Peripheral component with high error protection for stored programmable controls

The invention relates to a peripheral component with high error protection for stored programmable controls. The invention relates particularly to an analog-input circuit with at least two channels substantially identical in design, for parallel signal input and/or output, which are parallel connected and/or parallel connectable in the region of the peripheral interface. Said analog-input circuit also comprises at least one data processing component (μP or μC) for testing the channels without any disruption of the data flows.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is based on and hereby claims priority to PCT Application No. PCT/DE01/01885 filed on May 17, 2001, German Application No. 100 24 479.3 filed on May 18, 2000, and German Application No. 100 35 174.3 filed on Jul. 19, 2000, the contents of which are hereby incorporated by reference.

BACKGROUND OF THE INVENTION

The invention relates to an interface module having a high level of error immunity for programmable logic controllers, particularly to an analog-input circuit.

U.S. Pat. No. 5,508,910 discloses a redundant analog input/output system having two identical analog input/output units, with in respective input/output unit being in operating mode and the respective other one being in monitor mode. Each analog input/output unit has a microcomputer, two D/A converters and a D/A converter. In a fault situation, the respective microcomputer for one analog input/output unit switches itself to monitor mode and switches the respective other input/output unit to operating mode.

If industrial and other, technically complicated plant processes are being automated to an ever increasing extent through the use of programmable logic controllers, then this was probably originally influenced by the idea of transferring simple activities, such as the activation of various processing steps in a serial processing process, and simple control sections, e.g. filling-level control sections or temperature control sections. The design of control loops had resulted in feedback of process signals, and this tendency finally resulted in the transfer of extensive monitoring tasks to programmable logic controllers. In this context, however, it is found that when a monitoring person delegates such tasks to a machine, one human property important to monitoring tasks is of very great significance, namely the responsibility for preventing accidents and other damage during operation of a plant as far as possible and of ensuring the highest possible level of safety for people, machines and the environment. The regularly recurring reports about the escape of poisonous gases from plants in the chemical industry and the countless risks lying in wait as a result of the use of large amounts of power in a wide variety of plants in the raw-materials industry, power generation, mechanical conveying and handling, mechanical working and automated production have to be regarded in this context as an incentive to increase plant safety further.

In this context, malfunctioning of individual plant parts can probably never be ruled out, and the task of an automatic controller therefore needs to be to identify such malfunctions and to initiate countermeasures or to shut down the plant or trigger an alarm as quickly as possible. However, it can only perform this task if it is certain to work correctly itself even, and specifically, upon the occurrence of malfunctions in the plant. Although the use of microelectronics in millions of wristwatches, household appliances, aircraft and vehicles shows that the greatest risk when operating an electronic circuit is probably failure of the supply voltage, particularly a drop in the battery voltage, it must not be forgotten that industrial plants are operated on a crude basis and only rarely is it possible to presuppose an atmosphere which is entirely free of vapors, gases and other chemicals. For this reason, particularly in the case of critical processes in which there should be no malfunction if at all possible, additional measures should be taken in order to increase the operational reliability of the control device further.

When dealing with this problem, the design of a programmable logic controller should be recalled: to allow optimum matching to a very wide variety of application instances, a modular design has been implemented for this in practice, the core of the programmable logic controller being formed by a central processor unit which processes a program specific to the application instance in question. By contrast, the interfaces to the individual actuators for the process in question and also hived-off subfunctions, such as control sections, are held in modules which are separate therefrom and are normally all coupled to a communications line, for example in the form of a serial bus, so that information interchange between the various components is possible. In such a case, an error can theoretically occur in all the components, i.e. both in the central processor unit and in the connected components, and also on the communications line connecting them to one another.

While the first two sources of error can be prevented, or can be reduced to an extremely minimal residual risk, for critical processes by increasing the availability, for example by using a second central processor unit connected in parallel and/or a second communication bus operated in parallel, duplication of all other components in most application instances would entail a substantial level of additional involvement, and the enormous increase in complexity would additionally mean that it would instead even impose the risk of additional sources of error as a result of wiring or setting errors. In addition, the interchange of information via the communications line in question would be at least doubled in such a case, which would necessitate a further power increase for the controller. It should then be remembered that, on the other hand, increased significance should specifically be attached to the interface modules as the interface between the process and the controller, since failure of such a component may result in crucial signals being lost or in the influence of the controller on the process being restricted or even interrupted.

