AU620347B2 - Fault-tolerant output circuits - Google Patents

Description

I~ i I PAlETA (51) (43) Ail-A-2L42 31/

A&A

WORLD INTELLECTUAL PROPERTY ORGANIZATION Q S nterfnal reau INTERNATIONAL APPLICAT6 4 LlJ EDIDEI TH PATENT COOPERATION TREATY (PCT) (51) International Patent Classification 4 (11) International Publication Number: WO 89/ 02124 GO6F 11/16, 11/18, 11/20 Al (43) International Publication Date: 9 March 1989 (09.03.89) (21) International Application Number: PCT/US88/02869 (74) Agent: HEAL, Noel, 21535 Hawthorne Boulevard, Suite 223, Torrance, CA 90503 (US).

(22) International Filing Date: 19 August 1988 (19.08.88) (81) Designated States: AU, BE (European patent), BR, CH (31) Priority Application Number: 091,086 (European patent), DE (European patent), DK, FR (European patent), GB (European patent), IT (Euro- (32) Priority Date: 31 August 1987 (31.08.87) pean patent), JP, KR, LU (European patent), NL (European patent), SE (European patent), SU, (33) Priority Country: US Published (71) Applicant: TRIPLEX [US/US]; 20316 Gramercy Place, With international search report.

Torrance, CA 90501 (US).

(72) Inventors: SMITH, Ste.ven, E, 3407 Laurel Avenue, Manhattan Beach, CA 90266 MURPHY, Kenneth, J. 8028 Masefield Court, West Hills, CA 51304 KUCHARSKI, Janusz, M. 1909 Carnegie 1i Lane, Redondo Beach, CA 90278 A.O.J. 1 AY W9 AUSTRALiAN 3 1 MAR 1989 PATENT OFFICE (54) Title: FAULT-TOLERANT OUTUT CIRCUITS .1 (57) Abstract Circuit modules for providing digital or analog outputs from computational devices in a manner toLiraltt of malfunctions in modu l components, In the digital output embodiment, two independent voting circuits (18a, 18b) provide outputs to series connected switches (20a, 20b) to provide a fail-safe condition for most malfunctions of the switches or the voting circuits. Two modules (22, 24) in parallel increase reliability and permit replacement of a defective module without affecting output through the other module. In an analog output module (60a), two independent voting circuits (62a, 64a) provide outputs to separate digital-to-analog converters (66a, 68a) whose outputs are compared to generate a validity signal used to activate an output switch (74a). The validity 'dgnal can be combined logically with the switch (74b) status of another module (60b), to determaine which module should be activated. An inactive module can be replaced without affecting the analog output.

WOo 89/02124 PCT/US88/02869 1 FAULT-TOLERANT OUTPUT CIRCUITS BACKGROUND OF THE INVENTION This invention rel-ttes generally to faulttolerant circuits and, itiore particularly, to output circuits associated with fault-tolerant computers and industrial controllers. The concept of using multiple computational devices to maintain the integrity of a computer-controlled process has been known for some years. The computational devices perform each function separately and the results are compared to determine the "correct" one. A commonly employed configuration has three computational devices and the results are compared in a voting circuit, such that the best two of the three results is taken to be correct. When one of the three computational devices generates erroneous results, it is usually replaced promptly, to avoid the possibility of having two malfunctioning computational devices in operation at the same time. This voting concept may be applied to practically all operations performed by the computational devices, including accessing data storage locations and performing arith'ttic or logical computations.

A different, but relatei problem is the design of output ~,$cu.;its to have a similar type of multiple redundacyy. There are two basic types of output from computational devices used as industrial controllers. One type of output consists of "on" and "off" signals and is usually referred to as digital or binary. The other form of output is in the form of an analog signal, which might be used to control, for example, the position of a valve. The valvNe, in turn, can control a fluid flow rate, a pressure level, or WO 89/02124 PCiUS88/02869 I -2e

S

es S 4 0* 4S@

S

See.

