JPH1039924A - Fail-safe DC digital output circuit - Google Patents

Abstract

(57) [Problem] To provide a fail-safe DC digital output circuit capable of self-determining a failure of an output element and preventing the failure from spreading beforehand. SOLUTION: An output element 1, which is connected in series with a load, between a load driving DC power supply that directly drives the load and a load.
2, and first and second output control circuits 10 and 20 for driving and controlling the output elements 1 and 2, respectively, and an instantaneous interruption pulse generation circuit 28 for instantaneously interrupting the driving output of the output element 2. Provide. First and second comparison circuits 12 and 22 compare output states of output elements 1 and 2 detected by first and second monitor input circuits 16 and 26 with drive outputs of output elements 1 and 2, When the two are different, the self-determination of the failure of the output elements 1 and 2 is performed, and the second comparison circuit 22 directly compares the pulse output of the instantaneous interruption pulse generation circuit 28 with the output state of the output element 2. The self-determination of the short-circuit fault of the output element 2 is made. When it is determined that one of the output elements 1 and 2 has failed, the drive output of both elements is turned off.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a fail-safe DC digital output circuit used as a control circuit for controlling, for example, a railway traffic signal.

[0002]

2. Description of the Related Art For example, when controlling a railway traffic signal, a malfunction of the control can directly cause an accident that threatens human life such as a train collision or derailment. It is desired to keep.

[0003] First, the fail-safe means that an erroneous ON output is not performed due to a malfunction of a circuit or element. This is because the circuit is configured so that the traffic light is turned on to output a red signal indicating train stop at the off output and the green signal is turned on at the on output to allow the train to proceed. 0 "output) and the ON output are defined as dangerous outputs (" 1 "outputs).

Second, failures and malfunctions of circuits and elements are not increased. This is because, for example, in a two-input AND output circuit, a failure or malfunction of one input does not result in a dangerous output ("1" output), but the other input is fixed to a dangerous side ("1" side). If a failure occurs, a failure or malfunction of one input may result in erroneous output of the dangerous output, and the first fail-safe property may not be maintained.

By the way, in signal control, a device having directionality, such as a point machine, is often controlled, and a direct current control capable of controlling a direction by a current direction is mainstream, but there is no change at all times. In the on / off control of the DC voltage, it is difficult to prevent the failure of a circuit or an element from expanding, which is the second fail-safe property. Therefore, a rectification output (DC output) circuit based on an AC input, which in principle is unlikely to cause a failure to occur or expand on the dangerous side as shown in FIG. 5, has been conventionally used as a control circuit for a railway traffic signal. I have.

In the circuit shown in FIG. 1, reference numeral 3 denotes a coupling transformer, which obtains a secondary AC voltage equivalent to a specified DC output voltage from the primary-side AC voltage input by AC coupling. . Then, the secondary AC voltage is rectified by the bridge rectifier circuit 4 to obtain a full-wave rectified waveform (pulsating current), and a DC output is obtained from the pulsating current by the smoothing capacitor 6.

In such a circuit, when the coupling transformer 3 is disconnected, the bridge rectifier circuit 4 has no output, or the smoothing capacitor 6 is short-circuited, regardless of the presence or absence of the AC input, In either case, a DC output cannot be obtained, and in such a case, a dangerous output cannot be obtained.

Further, when the bridge rectifier circuit 4 has a half-wave output, a specified DC voltage output cannot be obtained, and when the bridge rectifier circuit 4 has an AC output, the DC load cannot be operated in practice. It is not a side output.

In recent years, signal equipment control has been shifting from conventional relay sequence circuit control to control by a digital controller equipped with a CPU due to land shortage and cost reduction requirements. When such a fail-safe output circuit is used, in an oscillation circuit provided for obtaining an AC signal, it is difficult to secure fail-safe characteristics due to an oscillation circuit failure (uncontrolled oscillation state). The waveform shown in FIG. 6 is output by digital processing, and is used as an input signal of the circuit of FIG. 5 as a pseudo AC signal.

[0010]

However, each of these systems supplies AC power or pseudo AC power to an input terminal with sufficient power to drive a load connected to an output terminal. For this reason, unnecessary heat is generated, and the circuit must be configured with power elements that can sufficiently withstand power supply, making it difficult to reduce the size and cost of the circuit itself.

Further, when the above-described circuit is used in a digital control device, a pseudo-AC power is not directly output by a DC power supply for a control device due to a problem of a power supply voltage, a power supply capacity, and noise generation. In general, a DC power supply for driving the load is prepared, and the DC voltage is turned on / off to obtain a pseudo AC waveform. However, when a method of preparing a DC power supply for driving the load separately from the apparatus power supply and obtaining a pseudo AC waveform is used, when the load is directly driven by the DC power supply for driving the load as shown in FIG. This is much less efficient than that of, and has been an obstacle to miniaturization and power saving of the entire device.

Therefore, if a DC voltage on / off control circuit having a DC power supply for driving a load as shown in FIG. 7 is employed as a control circuit for a railway signal device, the above-mentioned problem can be solved and the entire apparatus can be solved. Although it is considered that downsizing, power saving, and cost reduction can be achieved, this DC voltage on / off control circuit is difficult to secure fail-safe characteristics as described above, and the signal device control circuit Could not be used.