SUMMARY OF THE INVENTION

The drawbacks of the above approach are why one potential object for the invention is to provide an interface module for programmable logic controllers which itself already has an increased level of error immunity, so that it is possible to achieve a high level of error coverage even without using a redundant component.

This problem is solved by at least two channels of largely identical design for parallel signal input and/or output which are connected in parallel, and/or can be connected in parallel, in the region of the peripheral interface, and by at least one data processing block (μP or μC) for testing the channels without interrupting the flow of data.

Potential benefits associated with the above interface module include: on the one hand, the interface module already contains a second channel, which means that redundancy is already provided internally. In addition, a data processing block is provided which performs a test on one or both channels permanently or at least at short intervals of time in parallel with the ordinary flow of data, which relieves both the communication line to the central processor unit and the central processor unit itself of this task. As soon as a malfunction in one or both channels has been identified, on the other hand, the data processing block performing the test can immediately report this to the central processor unit so that, in such a case, a countermeasure can immediately be introduced before a malfunction can occur in the plant itself. This ensures that, if a fault situation arises in the plant, at least one channel in the interface block is always intact, which means that information interchange between plant and controller is ensured.

The interface module is also distinguished by a second data processing block (μP or μC) for conditioning the data to be transferred during a test phase. On the one hand, this second data processing block provides redundancy if the first data processing block fails, and on the other hand, in such a case, data conditioning can also take place in the channel which adopts the flow of data, in which case, by way of example, if an input signal which is to be expected does not appear, an error message can be triggered; in addition, the data format can be converted into a for communication with the central block or for communication with the data processing block performing the test.

It has been found to be beneficial for each of the two data processing blocks to be associated with one respective channel and to be designed such that they can undertake both the signal conditioning and the testing for this channel. The firm association between the two data processing blocks and a respective channel affords a simplification in terms of circuitry by virtue of no further circuit element needing to be provided between the channel block in question and the associated data processing block, which means that such circuit elements cannot be a source of error.

The interface module provides for the two data processing blocks to be coupled to one another for the purpose of information interchange. This coupling is firstly important for coordinating the operation of the two channel blocks so that a correct flow of data always takes place on at least one channel, and secondly test results can be exchanged, for example, so that each of the two data processing blocks is always informed about the state of both channels and can not just orient its own operation thereto, but rather can also immediately provide a central processor unit with the necessary information upon request.

The interface module can be developed such that the two data processing blocks are coupled to one another via in-module connections. This measure reduces the signal traffic on the connecting line between the individual components of the programmable logic controller.

Other advantages can be obtained by virtue of the two data processing blocks being coupled via a memory to which they both have access. The data processing blocks can use this common memory to store the information intended for the respective other block, and this information can then be fetched from the memory at a given time, i.e. when needed. This avoids unnecessary waiting times for a data processing block.

One refinement can provide for the two data processing blocks to be connected to different inputs/outputs for the memory (dual-port RAM). In such a case, the communication between each of the two data processing blocks and the common memory is entirely independent of the operation of the respective other block, and particularly of its clocking. This allows largely autarkic systems to be provided for each of the two data processing blocks, which means that smooth operation of at least one signal can be ensured even if an error has occurred in the other channel block and/or in the data processing block controlling it.

The performance of the interface module can be increased by virtue of a two-channel input module being provided with an additional output channel, and a two-channel output module being provided with an additional read-in channel, which can be coupled to each of the two remaining channels in order to form a loop via a respective one of the two parallel channels, so that correct processing of a test signal can be checked. While, in the absence of such an arrangement, at best a test is possible by comparing the signals which are output by the two channel blocks, a test channel complementary thereto can close a loop via a respective one of the two channel blocks, and a genuine test on the absolute accuracy of all the components in this loop is thus possible by comparing the input signal for this loop with its output signal. Accordingly, as soon as an error occurs which means that a channel block no longer works correctly, then such a test setup can be used to establish clearly which of the two channel blocks has the fault, and the flow of data can then be routed via the channel block which is still intact until the faulty channel block has been replaced or repaired. The arrangement is therefore used not just for sensing an error; rather, this error can also be clearly located and, provided that a single channel block is still working, the interface module can perform its function.

