KR100497116B1 - Fail-safe, fault-tolerant switching system for a critical device - Google Patents

Abstract

The present invention relates to a fault tolerant fail-safe switching system for critical devices, comprising: a pair of first terminals connected to a power source; A first circuit having a first fuse device, a first switching device, and a third switching device connected in series between the pair of first terminals; A second circuit having a second fuse device, a second switching device, and a fourth switching device connected in series between the pair of first terminals, the second circuit being connected in parallel with the first circuit; And when the first and second switching devices are opened and the third and fourth switching devices are closed, or the first, second, third, and fourth switching devices are opened, the fault-tolerant operation is performed by the first fuse device, One terminal is connected between the first and third switching devices so that one terminal is generated between the first and fourth switching devices, or the second fuse device, the second switching device and the third switching device. It includes a pair of second terminals for connecting with the critical device between the switching devices.

Description

Fault-tolerant fault-safe switching system for critical devices {FAIL-SAFE, FAULT-TOLERANT SWITCHING SYSTEM FOR A CRITICAL DEVICE}

The present invention relates to a fault-tolerant fail-safe switching system for critical devices.

Failure-safety devices are used where there is a risk of damage or damage to personal property. For example, a large truck's air brake is released by the air pressure on a strong actuator. Failure of any air pressure system releases the springs to provide a brake to the "fault safe" system. In track trains, a "vital relay" is used to monitor the presence of a vehicle to control the distance between trains. When the gap is sensed below the required value, the relay's power is cut off and the "Fault Safe" gravity force depends on the close contact and generates a warning signal. The use of highly sophisticated electrical computer control systems, such as in individual high speed transportation (PRT) systems, requires very sophisticated requirements for fail-safe operation. PRT systems are driverless, automated, compact, and passenger vehicles operating on guideways. Moreover, fault-tolerant operation that keeps a partially disabled but safe vehicle still in operation is important. For example, the PRT must always operate in a fault-safe state, but some fault tolerance is required so that the fault will at least move the vehicle from the induction plane to maintenance, so that the failed vehicle does not interfere with the operation of other vehicles by stopping it. Shall be. PRTs are just one example of where fault tolerant fault-safe systems are needed. This provides a switching circuit with multiple switches that provide fail-safe operation: one switch is not sufficient because a switch, which can be mechanical or semiconductor, can fail in a closed or open mode. The result is therefore not predictable and failures are not guaranteed to be safe. Two or more switches in series increase reliability and are safe even if a defective switch is detected. Two or more switches in parallel provide extras but do not increase reliability.

1 is a schematic diagram of a fault tolerant fail-safe H switch according to the invention.

FIG. 2 is a view similar to FIG. 1 including a monitoring device and a controller for monitoring and controlling the operation of individual switches.

FIG. 2A is a view similar to FIG. 2, with a diode bridge connected across a polarized rod. FIG.

3 to 7 are flowcharts for explaining the operation of the controller and the monitor.

8 illustrates the desired operation of an H switch in accordance with the present invention.

It is therefore an object of the present invention to provide an improved fail-safe switching system.

It is a further object of the present invention to provide a fault-safe switching system which has improved fault tolerance on its own for some faults.

It is a further object of the present invention to provide a fault-tolerant fault-safe switching system which is simple, reliable and uses a few conventional parts.

It is a further object of the present invention to provide a fault tolerant fail-safe switching system which is capable of tracking and self-testing faults with individual switching elements.

It is a further object of the present invention to provide a fault tolerant fault-safe switching system that can be monitored and controlled to reconfigure fault-safe operation for further faults.

It is a further object of the present invention to provide a fault tolerant fail-safe switching system using fuses to overcome failures due to a failed switching device in closed-mode.

It is a further object of the present invention to provide a fault tolerant fault-safe switching system that reduces the likelihood of failure in hazardous mode.

It is a further object of the present invention to provide a fault tolerant fault-safe switching system capable of operating in a single fault condition.