The circuit configuration of each circuit shown in FIG. 7 and the situation where it is difficult to ensure fail-safeness in each circuit will be described below. First, (a) and (c) of the figure are the simplest circuits as a DC voltage on / off control circuit. In each case, a relay, a MOS-FET or the like is provided between the load driving DC power supply and the load. Is a single circuit provided with one output element 1. 1A uses a voltage detection circuit 41 for detecting a voltage as a detection circuit for detecting a failure of the output element 1, and the voltage detection circuit 41 is connected in parallel with a load. In (c), the current detection circuit 51 is used for detecting the current of the output element 1 by the detection circuit, and the current detection circuit 51 is connected in series with the load. In such a single circuit, when the output element 1 has a short-circuit failure or a short-circuit malfunction, the output becomes a dangerous output, and even the first fail-safe property cannot be ensured.

The circuit shown in FIG. 1B is an output element serial multiplexing circuit formed by connecting output elements 1 and 2 in series between a DC power supply and a load. , 2
Are respectively connected in parallel with the load. This circuit is shown in FIG.
Are formed in series and doubly connected to each other to form an AND output circuit. Table 1 summarizes the operating state and the detecting state of each part in this circuit.

[0015]

[Table 1]

In Table 1, the output data is an output control value for output element 1 and output element 2;
ON indicates a dangerous output, and OFF indicates a safe output. The element states of the output elements 1 and 2 indicate an operation state including a malfunction of the output elements 1 and 2 and a failure state (failure mode). The column of the voltage detection circuits 41 and 42 shows the DC voltage detected by each of the voltage detection circuits 41 and 42. The voltage is ON when there is a voltage and OFF when there is no voltage. The column of output element failure detection indicates whether failure of each of the output elements 1 and 2 can be detected. As shown in the table, in principle, the output data (output control value) and each of the output elements 1 and 2 are output. Voltage detection circuit corresponding to
If the values of 41 and 42 match, detection is impossible, and if they are different, detection is possible. The load column indicates the operation state of the load,
On-operation is on operation, that is, dangerous operation.

As is apparent from Table 1, the circuit shown in FIG. 7B does not satisfy the first fail-safe property, that is, the dangerous output due to the failure or malfunction of the output elements 1 and 2. (Load ON) is b1, d1, e1, and e0 in Table 1. Among them, the truly dangerous output is that the output data and the operating state of the load differ from each other.
0. The state of e0 corresponds to output element 1 and output element 2
Are both short-circuit faults, but considering the failure rate of normal components, it is extremely rare for both elements to be short-circuit faults at the same time.As a result of leaving one element short-circuit fault, It usually leads to a short circuit failure of both elements.
Conversely, if the short-circuit failure of one of the elements is reliably detected and appropriate measures are taken at that time, the expansion of the failure (that is, short-circuit failure of both elements) can be prevented beforehand, and the second failure can be prevented. The safety property is satisfied, and as a result, the first fail-safe property can be secured in the entire circuit.

Therefore, in Table 1, when attention is paid to whether or not a short-circuit failure of the output element 2 can be detected among the states of b1, d1, and e1 leading to e0, which is a truly dangerous state, as shown in Table 1, In the circuit shown in FIG.
Since the short-circuit failure of the output element 2 cannot be detected and the second fail-safe property cannot be secured, the first circuit
Fail-safeness cannot be ensured.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned conventional problems. An object of the present invention is to provide a DC digital output circuit of an output element serial multiplex type for use in, for example, railway signal equipment. To provide a small and inexpensive fail-safe DC digital output circuit that can reliably judge the failure of two output elements and thereby prevent the danger caused by the malfunction of the output elements. It is in.

[0020]

Means for Solving the Problems To achieve the above object, the present invention provides means for solving the problems by the following constitution. That is, the first invention is an output element serial multiplex type DC digital output circuit including a plurality of output elements connected in series with each other between a load driving DC power supply that directly drives a load and a load. Each of the plurality of output elements is provided with an output control circuit for driving and controlling each output element, and the output state of the output element corresponding to the drive output of each output element controlled by the output control circuit. When the drive output of each output element is different from the output state of the corresponding output element by comparing the respective output elements with each other, a comparison / determination circuit for self-determining that the output element is faulty is provided. Is determined, the drive outputs of all the output elements are turned off by the output control circuits.

Further, there is provided an instantaneous pulse change generating circuit for instantaneously changing the drive output of at least one output element for a short period of time, and the comparison / judgment circuit is provided with an output of the output element corresponding to the output of the instantaneous pulse change generating circuit. If the output state does not change due to a change in the driving output of the output element by comparing the output state with the output state, it is also a characteristic feature of the first invention that the output element self-determines that it is faulty. .

