detail in "Softward Signature Analysis Identifies and Checks Proms" by Schweber et al., EDN, November 5, 1978, 10 biz. 79-81, convert the fault-seeking test inputs into a series stream of bits applied by the central processor unit 14 to the output 44 on the sign generator 46. By the sign generator 46, the series of information stream is divided by a predetermined polynomial and the rest of this division is a sign that is unambiguous for the table content. This unambiguous character remainder, in the form of a debugging word, is then fed back to the central processor unit 14 by means of the input terminal 48, where it is used together with other debugging words to form suitable control words.

As shown in Fig. 1, the character generator 46 is located outside the processor. Of course, the error-seeking sign can be provided by the program 25 of the central processor unit, but the delivery of this then takes too long and can be too much of a burden for the central processor unit 14. The sign generator 46 can easily be placed outside the central processor unit 14 installed using a 30 UHRT and a CRV generator such as a Fairchield 9401.

As noted above, the system of the invention provides various control words based on a number of fail-safe system checks to verify that the central processor unit 14 and its necessary links are working properly. These various control words, which are herein conveniently described as complementary, have been validated outside the central processor unit by the control word processor 52, which is shown in more detail in Figs. 4, 8000473-19 - to provide fail safe + signals for energization. of the selected fail-safe relay when the operator, or execution pushbutton, is pressed by the operator. The different control words are formed by arithmetically combining predetermined words, which give an indication of the system behavior as supplied by the central processor unit, in predetermined combinations. Each checkword pair consists of a direct checkword 10 and its complement and corresponds to a predetermined constant or normalized multi-bit pattern.

Normalization of the control words is achieved by means of the above normalization table stored in the central processor unit. Since each keyboard command stimulates an unambiguous central processor unit I / O configuration, a normalized control word is obtained by addressing the normalization table by means of a preselected system word supplied by the keyboard command, taking a corresponding normalization word or DELTA word from the normalization table and additionally the control words are based on the DELTA word. Of course, the DELTA word stored in the normalization table is chosen so that when combined with other predetermined system words, the same multi-bit check word is formed.

In formulating the control words, the central processor unit 14 in conjunction with the character generator 16 additionally provides a clamp character word which provides an indication of the content of the information supplied to the address and command output terminals for a cyclic redundancy check, wherein a series current of the respective clamp bits 35 is divided by a selected polynomial in a manner similar to that described above with respect to the debugging character test. Once again, the rest of this division is a clamping word, which is unambiguous for the clamping content. To avoid the 8000473 -20- unlikely case that two content groups provide the same clamp mark, the character analysis performed during a complement checkword analysis cycle uses a different divisor-5 polynomial to ensure that different clamp marks will be obtained during the direct checkword cycle and the complement check cycle.

In order to further increase the vitality of the cyclic redundancy terminal sign check, each 10 of the address and command output terminals 36 contains at least one identity bit, and for each terminal a different bit included in the series of information streams supplied to the sign generator 46. However, the identity bits in each of the respective terminals are used only in providing the gate characters. Thus, in forming the terminal character word, the central processor unit expects specific and different output configurations at the different output terminals generated by the identity bits 20 such that equally unselected terminals and to be applied to the character generator 46 exhibit specific identity / output configuration. Essentially, the provision of the identity bits in the different output terminals responds to the caution of using a logic level "zero" as an error indication for a fail safe system, with the absence of logic "zeros" in the unselected terminals, which often may be the majority, otherwise it would indicate valid operation. Thus providing each output terminal with an identity bit ensures that each output terminal, including unselected output terminals, will make a relatively unambiguous contribution to the terminal word.

As noted above, the central processor unit 14 sequentially provides checkword pairs, each containing a direct word and a complement word. In a favorable embodiment, the direct control word contains at least the sum of the stored message-8 0 0T? 7? result of an output terminal test, and a - 21 - DELTA word, obtained using the output terminal sign as the address for the normalization table.

In this embodiment, the control complement word includes at least the sum of the image echo word stored in the central processor unit, an image clamp test word, and an echo DELTA word obtained by addressing the normalization table with a distinct clamp character word, wherein a distinct polynomial divider is used.

