JPH10340101A - Fail safe output device - Google Patents

Abstract

(57) [Problem] To provide a fail-safe output device having a fail-safe property for each control signal of a triple system without requiring a complicated circuit configuration. SOLUTION: A control signal input circuit 5 sequentially inputs control signals from respective systems of a triple system with a predetermined delay time, and a majority decision output circuit 6 outputs two of the three system control signals.
When the control signals of the system coincide, a control command signal to the control device 2 is output, and the signal detection circuit 8 detects the presence or absence of the control command signal. The failure detection circuit 11 detects a failure of the majority output circuit 6 based on the detection signal of the signal detection circuit 8 and the input state of the control signal to the control signal input circuit 5.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a fail-safe output device that receives a control signal from a triple system and outputs a control command signal to a control device based on a majority rule.

[0002]

2. Description of the Related Art For example, as an interface device for a multiplex system, there is a fail-safe output device 1 as shown in FIG. This means that control signals from the three systems of the A system, the B system, and the C system are input, and a control command signal is sent to the control device 2 when two of the three control signals match. This is to output.

[0003] Whether the two control signals match is determined by the majority decision unit 3. The majority decision unit 3 has three matching circuits, a matching circuit for determining the match of the A system and the B system, a matching circuit for determining the match of the B system and the C system, and a matching circuit for determining the match of the C system and the A system. Circuit. Each matching circuit is composed of two 3-input AND logic elements,
Only when the outputs of the two AND logic elements match, a control command signal is output to the control device 2 via the fail-safe relay driver 4. That is, even if one of the AND logic elements fails, the other AND logic element does not output an erroneous signal.

When the fail-safe relay driver 4 is out of order, it does not output a control command signal, and has a fail-safe function so that the control device 2 does not malfunction.

As described above, the fail-safe output device is
The majority decision section 3 has a circuit configuration in which a total of six 3-input AND logic elements and a fail-safe relay driver 4 are combined in a complicated manner.

[0006]

However, in such a conventional fail-safe output device, a plurality of AND logic elements and fail-safe relays are provided in order to provide a fail-safe property to a control signal of a triple system. A circuit configuration in which drivers and the like are combined in a complicated manner is required.

An object of the present invention is to provide a fail-safe output device having a fail-safe property for each control signal of a triple system without requiring a complicated circuit configuration.

[0008]

According to a first aspect of the present invention, there is provided a control signal input circuit for sequentially delaying and inputting control signals of respective systems from a triple system, and a control signal input circuit for controlling signals from the triple system. A majority output circuit that outputs a control command signal to a control device when the control signals of any two systems match, a signal detection circuit that detects the presence or absence of a control command signal from the majority output circuit, and a control signal input circuit And a failure detection circuit that detects a failure of the majority circuit by comparing the input state of the control signal of each system to the control command signal detected by the signal detection circuit.

According to the first aspect of the present invention, the control signal input circuit sequentially inputs control signals from the respective systems of the triple system with a predetermined delay time, and the majority output circuit outputs two of the three control signals. When the control signals match, a control command signal to the control device is output, and the presence or absence of the control command signal is detected by a signal detection circuit. The failure detection circuit detects a failure of the majority output circuit based on the detection signal of the signal detection circuit and the input state of the control signal to the control signal input circuit.

According to a second aspect of the present invention, in the first aspect of the present invention, the control signal input circuit sequentially delays the control signal of each system from the triple system to three control relays corresponding to each system. The majority output circuit is constituted by connecting in parallel three judgment circuits in which the contacts of the two control relays are connected in series by a combination of two control relays among the three control relays. A control command signal is output to the control device when both of the series contacts in any one of the three determination circuits are closed, and the signal detection circuit outputs when both of the series contacts of the determination circuit are closed. Each current detector detects the current flowing through the circuit and individually detects the control command signal of each determination circuit.The failure detection circuit determines the input state of each system control signal to each control relay and the signal detection circuit. Each detected individually It compares the control command signal of the decision circuit of is obtained to detect the closing failure of the contacts of the respective control relay.