Further, the second invention provides an output element serial multiplex type DC digital device having a plurality of output elements connected in series with each other between a load driving DC power supply for directly driving the load and the load. An output circuit, wherein each of the plurality of output elements is provided with an output control circuit for driving and controlling each of the output elements, and an instantaneous pulse change for instantaneously changing a drive output of at least one output element for a short time. A generator circuit is provided, and the output of the instantaneous pulse change generator is compared with the output state of the corresponding output element, and when the output state does not change with the drive output change, the output element fails. Is provided, and when an output element failure is determined by the comparison / determination circuit, the drive outputs of all output elements are controlled by the output control circuits. Is configured as characterized in that a configuration in which full.

Further, it is detected whether or not the power supply voltage supplied from the DC power supply to each output element has reached a predetermined reference voltage value, and when the DC power supply voltage falls below the reference voltage value. A characteristic feature of the first and second inventions is that a power supply voltage monitoring circuit for adding a self-judgment inhibiting signal to the comparison / judgment circuit is provided.

In the first aspect of the present invention, the drive output of each output element controlled by each output control circuit is compared with the output state of the corresponding output element by the comparison / judgment circuit. When the drive output is different from the output state of the corresponding output element, the output element is determined to be faulty. When the failure of the output element is determined by the self-determination, the output of all the output elements is turned off by each output circuit for driving control of each output element.

In the first invention having the above-described structure, the instant pulse change generating circuit is provided. In the second invention having the above-described structure, at least one output element is provided by the instant pulse change generating circuit. When the drive output is instantaneously changed for a short period of time and the output state does not change in accordance with the drive output change in the corresponding output element despite the drive output change, this output element is determined by the comparison and judgment circuit. Is determined to be a failure. When the short-circuit failure of the output element is determined by this self-determination, the output of all the output elements is immediately turned off by each output circuit for driving control of each output element.

As described above, according to the present invention, the comparison and judgment circuit compares the drive output of each output element with the output state of the corresponding output element to determine whether or not each output element has a fault, In the case where the change generation circuit is provided, the drive output of the output element is instantaneously changed by the instantaneous pulse generation circuit as necessary, and the presence / absence of a short-circuit failure of the output element can be determined by the comparison judgment circuit. (1) Since a failure or malfunction of one output element is left as it is, it is possible to prevent a state in which a failure occurs in another output element and the output becomes a dangerous output.

By turning off the outputs of all the output elements when it is determined that the output element has failed, the output of the circuit is prevented from immediately becoming a dangerous output.
It is possible to prevent the failure of one of the output elements from causing an increase in the failure of the circuit and the recurrence of the malfunction, thereby ensuring the fail-safe property of the circuit. In addition, in the present invention, since it is used by being connected to a DC power supply that directly drives a load, the size and cost of the circuit can be reduced, and the above-mentioned problem can be solved.

[0028]

Embodiments of the present invention will be described below with reference to the drawings. In the description of the present embodiment, the same reference numerals are given to the same parts as those in the conventional example, and the overlapping description will be omitted. FIG. 1 shows a fail-safe type DC digital output circuit according to an embodiment of the present invention in a state where a load is omitted. The circuit shown in FIG. 7 is also connected between the load driving DC power supply for directly driving the load and the load, similarly to the conventional DC voltage on / off control circuit shown in FIG. This is a control circuit of an output element series multiplex type (series double type) configured to include output elements 1 and 2 connected in series. This circuit is connected to a DC power supply by a power input terminal and is connected by an output terminal. Connected to the load. In the embodiment, each of the output elements 1 and 2 is formed by an insulated output element such as a relay, a photo MOS-FET, and a photo coupler.

The DC digital output circuit according to the present embodiment includes a power supply voltage monitoring circuit 30, a first monitor input circuit 16,
Second monitor input circuit 26, first output control circuit (latch) 10, first comparison circuit 12, second output control circuit (latch) 20, second comparison circuit 22, instantaneous interruption pulse generation circuit 28 , A backflow prevention diode 34 and a smoothing capacitor 32.

The first output control circuit 10 is a circuit for controlling the driving of the output element 1, and outputs an extremely short pulse signal indicating ON / OFF from the internal output A as shown in FIG. In response, the pulse signal is converted into a state signal as shown in FIG. The internal output A is, for example, an internal control output for the output element 1 in a digital control device equipped with a CPU.

The second output control circuit 20 is a circuit for controlling the driving of the output element 2. The second output control circuit 20 includes a pulse signal from the internal output B similar to the internal output A,
An instantaneous interruption pulse signal from the instantaneous interruption pulse generation circuit 28 is added.

The instantaneous interruption pulse generation circuit 28 functions as an instantaneous pulse change generation circuit for instantaneously changing the drive output of the output element 2 for a short period of time. For example, an instantaneous interruption as shown in FIG. A second output control circuit for generating a pulse
20 and the second comparison circuit 22.

The second output circuit 20 converts the pulse signal from the internal output B into a state signal in the same manner as the first output control circuit 10 and applies it to the output element 2. Since the instantaneous interruption pulse from the instantaneous interruption pulse generation circuit 28 is added to the circuit 20 together with the pulse signal from the internal output B, when the instantaneous interruption pulse is turned off, the internal output B is in the on state. As shown in FIG. 2F, the output of the second output control circuit 20 is also turned off, and this output is applied to the output element 2.