As noted above, the keyboard commands to the central processor unit 14 are sequentially entered as address commands to select a device to be controlled and more particularly the associated fail-safe relays, which keyboard commands are to be followed by command signal commands in order to choose what to do about the addressed device by means of the fail safe command relays. Thus, the central processor unit stores the following entities, which are divided into two groups as follows;

Address Message Word Address Copy Word Address Image Word Command Message 25 Command Copy Word

Command Image Echo Word

After the address is entered, only those first three of the above words are present. A control word 30 is then supplied by the central processor unit to validate the address selection.

In a favorable embodiment, the position of the execution switch 60 as indicated by the switching elements 70, 72 and 74 is also used in forming the control words. Therefore, at this time before a command is entered, the execution push button is not pressed, so that a complement for the address check word is EX.

In a favorable embodiment, the control word $ 0 0 0 3 3 - 22 - provided by the central processor unit 14 must contain all relevant data, so that the results of the error investigation (memory sign), performed when the system was idle, are stored and used . Also in a favorable embodiment, in which the system according to the invention is used in conjunction with a fail-safe railway relay system, the information of a control word includes a signal of the fail-safe railway relay system, which indicates that it is easy to control. This signal, designated "system normal", is applied to input terminal 100, as shown in FIG. 1.

In a favorable embodiment, the different control words supplied by the central processor unit are based on the following arithmetic combinations:

Address check =

Stored error search and address clamp test words + Address message word -20 + Address output terminal sign + System normal + EX words + DELTA (made accessible by the address image echo word)

Address Check = 25 Stored Error Finder + Address Image Clamp Words + Address Copy Word + Different Address Clamp Mark (Different Polynomial) Word 30 + System Normal + EX Words + DELTA (Made Accessible for the Address Copy Word)

Execution of control =

Address check 35 + Command message + Command output terminal test word + Command terminal sign + System normal + EX words + DELTA (made accessible by the command 8 0 0 0 4 7 3 image echo word) - 23 -

Implementation of control

Address Control + Command Copy Word + Command Image Clip Test Word 5 + Different Command Clip Word + System Normal + EX Word + DELTA (made accessible by the Command Copy Word)

The control words thus derived in the favorable embodiment serve to illustrate the formation of the control words. However, endless variations are possible. For example, when the same quantities are used in more than one place, system normal or EX or one of these values may be changed before being used for the second time by the central processor unit by an offset or by an arithmetic change to vary the diversity of the system. further emphasize the control process.

The checkword and checkword complement provided by the central processor unit are delivered to the checkword processor shown block schematically in FIG. These checkwords cannot occur simultaneously in a central processor unit since they occupied a common single memory location for delivery before being transferred to the checkword processor.

The checkword processor in FIG. 4 develops the successively supplied checkword and checkword complement to verify valid system behavior and provide an error-free plus signal for energizing the relays selected by the keyboard instructions.

Thus, the checkword processor compares the consecutively supplied checkword / complement words with the predetermined multi-bit patterns to provide the fail-safe + relay control signals. Since neither the checkword nor the checkword complement is stored anywhere in the central processor unit 8 0 0 0 4 1 3 - 24 - this can only be provided by correct operation of the structure and program in the system.

As shown in Fig. 4, the check 5 word processor is designed as a fail safe driver, formed by a conventional microprocessor such as RCA 1802 to perform the two most important tasks of the fail safe control function: 1. Fail safe + should only be supplied 10 when the correct control word and complement have been issued.

2. Fail-safe + must be provided for a precisely defined period of time, which must be chosen less than the connection time of a fail-safe output relay, so that a system failure causing an invalid control word will be detected in time to prevent relay operation .

Since the system according to the invention responds to address and command keyboard commands, the system takes care of two validity steps, address and command.