It is a further object of the present invention to provide a fault tolerant fault-safe switching system that is resistant to common mode failures.

The present invention provides fault-tolerant and fault-tolerant fault-tolerant fault-safe switching systems for their critical devices through their inherent operation in which the system is implemented by means of automatic monitoring and control of the switching device as a whole using two parallel networks. The two parallel networks each comprise a series of fuse devices and two switching devices, each of which is important for the switching between the switching device and the fuse device of each network at each junction between the networks. Connected.

The invention provides a pair of first terminals connected to a power source, a first network having a first fuse device connected in series between a pair of first terminals, a first switching device and a third switching device, and a A second network having a second fuse device, a second switching device and a fourth switching device connected in parallel with the first network between the first terminals of the pair and connected in series between the first terminals of the pair; It is characterized by fault-tolerant fault-safe switching systems for critical devices. The first switching device and the second switching device are open, the third switching device and the fourth switching device are closed, the first switching device, the second switching device, the third switching device, and the fourth switching device are open, the first fuse. When the device and the second fuse device are opened, the first switching device and the second switching device are open, and the third and fourth switching devices are closed so that the first fuse device and the second fuse device are not damaged; The first switching device is in a faulty on state, the second switching device is opened, the third and fourth switching devices are closed, and fuse 1 is opened due to a short circuit path through the first and third switching devices, and 2 fuse unit is not damaged; The first switching device is open, the second switching device is in a faulty on state, the third switching device and the fourth switching device are closed, the fuse 1 is not damaged and the fuse 2 is a short circuit through the second switching device and the fourth switching device. When opened due to the path, the fault-safe current is removed from the critical device, and fault-tolerant operation is achieved by the first fuse device, the first switching device and the fourth switching device, or the second fuse device, the second switching device and the third switching device. To occur through the device, there is a pair of second terminals, one terminal connected to the critical device between the second switching device and the fourth switching device in the first switching device and the third switching device.

In a preferred embodiment there may be a unidirectional current flow circuit that is interconnected between the pair of second terminals and the critical device so that the current flows in one direction. The unidirectional current flow circuit can include a diode bridge. There is a first monitor circuit for monitoring the first switching device, a second monitor circuit for monitoring the second switching device, a third monitor circuit for monitoring the third switching device, and a fourth monitor circuit for monitoring the fourth switching device. Can be. There may be a controller responsive to the monitor circuit for selectively operating the switching device.

Other objects, features and advantages will be apparent to those skilled in the art from the following preferred embodiments and the accompanying drawings.

Four switches: basic H switch including switch 1 (12), switch 2 (14), switch 3 (16), and switch 4 (18) and two fuses 1 (20), and fuse 2 (22). 10 is shown in FIG. 1. The switch is arranged in an "H" shape with the critical rod 24 in the middle. The switch may be a conventional switch, relay, or semiconductor device. The first network 26 comprising fuse 1 20, switch 1 12 and switch 3 16 is in this embodiment a pair of terminals 28 and 30 respectively connected to the positive power supply and ground respectively. Is connected between. The second network 32 comprising fuse 2 22, switch 2 14 and switch 4 18 is connected in parallel with the network 26 between the terminals 28, 30. The critical device 24 is connected between a terminal 34 located between switch 1 12 and switch 3 16 and a terminal 36 located between switch 2 14 and switch 4 18. These four switch base configurations have 16 combinations. Two of them power the device. This depends on the fact that the device can be driven by current flowing from left to right through the critical device 24 or from right to left through the critical device. The four combinations can be used in self-test circuits by turning on only one switch; Three combinations are in a safe state; And seven other combinations close the fuse and return to one of the other combinations. This is explained in more detail below. Two power supply modes are complementary. This protects common mode failures and thus reduces the likelihood of failure in an unsafe state.