The first monitor input circuit 16 monitors and inputs the output voltage waveform of the output element 1 (for example, (e) of FIG. 2).
This is a circuit for detecting as a load operability state (for example, (i) in FIG. 3), and detects a voltage between the output element 1 and the output element 2 and applies the voltage to the first comparison circuit 12.

The second monitor input circuit 26 monitors and inputs the output voltage waveform of the output element 2 (for example, (g) in FIG. 2).
This is a circuit for detecting as a load operability state (for example, (j) in FIG. 3), the output element 2 and a backflow prevention diode 34.
Is detected and applied to the second comparison circuit 22.

The first comparison circuit 12 compares the drive output of the output element 1 controlled by the output control circuit 10 with the output state of the corresponding output element 1, and based on the comparison result, determines whether the output element 1 It functions as a comparison / judgment circuit for self-judgment of the presence or absence of a failure. The first comparison circuit 12 outputs a control output from the first output control circuit 10 to the output element 1 (for example, (d) in FIG. 2) and an output of the first monitor input circuit 16, that is, whether or not the load can operate. The state (for example, (i) in FIG. 3) is compared, and when the output of the first monitor input circuit 16 does not match the output of the first output control circuit 10,
The self-determination is made that the output element 1 has failed, and the result of this determination is applied to the first output control circuit 10 and the second output control circuit 20.
It should be noted that the determination result once determined to be faulty is held as long as the comparison circuit functions.

The second comparison circuit 22 also functions as a comparison judgment circuit. Similarly to the first comparison circuit 12, the second comparison circuit 22 includes a drive output of the output element 2 controlled by the second output control circuit 20 (a control output for the output element 2) and a corresponding output element 2 The output state of the output element 2 is compared with the output state of the instantaneous interruption pulse generation circuit 28 and the output state of the output element 2 is determined based on the comparison result. When the output state change does not occur in the element 2 due to the occurrence of the instantaneous interruption pulse, it is determined that the output element 2 is short-circuited. That is, the second comparison circuit 22
The output of the second output control circuit 20 (for example, (f) in FIG. 2) and the output of the second monitor input circuit 26 (for example, FIG.
(J)), and when the voltage waveform does not match the control output waveform, the output element 2 performs an operation of determining that it is abnormal. In particular, when the instantaneous interruption pulse is off, the second monitor If the load operation off is not detected by the input circuit 26, the short circuit fault of the output element 2 is immediately detected regardless of the control output state of the output element 2. All of these comparison results are applied to the first and second output control circuits 10 and 20. Further, these comparison results once determined to be faulty are self-held as long as the comparison circuit functions.

The first output control circuit 10 adds the failure judgment result of the output element 1 from the first comparison circuit 12 and the failure judgment result of the output element 2 from the second comparison circuit 22. In any case, the output of the output element 1 is controlled to be off even if the internal output A is on. Further, the second output control circuit 20 also receives the failure judgment result of the output element 2 from the first comparison circuit 12 and the failure judgment result of the output element 2 from the second comparison circuit 22. In some cases, the output of the output element 2 is turned off even when the internal output B is on.

The power supply voltage monitoring circuit 30 constantly detects the power supply voltage supplied to each of the output elements 1 and 2 from the DC power supply for driving the load, and determines whether the power supply voltage has reached a predetermined reference voltage value. If the DC power supply voltage value is lower than the reference voltage value, a self-judgment inhibiting signal is applied to the first and second comparison circuits 12 and 22. The self-judgment inhibiting signal may be, for example, a signal for preventing the first and second comparison circuits 12 and 22 from performing the self-judgment operation, or after performing the self-judgment operation. The signal may be a signal that prevents the result from being applied to the first and second output control circuits 10 and 20.

In this embodiment, the power supply voltage monitoring circuit 30 is provided so as to constantly monitor the DC power supply voltage, so that when the DC power supply stops or the voltage drops below the reference voltage. First and second monitor input circuits 16, 26
Detect that the load operation is off. At this time, the drive output from the first output control circuit 10 and the drive output from the second output control circuit 20 are on, and the first comparison circuit 12 The second comparison circuit 22 prevents a malfunction such as detecting an abnormality of the output element 1 or the output element 2.

The smoothing capacitor 32 is a capacitor for smoothing a voltage. In the circuit shown in FIG. 1, when the output data is on and the output elements 1 and 2 are normal, the operation state of the load is also on. In this state, the instantaneous interruption pulse generation circuit 28 When a disconnection pulse is generated, the output is turned off for the duration of the pulse generation, and the load is also turned off during this time.
The output data and the load operation state may be different. To prevent this, the smoothing capacitor 32 is charged with energy sufficient to make up for the momentary interruption time at the time of ON output, and the energy stored in the smoothing capacitor 32 is momentarily interrupted by the momentary interruption pulse generation circuit 28. By discharging, the ON of the load operation is compensated even when the instantaneous interruption pulse is generated by the instantaneous interruption pulse generation circuit 28.

