Patent Number: 047626631
Section: description

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Reference will now be made in detail to the presently preferred embodiments of the invention, an example of which is illustrated in the accompanying drawings. FIG. 1 shows a functional block diagram of a basic circuit according to the present invention. Numeral 10 designates generally a switch having two pairs of contacts, one of which is normally open (contact pair 20 in FIG. 1), and the other of which is normally closed (contact pair 30 in FIG. 1). Connected across contact pair 20 is first test circuit 40. Similarly, connected across contact pair 30 is a second test circuit 50. First test circuit 40 is adapted to produce a first status signal STAT1 normally indicative of the state of contact pair 20. Similarly, second test circuit 50 is adapted to produce a second status signal STAT2, normally indicative of the state of contact pair 30. Since it is given that when the switch is operating properly, the contact pairs will be in opposite states, the value of STAT1 and STAT2 should never be equal if the switch is operating properly. Logic circuit 60 compares the values of STAT1 and STAT2 and produces a monitoring signal having a first value if STAT1 and STAT2 are not equal, thus indicating normal operation, and a second value if STAT1 equals STAT2, thus indicating that the switch 10 is malfunctioning. The circuit depicted in FIG. 1 also includes a test control circuit 70. Test control circuit 70, in response to a control signal C, is capable of producing a first enable signal EN1 and a first select signal SEL1 for first test circuit 40, and a second enable signal (EN2) and a second select signal (SEL2) for second test circuit 50. Details of the construction of a circuit serving as test control circuit 70 will be readily apparent to one having ordinary skill in the art. When the enable signals have a first logical value (e.g. low) first and second test circuits 40 and 50 operate normally, i.e., the signals STAT1 and STAT2 are indicative of the actual state of contact pair 20 and 30, respectively. When the enable signals assume a second value (e.g., high), the signals STAT1 and STAT2 are no longer reflective of the condition of the contact pairs, but instead assume a value dependent on the value of the SEL1 and SEL2 signals, respectively. Thus, it is possible to "inject" forbidden logical values into the system. When the enable signals enable testing, and the select signals select the same value for STAT1 and STAT2, an error condition is artificially created. If the logic circuit does not produce a malfunction indication in response to the injection of the invalid logic state, then it may be inferred that the logic circuit is malfunctioning or that the test circuits are malfunctioning, and appropriate corrective measures may be undertaken. Switch 10 is intended to represent a form "C" switch, but a form "D" switch, or any other switch which includes two pairs of contacts which normally have different states, may be used. If a form "D" switch is used (make before break), there is naturally a brief instant when both switches are closed. The brief existence of an invalid logic state, however, can be identified and discriminated so that it does not produce an error signal. Also, in the foregoing discussion and the discussion which follows, it is assumed that there are separate enable and select signals generated. It will apparent to one of ordinary skill in the art, however, that the same enable and select signal could be sent to first test circuit 40 and second test circuit 50 and still provide satisfactory operation of the system. Finally, for maximum reliability, it is desirable that each "channel" (defined by a pair of contacts) have an independent power supply. In the circuit shown in FIG. 1, two power supplies are represented by separate numerals for the triangles representing ground. The power supplies are assumed to have their high sides tied together between the pairs of contacts at +V. FIG. 2A shows a preferred circuit to serve the function of first test circuit 401. This can be seen, the circuit comprises a first relay 80 having a first terminal 90, a second terminal 100, and a third terminal 110. The first terminal 90 is connected to the contact of switch 20 which is not directly connected to the other pair of contacts 30. The third contact 110 is selectably connectable to either first terminal 90 or second terminal 100 depending on the position first relay arm 120. The position of first relay arm 120 is controlled according to whether or not a current flows first relay coil 130, a condition which is, in turn, controlled by whether EN1 is high or low (i.e., the presence or absence of EN1). The circuit also includes a second switch or relay 140 having at least fourth terminal 150 and a fifth terminal 160. The second terminal 100 of first relay 80 is connected to fourth terminal 150 of second relay 140. The fifth terminal is connected to +V. Whether the fourth terminal, and thus the second terminal, is connected to +V is controlled by the position of second relay arm 180, which is in turn controlled by second relay coil 190. In other words, the connection between fourth terminal 150 and fifth terminal 160 will be made when current flows through coil 190, which occurs when the select signal SEL1 goes high. Relays 80 and 140 may be any suitable relay, for example, a Teledyne 712M-112. Also, relay 140 may be replaced by a simple electromagnetic switch. The output from third terminal 110 is used as input for optoelectronic isolation circuit 195. When terminal 110 is high (that is, when it connected to +V either through contact pair 20 or through second relay 140 in a manner which will be described below) current flows through the LED internal to optoelectronic isolation circuit 195 so that it emits light. This transmission