Table 1

Switch 4 Switch 3 Switch 2 Switch 1 mode off off off off Safety 1 off off off On Self-test 1 off off On off Self-test 2 off off On On Safety 2 off On off off Self-test 3 off On off On Fuse disconnect off On On off Power supply 1 off On On On Fuse disconnect On off off off Self-test 4 On off off On Power supply 2 On off On off Fuse disconnect On off On On Fuse disconnect On On off off Safety 3 On On off On Fuse disconnect On On On off Fuse disconnect On On On On Fuse disconnect

The two states that actually enable brake release are: (1) switch 1 and switch 4 are on and switch 2 and switch 3 are off; And (2) switch 2 and switch 3 are on, and switch 1 and switch 4 are off. This assumes that the critical rod 24 has no polarity. This is the case, for example, when the critical rod is a solenoid.

The external circuit functions to control the H switch 10 in the following manner. In power off mode, the external circuitry disables all switches and monitors the switches to find out whether switch 1 or switch 2 is shorted. If switches 1 and 2 are not shorted, switches 3 and 4 are turned on. This is a safe state. If a power down condition is required, a self test is performed on the switch. This self-test is done by looking for each switch to be turned on and off. Next, a detection is made as to whether the H switch can be safely powered on, and if so, the power supply mode is entered. This can be more easily understood by the following description.

In addition to providing protection against a false combination of four signals, the fuse also allows the controller to convert the failure of the top two switches from failed closed to failed open. To be. This is done by intentionally closing the switches in the same leg. Open faults are much easier to handle than closed faults for fault tolerant systems. Four switches are monitored by FIG. 2: Monitor 1 (40), Monitor 2 (42), Monitor 3 (44), and Monitor 4 (46). Each monitor in this embodiment is implemented by an optoacoustic insulator 48 and a resistor 50, as shown in connection with monitor 1 40. By using the optoacoustic-insulator, the controller 52 can be electrically insulated from the critical load. This electrical isolation is perfect if the actual switch is implemented by a solid state relay. This reduces the monitor's negative impact on critical devices and improves circuit reliability. System safety is not significantly reduced by the presence of the monitor because in normal operation the current of the monitor is limited to a fraction much smaller than necessary to operate the solenoid by the series resistor 50. Since the resistors can only fail in the open state, they cannot power the solenoids. The controller 52 may be a microprocessor such as the Motorola 68040 programmed as a function as described below and with respect to FIGS. 3-7.

H switch 10 can be any switch open or close fault and operate in a fail-safe manner. One process that can be implemented by the controller 52 is as follows. If releasing the brake is required by the controller 52, a self-test is run to check whether each switch can be turned on and off. If switch 1 is an open fault, the H switch turns on switches 2 and 3, switches 1 and 4 are turned off and critical devices are connected. If switch 1 is a closed fault, the H switch turns on switches 2 and 3 and switches 1 and 4 are turned off. This will isolate fuse 1 on the same line as switch 1 and the critical device will be connected. Similar processing can be done in Switch 2 failure mode. If switch 3 is an open fault, the system turns on switches 1 and 4 and turns off switches 2 and 3 so that critical devices are connected. If switch 3 is a closed fault, the critical device is reconnected since it can continue to operate by turning on switches 2 and 3 and turning off switches 1 and 4. Similar processing can be done in Switch 4 failure mode. If multiple faults are found, all four switches can be turned off and critical devices can be released. When the controller is requested to apply a brake, switches 1 and 2 are turned off and switches 3 and 4 are turned on. If for some reason either switch 1 or switch 2 should not be on, it detects that a second fault, such as being on, is missed, and all four switches are open.

2A, critical device 24a may comprise a rod having a polarity in which a single direction of current flow is required. Diode bridge 25 includes ac terminals 35, 37 connected to terminals 34, 36, respectively. The critical device 24a is connected to the terminal 39 having the positive polarity and the terminal 41 having the negative polarity of the diode bridge 25.