The backflow prevention diode 34 is for preventing the discharge of the smoothing capacitor 32 from flowing back to the second monitor input circuit 26 side, and is provided between the second monitor input circuit 26 and the smoothing capacitor 32. It is connected in series between them. The backflow prevention diode 34 is provided, and the smoothing capacitor 32 is provided.
Is prevented from flowing back to the second monitor input circuit 26 side, the second monitor input circuit 26 erroneously detects the load operation state as an ON operation by discharging from the smoothing capacitor 32, The second comparison circuit 22 prevents the output element 2 from being erroneously detected.

The present embodiment is configured as described above. The circuit operation when both the output elements 1 and 2 are normal will be described based on the output voltage waveforms of the components shown in FIGS. . First, a power supply voltage from a DC power supply is supplied to the output elements 1 and 2, the output element 1 is driven and controlled by the first output control circuit 10, and the output element 2 is driven and controlled by the second output control circuit 20. . At this time, the power supply voltage monitoring circuit 30 constantly monitors the power supply voltage of the DC power supply. For example, when a power outage of the DC power supply occurs, as shown in FIG. As a result, the power failure is detected, and the output of the power supply voltage monitoring circuit 30 is applied to the first and second comparison circuits 12 and 22.

As described above, the first output control circuit 10 converts the pulse signal shown in FIG. 2A applied from the internal output A into a state signal shown in FIG. Convert and apply to output element 1. Then, the output of the output element 1 becomes Nv when the output of the first output control circuit 10 is turned on, as shown in (e) of FIG. When it becomes 0 due to the power failure, it becomes 0v, and when returning from the power failure, it becomes Nv again,
When the first output control circuit 10 is turned off,
Becomes

On the other hand, as described above, the second output control circuit 22 outputs the signal from the instantaneous interruption pulse generation circuit 28 together with the internal output B.
Since the instantaneous interruption pulse as shown in FIG. 7B is applied together, the waveform has a period (s3 'in the figure) that is momentarily off as shown in FIG. The output element 2 receives the output of the second output control circuit 20 and outputs a voltage having a waveform shown in FIG. That is, when the second output control circuit 20 is turned on, the output of the insulated output element 2 becomes Nv, the output voltage of the output element 2 becomes 0 V due to the power failure of the DC power supply, and when the power failure is restored, the output voltage becomes Nv again. Become. And, unlike the output of the output element 1,
In response to the occurrence of the instantaneous interruption pulse (s3 in the figure), the output of the output element 2 also instantaneously becomes 0v at s3 ″ in the figure. Then, the output of the output element 2 becomes Nv again, and the second When the output of the output control circuit 20 is turned off,
Becomes

FIGS. 3 (i) and 3 (j) respectively show the first
The output of the monitor input circuit 16 and the output of the second monitor input circuit 26 are shown. Each of these monitor input circuits 16,
The first monitor input circuit 16 detects the output voltages of the output elements 1 and 2 as whether or not the load operation is possible (permitted when turned on, and deactivated when turned off). Is turned on when the output is equal to or higher than the operating voltage Mv of the load, and turned off at other times. The output of the second monitor input circuit 26 is M
It is on when v is greater than or equal to v, otherwise it is off. The output of the first monitor input circuit 16 is the first
The output of the second monitor input circuit 26 is applied to the second comparison circuit 22.

The first comparison circuit 12 outputs the output of the first output control circuit 10 shown in FIG. 2D and the output of the first monitor input circuit 16 shown in FIG. When the waveforms do not match, it is determined that a failure (abnormality) of the output element 1 has occurred. In this embodiment, however, the power supply voltage monitoring circuit 30 constantly monitors the power supply voltage of the DC power supply. When the power supply voltage falls below the reference voltage, the first comparison circuit 12 does not perform self-determination.

Therefore, when the output of the first output control circuit 10 shown in FIG. 2D and the output of the first monitor input circuit 16 shown in FIG. 3I are simply compared, Although there is an area where both waveforms do not match, it is clear from the output waveform of the power supply voltage monitoring circuit 30 shown in FIG. 3H that this area is caused by a power failure of the DC power supply. In this power failure region, the self-determination of the failure of the output element 1 by comparing the output of the first output control circuit 10 and the output of the first monitor input circuit 16 is not performed, as shown in FIG. 3 (k). Then, a normal signal of the output element 1 is output and applied to the first and second output control circuits 10 and 20, respectively.

Further, the second comparison circuit 22 is provided as shown in FIG.
The output of the second output control circuit 20 shown in FIG.
Is compared with the output of the second monitor input circuit 26 shown in (1), whereby the self-determination of the failure of the output element 2 is performed.
In this self-determination, as in the self-determination of the failure of the output element 1 by the first comparison circuit 12, the second determination is performed while the power supply voltage monitoring circuit 30 detects the power failure of the DC power supply.
Is not compared with the output of the second monitor input circuit 26, and the output of the second output control circuit 20 and the output of the second monitor input circuit 26 are not compared in other regions. A comparison is made to determine whether the output element 2 has failed.