The control word processor 52 shown in Figure 4 consists of a fail safe control processor 102, 25 at the input terminal 104 of which the control words of the central processor unit 14 are applied. The fail-safe control processor 102, which is a microprocessor, is provided with output terminals 106 and 108, to which resp. validity signals are issued in the form of constant digital frequency pulse trains in the case of valid system operation. The validity signal from terminal 106 is applied to a matched fail safe controller 110, which provides an indication that the system is available. The validity signal, which appears at terminal 108, is output to the tuned fail safe controller 112 and the Dynan level gate 114. The + input of gate 114 is connected to line B-, while the input of gate 114 is connected with the node 118 8000473 - 25 - of a resistor 120 and a contact arm 68 of the switch member 64, 66, 68 associated with the embodiment push button 60. The contact 66 of the switch is connected to a fail safe control unit 122, which in turn is connected to a clock pulse generator 124. Fail-safe control unit 122 provides a potential, which may be referred to as "super di more negative than any other power supply potential in the system. This" super potential is applied through contact 66 and the contact arm 68 and supplied through the input of gate 114 after the operator has pressed the execution push button. Thus, the above two system stages, i.e. the address and command stage, first performed by the tuned fail-safe control unit 112 to deliver a fail-safe + signal to the address relay and secondly through the Dynan level port 114 and matched fail-safe control unit 116, which provides a fail-safe + signal delivers to the command relay 20 after pressing the execution push button. Obviously, it is desirable for the direction controller to provide validity in more than two stages. However, the construction principles described can be extended to provide as many stages 25 as desired. For a more detailed description of the circuit elements 110, 112, 114, 116 and 122, reference is made to U.S. Patent 4,090,173.

The checkword processor 30 shown in FIG. 4 further includes a restart delay circuit 126, which is constituted by a reset timer 128 and a dual precision motor stable multivibrator.

The restart delay circuit 128, which is described in more detail in U.S. Patent Application 002,765, filed January 11, 1979 by the Applicant, is used in the variety check for a program delay used in a fail safe driver start program. This delay, which is vitally emphasized by an inequality, prevents the checkword processor from recovering from a failure quickly enough to provide a burst signal fail safe + sign, which could otherwise include an output relay.

In order to reduce the capacity requirements of the central processor unit 14, which is ideally formed by a microprocessor, FIG. 5 shows an output multiplex circuit for reducing the required number of output terminals of the central processor unit. In principle, this multiplex circuit uses a number of main terminal relays 134, each of which is connected to the bits of an output terminal of the central processor unit. Each of the main terminal relays 134 includes a plurality of switching elements 136 and 138 connected in series between fail safe output terminal 40 and a common relay return line R. Thus, it appears that the multiplex system of Figure 5 speculates on the cost of one relay per bit to the output terminal of the central processor unit in order to reduce the number of output terminal bits, which must be equal to a number of main terminal relay switches, connected to the fail safe output relays.

The main clamp relays 134 in the multiplex circuit 25 of the invention each include a downshift contact connected in series with a downshift contact of the other main clamp relays to provide a master clamp relay back-check signal for testing whether one of the main clamp relays is in a given state is locked or not. This main clamp relay back control signal may optionally be contained in the control word information and permit the use of non-fail safe main clamp relays 134.

Fig. 6 shows a modified embodiment 35 of the optical isolation circuits used to feed back the output terminal signal from the central processor unit via an associated echo input terminal. In this embodiment, each output terminal bit is connected to a standard type D flip-flop 140 followed by 8000473-27 by a relay control circuit 142. Each output stage includes an input stage consisting of a three position inverter 144. As shown in FIG. the input stage is connected such that the outputs are shifted one bit when they are output to the information collection line so as to facilitate the above port. Furthermore, in Fig. 6, the loop failure safe + sign switch 54 is shown to enable the supply of the fail safe + signal to the fail safe relays 40, which is accomplished by conventional digital logic circuits.

In summary, it should be noted that the fail-safe digital control system of the invention allows the use of an easily available keyboard (such as of the type used for calculators as an input to the fail-safe system). The keyboard itself does not have to display fault-proof characteristics. However, the validity of the key lock input is verified by the operator after the keyboard command has been mapped by the system. Thus, a hallmark of the system according to the invention is therefore a fail-safe test, which ensures that the information passed over is the information received from the keyboard. A second important feature is the fail safe test to ensure that the output devices respond correctly to the logic system while a third important feature ensures that the output is the correct output for a given input.

The fail-safe system according to the invention is equipped with a digital decoder in the form of a central processor unit, i.e. a microprocessor, and associated control word processing chains.