Thus, irrespective of whether the operation switch state is the switch 1, the switch 4 is closed, or whether the switch 2, the switch 3 is closed, the critical rod 24a having the polarity always has a positive potential at its positive terminal and its negative terminal. Has a negative potential at. In this way, the diode bridge 25 reliably removes current from the critical device 24a with polarity while maintaining unidirectional current through the load without damaging the fail-safe feature.

The use of a switch and monitoring function to perform highly reliable control of the brake system of a PRT vehicle is described below. The brake is applied when no power is supplied through the brake actuator and this is a safe state for the system. The combination of the switch components, the monitoring circuit and the control logic process steps eliminate the brake when the request-ON is made so that the vehicle can move and reliably brake when the request-OFF is made. Is applied. The present embodiment also provides a hardware fault tolerance to allow the brake to be removed and the vehicle to move by automatic reconfiguration upon failure detection and to provide the same level of reliability to reapply the brake when commanded. .

Switch monitors and control functions collectively provide highly reliable control functions. The control function can be commanded in two states: on or off. In this embodiment, off applies the brake, and on releases the brake. The control function proceeds to one of four states due to the external state provided.

State 1: Off state, provided indefinitely in response to an external command to maintain the off state.

State 2: Self-test, on state transition, which occurs in response to an external command to transition from off state to on state. This state is temporary and short-lived compared to system responsiveness. During this state, the output is off. The result detects a persistent off state if either one of the two different hardware internal on states is determined based on the health of the hardware element, or if it is determined that there is an excess number of hardware failures.

State 3: On, indefinitely after a successful self-test in response to an external command to remain on.

State 4: Self-test, off state transition, which occurs in response to an external command to transition from on state to off state. This state is temporary and short-lived compared to system responsiveness. During this state, the output is effectively off. The result detects which of the two different hardware internal off states will be selected based on the goodness of the hardware elements.

The following description of the status is made with respect to the flowcharts of FIGS. 3 to 7. The point of entry for processing is optionally defined as state 1, which is off. Switches 1, 2, 3, and 4 are referred to as S1, S2, S3, and S4, and monitors 1, 2, 3, and 4 are referred to as M1, M2, M3, and M4.

(1) State 1 is predominantly satisfied by having inactivated S1 and S2 and activated S3 and S4. This is provided to the two ends of the load (brake actuator) via a short-circuit to ground to ensure power interruption. Optionally, only as a result of detecting a fault condition from previous tests, the four switches, S1, S2, S3, S4, are inactivated to reduce the possibility of inadvertently establishing the conduction path.

(2) The on state transition self-test processing is started when the external sequence is switched from the off state to the on state. This process is a sequentially fixed sequence and takes a fixed time-cycle. Breaking the sequence by deasserting external states and mid-self-tests is prevented through logic. In the field of PRT brakes, the self-test is taken to be less than 100 msec, compared to the brake period, which is controlled to occur at a rate of 1.5 seconds, typically less than once per 100 seconds.

(3) Initially all the switches S1 to S4 are deactivated. From this state all switches can be individually examined as a serial sequence. This is done by turning on each switch individually and verifying using monitors M1 through M4. The load is powered off during this process. As a result of the failure, activating one switch provides a path through the failure and it is possible that the load is energized momentarily. In the function of brake control on the PRT, the time constant of the load (brake) is significantly longer than in the instantaneous power supply case, so that no result proceeds from this short case.

(4) S1 is activated, causing M1 to be off. If M1 remains on, a fault occurs, which assumes that S1 has a failed open-circuit. This test result is logged for the switch S1 as an operation (OK) or as a broken open-circuit (OC).

(5) S1 is inactivated. All switches are inactive.

(6) S2 is activated, causing M2 to be off. If M2 remains on, a fault occurs, which assumes that S2 has a failed open-circuit. One of the two states is logged for switch S2, either as an operation (OK) or as a failed open-circuit (OC).

(7) S2 is inactivated. All switches are inactive.