S. 0

OS

some other physical parameter. Digital output signals are used in control processes to turn direct-current (dc) motors on and off, to open and close solenoid.actuated valves, and to perform various other functions.

One approach to providing the output signals is to connect multiple outputs, from the multiple computational devices, to a voting circuit and then to connect the output of the voting circuit to the control terminal of a dc switch connected between a power supply and a load, such as a motor. The difficulty is that both the voting circuit and the switch are single components subject to failure. A failure of either of these components would probably result in the generation of an erroneous signal, in spite of the presence of multiple couputational devices. The same considerations apply to the analog case. One could connect the digital outputs of three computational devices to a single voting circuit supplying a, 20 single digital-to-nalog converter. Again, failure of either the voting circuit or the converter would probably result in 'the geerration of an erroneous output signal.

From the foregoing, it will be apparent that there is still a need for a configuration of output circuits that is more fault tolerant, 'in the same sense that the computational devices themselves are rendered fault tolerant by their multiple redundancy.

The presrent invention is directed to this end.

SUMMARY OF THE INVENTION According to the present invention there is provided a fault-tole,:ant output circuit for digital controller output signals, the circuit comprising: two identical circuit modules, each having two voting circuits connected to receive output signals from a plurality of cc putational devices, to provide two i WO 89/02124 PCT/US88/02869 -3independently voted output signals, and two electrically controllable switches connected in series in a circuit to be controlled; wherein the output signals from the voting circuits in each module are connected separately to control the two switches in the module, and the series-connected switches in one module are connected in parallel with the series-connected switches of the other module; whereby the two modules provide redundant means f r controlling the same circuit, and will carry out an intended ON or OFF command in a fault tolerant manner; and wherein either of the two modules can be removed and replaced without affecting the proper ON/OFF operation of the circuit to be controlled.

In one embodiment of the invention, specifio. cally concerned with the output of digital control signals, the output circuit comprises two voting circuits, each connected to receive output signals from a plurality of computational devices, to provide two independently voted output signals, and two electrically controllable switches connected in series in a circuit to be controlled. The output signals from the voting circuits are connected separately to control the two switches, whereby a malfunction in either of the voting circuits or either of the switches will have one of two possible results. Either a switch will fail in the ON state, j in which case the redundant series switch still main:ains proper control of the load, or, at worst, a switch will fail in the OFF state, which is a failsafe condition in which the circuit to be controlled is also OFF. Ideally, the circuit alo includes means for detecting whether either of the switches fails to turn on or off.

WO 89/02124 PCT/US88/02869 A most useful form of the invention includes two identical modules like the pne just described.

The output signals from the voting circuits in each module are connected separately to control the two switches in the module, and the series-connected switch pair in one module is connected in parallel with the series-connected switch pair of the other module. The two modules provide redundant means for controlling the same circuit, and will carry out an intended ON or OFF command in an extremely faulttolerant manner.

The fault detection means in each module includes means for generating periodic test pulses, and means for logically combining the test pulses with the output si,,nals from the voting circuits, such that each switch commanded to the OFF state is periodically switched ON by a test pulse, and each switch in the ON state is periodically switched OFF by a test pulse.

The analog output form of the invention includes means for deriving an analog output signal from a plurality of computational devices, means for determining whether the analog output signal is valid and generating a module. validity signal, and switch means for enabling or disabling analog output from the module by switching it to a high-impedance state.

In an extremely useful form of this embodiment, two identical modules are employed, and each also includes logic means for combining the module validity signal and the state of the switch means in the other module, thereby generating a switch means control signal, Only one of the modules is active at any time, with its controllable switch means in the ON condition, and the logic means ensures that the other module does not become active unless a failure is f Wo 89/02124 PCT/US88/02869 detected in the active module.

More specifically, the means for deriving an analog output signal includes two voting circuits, each connected to receive digital output signals from the plurality of computational devices, to provide two independently voted output signals indicative of a commanded analog output level, and two digital-toanalog converters connected to receive inputs from the respective voting circuits, to provide two independently derived analog output signals. The means for determining whether the analog output signal is valid and generating a module validity signal, includes an analog comparator connected to receive as inputs the outputs of the digital-to-analog converters, and to provide a binary output signal indicative of whether or not the two analog output signals match.