According to the invention of claim 2, in addition to the operation of the invention of claim 1, each control relay of the control signal input circuit inputs a corresponding control signal with a predetermined delay time, and each control relay The operation is performed with a delay from each other by a delay time according to the input control signal. The decision circuit of the majority output circuit outputs a control command signal when two of the control relays operate, and the signal detection circuit individually detects the control command signal of each decision circuit. The failure detection circuit detects a failure of the majority output circuit based on a control command signal for each determination circuit detected by the signal detection circuit and an operation state of each control relay.

A third aspect of the present invention provides a control signal input circuit for simultaneously inputting control signals of respective systems from a triple system,
A contact that opens and closes in response to a control signal from the triple system is provided. When the control signal of any two of the control signals from the triple system matches from the state of this contact, the control device is controlled. A majority output circuit that outputs a command signal, a readback circuit that operates in conjunction with the contacts of the majority output circuit, and a comparison between the input state of each system control signal to the control signal input circuit and the operation state of the readback circuit And a failure detection circuit for detecting a failure of the majority circuit.

According to the third aspect of the present invention, control signals from the respective systems of the triple system are simultaneously input by the control signal input circuit, and the majority output circuit matches the control signals of two of the three system control signals. Sometimes, a control command signal to the control device is output, and the contact output signal of the majority output circuit is detected by the readback circuit. The failure detection circuit detects a failure of the majority output circuit based on the output signal of the majority output circuit input from the readback circuit and the operation state of the control signal input circuit.

According to a fourth aspect of the present invention, in the third aspect of the invention, the control signal input circuit inputs a control signal of each system from the triple system to three control relays corresponding to each system. The majority output circuit has three control relay contacts as contacts, and three determination circuits in which the two control relay contacts are connected in series by a combination of two of these contacts are connected in parallel. When both of the series contacts in one of the three determination circuits are closed, a control command signal is output to the control device, and the read-back circuit controls each of the control circuits constituting the determination circuit. Equipped with contacts that open and close in conjunction with multiple relay contacts, the fault detection circuit compares the control signal input status of each system to the control signal input circuit with the contact open / close status from the readback circuit. Contact It is obtained so as to detect the closing failure.

According to a fourth aspect of the present invention, in addition to the operation of the third aspect of the invention, each control relay of the control signal input circuit inputs a corresponding control signal, and each control relay operates according to the input of the control signal. . The decision circuit of the majority output circuit outputs a control command signal when two of the control relays operate, and the contact of the readback circuit is connected to a plurality of contacts of each control relay constituting the decision circuit. It opens and closes in conjunction. The failure detection circuit detects a contact closing failure of the majority decision output circuit based on the input state of the control signal of each system to the control signal input circuit and the switching operation state of the contact input from the readback circuit.

According to a fifth aspect of the present invention, in the third aspect, a signal detection circuit for detecting the presence or absence of a control command signal from the majority output circuit is provided.

According to a fifth aspect of the present invention, in addition to the function of the third aspect of the present invention, the presence or absence of a control command signal is detected by a signal detection circuit. The failure of the majority output circuit is detected based on the output signal of the majority output circuit from the readback circuit and the operation state of the control signal input circuit, and the failure of the control device is detected based on the control command signal from the signal detection circuit.

[0018]

Embodiments of the present invention will be described below. FIG. 1 is a configuration diagram showing a first embodiment of the present invention. The control signal input circuit 5 is for inputting control signals from the respective systems of the triple system, and corresponding to the control signals of the respective systems of the A, B and C systems, the control relay R
A, RB, and RC are provided. Majority decision output circuit 6
Outputs a control command signal to the control device 2 when the control signals of the two systems coincide with each other among the three system control signals, and is constituted by relay contacts of control relays RA, RB, and RC.

That is, three control relays RA, RB,
Combination of two control relays of RC, 2
It is configured by connecting three determination circuits in which the contacts of the control relays are connected in series. That is, the control relay RA
Has two contacts RA1, RA2, likewise, the control relay RB has two contacts RB1, RB2, and the control relay RC has two contacts RC1, RC2. The first determination circuit is configured by connecting a contact RA1 of the control relay RA and a contact RB1 of the control relay RB in series.
The second judgment circuit is constituted by a series connection of a contact RB2 of the control relay RB and a contact RC1 of the control relay RC, and the third judgment circuit is constituted by a contact RC2 of the control relay RC and a control relay R
It is configured in series with the A contact RA2.