(8) S3 is activated, causing M3 to be off. If M3 remains on, a failure occurs, which assumes that S3 has a failed open-circuit. One of the two states is logged for the switch S3 as an operation (OK) or as a failed open-circuit (OC).

(9) S3 is inactivated. All switches are inactive.

(10) S4 is activated, causing M4 to be off. If M4 remains on, a failure occurs, which assumes that S4 has a failed open-circuit. One of two states is logged for the switch S4, either as an operation (OK) or as a failed open-circuit (OC).

(11) S4 is inactivated. All switches are inactive.

(12) Next, the monitors M1 to M4 are checked to verify that all monitors are all on, which means normal bias across the switches S1 to S4 when the power supply, which is in the predicted state, is cut off. If any of the monitors M1 to M4 is off, a failure occurs. The fault is assumed to have a short circuit at the switches, S1 to S4. By breaking the fuse affected by the shorted switch and thus eliminating the short circuit, it is very easy for the monitoring circuit for S1 or S2 to fail if one of the S1 or S2 switches is written as a short circuit. .

(13) By testing all four switches individually, a decision is made in one of three desirable states in which the switches can be configured:

The prevailing case is to power switches S1 and S4, which are applicable to fully-functioning hardware, or to hardware having a specific set of estimated failures.

Any failure can be overcome by choosing an alternative path, which powers switches S2 and S3.

This also activates the load, but reverses the direction of current through the load as compared to activating S1 and S4. In the PRT field of brake release function, the rod is not polarized and is not affected by the direction of current flow.

Certain combinations of hardware failures cannot be tolerated. This function locks all switches off, leaving the brakes on in response to these failures.

The detection of the appropriate load condition is made by evaluating the 24 possible states of all four switch combinations according to the following table.

TABLE 2

condition S1 S2 S3 S4 result One OK OK OK OK S1, S4 selection 2 OK OK OK OC S2, S3 selection 3 OK OK OK SC S1, S4 selection 4 OK OK OC OK S1, S4 selection 5 OK OK OC OC Unchecked 6 OK OK OC SC S1, S4 selection 7 OK OK SC OK S2, S3 selection 8 OK OK SC OC S2, S3 selection 9 OK OK SC SC Unchecked 10 OK OC OK OK S1, S4 selection 11 OK OC OK OC Unchecked 12 OK OC OK SC S1, S4 selection 13 OK OC OC OK S1, S4 selection 14 OK OC OC OC Unchecked 15 OK OC OC SC S1, S4 selection 16 OK OC SC OK Unchecked 17 OK OC SC OC Unchecked 18 OK OC SC SC Unchecked 19 OK SC OK OK S1, S4 selection 20 OK SC OK OC S2, S3 selection 21 OK SC OK SC S1, S4 selection 22 OK SC OC OK S1, S4 selection 23 OK SC OC OC Unchecked 24 OK SC OC SC Unchecked 25 OK SC SC OK S1, S4 selection 26 OK SC SC OC Unchecked 27 OK SC SC SC Unchecked 28 OC OK OK OK S2, S3 selection 29 OC OK OK OC S2, S3 selection 30 OC OK OK SC Unchecked 31 OC OK OC OK Unchecked 32 OC OK OC OC Unchecked 33 OC OK OC SC Unchecked 34 OC OK SC OK S2, S3 selection 35 OC OK SC OC Unchecked 36 OC OK SC SC Unchecked 37 OC OC OK OK Unchecked 38 OC OC OK OC Unchecked 39 OC OC OK SC Unchecked 40 OC OC OC OK Unchecked 41 OC OC OC OC Unchecked 42 OC OC OC SC Unchecked