of light renders the diode in the output side of optoelectronic isolation circuit conductive, thus rendering a low or logical 0 signal for status signal STAT1. Otherwise, the status signal STAT1 remains high. In normal operation, the enable signal would be low, which directly connects switch 20 to the optoelectronic isolation circuit 195, so that the logical value of status signal STAT1 would be reflective of whether contact pair 20 is open or closed. When it is desired to test the circuit, on the other hand, the enable signal EN1 goes high to energize relay coil 130, thus moving relay arm 120 from contact with first terminal 90 to contact with second terminal 100. The logical value of status signal STAT1 will depend upon whether the switch defined by relay arm 180 and fourth contact 150 is open or closed. The state of the switch is controlled by the select signal SEL1. When SEL1 is low, the switch remains open, no current flows through the optoelectronic isolation circuit 195, and the STAT1 signal remains high. When the switch is closed, current flows through the light emitting diode within optoelectronic isolation circuit 195 and so the STAT1 signal becomes low. The optoelectronic isolation circuit may be any suitable circuit, for example, an HCPL-3700. Details of construction and operation of second test circuit 502 are identical to those just described, and will be omitted here for the sake of brevity. Let it suffice to say that second test circuit 50 as shown in FIG. 2B also comprises a pair of relays 85, 145, interconnected in a fashion similar to that described above for relays 80, 140, respectively, and an optoelectronic isolation circuit 197. With a circuit such as that just described, it is expected that periodic testing of each contact input circuit on a 4-6 week interval will be feasible. As mentioned above, a contact arrangement such as a form "C" contact arrangement offers a means in inherent error detection. Of the four possible combinations (00, 01, 10, and 11), only two are valid, and the other two are detectable as invalid. The test circuit in effect forces the inputs to assume the invalid states of 00 and 11 (those having even parity) and verify that the built-in error detection logic is working correctly. Until the next periodic test, the contact closure's input system continuously checks for valid inputs, and if a wire, connection, or switch should fail "shorted" or "open" the logic processor is programmed to take appropriate action such as reporting the fault and reverting to a safer or preferred state. In addition to testing the continous test capability of the contact closure input logic processor, the automatic tester sets up test conditions to check the system logic from input to output. When enabled, for example, by a key switch, the auto tester can force the status of each individual contact closure input (CCI) signal to be either closed or open. It does this by outputting a logic "0" and thus causes the switch to appear to be closed. Thus, all four possible states may be injected into the system, and proper system operation may be ascertained by means of output signals which are monitored by the automatic tester via data links. FIG. 3 shows the testable contact closure input circuit as part of an overall system such as would be used in a safety grade application such as in a nuclear power plant. In the arrangement shown in FIG. 3, surge withstand circuits 200 and 210 have been interposed between the test circuits and their respective pair of contacts. The surge withstand circuits are used to decouple the plant contacts from the test injection circuit during invalidity tests, and they also serve to limit surge withstand circuit test currents to the test circuitry. These test circuits are well known to one of ordinary skill in the art, and typically include choke coils to reject RF signals, appropriate resistor networks, and capacitor networks. Typically, they are designed to withstand up to a 3,000 volt surge. Downstream of first test circuit 40 and second test circuit 50 are debounce circuits 240 and 250. These circuits "debounce" the signals (i.e., prevent erroneous indications of multiple depression of a switch inadvertently caused by "bounce" in the switch) by accepting a change in state only after the signal level has been stable for several consecutive samples. Such debounce circuits are well known in the art, and commercially available. For example, a Motorola MC14490 Hex Contact Bounce Eliminator would suffice in this application. Finally, an additional pair of optoelectronic isolation circuits, 260 and 270 are interposed between the debounce circuits and the logic circuit, respectively, in order to provide an additional degree of electric isolation and to prevent any circulating currents. FIG. 4 shows the self-testing monitoring circuit incorporated into the monitoring system of a nuclear plant. Switch 10 having normally open contacts 20 and normally closed contacts 30 represents any of the multitude of such switches (e.g., form "C" or form "D") normally included in a control system panel of a nuclear reactor. The self-testing monitoring circuit connects across the contacts as previously described, and produces a monitor signal which the monitoring system uses to determine either proper operation or malfunction and response. If will obvious to one of ordinary skill in the art that many modifications of the specific embodiments described above can be made without departing from the spirit of the invention. For example, if desired, the first and second relays may be replaced with optoelectronic isolation circuit for forcing the status outputs STAT1 and STAT2 high or low as desired. Therefore, the invention should not be regarded as being limited to the embodiments specifically described above, but instead should be regarded as being fully commensurate in scope with the following claims.