35 When not in use, the system runs debugging programs to demonstrate availability if necessary. These troubleshooting programs include a character analysis of the memory content and tests of image output terminals and fail safe 8000473 - 28 control units.

When a keyboard input is made, the specific command is placed in a message repository, for example, in a constant ratio 5 code like that 3: 8 or 2: 5. This message location in the central processor unit is not re-enrolled during the transaction. However, this number is converted into an image format and likewise placed in an image location in the memory of the central processor unit.

10 The contents of the image location are transferred to the image after the image clamp has been tested. The output terminal test verifies that the states of the output devices can be tested. Interrupted connections or open or shorted input devices cannot result in a malfunctioning output device remaining undetected.

The information supplied to the image output terminal is transferred to an echo memory location in the central processor unit in a format different from that used in the message or image memory locations. The contents of the message and echo memory locations are different forms of the keyboard input commands and are used by the processor for fail-safe control of the selected output.

25 The operator must establish that the image corresponds to the intended operations or he must not initiate the execution command. An emerging error could have been caused by a system error or operator error. If the desired processing is not displayed, the operator presses an cancel button, which can, for example, remove the power supply from the processor, erase its memories of useful information, and force the memory to be reset.

The system performs troubleshooting checks before, between and after the keyboard keys are pressed. When a complete message has been entered by the operator and displayed, the 8000473-29 processor performs a clamp test on various output terminals, the results of which are stored for use in providing control words. The address and message output terminals are arranged in specific groups, which are selected by the central processor unit in response to the keyboard commands such that it is necessary to perform a clamp test only on the specific terminals used, in order to time which would otherwise be necessary for testing all cores of the central processor unit.

The fail-safe control system of the invention utilizes the checkword / checkword complement combination as a simple means for trouble-free emphasizing the performance of the central processor unit. The fail safe output relays are not energized until many tasks have been performed correctly, as indicated by a correspondence between the different inputs for the control word information. The control word and its complement are supplied from selected different elements, which contain all failure-safe factors. Of decisive importance is the fact that the processing chains have no control word in a memory, but can only supply this in the case of a valid operation by correctly performing each of a number of tasks.

An example of a typical logic diagram for providing the checkword pair is shown in the attached table. It should be noted, however, that the system of the invention includes further (non-fail-safe) program checks at each stage of system operation to alert the operator to errors.

Various modified embodiments are possible without departing from the scope of the invention. Such a modification has already been discussed with respect to the isolation circuits shown in FIGS. 3 and 6. Although in the circuit of FIG. 3, use is made of optical isolator circuits for returning the output to the input, 8000473-30. the circuit of FIG. 6 instead uses large film-type resistors to limit the energy that could be input into the relays due to a failure within a latch or buffer. Thus, if a fail safe + signal is stopped for any reason, it will be impossible to cause a fail safe relay to trip by supplying a fail safe signal from another source.

Furthermore, changes may have been made regarding the testable image. As described above, the image testing techniques return the image output to an image input terminal for an inequality check, assuming that the lines from the output terminals to the actual image unit itself are fail-safe.

However, in a further constructional approach, the image echo input signals may be formed by a light detecting means associated with each of the image segments of the image character such that the actual image indicia themselves are returned to the central processor unit. If the image 25 is done with separate rectangular lamps like that. of the Hewlett Packard 5082-4670 type, a phototransistor can be attached to each segment. On the other hand, an incandescent lamp image may form a pattern according to Maste Specialties 96182, using optical fibers to couple the image signals to the image lamps. Here, use can be made of a second group of fibers for transferring part of the light to the photo-detecting members of an echo return branch.

The standard image unit could be used with the input of an optically coupled isolator connected in series with each image segment to test the current away. In order to provide protection against short-circuited segments, which may provide erroneous 8000473 - 31 - indications, the voltage across each segment should also be detected and the signals from the voltage and current inductors should then be combined in a fail safe 5 AND function .

The above-described favorable image, formed of separate circuit elements, which cannot short-circuit each other, is used in the clamp test to demonstrate that the states of the image control unit 10 can be tested. This type of image only shows that the control of the image is correct.