43 OC OC SC OK Unchecked 44 OC OC SC OC Unchecked 45 OC OC SC SC Unchecked 46 OC SC OK OK S2, S3 selection 47 OC SC OK OC Unchecked 48 OC SC OK SC Unchecked 49 OC SC OC OK Unchecked 50 OC SC OC OC Unchecked 51 OC SC OC SC Unchecked 52 OC SC SC OK Unchecked 53 OC SC SC OC Unchecked 54 OC SC SC SC Unchecked 55 SC OK OK OK S2, S3 selection 56 SC OK OK OC S2, S3 selection 57 SC OK OK SC Unchecked 58 SC OK OC OK Unchecked 59 SC OK OC OC Unchecked 60 SC OK OC SC Unchecked 61 SC OK SC OK S2, S3 selection 62 SC OK SC OC S2, S3 selection 63 SC OK SC SC Unchecked 64 SC OC OK OK Unchecked 65 SC OC OK OC Unchecked 66 SC OC OK SC Unchecked 67 SC OC OC OK Unchecked 68 SC OC OC OC Unchecked 69 SC OC OC SC Unchecked 70 SC OC SC OK Unchecked 71 SC OC SC OC Unchecked 72 SC OC SC SC Unchecked 73 SC SC OK OK S1, S4 selection 74 SC SC OK OC S2, S3 selection 75 SC SC OK SC Unchecked 76 SC SC OC OK S1, S4 selection 77 SC SC OC OC Unchecked 78 SC SC OC SC Unchecked 79 SC SC SC OK Unchecked 80 SC SC SC OC Unchecked 81 SC SC SC SC Unchecked

(14) If it is determined that the load can be activated, the appropriate switch is powered on and state 3 is initiated. Failure of the load to be activated is the result of a previous test and requires repair of the hardware.

(15) If S1 and S4 are activated, the occurrence of a new fault for the duration of which State 3 is valid causes the switch to operate according to the eight possible combinations defined in the table below:

TABLE 3

S1 fault OC Fault-off S1 fault SC Keep up S2 fault OC Keep up S2 fault SC S2 fuse blown, keep on S3 Fault OC Keep up S3 fault SC S1 fuse blown, fault-off S4 fault OC Fault-off S4 fault SC Keep up

(16) If S2 and S3 are activated, the occurrence of a new fault for the duration of which State 3 is valid causes the switch to operate according to the eight possible combinations defined in the table below.

Table 4

S1 fault OC Keep up S1 fault SC S1 fuse blown, keep on S2 fault OC Fault-off S2 fault SC Keep up S3 Fault OC Fault-off S3 fault SC Keep up S4 fault OC Keep up S4 fault SC S2 fuse blown, fault-off

(17) The result is that the load is dominant and the system is powered for the duration of State 3. There is a possibility that a failure can cause the rod to deactivate. The system recognizes if a failure has occurred. In the brake release function application for the PRT, if the brake is provided again, the vehicle is stopped and proceeds to the diagnostic set. This diagnosis includes removing the command to release the brake (on to off) and providing the command to release the brake (off to on) again. The process again performs the on transition self-test at a point where other results of the appropriate switch configuration can be reached. For example, if a fault has occurred in which the rod is activated by the activated switches S1 and S4 and S1 goes to the open-circuit, the brake release function is stopped and the PRT vehicle is stopped. The command to release the brake is removed and applied again. The generated on-turn self-test estimates the need to activate switches S2 and S3 to power the load and release the brakes. Thus, these periodic events allow the system to continue in the presence of the fault that caused the pause.

(18) The 'off-switching-self-test' process is started when the external sequence is switched from the on-state to the off-state. This process is a sequentially fixed sequence and takes a fixed time-cycle. Intermediate-self-tests are prevented by logic by stopping the sequence by deasserting the external state. In the field of PRT brakes, self-tests occur at less than 1.5 times per second, and are 100 msec or less, compared to a controlled brake period, typically 100 seconds or more between trip start and end times.

(19) Initially all the switches S1 to S4 are deactivated, and then the switches S3 and S4 are activated. This two-step process ensures that no state-to-transition conditions occur where the switch combination leads to a switching short circuit path.