To simplify the design complexity, the actuation for the test channel can be transferred to one of the two data processing blocks. Although it would be conceivable to access control of the test channel block in both data processing blocks in order to increase redundancy further, this is found not to be necessary, since, if one channel block fails, it is no longer possible to perform a test anyway, because the normal flow of data must have been interrupted in such a case. For this reason, the actuation for the test channel block can be firmly associated with one of the two data processing blocks, so that an additional switch and interposed OR gates or the like are not necessary and the likelihood of failure is reduced further.

Superfluous sources of error can be avoided by virtue of the two channels being arranged on the same circuit board. This design specification is based on the realization that every connector, and particularly every cable connection, has a higher likelihood of failure than a conductor track on a circuit board, where at most a poor solder connection could result in a fault.

The same purpose is served by a development in which at least one data processing block is arranged together with the two channels on the same circuit board. This measure also reduces the number of plug and solder connections and thus increases the operational reliability of the interface module.

So that scattered noise is kept away from the evaluation electronics, both channels, preferably including a test channel, are provided with potential isolators. The task of these potential isolators is that of completely removing a signal's pure information value from its actual voltage potential, so that dangerous noise, which can originate from the process or can be scattered on the supply lines in question, cannot harm the sensitive microelectronics. This can be implemented most effectively using optocouplers, which are used by the absence of potential when transmitting light.

The design complexity can be reduced further if signal conversion takes place between analog current or voltage levels, on the one hand, and an alternating signal (pulse train) having a frequency which is proportional to the analog signal, on the other hand. While the data processing blocks ultimately use a sequence of binary number representations for the particular amplitude of the analog signal, the interposition of an alternating signal having a variable frequency affords the advantage that all of the information about the amplitude value can be transferred on a single signal line, with an analog circuit which is less susceptible to interference being able to be used, on the other hand.

In such a case, it is possible to use the potential isolator for the alternating signal, for example using optocouplers. Since this alternating signal contains the entire information content about the signal amplitude which is to be transferred, it is suitable as a preference for the potential isolator. Firstly, it saves increased complexity for the potential isolator, as would be the case with a binary signal, for example, and secondly the potential isolator can be of much simpler design in the case of a signal which alternates between two voltage ranges and whose exact amplitude carries no information than in the case of a pure analog signal, where the information corresponds to the voltage amplitude in question.

To decrypt the alternating signal, it can be supplied to a counter module which, by counting the pulses within a fixed interval of time, produces a digital value which is proportional to the frequency of the alternating signal. This involves an extremely simple design, where only after the expiry of a firmly prescribed interval of time is it necessary to request the counter reading and then to reset the counter to zero again. The resolution which can be achieved with this signal conversion depends on the interval of time, on the one hand, and on the frequency of the alternating signal, on the other hand. To be able also to transfer voltages having the amplitude zero or even negative voltages with sufficient resolution within the scope of this method, the relevant voltage interval should be transformed to a frequency range which extends upward from a minimum frequency corresponding to the minimum voltage amplitude.

In the opposite signal direction, the alternating signal should be removed from a module having a sequential output, for example from a shift register, which outputs a prescribable number of output bits in a prescribed interval of time. The opportunities for generating the alternating signal are manifold. Since the individual pulses do not need to be split uniformly over the interval of time in question, it would be possible to output pulses derived from the clock frequency, for example, with counting simultaneously being able to take place in order to compare the current counting result with the prescribed value using a comparator and to suppress the transfer of further pulses when the prescribed value has been reached. Another option involves writing the relevant number of pulses to a shift register and then outputting the latter's content serially to the channel block in question within the prescribed interval of time.

To operate the interface module, one channel is always to be used for signal transmission, while the other is operated for test and/or correction purposes. In such a case, the test can be carried out entirely invisibly to the central processor unit for the programmable logic controller in question, i.e. this programmable logic controller always has the information it requires delivered to it, largely without delay, and can rely on the fact that signals which it outputs to the plant also arrive at the plant virtually without delay, provided that the interface block in question does not fail completely.

