Abstract:
This invention relates to fault detection in electrical circuits. The invention provides a switch for a fault tolerant digital output module comprising: an output transistor pair for enabling and disabling an alternating output current; and a current limiter for clamping the output current to a predetermined maximum value.

Description:
[0001]     This application is related to and claims priority from U.S. Provisional Application No. 60/785,537 filed Mar. 24, 2006 entitled Fault Detection and Apparatus, which is incorporated fully herein by reference. 
     
    
     BACKGROUND  
       [0002]     a. Field of the Invention  
         [0003]     This invention relates to fault detection in electrical circuits, in particular it relates to overload protection in a switch circuit for digital output modules.  
         [0004]     In safety control systems, fault tolerance is of utmost importance. Fault tolerance is the ability to continue functioning in the event of one or more failures within the system.  
         [0005]     Fault tolerance may be achieved by a number of different techniques, each with its specific advantages and disadvantages. One example of fault tolerance is known as Hardware Implemented Fault Tolerance (HIFT). HIFT means that the system relies on robust hardware circuits (as opposed to complex software algorithms) to perform the fault detection and redundancy management functions. A significant advantage HIFT has over software-implemented fault tolerance is that HIFT eliminates the overhead for communications between processors, leaving more time for controlling the process. This makes HIFT systems significantly faster and more dependable than systems using software-implemented fault tolerance.  
         [0006]     An example of a HIFT system is a system which provides redundancy, in particular Triple Modular Redundancy (TMR). Using TMR, critical circuits are triplicated and perform identical functions simultaneously and independently. The data output from each of the three circuits is voted in a majority-voting circuit, before affecting the system&#39;s outputs. If one of the triplicated circuits fails, its data output is ignored. However, the system continues to output to the process the value (voltage, current level, or discrete output state) that agrees with the majority of the functional circuits. TMR provides continuous, predictable operation.  
         [0007]     HIFT and TMR provides for automatic fault recovery with no disruption to system operation and ensures minimal fault detection periods.  
         [0008]     Another approach to fault tolerance is the use of hot-standby modules. This approach provides a level of fault tolerance whereby the standby module maintains system operation in the event of module failure. With this approach there may be some disruption to system operation during the changeover period if the modules are not themselves fault-tolerant.  
         [0009]     Fault tolerant systems ideally create a Fault Containment Region (FCR) to ensure that a fault within the FCR boundary does not propagate to the remainder of the system. This enables multiple faults to co-exist on different parts of a system without affecting operation.  
         [0010]     Fault tolerant systems generally employ dedicated hardware and software test and diagnostic regimes that provide very fast fault recognition and response times to provide a safer system.  
         [0011]     Commonly, it is possible to repair faults without interrupting system operation (known as hot replacement). For example active and standby module may operate in parallel so that if an active module becomes faulty there is an automatic change over to a standby module.  
         [0012]     Safety control systems are generally designed to be ‘fail-operational/fail-safe’. Fail operational means that when a failure occurs, the system continues to operate: it is in a fail-operational state. The system should continue to operate in this state until the failed module is replaced and the system is returned to a fully operational state.  
         [0013]     An example of fail safe operation occurs, for example if, in a TMR system, a failed module is not replaced before a second failure in a parallel circuit occurs, the second failure should cause the TMR system to shut down to a fail-safe state.  
         [0014]     Typical safety control applications include emergency and safety shutdown systems, process control, reactor control, wellhead control, turbine and compressor control, fire and gas detection and abatement, and are applicable to many industries including oil and gas production and refining, chemical production and processing, power generation, paper and textile mills and sewage treatment plants.  
       SUMMARY OF THE INVENTION  
       [0015]     According to the invention there is provided a switch for a fault tolerant digital output module comprising: an output transistor pair for enabling and disabling an alternating output current; and a current limiter for clamping the output current to a predetermined maximum value.  
         [0016]     Preferably, the current limiter comprises a pair of current sense transistors.  