In the previously mentioned form of the invention having two analog output circuit modules, the logic means in each module inclucles a logic function gate having one input derived from the comparator in the same module and one input derived from the inverse of the output of the logic function gate in the other module. The logic function gates in the two modules are thereby cross-connected to form a flip-flop circuit distributed between the two modules.

It will be appreciated from the foregoing that the present invention represents a significant advance in the field of fault-tolerant output circuits. In particular, the invention ensures that commanded digital or analog output signals are gener.ated reliably, without dependence on the integrity of particular components of the circuitry. The output circuits of the invention are conveniently conws~ PCT/US88/0269 WO 89/02124 -6structed in modules that can be easily removed and replaced without affet(.ing the desired output conditions. Other aspects ar.d advantages of the invention will become apparent from the following more detailed descri '.ion, taken in conjunction with the a.ccompanying draw ngs.

BRIEF DESCRIPTION OF THE DRAWINGS FIGURE 1 is a simplified block diagram of a de output circuit in accordance with the invention; FIG. 2 is a simplified block diagram of a two-module dc output circuit similar to that shown in FIG. 1; FIG. 3 is a more detailed block diagram of the circuit of FIG.1; FIGS. 3a and 3b are simplified graphs of test pulse waveforms used in the circuit of FIG. -3; FIG. 4 is a more detailed schematic diagram of portion of a dc output circuit similar to that shown in FIGS. 1 and 3; and FIG. 5 is a simplified schematic diagram of an analog output circuit in accordance with the invention.

DESCRIPTION OF THE PREFERRED EMBODIMENTS As shown in the drawings for purposes of illustration,, the present invention is concerned with providing fault tolerance in output circuits in industrial control systems and the like. Although systems exist to provide redundancy and fault tolerance at a computational level, output control signals should ideally b applied through output circuits that are also resistant to component

L

WO 89/02124 PCT/US88/02869 -7malfunctions. Two principal types of control signals may be characterized as digital or on-off signals, and analog signals.

In accordance with the invention, output control signals are not only "voted" to eliminate a possible erroneous signal, but voting circuits and output switches are duplicated in such a manner as to eliminate the possibility of an output fault caused by a single component failure. In both the digital and analog output cases, components are continually monitored for correctness of operation, so that defective components may be replaced prior to the possible occurrence of a second failure.

FIG. 1 shows the simplest form of the invention, fo. controlling a direct- urrent (dc) circuit having, for example, a power supply, indicated by reference numeral 10, and a dc motor 12. A control system, which is not shpwn in full, includes three identical computational devices 14a, 14b and 14c that generate output signals to control the on-off condition of the motor 12. The control signals, on output lines 16a, 16b and 16c are applied to two identical voting circuits 18a, 18b, which determine the correct output signal based on a "vote" of the input signals.

The voted output signals are then applied to control two series-connected switches 20a and 20b, which connect the power supply 10 to the motor 12.

Digital outputs for the control of motors and similar loads usually have a preferred or "fail-safe" condition. If an ON signal is commanded and the motor fails to turn on, this is normally considered to be an acceptable failure condition, so long as the condition is quickly detectable and can be remedied. On the other hand, if an OFF signal is commanded and the motor inadvertently stays on, this WO 89/02124 PCT/US88/02869 -8is normally an unacceptable failure condition. If a single voting circuit and a single switch were used to control the motor 12, there would be, in theory, an equal probability that the switch could fail in the ON condition as in the OFF condition. Thus there is a high probability of a failure of the unacceptable type.

