Combining replicated sub-system outputs

Claim 1

A system comprising a plurality of parallel replicated sub-systems the outputs of which are_ combined by a majority voter to provide a single consolidated output and sub-system output coincidence checking mans to assure integrity of the consolidated output, characterised in that the coincidence checking means (10) comprises apparatus (25x, 25 Y , 25 )in each sub-system channel (X, Y, Z) connected to receive the outputs of all channels (5, 6, 7) and arranged to perform a coincidence checking function and to provide an output to operate a fault indicator (X 1 , Y 1 , Z 1 ; X 2 , Y 2 , Z 2 ; X 3 , Y 3 , Z 3 ) in the event of lack of coincidence with the majority, and apparatus (Fig. 3) for combining the fault indications relating to each sub-system (5, 6, 7) to provide a single consolidated output (11, 12, 13) declaring the integrity of each sub-system channel.

Claim 2

A system comprising a plurality of parallel replicated sub-systems the outputs of which are_ combined by a majority voter to provide a single consolidated output and sub-system output coincidence checking mans to assure integrity of the consolidated output, characterised in that the coincidence checking means (10) comprises apparatus (25x, 25 Y , 25 )in each sub-system channel (X, Y, Z) connected to receive the outputs of all channels (5, 6, 7) and arranged to perform a coincidence checking function and to provide an output to operate a fault indicator (X 1 , Y 1 , Z 1 ; X 2 , Y 2 , Z 2 ; X 3 , Y 3 , Z 3 ) in the event of lack of coincidence with the majority, and apparatus (Fig. 3) for combining the fault indications relating to each sub-system (5, 6, 7) to provide a single consolidated output (11, 12, 13) declaring the integrity of each sub-system channel.

Claim 7

A system according to any proceding claim further characterised in that the apparatus in each sub-system channel for performing the coincidence checking function comprises a data memory, data reading means connected to the ' ulpjt of cach replicated sub-system for reading data in said outputs into the memory, data comparison means for comparing data stored in the memory, a plurality of fault jndicators one for each sub-system which are responsive to the data comparison means, and control means for operating said apparatus in a succession of cycles each of which incled the steps of reading the sub-system output into the data memory comparing The sto ' red :ita and registering a fault in a .4 fault dicaior when a sub-system output f.j-i')g to coincide with a Tajority of the remaining sub-system outputs.

Claim 8

A system according to any preceding claim wherein the replicated sub-systems each produce a plurality of outputs which are consolidated by a plurality of : majorify voters for ce nection to a like plurality of control line's forther characteristed in that the fault indicator (X 1 Y 1 , Z 1 ; X 2 , Y 2 , G 2 ; X 3 , Y 3 , z 3 ) cach Y 1 , Z 1 ; X 2 , Y 2 , Z 2 ; X 3 , Y 3 , Z 3 ) in each sub channel is forther connected to be operated by the output of a pulse testing circuit (21 x , 21 Y , 21 z ) wherein said pulse testing circuit 7S connected to inject a test pulse into the sub-system output (22, 23, 24) and is connected to the output majority voter (8) by a feedback connection (34, 35, 36), the testing circuit being arrenged to rempond to the absence of feedLack of iafast pulse O operate the fault indicator.

Claim 9

A system according to any pr ''edi;:g clain farther characterised in that a majority voter (Fig. 4b) includes logic AND gating means (41, 44) for a pair of outputs comprising a first light emitting device (48) connected in a first energising circuit (47, 48, 49), a first terminal (X) in the first energising circuit for receiving a first of the pair of outputs capable of occupying a first state which inhibits energisation of the first light emitting device (48) or an alternative second state which permits energisation of the device, a first light responsive switching device (50) connected in a second energising circuit (Y, 50, 51) for a second light emitting device (51), a second terminal (Y) in the second energising circuit for receiving a second of the pair of outputs also capable of occupying a first state which inhibits energisation of the second light emitting device (51) or an alternative second state which permits energisation of the device, a second light responsive switching device (52) connected to provide an output, and in parallel therewith further second light responsive switching devices of similar logic AND gating means (42, 45; 43, 46) for further pairs (X, Z; Y, Z) of outputs.

Claim 10

A system according to any pr ''edi;:g clain farther characterised in that a majority voter (Fig. 4b) includes logic AND gating means (41, 44) for a pair of outputs comprising a first light emitting device (48) connected in a first energising circuit (47, 48, 49), a first terminal (X) in the first energising circuit for receiving a first of the pair of outputs capable of occupying a first state which inhibits energisation of the first light emitting device (48) or an alternative second state which permits energisation of the device, a first light responsive switching device (50) connected in a second energising circuit (Y, 50, 51) for a second light emitting device (51), a second terminal (Y) in the second energising circuit for receiving a second of the pair of outputs also capable of occupying a first state which inhibits energisation of the second light emitting device (51) or an alternative second state which permits energisation of the device, a second light responsive switching device (52) connected to provide an output, and in parallel therewith further second light responsive switching devices of similar logic AND gating means (42, 45; 43, 46) for further pairs (X, Z; Y, Z) of outputs.

Claim 11

A system according to any preceding claim further characterised in that a majority voter (8) comprises a relay (9) having a plurality of energising coils (27, 28, 29) co-operating with a magnetic circuit arranged so that the relay operates when a majority of the coils (27, 28, 29) are energised.