On the other hand, depending on the cost and taking into account the complexity, preference is given to an image using 15 light detecting means, since the operator does not have to demonstrate that the work and the current function of converting electricity - ^ oic signals in light is checked.

The requirement to check the imaging devices themselves can be avoided by using alphabetical mapping when expressing the numbers as words: one, two, three ... etc. Failures on the devices can then prevent the number easily change into another.

Furthermore, various modifications and variations are possible in the selection of a control word and its processing. More specifically, the different decisive elements of the control words can be combined in different combinations without departing from the scope of the invention.

With regard to the processing of the control word, it is noted that the system according to the invention supplies the fail safe signal only long enough to repeat the fail safe checks in a check cycle, and a continuous successful repeat of the fail safe checks is required for maintaining the fail safe + signal. Optionally, a fail-safe 8000471 - 32 - number logic can be used to count the number of control cycle and provide a time limit, within which the operator must complete his transaction before field conditions can change it, making 5 for him it is no longer safe to do so.

A failure to complete the transaction within the designated time would then result in a reset of the central processor unit requiring new keyboard commands to be entered. If the operator presses the execution push button, a new time limit can be set, which corresponds to the actuation time of the selected output relay.

It will be clear that the invention is by no means limited to the above-described embodiment, but that. many modified embodiments are possible without departing from the scope of the invention.

Table.

8000473 - 33 - PROGRAM CHART.

RELAY SELECTION VIA KEYBOARD

FAULT INQUIRY

LOOP I

OUT OF ORDER? - NO EXIT

I “

IMPORT? - <<OUTPUT

GET ON

END LOOP

i

TRANSFER OF KEYBOARD INPUTS TO MEMORY

TEST IMAGE

IMAGE INPUT

TEST CLAMPS

DECODING MESSAGE, SET OUTPUTS INTRODUCTION TIME LIMIT

LOOP |

FORMS OF CONTROL, TRANSFER TO FAULT-PROOF CONTROL UNIT

FORMING CONTROL WORDS, TRANSFER TO FAULT-PROFESSIONAL UNIT

END OF TIME LIMIT? - << OUTPUT

TO CARRY OUT? - INTRODUCTION PERFORMANCE TIME, CONTINUE

GET ON

GO TO FAULT RESEARCH FAULT RESEARCH

TEST IMAGE & OUTPUT CLAMPS

PERFORM SIGN EXAMINATION ON MEMORY

SEND TEST RESULTS TO FAULT-PROTECTIVE TIME CONTROLLER *

TEST KEYBOARD ENTRIES

IMPORT? - GO TO KEYBOARD PRQGRAM REPEAT TROUBLE SHOOTING

fi η λ n /, 7 * - 34 -

CONTINUED PROGRAM TABLE KEYBOARD PROGRAM

INTRODUCING REGISTERS

TRANSFER FROM KEYBOARD INPUT TO (MESSAGE MEMORY)

CONVERT MESSAGE TO IMAGE CONSTRUCTION

TEST IMAGE, SAVE RESULT IN (IMAGE TEST)

IMAGE TRANSFER TO IMAGE KEYPAD FEEDER EXCLUSION • GO TO PROCESSING MESSAGE PROCESSING MESSAGE

TEST CLAMPS, KEEP OUTCOME IN (CLAMP TEST)

DECODE MESSAGE BY LOOKING IN TABLE

SET BITS IN GROUP & MAIN CLIPS

INITIATE TIME LIMIT

CONTROL WORD LOOP

GET MESSAGE, ADD (CLAMP TEST) STORE IN (CHECK)

READ CLAMPS, DELIVER SIGN

OBTAINING DELTA THROUGH TABLE

ADD TO (CONTROL), TRANSFER TO FAULT-SAFE CONTROL UNIT

READ IMAGE, STORE IN (CHECK)

READ CLAMPS, DELIVER "DIFFERENT" SIGN

!