In the configuration of FIG. 1, on the other hand, the likelihood of an unacceptable failure condition is extremely small, as indicated in Table 1 below, showing possible combinations of failure conditions, in which the switches 20a, 20b are indicated as A and B: IF Table 1 A off A on B off B on (A off (A on (A off (A on (B off (B on (B on (B off OK OK OK OK OK BAD OK OK The top row of the table indicates the failure condition, for example, "A off" means that switch A fails in the OFF condition, i.e. it cannot be switched on. The last four columns of the table indicate failures of both switches. The "OK" condition means that the controlled motor or other load can either be switched off by one of the two switches, or that the output circuit as a whole will fail in the generally safe OFF condition. Because switches 20b are connected in series, the failure of either one of them in the ON condition is not fatal to the overall circuit, since the other switch can still be switched off. Also, the failure of one or both switches in the OFF condition is not fatal if, as is usual, the OFF condition is a safe failure condition :1 WO 89/02124 PCT/US88/02869 -9for the controlled motor 12. The only unacceptable failure condition occurs when both switches fail in the ON condition. The likelihood of this condition is extremely low. For example, if there is a probability of 1% that one switch will fail in the ON condition during a preselected time period, and an equal probability that it will fail in the OFF condition, the use of a single switch to control the motor will result in a 1% probability of unaccep' le failure within the time period under consideration. On the other hand, if two series switches are employed in the configuration of FIG. 1, the probability of an unacceptable failure during the same time period is only .01 x .01, or As will now be further explained, the probability of an unacceptable failure can be reduced even further by the use of multiple modules of the type shown in FIG. 1.

FIG. 2 shows two identical dc output modules of the type shown in FIG. 1. The modules, indicated at 22 and 24, are connected by external wiring to the power supply 10 and load 12, such that the series-connected pairs of switches 20a, 20b are connected in parallel. Thus, power can be applied to the load through either or both pairs of switches, and one module may be totally removed and replaced without affecting the control of the load. When this arrangement also includes circuitry for the detection of faults in the modules, a defective module can be promptly replaced before the possible occurrence of a defect in the other module.

It will be seen that this arrangement is not only "fail-safe" but is "fail-operational." That is to say the failure of one component will not affect the intended switching result. For :xample, if it is intended to switch the load ON but one of the f WO 89/02124 PCT/US88/02869 switches fails in the OFF condition, the other switching module will still ensure that the load is switchie to the ON condition. Similarly, if it is intended to switch the load OFF but one of the switches fails in the ON condition, the series switch connection in each module will still ensure that the load is switched to the OFF condition. The only condition that results in an unintended operation arises when both switches in the same module fail in the ON condition and it is intended to switch the load OFF. As will be discussed, the failure of any one switch can be detected by appropriate circuitry within each module, and the module can usually be replaced before the failure of the second switch in the module can occur. The probability of both switches in the same module failing in the ON condition at nearly the same time is extremely low.

One measure of a low probability of failure is a long mean time between failures (MTBF). For the configuration described, the mean time between failures is believed to be measured in hundreds of years.

FIG. 3 is a more detailed schematic diagram of the module illustrated in FIG. 1. Outputs from the voting circuits are shown as passing through respective signal conditioning circuits 30a, 30b, and through two respective exclusive OR (XOR) gates 32a, 32b. The outputs of the XOR gates pass through isolators 34a, 34b before controlling the switches 20b, which are shown as MOSFETs (metal oxide semiconductor field-effect transistors). The load, indicated at 12' is connected between the two switches 20a, 20b. The output circuit also includes an oscillator 36, supplying a test pulse shaping circuit 38, which in turn supplies test pulses, indicated as X and Y respectively, to one input of =WW Z WO 89/02124 PCT/US88/02869 -11each of the XOR gates 32a, 32b. The other inputs to the XOR gates are referred to in the subsequent discussion as A and B respectively, while the outputs of the XOR gates are referred to as A' and B'.

The XOR gate outputs A' and B' are also connected to fault detection circuitry, indicated at which also monitors the conditions of the switches 20a, 20b. The dc power circuit extends from the power supply 10 through the first 'switch then through a diode 42 to the load 12', then through another diode 44 to the second switch and finally to the power supply return. The junction between the first switch 20a and diode 42 is coupled to the fault detection circuitry 40 through another isolator 46a, and the junction between the second switch 20b and diode 44 is coupled to the fault detection circuitry through another isolator 46b.