Each of the decision circuits of the majority output circuit 6 is supplied with power from the control power supply 7 and when both of the series contacts in one of the three decision circuits are closed, A control command signal is output to the control device 2.

The signal detection circuit 8 detects a current flowing when both of the series contacts of each determination circuit are closed by the respective current detectors CT1, CT2, and CT3.
The presence or absence of a control command signal of each determination circuit is individually detected. Then, the failure detection circuit 11 compares the presence or absence of the control command signal individually detected by the signal detection circuit 8 with the control signal to each system input to the control signal input circuit 5 and determines whether the majority output circuit 6 has failed. Is to be detected.

FIG. 2 is a time chart showing the operation of the first embodiment. As shown in FIG. 2, control signals from the respective systems of the triple system are sequentially input to the control signal input circuit 5 with a predetermined delay time. The A-system control signal becomes "1" at a timing t1, the B-system control signal becomes "1" at a timing t2 after a predetermined delay time from the input of the A-system control signal. Is a timing t after a predetermined delay time from the input of the B-system control signal.
The control signal which becomes “1” at 3 is input.

Since these control signals have the same output time, when the A-system control signal becomes "0" at timing t4, the B-system control signal becomes "0" for the A-system control signal. , Becomes “0” at a timing t5 after a predetermined delay time, and similarly, the C-system control signal becomes “0” at a timing t6 after a predetermined delay time after the B-system control signal becomes “0”.

When such control signals of the respective systems are inputted to the majority output circuit 6, the control relays RA, RB, R of the respective systems are transmitted.
C operate with delay. Therefore, each determination circuit outputs a control command signal in a state where the two contacts connected in series are operating simultaneously by the operation of each control relay RA, RB, RC. Therefore,
For the control device 2, the first determination circuit (RA1, RB
1) The logical sum from the second determination circuit (RB2, RC1) and the third determination circuit (RC2, RA1) is output as a control command output.

The signal detection circuit 8 includes current detectors CT1, C
As shown in FIG. 2, the currents (control command signals) flowing through the respective determination circuits are individually detected by T2 and CT3.

The failure detection circuit 11 detects a failure of the majority output circuit 6 based on the detection signal of the signal detection circuit 8 and the input state of the control signal to the control signal input circuit 5. That is, as shown in FIG. 2, if a current is detected in a portion of a broken line where current does not flow unless the two contacts of the determination circuit are simultaneously turned on, it is detected as an ON-side failure of the contact of the control relay. For example, if a current is detected in the region S1 in FIG. 2, it is a failure of the contact RB1 of the control relay RB, and
If the current is detected at 2, the contact RA1 of the control relay RA is faulty. Similarly, the contact point RC1 of the control relay RC fails in the region S3, and the contact point RB of the control relay RB in the region S4.
2, the area S5 is a failure of the contact RC2 of the control relay RC, and the area S6 is a failure of the contact RA2 of the control relay RA. By such a determination, the control relays RA, R
B, Failure on the RC fail-out side is detected.

According to the first embodiment, with a simple circuit configuration of the control relay and the current detector CT, the majority of the control signals of the triple system are output and the control relays of the respective systems are turned on. Side faults can also be detected.

Next, a second embodiment of the present invention will be described. FIG. 3 is a configuration diagram showing a second embodiment of the present invention. The second embodiment is different from the first embodiment shown in FIG. 1 in that control signals of respective systems are simultaneously inputted to a control signal input circuit 5 and a signal detection circuit 8 is used instead of the signal detection circuit 8. And a read-back circuit 9 for monitoring the operating state of the contacts of the majority output circuit 6.

In FIG. 3, the control signal input circuit 5
Control signals from each system of the heavy system are input, and control relays RA, RB, and RC are provided corresponding to the control signals of the A system, the B system, and the C system, respectively.
The majority decision output circuit 6 outputs a control command signal to the control device when the control signals of the two systems coincide with each other among the three control signals, and is constituted by relay contacts of the control relays RA, RB, and RC. ing.