A component test can be carried out by virtue of the output signals on the two channels being subtracted from one another, with the result of the subtraction being compared with at least one prescribed limit value in order to identify an error if there is a relatively large discrepancy. This mode can be used in order to identify an error occurring in a channel block immediately, since in such a case a difference significantly other than zero arises. In this case, this comparison can be performed both for an input block and for an output block if the output is provided, by way of example, with an appropriate analog circuit having an operational amplifier connected as a subtractor, possibly an absolute-value generator and a comparator for comparing the absolute difference with a prescribed and still tolerable limit value. The acknowledgement from this test block can be provided using a single signal, for example the output signal from the comparator, which means that a potential isolator can be very simply produced in this case too.

In another test mode, one channel is used for signal transmission and the other is meanwhile subjected to a test by outputting a test signal and reading it in again, the signal value which is output and the signal value which is read in being subtracted from one another, and the result of the subtraction finally being compared with at least one prescribed limit value in order to identify an error if there is a relatively large discrepancy. While parallel operation of the two channels and comparison of their output signals make it possible to establish whether an error has actually occurred in one of these two channels, the latter test mode even makes it possible to ascertain which of the two channels is faulty. This is achieved by connecting the channel which is to be examined as part of a signal transmission loop, and comparing the output signal from this loop with its input signal allows a malfunction in the channel block in question to be diagnosed if there is an identifiable discrepancy. In such a case, this channel can be selectively disconnected, and then just the remaining channel can be used temporarily until the fault has been eliminated as a result of an alarm triggered by the error message.

To allow early identification of an error which has occurred, the test mode should be repeated at short intervals of time, with first one channel and then the other being respectively tested, and the respective other one undertaking the signal transmission in the meantime. In the extremely unlikely situation in which both channel blocks become damaged at the same time, comparison of the output signals might possibly establish no error if, by way of example, both output signals adopt zero voltage at the same time. However, this situation can be prevented or identified by regularly testing the absolute operability of the channel blocks. For this reason, at least one of the two channel blocks should be examined at short intervals of time with regard to its absolute operability. Since simultaneous failure of both channel blocks is an extremely rare event, these absolute operation tests can be carried out at relatively long intervals of time, for example approximately once per second. Provided that the channel blocks connected in parallel are not compared during normal operation, the flow of data between the two channel blocks should be changed over at correspondingly short intervals of time and, in the meantime, at least one test on the channel block which has not been required up until then should be carried out in each case.

Optimum results can be attained if a data processing module undertakes the evaluation of the test results (comparison of the output signals on the two channels and of the read-in test result with the output test result). During correct operation, the output signals from both channel blocks operated in parallel can always be compared in the same data processing module; the control of the test channel block and the comparison between the respective test loop's input signal and output signal can also be transferred to the data processing module for the absolute value tests which are to be performed alternately. This reduces the programming complexity, since a unique master-slave configuration is obtained, where control commands are always sent from the master module to the slave module and information is always sent in the opposite direction.

Correct data interchange with the central processor unit for the programmable logic controller takes place by virtue of a data processing module, preferably the one undertaking evaluation, communicating with the central control unit via a data interface. The interface module can be used in various respects in order to increase the error immunity of a programmable logic controller. Merely a plant having just one central processor unit and a communication bus has increased security against failure of the interface block itself. The use of particularly secure data lines and/or the use of particularly secure data formats and/or a reduction in the data transfer rate can likewise achieve an increase in security. According to standard, this communication takes place with one of the two data processing blocks in the interface block. The central processor unit can also use this block to request the current error status for the two channel blocks. For this purpose, it is therefore advantageous to use that block which also controls the test procedure at the same time, since in such a case data transfer from the master module to the slave module is not necessary.

To render the events in the interface module transparent to the central processor unit for the programmable logic controller in question, the data processing module communicating with the programmable logic controller's central processor unit should provide an information signal about the current test or error status. So that the central processor unit can receive information about the most recent level of knowledge in terms of the operability of the channel blocks at any time, the test result which is respectively most up to date should be stored in order that an immediate response can be delivered for every request by the programmable logic controller's central processor unit. In this context, the test result can be stored either in a register in the data processing module carrying out the test or else in an external memory.