OBTAINING ECHO DELTA FOR "DIFFERENT" SIGN

ADD TO CONTROL, ADD (IMAGE TEST) TO CONTROL

TRANSFER TO FAULT-SAFE CONTROL UNIT END OF TIME LIMIT? - " EXIT

TO CARRY OUT? - INTRODUCTION PERFORMANCE TIME, CONTINUE

GET ON

80 ü U4 7 J

CONTINUED PRQGRAM TABLE

- 35 - GO TO ERROR TEST CLAMP TEST P = R4

FAULT PROTECTION + SIGNAL

SWITCH OFF "FAULT-SAFE"

DELAY

CHECK FAILURE SAFE + SIGNAL

START TEST +

ENTERING 0 1 IN CLAMP WORD

INTRODUCE LOOP COUNTER

i

LOOP

CHECK FAILURE SAFE + SIGNAL

SUBMIT CLAMP WORD

DELAY

READ CLAMP COMPLEMENT

CLAMP = 0? - ERROR - i -

INCREASE CONTROL WORD

SHIFT RIGHT

i

CLAMP = (?? - << OUTPUT

SHIFT LEFT

DECREASE OF LOOP COUNT

LOOP COUNT = 07- ERROR -

CONTINUE WITH LOOP

END LOOP

FINAL TEST +

RETURN TO MAIN PROGRAM

+ Output to fail safe time control device, is a single unsupported word. The fail safe timing device responds by outputting a dynamic output with a frequency different from the frequency providing a fail safe + signal. This output indicates the availability of the system. It is not fail safe.

8000473

Claims (16)