Since the instantaneous interruption pulse signal from the instantaneous interruption pulse generation circuit 28 is directly applied to the second comparison circuit 22, the second comparison circuit 22 When an instantaneous interruption pulse is off, that is, when s1, s2, and s3 in FIG. 2B are connected to the output of the second monitor input circuit 26 as shown in FIG. Is also off, it is determined that the output element 2 is normal, but despite the instantaneous interruption pulse being off,
When the output of the second monitor input circuit 26 is not turned off, it is immediately determined that the output element 2 is short-circuited regardless of the output of the second output control circuit 20.

In the output waveforms shown in FIGS. 2 and 3, the instantaneous interruption pulse shown in FIG. 2B is compared with the output waveform of the second monitor input circuit 26 shown in FIG. In this case, there is no state where the output of the second monitor input circuit 26 is turned on despite the state of the instantaneous interruption pulse being off, and except for the above-mentioned power failure, the state shown in FIG. Since the output of the second output control circuit 20 shown in FIG. 3F and the output of the second monitor input circuit 26 shown in FIG. 3J match, the waveform shown in FIG. From the second comparison circuit 26, the judgment result that the output element 2 is normal is given by the first comparison circuit 26.
The signals are applied to the second output control circuits 10 and 20, respectively.

Next, the operation when a failure occurs in the output element 2 will be described with reference to FIG. It is assumed that the pulse signal from the internal output B, the instantaneous interruption pulse signal from the instantaneous interruption pulse generation circuit 28, and the DC power supply voltage are in the states shown in FIGS. Suppose that a short-circuit failure of the output element 2 occurs during a power failure of the DC power supply voltage as shown in FIG. Then, the drive output from the second output control circuit 20 is applied to the output element 2 as shown in FIG. 2F, and the instantaneous interruption pulse generation circuit 28 generates the instantaneous interruption pulse (FIG. In s3), the drive output is also turned off (s3 'in the figure), and the output of the output element 2 is naturally 0v (s3 in the figure)
3 "), but when the short-circuit fault occurs, the output of the output element 2 becomes as shown in FIG.
It does not become 0v but remains Nv. Then, the output of the second monitor input circuit 26 for detecting the output of the output element 2 also remains on without being turned off, and the detection result is applied to the second comparison circuit 22.

The second comparison circuit 22 compares the output of the second monitor input circuit 26 with the instantaneous interruption pulse. Even though the instantaneous interruption pulse is off (s3 in FIG. 2), the second comparison circuit 22 (FIG. As shown in (n), since the output of the second monitor input circuit 26 is on (the load operation is on), the short-circuit fault of the output element 2 is immediately judged by itself and the self-judgment result is output to the first output. It is added to the control circuit 10 and the second output control circuit 20. Then, in the first and second output control circuits 10 and 20, the output is turned off to each of the output elements 1 and 2, whereby the circuit is cut off by the output elements 1 and 2. As shown in (n), the load operation is also turned off.

Table 2 shows the circuit operation state of the fail-safe DC digital output circuit of this embodiment and the output elements 1 and 2.
The result of summarizing the failure detection elements of FIG. In addition,
In Table 2, how to display ON and OFF and whether to enable or disable output element failure detection are the same as in Table 1 above.

[0055]

[Table 2]

As is apparent from Table 2, b1 in Table 2
In the states of e1 and e1, that is, when a short-circuit fault of the output element 2 has occurred and the load is turned on and the output is on the dangerous side, the fault of the output element 2 can be detected.
As described above, in the present embodiment, in Table 2, both the output elements 1 and 2 are in the state immediately before reaching the truly dangerous state e0.
Can detect the state of e1 in which a short-circuit fault has occurred.
The short-circuit fault state of the output element that leads to the above state is determined by the output element 1
As shown by d0 in Table 2, the output element 2
Can be detected as shown by b1 in Table 2.

According to the present embodiment, by the above operation,
By the first and second comparison circuits 12 and 22, each output element 1,
In particular, although the drive output of the output element 2 is momentarily interrupted for a short time by the instantaneous interruption pulse generation circuit 28, the instantaneous interruption of the drive output occurs. If the output of the output element 2 does not become 0 V due to the instantaneous interruption of the drive output, the output data is turned on (DC power supply voltage is supplied) by self-determining that the output element 2 is short-circuited. When the output element 2 is short-circuited in the state described above, the short-circuit failure of the output element 2 can be immediately determined by self.

When the failure of the output elements 1 and 2 is determined, the drive outputs of the output elements 1 and 2 are both turned off, so that the failure of the output elements 1 and 2 (especially the short-circuit failure of the output element 2) occurs. It is possible to construct a fail-safe circuit without causing a failure or malfunction of the circuit while leaving it as it is.

Further, according to the present embodiment, the power supply voltage monitoring circuit 30 is provided to monitor the power supply voltage supplied from the DC power supply to each of the output elements 1 and 2, and to reduce the power supply voltage to the reference voltage due to power failure or the like. When the value falls below the value, the self-determination operation by the first and second comparison circuits 12 and 22 is not performed, so that the state of the DC power supply voltage is ignored despite the occurrence of a power failure or the like. And the first and second output control circuits 1
It is possible to prevent a malfunction of the self-determination operation by comparing the drive output of each of the output elements 1 and 2 by 0 and 20 with the output state of each of the output elements 1 and 2.