(20) In this state, the switch can be inspected using monitors M1 and M2. If either monitor M1 or monitor M2 is in the off state, either switch S3 or S4 indicates that there is another bias path that short-circuits the open-circuit and drives the output on. As soon as this happens, all switches are deactivated. The response time is less than 100 msec corrective action and can be ignored.

One of the two states is properly detected to ensure that the load is powered off (applied to the brake).

(21) Predominantly, when all hardware functional or selective faults exist, switches S1 and S2 remain inactive and switches S3 and S4 are activated, providing a short-circuit through ground across the load. Optionally, by eliminating the failure combination described above, all four switches remain inactive to inadvertently reduce the likelihood of establishing a conductive path. These two conditions function as state one.

(22) If S3 and S4 are activated, the occurrence of a new fault for the duration of state 1 is valid causes the switch to operate according to the eight possible combinations defined in the table below:

Table 5

S1 fault OC Keep up S1 fault SC S1 fuse blown, keep on S2 fault OC Keep up S2 fault SC S2 fuse blown, keep on S3 Fault OC Keep up S3 fault SC Keep up S4 fault OC Keep up S4 fault SC Keep up

(23) If all switches are inactive, the occurrence of a new fault for the duration of state 1 is valid causes the switch to operate according to the eight possible combinations defined in the table below:

Table 6

S1 fault OC Keep up S1 fault SC Keep up S2 fault OC Keep up S2 fault SC Keep up S3 Fault OC Keep up S3 fault SC Keep up S4 fault OC Keep up S4 fault SC Keep up

(24) The result is that the load is always powered off for the duration that the system is in state 1. There is a possibility of changing the state of individual switches and inducing a fuse to shut off, but the load remains disconnected. At the point where the processing described and illustrated in the flowchart is repeated, the operation remains in this state until the next external transition from off to on.

The operation of the H switch 10 is summarized in FIG. 8, where the action required when the brake is applied is off and as required in the path 60 of FIG. The operation is on. During the four states of switch processing, the brake is off and off in state 1 (62), the self test sequence state is off in state 4 (64), and the brake is in on state 2 (66). State 3 (68) is on.

Although the features of the present invention are shown in some drawings, this is a convenience for each feature may be combined with any or all other features in accordance with the present invention.

Other embodiments are apparent to those skilled in the art and are present in the following claims.

Claims (5)

A pair of first terminals for connecting a power source; A first network comprising a first fuse device, a first switching device, and a third switching device connected in series between the pair of first terminals; A second network connected in parallel with said first network comprising a second fuse device, a second switching device and a fourth switching device connected in series between said pair of first terminals; And When the first and second switching devices are open and the third and fourth switching devices are closed or the first, second, third and fourth switching devices are open, a fault-safe current is drawn from the critical device. So that the fault-tolerant operation is made through the first fuse device, the first switching device and the fourth switching device, or through the second fuse device, the second switching device and the third switching device, Fault-tolerant fault-safe for critical devices comprising one pair of second terminals connected between the first and third switching devices and one terminal connected to the critical device between the second and fourth switching devices Switching system. 2. The fault-tolerant fault-safe switching system of claim 1, further comprising a unidirectional current flow circuit interconnected between the pair of second terminals and the critical device such that current flows in one direction. . 3. The circuit of claim 2, wherein the unidirectional current flow circuit comprises a diode bridge having a first terminal connected between the first and third switching devices and second terminals connected between the second and fourth switching devices, Fault-tolerant fault-safe switching system for critical equipment, characterized in that terminals having polarity are provided across the critical equipment. The apparatus of claim 1, wherein the first monitor circuit monitors the first switching device, the second monitor circuit monitors the second switching device, the third monitor circuit monitors the third switching device, and the fourth switching device. And a fourth monitor circuit for monitoring the fault tolerance fault-safe switching system for the critical device. 5. The fault-tolerant fault-safe switching system of claim 4, further comprising a controller responsive to the monitoring circuits for selectively operating the switching device.