Fail-safe digital control device with keyboard inputs for energizing at least one output device in response to a manually operated keyboard selection of a predetermined number of editing commands, characterized in that this device consists of a keyboard encoder for supplying of the editing commands in a format, formed by successive pairs of several multi-digit keyboard-10 words, each separated by a constant multi-bit picture sequence, from a fail-safe decoder coupled to the keyboard encoder to identify each pair of keyboard words from the image sequence and for supplying different message and copy words, different output words and different image words, based on the keyboard words, and image echo words, based on the image words, from a display device coupled to the decoder and representation of the picture words, wherein the fail safe decoder includes means for sequentially supplying several multi-bit control words based on the particular words provided by the system, which indicate the system behavior, which for certain words include copy words, as well as the image words and the image echo words in response to receiving the keyboard words, and a means for checking that successive of the control words are different, the control means consisting of a means for comparing each supplied control word with a previously determined constant multi-bit pattern and for supplying a validity signal if successive control words of the group of control words are complementary and correspond to the constant multi-bit pattern, the fail safe decoder only being provided if 8000471 - 37 - the validity signal energizes the output device in accordance with the keyboard commands. 2. Device according to claim 1, characterized in that the fail safe decoder consists of a central processor unit for supplying the control words and for supplying at least one address output word and at least one command output word, based on the keyboard words, which central processor unit includes an image output terminal for applying the image output word to the display, an image echo input terminal coupled to the image output terminal for receiving the image echo word, a check word output terminal for applying sequentially supplied complementary control words to the comparator, of at least one address output terminal and of at least one. command output terminal, which central processor unit applies the address and command output words to the at least one address output terminal and the at least one command output terminal, respectively, based on the key words. 3. Device as claimed in claim 2, characterized in that the central processor unit is provided with an addressable memory, in which a number of normalization words are stored, of which each normalization word corresponds to a specific address of the memory, that the central processor unit contains the control words additionally based on a selected normalization word obtained by addressing the memory in a predetermined word of the predetermined words supplied by the system, whereby only control words corresponding to a constant multi-bit pattern are provided in the case of 35 a valid operation of the device, resulting in the provision of the validity signal, Apparatus according to claim 3, characterized in that the keyboard member successively provides different pairs of address keyboard words and different pairs of command keyboard words, the fail safe decoder several pairs of address image words, command image words, address image echo words and command image echo words based on the address and supplies the command messages, and that the successive different control words are provided by the central processor unit, additionally based on the 10 address and command output words and the address and command message and copy words. 5. Device according to claim 4, characterized in that the central processor unit is provided. of an address echo input terminal and of a command echo input terminal coupled to the address and command output terminals, respectively, that the fail safe decoder includes an address image output terminal and a command image output terminal, respectively coupled to address and command image echo input terminals, which include an isolator is provided for coupling the respective output terminal to the respective echo input terminal of the central processor unit with a. shift to the right, where the controller sets the lowest order output bit, and cyclically reads the output to the input and turns on from the input to the output until the lowest order output bit is reset, which controller further records the number of cycles used to provide corresponding clamp test word, and that the control words supplied by the central processor unit are additionally based on the clamp test word. 6. Device as claimed in claim 5, characterized in that the central processor unit is provided with a number of address output terminals and with a number of command output terminals, wherein selected groups of the address and command output terminals are supplied with respective address and command words and each of 800047J The output terminals contain a predetermined number of identity bits in addition to the address and command bits, respectively. are reserved for the address words and the command words, that a number of fault-proof relays 5 are present, each of which is provided with a number of contacts, each of which is connected to the address and command bits of the output terminals, one relay per bit, and that further a release means is provided for enabling operation of only the relays associated with 10 selected groups of the address and command output terminals in dependence on the keyboard commands, the relays associated with the selected terminals being operated only in the presence of the validity signal . 7. Device according to claim 6, characterized in that it further comprises means for supplying a clamping word based on at least the output and identity of each of the image, address and command output terminals by means of a cyclic redundancy check, wherein a series of current of clamping bits from each of the output terminals is divided by a selected polynomial, which terminal sign word corresponds to the rest of the division, and that the control words supplied by the central processor unit are additionally based on the terminal sign word. 8. Device according to claim 7, characterized in that the display element comprises a means for supplying an execution word, based on a visual verification by an operator, that the displayed image output words actually correspond to the manually selected keyboard commands which execution word enables execution of the selected command operation, and that the control words supplied by the central processor unit are additionally based on the execution word. 9. Device according to claim 8, characterized in that it further comprises a bundling 8000473. Means for bundling selected address and command output terminals of the central processor unit and selected bits of each selected terminal, which bundling means includes a main terminal relay connected to each of the selected address and command bits one relay per bit of a selected bundled output terminal, which main terminal relays each comprise a number of contacts, which are connected on one side to a first signal and on their other side respectively. connected to an associated relay, which operates only in the case that the respective output terminal of the central processor unit is selected and only if the validity signal has been supplied, each main terminal relay further comprising a reverse contact, which is in series 15 are switched with the back contacts of the other main terminal relays to provide a main terminal relay back control signal, and that the control words supplied by the central processor unit are additionally based on the main terminal relay back signal. 