Finally, it is within the scope of the disclosure that each data processing module has a respective dedicated data interface to a respective data link, so that it is possible to use two data lines which are entirely independent of one another. This configuration is intended particularly for use with programmable logic controllers having two communication buses operated independently of one another which each communicate with one of two central processor units operated in parallel. In such a case, a maximum degree of redundancy is obtained, while on the other hand the system structure is extremely clear, since each of the two central processor units communicates only with a respective data processing block for the interface block. Since, on the other hand, the two data processing blocks for the interface module are connected to one another, a “crossover mode” can also be maintained if required, where, by way of example, if the primary channel block fails, the main central processor unit uses the master data processing block to control the slave data processing block, and hence accesses the secondary channel block, or, if the main central processor unit fails, the auxiliary central processor unit uses the slave data processing block to give appropriate instructions to the master data processing block and can thus use the primary channel block.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

The programmable logic controller1shown inFIG. 1comprises a central processor unit2of fail-safe design to which n components4, at least one of which is of fail-safe design, are connected via a communication bus3operated in a fail-safe manner. The fail-safe components2–4form a continuous, security-related chain, with information being detected by the fail-safe component4, being transferred to the central processor unit2via the communication bus3with a high level of security, and being logically combined therein in order to obtain control commands which can be used to prompt a reaction from an actuator in the plant via the communication bus3and an interface component4which is in turn fail-safe. The high level of error immunity in the individual components2,4can be achieved by very careful design and by constant self-tests using a respective microprocessor or microcontroller contained in these parts2,4. Particularly important parts of the inventive, fail-safe interface block4are additionally of multiple design, in order thus to provide redundancy for the situation of a failure.

By contrast, the programmable logic controller5has a particularly high level of availability by virtue of a first fail-safe central processor unit ZE1being supplemented by a second fail-safe central processor unit ZE2which is operated in parallel therewith and communicate with all n components4via respective dedicated, fail-safe communication buses3. In addition, data interchange and synchronization of the two interface central processor units ZE1, ZE2can take place via a coupling6. In the case of this arrangement too, at least one of the two components4connected to the central processor units2is in the form of a fail-safe interface block in accordance with the invention so that the high level of availability of this programmable logic controller5does not experience any weakness in the region of the interface to the process.

FIG. 3shows a block diagram of an inventive fail-safe interface block4in the form of an analog input unit which illustrates the basic design and the basic manner of operation of a block4in accordance with the invention.

The analog input7connected to the plant is connected via a changeover switch8to the input9of a first transmission channel10whose task is ultimately to transform the analog signal11into a digital signal12which represents a series of several numerical representations of the amplitude of the analog signal11, which amplitude is sampled at short intervals of time. This digital signal12is read in by a first data processing block13in the form of a microcontroller and is conditioned if appropriate, for example by adding an offset value, multiplying it by a scaling factor, or else by compiling a message14which contains the amplitude information and may identify it as such and which is then transferred by a communications module15via the link16and the fail-safe communication bus3to the central processor unit2for the programmable logic controller1, or to the main central processor unit ZE1for the controller5with a high level of availability.

Since the necessary signal conversion and the active parts required for this purpose mean that the transmission channel10has a likelihood of failure which does not disappear, the invention provides a largely identical, second transmission channel17whose analog input connection18can likewise be connected to the analog input7of the inventive interface module4via a changeover switch19. The analog signal11converted by the second transmission channel17into a binary pulse train20is supplied to a second data processing block21which is connected to the output20of the second transmission channel17and performs the necessary conditioning in order to obtain normalized digital values which, when the two transmission channels10,17are operated simultaneously, should ideally be identical to the values generated by the first data processing block13.

The normalized values obtained in the second data processing block21in such a manner are transferred23to a writable and readable memory module22and can be read25therefrom via a further connection24on this memory module22by the first data processing block13as required. It is thus possible for the first data processing block13to compare the two results from the two transmission channels10,17, and as soon as relatively large discrepancies arise in this context, there is without doubt an error in at least one channel transmission block10,17.

The control33for the first transmission channel10is assigned, like the actuation35for the first changeover switch8, to the first data processing block13, while the corresponding functions34,36for the second transmission channel17and for the second changeover switch19are adopted by the second data processing block21.