The majority output circuit 6 is a combination of two control relays among three control relays RA, RB, and RC.
It is configured by connecting the determination circuits in parallel. The first determination circuit includes a contact RA1 of the control relay RA and a control relay RB.
Similarly, the second determination circuit includes a contact RB2 of the control relay RB and a control relay R
The third determination circuit is configured by a series connection of a contact RC2 of the control relay RC and a contact RA2 of the control relay RA. Power is supplied to each determination circuit of the majority decision output circuit 6 from the control power supply 7, and when both of the series contacts in one of the three determination circuits are closed, the control device is connected to the control device. Outputs a control command signal.

The read-back circuit 9 includes a majority output circuit 6
The operation state of the contact is monitored, and has a contact that opens and closes in conjunction with a plurality of contacts of each control relay constituting the determination circuit. That is, a contact RA3 that opens and closes in conjunction with the two contacts RA1 and RA2 of the control relay RA,
A contact RB3 that opens and closes in conjunction with the two contacts RB1 and RB2 of the control relay RB, and two contacts RC of the control relay RC
1, has a contact RC3 that opens and closes in conjunction with RC2, and one of the contacts constituting the determination circuit of the majority decision output circuit 6 is O
When in the N state (closed), the failure detection circuit 11
To be entered.

FIG. 4 is a time chart showing the operation of the second embodiment shown in FIG. Control signal input circuit 5
, Control signals that become “1” at timing t1 and “0” at timing t2 are simultaneously input to the respective control relays RA, RB, and RC. The control relays RA, RB, RC operate when a control signal is input.

The majority output circuit 6 outputs a control command signal to the control device 2 when a control signal of the 2 system out of the control signals of the 3 system is input. Further, the readback circuit 9 outputs to the failure detection circuit 11 contacts that are linked to the plurality of contacts of the control relays of each system as readback outputs.

Here, the control relays RA, RB, RC are:
When one contact is welded and fixed to the ON (closed) side, the other sound contact is also fixed to the ON (closed) side, or at least a relay having a structure that does not become the OFF (open) side is used. Accordingly, when the relay contact of the majority output circuit 6 has a failure on the ON side, the contact is linked and the contact of the readback circuit 9 is turned on, so that a failure on the fail-out side of the control relay can be detected. Become.

For example, when the contact RA1 of the majority decision output circuit 6 in FIG. 3 fails on the ON side due to welding or the like, the contact RA3 of the readback circuit 9 is also fixed to the ON side in conjunction with the contact RA1. Therefore, even if the output of the A-system control signal is absent, the A-system readback output is established even at the broken line portion in FIG.
Can be detected as an ON-side failure of the contact of the A-system control relay RA by detecting this.

In the second embodiment, the majority output of the triple system is performed, and the output of the control relay of each system is controlled.
An N-side fault can also be detected.

Next, a third embodiment of the present invention will be described. FIG. 5 is a configuration diagram showing a third embodiment of the present invention. In the third embodiment, a signal detection circuit 10 for detecting the presence or absence of a control command signal from the majority output circuit 6 is added to the second embodiment shown in FIG. . The signal detection circuit 10 has a current detector CT for detecting the presence or absence of a control command signal from the majority output circuit 6 with a current. The other components are the same as those of the second embodiment shown in FIG. 3, and therefore, the same components are denoted by the same reference characters and description thereof will be omitted.

FIG. 6 is a time chart showing the operation of the third embodiment. Control signals that become “1” at timing t1 and “0” at timing t2 are input to the respective control relays RA, RB, and RC of the control signal input circuit 5 from the respective systems of the triple system. . The control relays RA, RB, RC operate when a control signal is input.

The majority output circuit 6 outputs a control command signal to the control device 2 when a control signal of the 2 system out of the 3 control signals is input. Further, the readback circuit 9 outputs to the failure detection circuit 11 contacts that are linked to the plurality of contacts of the control relays of each system as readback outputs.

Thus, when the relay contact of the majority output circuit 6 fails on the ON side, the contact of the relay contact turns on and the contact of the readback circuit 9 turns on.
1 can detect a failure on the fail-out side of the control relay. For example, if the contact RA1 in FIG. 5 fails on the ON side due to welding or the like, the contact RA3 is also fixed to the ON side, so that the A-system readback output is detected at the broken line portion in FIG. Thereby, the failure of the control relay of the A system is detected.