Incidentally, in the conventional DC output circuit as shown in FIG. 7B, considering that the DC power supply for driving the load is out of power, it cannot be a dangerous output.
Although there is no problem in the first fail-safe property, the output data and the detection values of the voltage detection circuits 41 and 42 are different at the time of the ON output, so that the output elements 1 and 2 may be erroneously detected as failures. However, in the present embodiment, as described above, the problem of the erroneous detection can be solved.

Further, according to the present embodiment, the first and second monitor input circuits 16 for detecting the output state of each of the output elements 1 and 2 as a load operable state are provided to change the load operable state. Since the detection is performed, the output states of the output elements 1 and 2 can be monitored irrespective of the connection state of the load, and erroneous detection in a state where the load is not connected is prevented. Free system operation is possible, such as securing a spare output circuit in advance, or leaving an unused output circuit without removing it as it is abolished.

The present invention is not limited to the above-described embodiment, but can adopt various embodiments. For example,
In the above-described embodiment, the instantaneous interruption pulse generation circuit 28 applies the instantaneous interruption pulse to the second output control circuit 20 and the second comparison circuit 22 so that the instantaneous interruption of the drive output of the output element 2 and the second comparison circuit twenty two
The self-judgment operation for the failure of the output element 2 is performed by using the instantaneous interruption pulse generation circuit 28 provided on the first output control circuit 10 and the first comparison circuit 12 side to generate the instantaneous interruption pulse. If the drive output of the output element 1 is momentarily interrupted by the
Can be determined by the first comparison circuit 12.

In place of the instantaneous interruption pulse generation circuit 28,
If a circuit for generating an instantaneous ON pulse for instantaneously turning on the drive output of the output element 1 for a short time is provided and applied to the first output control circuit 10 and the first comparison circuit 12, the OFF output of the DC power supply can be obtained. In the middle, it is possible to determine the short-circuit failure of the output element 2 (corresponding to b0 in Table 2).

Further, as in the above embodiment, the first,
When the self-determination of the failure of each of the output elements 1 and 2 is performed by the second comparison circuits 12 and 22, the result of the self-determination is first and second.
When adding to the second output control circuits 10 and 20, when the first and second comparison circuits 12 and 22 determine that the output elements 1 and 2 have failed, at the same time, the abnormal signal is sent to the outside as a device failure signal. Alarm output. In this manner, automatic control such as disconnection of the input power supply or automatic switching of the device provided with the output element serial multiplexing circuit, and maintenance by human hand such as device replacement can be enabled.

Further, in the above embodiment, the two output elements 1 and 2 are connected in series between the DC power supply and the load. However, the output elements are provided in the fail-safe DC digital output circuit of the present invention. The number of output elements provided is not particularly limited, and a circuit may be configured such that three or more output elements are provided and connected in series between a DC power supply and a load.

Further, in the above embodiment, the instantaneous interruption pulse generating circuit 28 is provided, and the drive output of the output element 2 is changed by the instantaneous interruption pulse generating circuit 28. However, the instantaneous pulse change generating circuit for instantaneously changing the drive output of at least one output element for a short time can be omitted. However, if an instantaneous pulse change generation circuit such as the instantaneous interruption pulse generation circuit 28 is provided and the short-circuit failure of the output element is determined, for example, as in the above-described embodiment, the short-circuit failure of the output element can be more quickly and efficiently performed. Can be self-determined, and after the self-determination, the output element can be turned off more quickly to provide a safe output.

Further, in the above embodiment, the first comparison circuit 12 compares the drive output of the output element 1 controlled by the first output control circuit 10 with the output state of the output element 1, Of the second ability control circuit
The first and second comparison circuits 12 and 22 compare the drive output of the output element 2 controlled by 20 with the output state of the output element 2.
When the drive output of each of the output elements 1 and 2 is different from the output state of each of the output elements 1 and 2, the output element is self-determined to be faulty. The output of the instantaneous pulse change generation circuit such as the instantaneous interruption pulse generation circuit 28 is compared with the output state of the corresponding output element, and an output state change occurs in the output element due to the drive output change due to the output of the instantaneous pulse change generation circuit. When there is no output element, the output element may perform only the self-determination of the short-circuit failure.

Further, in the above embodiment, the first and second
Although the monitor input circuits 16 and 26 are provided to detect the output states of the output elements 1 and 2 based on the voltage value, the output states of the output elements 1 and 2 may be detected based on the current value. . However, if the output state of each output element is detected by a voltage value, erroneous detection is prevented even when no load is connected. Therefore, it is desirable to detect the output state of each output element by a voltage value.

Further, in the above description, an example in which the fail-safe type DC digital output circuit is adopted as a control circuit of a railway signaling device has been described. In addition, it is widely used in various control fields in which off-output is defined as a safe side, such as engine control in an automobile and power control in a manufacturing apparatus.

