USSI Microlok II Functional description
Page 20 of 27 July 2005 UM-6800A Rev1.3
states, processing user inputs received from laptop PC or the CPU board
front panel, continuous internal and external diagnostics, recording and
playback of routine event and error codes, management of serial data ports,
and execution of the user developed application program software.
6.1.2. APPLICATION SOFTWARE
The Vital application program software contains the user-developed,
application-specific logic for the particular Microlok II system configuration.
The user develops the unique application program using software using the
same US&S developed maintenance tools program used to input Executive
software version upgrades. Additionally, site-specific configuration data is
stored in the Cardfile-mounted EEPROM, and can be loaded using the CPU
board front panel toggle switches and LED Displays. This data can be also
loaded using the Maintenance tools program on a laptop PC via connection to
the CPU board front panel serial port, the PC based method allows a grater
range of configuration options.
7.1. MICROLOK II VITAL DIAGNOSTICS
The processor activities performing vital interlocking operations are
monitored by internal diagnostics available within the Executive software
that is continuously executed and controlled from the CPU board in order to
detect and act upon various fault conditions. Microlok II uses diversity and
self-checking concepts in which critical operations are performed in diverse
ways using diverse software operations, and hardware is tested with self-
checking operations. Permissive outputs are allowed only if the results of
diverse logic operations correspond, and the self-checks reveal no failures.
Any failure in any critical portion of the equipment results in the controlled
system returning to the safe state. As discussed previously, vital software
diagnostics managed by the CPU board play a key role in the fail safe
operations of the Microlok II system in one particular significant respect, i.e.
control of power to vital outputs through the CPS on the power supply board
and the VCOR. Specifically , for the CPS to provide power to the VCOR and
vital outputs, it must continuously receive a 250Hz signal from the CPU
board. However, certain diagnostics tests must be passed before the
processor will generate this frequency. If the CPU detects an error, or is
simply unable to do anything, this 250Hz signal will no longer be generated.
Once the 250Hz signal is no longer received by CPS, the DC power supply is
no longer applied to the VCOR coil, thereby opening the contacts that provide
power to the vital output boards. In short, this failsafe function causes the
output systems controlled by Microlok II to go to most restrictive state.