         [0017]     Preferably the switch further comprises a voltage monitor for monitoring the voltage across the output transistor and which sets a signal in the event that the monitored voltage exceeds a predetermined maximum voltage and which is arranged in operation to sample the overvoltage signal at overvoltage sampling intervals and in the event that that the output transistor is enabling the output alternating current and the overvoltage signal is set for more than a predetermined number of voltage samples an overload condition is detected.  
         [0018]     In a preferred embodiment the voltage sampling interval is substantially equal to 60 μs, the predetermined maximum voltage value is substantially between 10V and 35V and the predetermined number of voltage samples is equal to 1, 2, 3 or 4.  
         [0019]     Preferably, the switch further comprises a current monitor for monitoring the current through the output transistor and which is arranged in operation to sample the current at current sampling intervals and in the event that the current exceeds a predetermined absolute maximum current value for more than a predetermined number of current samples an overload condition is detected.  
         [0020]     In a preferred embodiment, the current sampling interval is substantially equal to 240 μs and the predetermined number of current samples is in the range 1-4.  
         [0021]     Preferably, the switch further comprises an average current monitor for monitoring the average current though the output transistors and which is arranged in operation to sample the average current at average current sampling intervals and in the event that the average current exceeds an average current predetermined threshold for more than a predetermined number of AC cycles an overload condition is detected.  
         [0022]     In a preferred embodiment, the average current sampling interval is substantially equal to 300 ms and the predetermined number of AC cycles is 3. 
     
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0023]     The invention will now be described, by way of example only, with reference to the accompanying drawings in which:  
         [0024]      FIG. 1  illustrates schematically a fault tolerant architecture;  
         [0025]      FIG. 2  is a block diagram of a fault tolerant output module;  
         [0026]      FIG. 3  is a block diagram illustrating a fault tolerant AC digital output module switch section; and  
         [0027]      FIG. 4  is a circuit diagram of a fault tolerant AC digital output module switch section. 
     
    
     DETAILED DESCRIPTION  
       [0028]     Referring now to  FIG. 1 , signals  1  from an input field device (not shown) are connected to the system via an input Field Termination Assembly (FTA)  2 . An input  3  module receives, buffers and carries out any necessary conversion of the input data from the field device. The input data is then transmitted over a triplicated Inter-Module Bus (IMB)  5  to a TMR processor  4 . Triplicated microprocessors of the TMR processor receive the input data from each channel of the IMB  5  and carry out a majority vote of the data. During data processing, each of the three processors compares and majority votes its input data against that of the other two processors. The processors synchronously execute the application program, and the derived output data is transmitted back to the IMB. An output module  6  receives, majority votes, and carries out any necessary conversion of the output data from the TMR processor  4 . The output circuits are then driven by the majority-voted command. The output signals are connected to a field device (not shown) via an output FTA  7 . A communications interface  8  provides facilities to allow systems to be networked using peer to peer communications links, the collection of Sequence of Events (SOE) data, and connection to other systems.  
         [0029]     If an internal circuit in the system fails, it is simply voted out. Comprehensive distributed voting both out-votes failures, preventing them from being propagated into the process, and simplifies the process of identifying where faults have occurred.  
         [0030]      FIG. 2  illustrates an output module  6  comprising a host interface unit  6401  which provides fault-tolerant communications, control, and processing facilities for the module. Output functions of the host interface unit  6401  are contained in replicated output host interface units  6402  and related DSP firmware. The output host interface units  6402  provide communication facilities to and from an output field interface unit  6403 .  
         [0031]     The output field interface unit  6403  comprises replicated output field interface modules  6404  which are galvanically isolated from replicated output switches  600  connected in a series/parallel configuration as shown.  
         [0032]     For safety systems it is beneficial for output modules driving alternating current loads to protect the drive circuitry from damage due to external short circuit faults, as well as from less extreme load problems that may cause long-term overheating of the output drivers if not recognised. The method of protection must be balanced against the requirement to provide as much current to the load as is safely possible.  