In addition, a dedicated communication module26can also be connected27to the second data processing block21in order to allow communication with the auxiliary central processor unit ZE2via the dedicated communication module's output28, using the communication bus3which is connected thereto.

Upon the occurrence of a malfunction established by the data processing block13, a corresponding status register can be set, so that, in the event of a request from the central processor unit ZE, ZE1, this error state is reported further, or the data processing block13can independently send an appropriate error message to the central processor unit ZE, ZE1in question. In addition, the information about the error status can also be recorded in the writable and readable memory22, from where it can be read in by the second data processing block21via the memory's second connection29and can also be reported further to the auxiliary central processor unit ZE2via the second data processing block's communication module26.

Although this first mode of operation makes it possible to establish whether at least one of the two channel transmission blocks10,17is faulty, in the event of an established discrepancy it is not readily possible to make a statement regarding which of the two channel transmission blocks10,17needs to be examined for the error. For this reason, an additional test option is provided, where a test channel30, which can be controlled via connection31by the first data processing block13, generates a prescribable analog signal32which the changeover switches8,19, can selectively connect to the input9,18of a channel transmission block10,17instead of the analog input signal7for the inventive interface block4. By reading back the output signal12,20from the channel10,17in question and by comparing the output signal with the preset value31for the signal32which is output by the test channel30, it is possible to establish whether the channel transmission block10,17in question is operating correctly.

Preferably, only one respective channel transmission block10,17is tested simultaneously, while the other one is coupled to the analog input signal7by its changeover switch8,19and is thus able to ensure an uninterrupted flow of data. Provided that there is a second communication module26, the value12,20provided in digital signals by the transmission channel10,17which respectively ensures correct operation can be interchanged between the two data processing blocks13,21via the common memory22and can thus be transferred via the two outputs16,28to the respectively connected communication buses3and from there to the two central processor units ZE1, ZE2.

After a short interval of time, the operation of the two transmission channels10,17is then interchanged, which means that the other transmission path10,17can now be tested. Preferably, between these phases, the two transmission channels10,17are temporarily operated in parallel on the input signal7, so that not a single measured value is lost. This is achieved by virtue of one of the two changeover switches8,19always being connected to the analog input7. Upon changeover, a switch position is accordingly always first produced in which the two changeover switches8,19are connected to the analog input7until the respective other one is released from this signal and is applied to the test signal32.

A circuit designed in hardware for the purpose of producing the functions which have just been described is shown inFIG. 4.

FIG. 4shows that the inventive interface module4has a total of three analog inputs7a–7c, each of which can be connected to each of the two transmission channels10,17. Each analog input stage7a–7chas been designed using a voltage divider comprising two resistors37a–37cand38a–38c. One end of these voltage dividers37,38is connected to a ground connection39, while the respective other end potential and the center tap are in the form of voltage U and current I inputs,7a–7c, whose rated voltage and current levels are converted, by the voltage divider37,38in question, into voltage levels which are compatible with modules arranged thereafter. A supply DC voltage41of, by way of example, 24 volts, which is provided by an amplifier42at sufficient low impedance, supplies, by way of example, connected sensor current sources40a–40c, of 20 mA each, for example, which are modulated by the sensed signal. The input voltage considered to be relevant is then accordingly the voltage on the voltage divider center tap7a–7cand/or on the voltage input U in question, and this voltage is applied, possibly via two respective lines43a–43cand44a–44c, to the switches8,19, from where they can be connected in pairs to the inputs9a,9band18a,18bof one or both transmission channels10,17. Since the analog inputs7a–7care not connected to the general ground as a result of a potential isolator45, which will be explained further below, the analog ground39can be set in any relation to the input voltages7a–7c.

The voltage difference across the resistors37is accordingly regarded as a positive voltage by the transmission channel10,17in question and is transformed by an analog frequency converter46,47into a pulse train48,49of moderate frequency. This pulse train48,49can be transferred without any potential by a respective optocoupler50,51to a downstream counter module52,53which respectively counts the pulses arriving within a prescribed interval of time and thus delivers a measure of the frequency48,49. This counter reading is requested by the respectively coupled data processing block13,21whenever the prescribed interval of time has elapsed, and the counter is then reset to zero and is enabled again. The frequency-proportional counter reading12,20thus represents a binary analogon for the present voltage value at the respectively connected analog input7a–7cand can be normalized by the data processing block13,21in question if appropriate in order to obtain a digital value which is accessible for further processing.