Further, in each of the above embodiments, the circuit for detecting the failure of the output element is used. However, for example, when the drive output of the output element is different from the output state of the corresponding output element, the failure of the output element occurs. It is also possible to confirm whether or not there is a failure, and if there is no failure, it can be determined that the monitor input circuit has a failure.

[0071]

According to the first aspect of the invention, the drive output of each output element controlled by the output control circuit is compared with the output state of the corresponding output element, and the drive output and the output element are compared. When the output state is different, the output element self-determines that it is faulty, and the drive output of all output elements is turned off by each of the output control circuits when the output element fault is determined. The failure of each output element can be quickly and reliably detected by the self-determination. For this reason, it is possible to prevent the danger of the circuit from being increased and the malfunction from reoccurring due to leaving each output element in a failed state.

Further, there is provided an instantaneous pulse change generating circuit for instantaneously changing the drive output of the at least one output element for a short time. According to the first invention and the second invention, the most dangerous short-circuit of the output element can be extremely quickly performed by directly comparing the output of the instantaneous pulse change generation circuit with the output state of the corresponding output element. Since the self-determination can be made, the safety of the circuit can be made extremely high.

Further, it is detected whether or not the power supply voltage supplied from the DC power supply to each output element has reached a predetermined reference voltage value. When the DC power supply voltage falls below the reference voltage value, According to the present invention, the power supply voltage monitoring circuit for adding the self-judgment prevention signal to the comparison judgment circuit is provided.
When the DC power supply fails, the output state of the output element changed by the power failure or the like is compared with the drive output of the output element or the output of the instantaneous pulse change generation circuit, thereby erroneously detecting an output element failure (short circuit failure). Can be prevented.

[Brief description of the drawings]

FIG. 1 is a configuration diagram showing an embodiment of a fail-safe DC digital output circuit according to the present invention.

FIG. 2 is an explanatory diagram showing an example of an output state of a circuit component of the embodiment.

FIG. 3 is an explanatory diagram showing an example of an output state of a circuit component according to the embodiment, following FIG. 2;

FIG. 4 is an explanatory diagram showing an operation when a short circuit fault occurs in the output element 2 in the embodiment.

FIG. 5 is an explanatory diagram showing an example of a conventional DC output circuit using AC input.

FIG. 6 is an explanatory diagram showing a pseudo AC waveform in conventional DC control (pulse signal control).

FIG. 7 is an explanatory diagram of a conventional output element failure detection circuit that performs DC control.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 1st output element 2 2nd output element 10 1st output control circuit 12 1st comparison circuit 16 1st monitor input circuit 20 2nd output control circuit 22 2nd comparison circuit 26 2nd monitor Input circuit 28 Instantaneous interruption pulse generation circuit 30 Power supply voltage monitoring circuit

──────────────────────────────────────────────────続 き Continued on the front page (51) Int.Cl. ⁶ Identification number Agency reference number FI Technical display location H03K 19/007 H03K 19/007 (72) Inventor Akio Makishima 1-6-5 Chiyoda Marunouchi 1-chome, Tokyo No. Tohoku Japan Railway Company (72) Inventor Toshiyuki Komine 1-6-5 Chiyoda Marunouchi Tokyo Metropolitan Government Inside the Japan Railway Company

Claims (4)

[Claims] An output element serial multiplex type DC digital output circuit comprising a plurality of output elements connected in series between a load driving DC power supply for directly driving a load and a load, Each of the plurality of output elements is provided with an output control circuit for driving and controlling each output element. The output control circuit compares the drive output of each output element with the output state of the corresponding output element. When the drive output of each output element is different from the output state of the corresponding output element, a comparison / judgment circuit for self-determining that this output element is faulty is provided, and the comparison / judgment circuit judges the output element failure. A fail-safe DC digital output circuit, wherein the drive outputs of all output elements are sometimes turned off by the output control circuits. 2. An instantaneous pulse change generating circuit for instantaneously changing a drive output of at least one output element for a short time, and a comparison / judgment circuit outputs an output of the output element corresponding to the output of the instantaneous pulse change generating circuit. 2. A fail-safe type DC digital output according to claim 1, wherein the output element is self-determined as a failure when the output state does not change in accordance with the drive output change. circuit. 3. A DC digital output circuit of an output element series multiplex type comprising a plurality of output elements connected in series between a load and a load DC power supply for directly driving the load. Each of the plurality of output elements is provided with an output control circuit for driving and controlling each of the output elements, and is provided with an instantaneous pulse change generation circuit for instantaneously changing the drive output of at least one output element for a short time. Comparing the output of the instantaneous pulse change generation circuit with the output state of the corresponding output element, and when the output state does not change with the drive output change, the output element is determined to be faulty. A determination circuit is provided, and when the output element failure is determined by the comparison determination circuit, the drive outputs of all output elements are turned off by the output control circuits. Fail-safe type DC digital output circuit. And detecting whether or not a power supply voltage supplied from the DC power supply to each output element has reached a predetermined reference voltage value. When the DC power supply voltage falls below the reference voltage value, a self-test is performed. 4. A fail-safe type direct current digital output circuit according to claim 1, further comprising a power supply voltage monitoring circuit for applying a judgment prevention signal to the comparison judgment circuit.