         [0033]     In the preferred embodiment of the invention, there are four layers of protection to prevent overload damage to the output module, while handling turn-on current surges and tolerating brief overloads.  
         [0034]      FIG. 3  illustrates an output switch  600  according to a preferred embodiment of the invention. A binary input signal  6301  received from the output field interface module  6404  indicates whether the AC switch output is to be enabled or disabled.  
         [0035]     A driver  6221  receives the input signal and drives two back-to-back FET output transistors  6281 ,  6251  in dependence upon the received signal  6301 .  
         [0036]     A transformer isolated high frequency AC input power signal differential pair (Pwr 1  and Pwr 2 ) are rectified and regulated by a bridge rectifier and filter  6201  and a voltage regulator  6211  to generate isolated 10V and 3.3V power supplies for various components.  
         [0037]     A first level of overload protection is implemented in hardware directly in the output transistor control circuit. Each gate of the FET output transistors  6281 ,  6251  is clamped with a current sense NPN transistor pair  6231 .  
         [0038]     This current limiting transistor pair  6231  provides a virtually instantaneous current limit function to approximately 10 A to 40 A, depending upon the desired output current range of the implementation.  
         [0039]     The voltage across the FET output transistors  6281 ,  6251  is measured by the signal VMON and the current through the FET output transistors  6281 ,  6251  is measured using the signal IMON which measures the current though a current sense resistor  6232 .  
         [0040]     A second level of overload protection is provided by monitoring the voltage across the output transistors at a relatively high sample rate, in the preferred embodiment every 60 μs, and sending a signal to a diagnostic monitor  6291 . The monitoring is done in hardware by a switch overvoltage detect transistor  6261 . When the voltage across R 2121  ( FIG. 3 ) ie VMON is great enough to turn on the transistor, then the result is that the signal that is sent to the output field interface module  6040  indicates excessive voltage across the switch.  
         [0041]     In the preferred embodiment this signal is asserted if the voltage exceeds between 10V to 35V, depending upon the output current rating of the switch. If the output field interface module  6040  is commanding binary input signal  6301  such that the output is enabled, and if the voltage exceeds the predetermined maximum voltage value for more than a predetermined number of samples (in the range of 1-4 in the preferred embodiment), the output field interface module  6040  sets an overload condition and sends it via the binary input signal  6301  to be reset in order to turn the FET output transistors  6281 ,  6251  off and thus to disable the AC output.  
         [0042]     A third layer of protection is provided by monitoring the load current every alternating current cycle. The load current is digitized every 240 μs and transmitted to the output host interface unit  6402  via the output field interface unit  6404  as signal IMON by the diagnostic monitor  6291 . If the output host interface unit  6402  detects that the load current has saturated the IMON A/D converters in either or both directions for three consecutive AC cycles, then the output field interface module  6404  is instructed to set an overload condition and cause the binary input signal  6301  to be reset in order to turn the FET output transistors  6281 ,  6251  off and thus to disable the AC output.  
         [0043]     A final layer of protection involves monitoring the load current for a persistent long term average magnitude that would result in too much heat being dissipated in the output FETs, resulting in their junction temperature exceeding the maximum rating.  
         [0044]     This is performed by in the output host interface unit  6402  by sampling the IMON load current signal every 300 mSec and averaging the value in the output host interface unit  6402 . If it exceeds a given predetermined maximum average value for more than 1.5 seconds, the switch is turned off as before.  
         [0045]     There is also a temperature monitor  6271  which sends a temperature monitor signal to the output field interface module  6404  via the diagnostic monitor  6291   
         [0046]      FIG. 4  illustrates the internal components of the block shown in  FIG. 3  in more detail.  
         [0047]     It is to be recognised that various alterations, modifications, and/or additions may be introduced into the constructions and arrangements of parts described above without departing from the scope of the present invention as defined in the following claims.