The isolators are for the purpose of isolating the circuit being controlled, in this case the dc motor circuit, from control logic associated with the output circuit of the invention. Isolation is conventionally provided with the combination of a lightemitting diode and a phototransistor.

The test pulses X and Y generated in the test pulse shaping circuit 38 are substantially as shown in FIGS. 3a and 3b. Each signal (X and Y) is maintained at a high or logical level for most of the time, but pulses to a low or logical level approximately every second. The duration of each pulse is approximately 300 microseconds or less.

Moreover, the X and Y pulses are not concurrent but are offset in time as shown in FIGS. 3a and 3b.

The relationship between the test pu.lses X and Y and the A, B, A' and B 1 signals is shown in Table 2 below: WO 89/02124 PCT/US88/02869 -12- 2 Output Command A/B X/Y Comment

ON

ON

OFF

OFF

Test turnoff ability Turn-on normal operation Test turnoff ability Turnoff normal operation When the output command is ON, the signals A and B are and these are complemented in theXOR gates to produce a signal at A' and B' when no test pulse is occurring. During each test pulse (X or Y the A' or B' signal is temporarily dropped to a logical and the corresponding switch 20a or is opened for a ver-r short time. Since most of the loads being controlled are high-intertia devices Like motors, this brief interruption in the power supply is not significant. While the switches are commanded to the OFF state, the same test pulses are effective to switch the switches temporarily to the ON state, but since the X and Y signals are offset in time both switches are never turned on together. The test pulses propagate back to the fault detection circuitry 40, which controls a convention4,l :atchdog timer circuit (not shown). The well known principle of the watchdog timer is that it must be reset within some selected time period in order to prevent the occurrence of an alarm condition. In this case, the timer is reset by the detection of the X and Y test pulses as they propagate back from the switches 20a If either switch fails to open or close as commanded by one of the test pulses, the timer will not be reset and an error condition will be comm'-icated to personnel operating the syst.em.

FIG. 4 is a detailed schematic diagrazz o a Y 1 WO 89/02124 PCT/US88/02869 -13portion of an output circuit like the one shown in FIGS. i and 3. The same reference numerals have been used, where appropriate, to indicate equivalent components. The FIG. 4 schematic also indicates standart part numbers for various circuit components.

It will be more apparent from this schematic diagram how the fault detection circuitry 40 of FIG. 3 is implemented in the presently preferred embodiment of the invention, The first switch 20a is connected to a Zener diode 50 and then through the isolator 46a to the power supply return. Similarly, the second switch is connected through another Zener diode 52 and thence through isolator 46b and to the power supply line. The output of isolator 46a is coupled to a watchdog timer circuit 54, and the output of isolator 46b is coupled to another watchdog timer circuit 56.

When it is intended that both switches vb be in the OFF condition, and a test pulse is applied to switch 20a .o switch it on, a circuit is established through switch 20a, Zener diode 50, and isolator 46a. Therefore, a pulse appears at the output of the isolator 46a and resets the timer 54.

Similarly, when the other switch 20b is p lsed to the ON condition, a circuit is established through isolator 46b, Zener diode 52, and the switch thereby providing a pulse from the isolator and resetting the timer 56.

When both switches 20a, 20b are in the ON condition, the two paths through the Zener diodes are established together, but an interruption in either path, caused by the pulsing OFF of one of the switches, causes a pulse output from one of the isolators '46a, 46b, and resets one of the timers 54, 561 The timers are arranged to require a reset pulse within 3 seconds before generating an alarm signal, L, i -'~-ruuCr- WO 89/02124 PCT/US88/02869 -14and the test pulses are provided every second. If three consecutive test pulses applied to one of the switches do not propagate through to the appropriate timer 54, 56, a malfunction is assumed to e;xist.