20 10. Fail-safe digital controller for powering at least one output member with keyboard inputs in response to a manually operated keyboard selection of a predetermined number of edit commands, characterized in that it consists of a keyboard encoder for providing the editing commands in a format, defined by successive pairs of several multi-digit keyboard words, each pair of several keyboard words separated by a constant multi-bit picture sequence, from a fail-safe encoder coupled to the keyboard encoder, to identify each pair of keyboard words of the picture sequence and for supplying various message and copy words, various output words and various picture words, based on keyboard words from a display, which is coupled to the decoder, for displaying a representation of the picture word and, which decoder comprises an element 8000473 v *. - 41 - for supplying a picture echo word, based on the picture words, from a means for supplying various output sign words, based on the output words, from a memory for storing a table 5 of control normalization words to be used in the formulation of pairs of various multi-bit control words, from a means for supplying various error-seeking sign words, based on the normalization words, stored in the memory, from a means for repeating pairs of different control words, based on at least partly predetermined arithmetic combinations of the various message copy words, the image echo words, the output characters and the error-seeking characters, from a means 15 for comparing successive pairs of control words to determine that successive of the pairs are different and equal to a predetermined constant multi-bit pattern, from a organ vo or providing a validity signal based on a determination by the comparator that the control words are different and equal to the constant multi-bit pattern, and a means for energizing the at least one output member in accordance with the keyboard command only in the presence of the validity signal. 11. Device as claimed in claim 10, comprising a number of output means, characterized in that each keyboard command contains address commands for selecting certain output means to be operated, as well as other commands for identifying a specific operation to be performed by the selected output means, and an execution command to perform and begin a particular operation, and that the trouble-free decoded means 35 further comprises means for forming different address message and copy words, different command message and copy words, different address words and various command output words, 8000473 .. - - 42 - based on the address keyboard words and command keyboard words, provided by the decoder in response to the address and command commands, from an execution word forming means, 5 based on the execution assignment, and to which resp. the image words, address output words and command output words are applied, from an image echo input terminal, from an address echo input terminal and command echo input terminal, from an isolator for coupling the image output terminal, the address output terminal and the command output terminal with resp. the image echo input terminal, the address echo input terminal and the command echo input terminal with a predetermined bit shift, from a means for setting to the lowest order output bit in the image, address and command output terminals and respectively cyclically reading the output to the input and writing from the input to the output until the lowest order output bit of each output terminal is reset, which decoder 20 further registers the number of cycles used to provide corresponding clamp test words, and the different control words additionally based on arithmetic combinations of the image, address and command terminal test words and the execution command. 12. Apparatus according to claim 11, characterized in that the fault-finding means further comprises a first cyclic redundancy checker for forming a first series of information flow based on the normalization words and for dividing the first series of information flow through predetermined polynomials to provide unambiguous residues, which are used as error-seeking characters. 13. Device as claimed in claim 12, characterized in that the means for supplying the different output characters consists of a second cyclic redundancy controller for supplying a number of second series of information flows, 800047j. . Based on the address output words and the commander transition words and for dividing the second series of information streams by using the predetermined polynomials to provide unambiguous residues as output signatures. 14. Device according to claim 13, characterized in that the different address message and copy words and the different command message and copy words are constituted by pairs of complementary words, in which the ones and zeros are inverted, and that the member for supplying the control words, comprises a means for forming a true address control word based on at least in part the sum of the error-seeking character word, the address message word, the address output terminal test word, the execution word, a first address output terminal word, based on cyclic redundancy division of the address output word by a first polynomial and a normalization word, derived from the memory using the address image echo word as a memory table lookup address, from a means for forming a copy address check word based on at least in part the sum of the filed fault-seeking sign, the image clamp test word, the address copy view rd, and different address output terminal word, based on cyclic redundancy division of the address output word by a second polynomial different from the first polynomial, the execution word and a normalization word derived from the memory using the address copy word as the memory table lookup address from a means for forming a true command control word based on at least in part the sum of the true address control word, the command word, the command output terminal test word, a command output word based on cyclic redundancy division of the command output word by a third polynomial, the execution word and a normalization word derived from the memory by using the command image echo word as memory 8000473. - 44 - table lookup address, and a copier command control word forming means based on at least in part the sum of the copy address word, the command copy word, the command image clamp test word, a 5 different command output terminal sign, based on cyclic redundancy division of the command output word by a fourth polynomial , which differs from the third polynomial, the execution word, and the normalization word obtained from the memory by using the command copy word 10 as the memory table lookup address, the true and copy command words being multi-digit complementary words containing inverted ones and zeros. 15. Device as claimed in claim 14, characterized in that the central processor unit 15 is provided with a number of address output terminals and with a number of command output terminals, wherein selected groups of the address and command output terminals are supplied with respective address and command address words, each of which output terminals contain a predetermined number of identity bits in addition to addresses command bits, respectively. reserved for the address words and command words, which identity bits are contained in the series of information flows, supplied by the second cyclic redundancy controller, which comprise a number of fail-safe relays, each comprising a predetermined number of contacts connected to the address and command bits of the output terminals, namely one relay per bit, from a means for releasing the operation of only the relays belonging to selected groups of the address and command output terminals depending on the keyboard words of the keyboard encoder, the both selected terminals belonging relays are only operated in the presence of the validity signal. 16. Apparatus according to claim 15, characterized in that it further comprises an 8009473 * 45 means for bundling the output to selected address and command terminals of the central processor unit and selected bits of each selected terminal, which bundling means includes a main terminal relay connected to each selected address and command bit, viz. one relay per bit, of a selected bundled output terminal, which main terminal relays each comprise a number of contacts, each of which is connected on one side to a first signal and on the other side 10 and 10 respectively. are connected to an address or command relay, which operates only in the case that the respective output terminal of the central processor unit has been selected and a validity signal has been supplied, which main terminal relays each further comprise a back contact, which is connected in series with the back contacts of the remaining main terminal relays to provide a main terminal relay back control signal, and that the control words supplied by the central processor unit are additionally based on the main terminal relay check back signal. 8000473