By virtue of the digital value20delivered by the transmission channel17being made available to the first data processing block13by the data processing block21using a writable and readable memory22, this arrangement can be used for simultaneously converting two different input signals7a,7binto digital values and forwarding them16to a central processor unit ZE, ZE1via the communication block15. On the other hand, it is also possible to connect8,19the same input signal7a–7cto both transmission channels10,17in parallel and to have the digital values12,20obtained in such a case compared with one another by the data processing block13, for example by subtraction, in order to obtain grounds for whether an error has occurred in one of the two transmission channels10,17.

With an input voltage7a–7cwhich is different than zero, the input signal9,18for the transmission channel10,17in question changes, so that the frequency48,49and accordingly the counter output signal12,20change accordingly.

The signal lines43,44connected downstream of the inputs7a–7chave overvoltage protection diodes54for keeping away scattered interference spikes from the inputs9,18of the transmission channels10,17. The circuits8aand8bhave integrated protective diodes.

The drawing shows two different types of switches: the switches8a,8bare each 1-out-of-n multiplexers for each of the two input connections9a,9bof the connected transmission channel10, while the switching modules19a–19fare in the form of 2×ON switches. The respective actuation signals for these switching modules8a,8band19a–19fare generated by the data processing blocks13,21and additionally have separate potentials, so that no noise can pass through the barrier45into the data processing area13,21on this path either. To ensure correct operation, the switches8a,8beach need to switch through the mutually corresponding inputs to give the output signals9a,9b. On the other hand, for the circuit arrangement having the switches19a–19f, it is necessary to ensure that only a single switch module19a–19fis ever on.

Observing these switching rules, each of the two transmission channels10,17can have not only the three input signal connections7a–7cbut also three test signals switched through for it. This can be recognized most clearly in the case of the transmission channel17, where a dedicated switch19d–19fis provided for each test mode. If, of these, the switch19dis turned on, then the same voltage is applied to both inputs18a,18bof the analog frequency converter47, namely the analog ground potential39. Consequently, a counter value of zero must always be read20in the case of this test mode. If this is not the case, then the tested channel is faulty.

A further switch19ecan be used to connect firstly the ground potential39and secondly a firmly prescribed reference voltage54of, by way of example, 2.5 V relative to the ground potential39to the inputs18a,18bof the analog frequency converter47, and if a value corresponding to this voltage amplitude34is not read20from the counter53, there is likewise an error.

Finally, the switch19fcan be used for continuously checking the transmission channel47for any intermediate values. In this context, a test channel30is used which is actuated31by the data processing block13. The core of this test channel is formed by a frequency-analog voltage converter55which, for the purpose of potential isolation45using an optocoupler56, is loaded with a bit train which is output by a shift register57. The shift register57is loaded via the control line31from the data processing block13and is then clocked using a prescribed frequency such that all the bits in this shift register57are output to the output58in a prescribed interval of time. Depending on the number of edges in the pulse train58which is output by the shift register57, the frequency-voltage converter55generates different analog voltages32which—with reference to the analog ground potential39—are then applied via the switch19fto the inputs18of the transmission channel17which is to be tested. There, this voltage is converted back and can be read in20by the second data processing block21. This block reports the recorded result via the memory22to the first data processing block13, which compares the value obtained in this way at the end of the loop with the value originally output to the shift register57and, from this, can identify relatively large discrepancies and may establish an error.

The same test signal39,54,32can also be used to test the first transmission channel10, with nothing but control of the multiplexers8a,8bneeding to be carried out as appropriate.

In the case of an embodiment modified further, the input circuitry can also be duplicated for each interface module4overall, for example up to the barrier45, in order to improve security further. In such a case, for the association between the inputs7a,7band7cand the modules8,19and/or the association between the voltage-frequency converters46,47and the data processing blocks13,21in the case of the two input circuits can be effected crosswise, so that the two input circuits are actuated more or less parallel in opposite directions by the data processing blocks13,21.

The invention has been described in detail with particular reference to preferred embodiments thereof and examples, but it will be understood that variations and modifications can be effected within the spirit and scope of the invention.