In the analog output circuit in accordance with the invention, as shown in FIG. 5, two circuit modules 60a, 60b are normally employed, but only one of them provides the desired analog output signal at any time. The other module performs the same voting and digital-to-analog conversions as the active module, but its output is disabled so long as the active module continues to provide accurate output signals. In the following discussion, the same reference numerals are employed for both modules, ith the suffixes a and b indicating vrhich module is referred to. Each module has two &an-=g voting circuits 62 and 64, and two independent digital-toanalog converters 66 and 68. The voting circuits 62, 64 are basically digital voting circuits, producing an output that is the majority-vote of its three digital inputs. The voted outputs are converted to analog form in the converters 66, 68, and then input to an analog comparator 70, which produces a binary output indicative of whether the two analog inputs are equal to within a preselected margin. The binary output of the comparator 70 is applied as one input to an AND gate 72, the output of which is used to control the position of a switch 74. The other input to the AND gate is' an inverted input. The switch 74 is connected between the output of one of the converters 66 and an output terminal 76. Output terminals 76a and 76b are connected in common to provide a single output signal from the pair of modules Completing the circuitry are cross-connections between the AND gates 72. Thus, the output of AND 14t WO 89/02124 PCT/US88/02869 gata 72a is externally connected to the inverted input of AND gate 72b, and the output of AND gate 72b is ccnnected to the inverted input of AND gate 72a.

In operation, if the two converters 66, 68 of the same module provide nearly identical outputs it is assumed that the module is operating properly.

The comparator 70 then generates a logical "1" output, which is applied as an input to the AND gate 72. Ass-uming, for the moment, that switch 74a is closed and switch 74b is open, AND gate 72a will generate a logical at its output, to hold switch 74a closed, and AND gate 72b will have a logical "0" output. The cross-connected AND gate outputs will be fed back to opposite inverted inputs of the AND gates, 'which will hold the outputs stably in this condition. The output conditions will be reversed only if one module detects a malfunction an other module is off but not defective. In the in which the A module is providing the out through its closed switch 74a, if a malfuncti s detected on the A module, there will be a otput from the comparator 70a, which will produce a "0" output from AND gate 72a. This output will feed back to AND gate 72b as a logical which will provide a output from the B module AND gate, thereby closing switch 74b.

The AND gates 72 and their cross-connections form a simple flip-flop, the structure of which is distributed between the two ciZrw't modules 60. The state of the flip-flop determines which of the two modules is currently active, and the monitored state of each module determines when the flip-flop will be switched from one state to the other.

An important property of the distributed flip-flop formed by the two AND gates 72 is that the WO 89/02124 PCT/pS88/028'69 module that has a logical output, i.e. the inactive module, can be removed without affecting the active module. The inactive module provides a logical input through its cross-connection to the active module. If logical is represented by a zero voltage level, removal of the inactive module will have no effect on the active module. Therefore, the inactive module can be removed and replaced as soon as a defect has been detected, without interrupting operation of the apparatus being controlled.

A single module of the analog output type has more limited application, but does provide a fail-safe type of operation analogous to the failsafe operation of the digital output circuit module of FIG. 1. Upon detection of a fault by the comparator 70, the switch 74 will be turned off, as described in relation to the dual module system of FIG.

.If only one module is present, this provides a zero output from the module, which is typically the output level providing a fail-safe condition in analog control systems.

It will be appreciated from the foregoing that the present invention represents a significant advance in the field of fault tolerant control systems. In particular, the invention provides an output circuit configuration that is tolerant to faults in at least one component and has an extremely long means time between failures. It will also be appreciated that, although various embodiments of the invention have been described in detail for purposes of illustration, various modifications may be made without departing from the spirit and scope of the invention. Accordingly, the invention is not to be limited except as by the appended claims.