On the other hand, the signal detection circuit 10 detects an output signal current from the majority output circuit 6. That is, the failure detection circuit 11 can detect a relay failure on the control device 2 side or a failure when the control line is disconnected by detecting that the current, which is the output signal of the majority output circuit 6, stops flowing.

As described above, in the third embodiment, not only the control relay of each system but also the failure of the control device 2 can be detected while performing the majority output of the triple system.

[0043]

As described above, according to the present invention, it is possible to perform a majority decision output of a triple system with a simple circuit configuration and detect a failure of a control relay or a control device of each system. A fail-safe output device capable of performing the above-described operation can be obtained.

[Brief description of the drawings]

FIG. 1 is a configuration diagram showing a first embodiment of the present invention.

FIG. 2 is a time chart illustrating an operation of the first exemplary embodiment of the present invention.

FIG. 3 is a configuration diagram showing a second embodiment of the present invention.

FIG. 4 is a time chart illustrating an operation of the second exemplary embodiment of the present invention.

FIG. 5 is a configuration diagram showing a third embodiment of the present invention.

FIG. 6 is a time chart illustrating an operation of the third exemplary embodiment of the present invention.

FIG. 7 is a configuration diagram of a conventional example.

[Explanation of symbols]

 REFERENCE SIGNS LIST 1 fail-safe output device 2 control device 3 majority decision unit 4 fail-safe relay driver 5 control signal input circuit 6 majority decision output circuit 7 control power supply 8 signal detection circuit 9 readback circuit 10 signal detection circuit 11 failure detection circuit

 ──────────────────────────────────────────────────続 き Continuing on the front page (72) Inventor Akio Inada 1 Toshiba-cho, Fuchu-shi, Tokyo Inside the Fuchu factory, Toshiba Corporation

Claims (5)

[Claims] 1. A control signal input circuit for sequentially delaying and inputting control signals of respective systems from a triple system and a control signal of any two of the control signals from the triple system. A majority output circuit that outputs a control command signal to a control device when they match, a signal detection circuit that detects the presence or absence of a control command signal from the majority output circuit, and a control signal input to the control signal input circuit. A fail-safe output device comprising: a failure detection circuit that compares an input state with a control command signal detected by the signal detection circuit to detect a failure in the majority circuit. 2. The control signal input circuit delays and inputs control signals of each system from the triple system to three control relays corresponding to each system, and the majority output circuit A combination of two control relays of the three control relays, wherein three determination circuits in which the contacts of the two control relays are connected in series are connected in parallel. A control command signal is output to the control device when both of the series contacts in one of the determination circuits are closed, and the signal detection circuit detects a current flowing when both of the series contacts of the determination circuit are closed. Each of the current detectors individually detects the control command signal of each of the determination circuits, and the failure detection circuit detects an input state of a control signal of each system to each of the control relays and the signal detection. Individual circuit 2. The fail-safe output device according to claim 1, wherein the control command signal of each of the determination circuits is compared to detect a closing failure of a contact of each of the control relays. 3. A control signal input circuit for simultaneously inputting control signals of respective systems from a triple system, and a contact which opens and closes in response to a control signal from the triple system. A majority output circuit for outputting a control command signal to a control device when the control signals of any two of the control signals from the triple system match, a readback circuit operating in conjunction with the contact point; A failure detection circuit for comparing the input state of each system control signal to the control signal input circuit and the operation state of the readback circuit to detect a failure of the majority circuit. Safe output device. 4. The control signal input circuit inputs a control signal of each system from the triple system to three control relays corresponding to each system, and the majority output circuit includes:
The above-mentioned three contact points of the control relays are provided as the contact points, and three judgment circuits in which the contact points of the two control relays are connected in series are connected in parallel by a combination of two of the contact points. When both of the series contacts in one of the three determination circuits are closed, the control device outputs a control command signal to the control device, and the readback circuit comprises the determination circuit. A contact that opens and closes in conjunction with a plurality of contacts of the control relay of the control relay. 4. The fail-safe output device according to claim 3, wherein a closing failure of a contact of the control relay is detected in comparison. 5. The fail-safe output device according to claim 3, further comprising a signal detection circuit for detecting the presence or absence of a control command signal from the majority output circuit.