I

c

Claims (4)

1. 2. A circuit as defined in claim 1, and further comprising: :ault detection means within each module, for detecting inability of a module switch to respond to ON 25 or OFF signals, 0
2. 3. A circuit as defined in claim 1, wherein the fault detection means includes: means for generating periodic test pulses; and wherein each switch commanded to the OFF state is periodically switched on by a test pulse and each switch in the ON state is periodically switched off by a test pulse. ~Ar Qi2 20821A WO 89/02124 PCT/US88/02869 i I- -1
3. 4. A fault-tolerant output circuit for generating analog output signals, the circuit com- prising: two voting circuits, each connected to receive digital output signals from a plurality of computational devices, to provide two independently voted output signals indicative of a commanded analog output level; two digital-to-analog converters connected to receive inputs from the respective voting cir- cuits, to provide two independently derived analog output signals; an analog comparator connected to receive as inputs the outputs of the digital-to-analog convert- ers, and to provide a binary output signal indicative of whether or not the two analog output signals match; and t a controllable switch connected between .an output from one of the digital-to-analog converters 20 and an output terminal, the switch having a control terminal to which the output of the comparator is coupled; whereby detection of non-matching analog outputs from the digital-to-analog converters has the 25 effect of disabling analog output from the entire "output circuit. 0 SI *O 0 WO 89/02124 PCT/US88/02869
4. 19- A fault-tolerant output circuit for generating analog output signals, the circuit com- prising: two circuit modules, each including two voting circuits, each connected to receive digital output signals from a plurality of computational devices, to provide two indepen- dently voted output signals indicative of a com- manded analog output level, two digital-to-analog converters con- nected to receive inputs from the respective voting circuits, to provide two independently derived analog output signals, an analog comparator connected to receive as inputs the outputs of the digital- S. to-analog converters, and to provide a binary I A output signal indicative of whether or not t? two analog output signals match, a controllable switch connected between 20 an output from one of the digital-to-analog con- verters and an output terminal, which is common to both modules, the switch having a control terminal to which the output of the comparator is indirectly coupled, and 25 logic means for combining the compara- tor output and the logical state of the control- lable switch of the other of the two circuit •modules, to generate a control signal connected to the switchy a wherein only one of the modules is active, with its controllable switch in the ON condition, and the logic means ensures that the other module does not become active unless a failure is detected in the active module. A I f' WO 89/02124 PCT/US88/02869 6. A circuit as defined in claim 5, wherein: The logic means in each module includes an AND gate having one input derived from the comparator in the same module and one input derived from the inverse of the output of the AND gate in the other module. 7. A fault-tolerant output circuit for generating analog output signals, the circuit com- prising: two circuit modules, each including means for deriving an analog output signal from a plurality of computational devices; means for determining whether th analog output signal is valid and generating module validity signal, 10 controllable switch means for enabling or disabling t o analog output from the module, logic means for combining the module b validity signal and the state of the switch means in the other module, and thereby generating a switch means control signal for this module; wherein only one of the modules is active, with its controllable switch means in the ON con- dition, and the logic means ensures that the other module does not become active unless a failure is detected in the active module. S** S 4 HA ~T LII--~P- asa~ 21 8. A circuit as defined in claim 7, wherein the means for deriving an analog output signal includes: two voting circuits, each connected to receive digital output signals from the plurality of computational devices, to provide two independently voted output signals indicative of a commanded analog output level; and two digital-to-analog converters connected to receive inputs from the respective voting circuits, to provide two independently derived analog output signals. 9. A c.rcuit as defined in claim 8, wherein the means for determining whether the analog output signal is valid and generating a module validity signal, includes: an analog comparator connected to receive as inputs the outputs of the digital-to-analog converters, and to provide a binary output signal indicative of whether or not the two analog output signals match. A circuit as defined in claim 9, wherein: the logic means includes a logic function gate having one input derived from the comparator in the same module and one input derived from the inverse of the output of the logic function gate in the other module. 11. A fault-tolerant circuit as defined in claim 7, wherein: either of the two modules can be removed and replaced without affecting the proper' analog output operation of the output circuit. 12. A fault-tolerant output circuit substantially as hereinbefore described with reference to Figure 1 or Figure 2 in conjunction with Figures 3 to 4 of the accompanying drawings. Dated this 6th day of November 1991 TRIPLEX By their Patent Attorneys GRIFFITH HACK CO I'S 20821A