The present invention relates to a method for monitoring the relation between logic signals.

The invention furthermore relates to a device for carrying out said method, and also to a protection system provided with such devices.

The method, the device and the system for monitoring the relation between logic signals which are processed in and supplied to protection circuits which function to interfere in a control process or to supply signalling, measuring or control signals to a control room, in order to be able to interfere upon detection of an undesirable situation in the control process, are generally known.

In such an environment of protection circuits reliability and in particular inherent reliability play a very impor¬ tant role. When for example one or more components in protection circuits of this type no longer meet the origi¬ nal specifications, this must never lead to a situation where the circuit generates of its own accord a signal that would wrongly indicate that the process being protected is not proceeding as desired. Furthermore such a fault must never lead to the availability of the protection system as a whole being affected, that is, if it actually becomes necessary to interfere in the process, the system should be designed such that the necessity to interfere is established and processed and that contiguous thereto measures are actually taken, if necessary.

In order to improve the operational reliability of usually logic circuits, insofar as they are less reliable by nature, said circuits may be designed as multiple circuits, for example triple circuits. By means of a so-called Voter circuit it is checked whether the logic circuits in

question all supply the same output signals. On the basis of a majority decision in the Voter circuit an output signal may or may not be supplied at the output of the Voter circuit for further processing in the protection system.

Within the framework of inter alia circuits of this type it is necessary to provide a method, a system and a device in which the value of the output signal of the device changes permanently after a certain fault situation has occurred.

The object of the present invention is to provide a method, a device and a system of this type, wherein the design of the device is such that also the device itself is inherently safe and in addition comprises a minimum number of necessary components.

In order to accomplish that objective the method according to the invention comprises the features defined in claim 1.

The advantage of the method according to the invention is that the relation between for example the mutual time sequence or the actual presence of the logic signals within safety limits is known at any moment, so that, for example in case of an interruption, which may or may not be temporary, in one of the logic signals as a result of a fault, the transformer will no longer switch in the absence of a control signal, and the power supply signal, which by itself is necessary again to generate said control signal, will no longer be generated. In other words, an incorrect relation between the logic signals being supplied will in practice lead to the supply voltage being turned off. If subsequently the relation between the logic signals is restored again, the generation of a control signal after the previous fault will become impossible, since the required power supply signal is lacking. The absence of the power supply signal indicates a past disturbance in the

relation between the logic signals being monitored.

A possible variant of the method according to the invention is defined in claim 2.

If there has been an incorrect relation at any moment between logic signals being monitored, for example when a signal is altogether lacking, the direction of magnetization will no longer change and will remain constant, in which situation no control signal will be supplied. Switching of the transformer will no longer take place and the power supply signal will reach a value lower than a minimum value, to indicate that the relation between the logic signals has been disturbed and that a fault situation has occurred.

The device for carrying out the method is defined in claim 3.

Variants of the invention are defined in the subclaims.

The invention and its further advantages will be explained in more detail hereafter with reference to the accompanying Figure, which shows a possible embodiment of in particular the device for monitoring the relation between logic signals.

The Figure shows a device 1, which is provided with magnetizable means in the shape of a ring core 2, which ring core 2 is coupled, via the main path of current 3 of a first controllable semiconductor 4, to a transformer 5 for generating a power supply signal in the form of a supply voltage on an output 6 of the device 1.

In the illustrated embodiment the ring core 2 is provided with windings 7, 8, 9, 10, which constitute the inputs to which logic signals are supplied, of which signals in

particular the mutual time sequence must be monitored. In the illustrated embodiment the windings 7 and 8 respectively and 9 and 10 respectively have opposed directions of winding, whilst windings 7, 8, 9 and 10 each comprise one or more wire windings. In this manner control winding 11 of ring core 2 is imparted an exclusive-OR function. The fact is that if the logic signals are present on both windings 9 and 10, the logic signals on windings 7 and 8 will be able to magnetize the ring core 2 in the one direction and subsequently in the second, opposite direction. The control winding 11 is connected, via a resistor 12, to the control input 13, that is the basis of the first controllable semiconductor 4. A diode 14 connected in anti-parallel is connected across the basis- emitter junction thereof. If both logic signals are present on windings 9 and 10, the consequence of the alternating magnetization will be that an alternating voltage on basis 13 will result in a corresponding alternation in the flow of current through the main path of current 3 of semiconductor 4. The main path of current 3 is coupled, via a resistance divider, to the control input 15 of a second controllable semiconductor 16, whose main circuit is connected in series to the primary side 17 of transformer 5. Parallel to the primary side 17 a diode 17' is connected to the permanent supply voltage for the device 1. The secondary side 18 of transformer 5 is connected, via a load resistor 19 and a rectifier circuit in the shape of a diode 20, to a smoothing circuit, which is provided with a capacitor 21 for supplying a DC supply voltage to the output 6 when the transformer 5 is being switched. Said DC supply voltage is furthermore used for supplying the first controllable semiconductor 4 via collector 22.

The operation of the device 1 is such that the alternating magnetization in the ring core 2 causes the first controllable semiconductor 4 to open en close in the rhythm of the successive logic control signals on windings 7 and

8. This varying current in the main path of current 3 influences the control signal on control input 15 of the second controllable semiconductor 16, which as a result will open and close in the same rhythm. Accordingly the transformer 5 is alternately energized and de-energized, as a consequence of which an alternating current is produced at the secondary side 18, which alternating current, after being rectified in circuit 20, is smoothed into a DC supply voltage on output 6, which enables the first controllable semiconductor 4, powered by said voltage, to switch. If the relation between the logic signals on the control windings 7 and 8 is at any time disturbed, for example as a result of a fault, the transformer will no longer switch at that moment, as a result of which the smoothing circuit 21 will lose its load within a certain period of time, inter alia to a load (not shown) on output 6, so that the moment the supply voltage on output 6 comes below a predetermined minimum level, said supply voltage will no longer be able to feed the semiconductor 4, not even when the correct relation between the logic signals on windings 7 and 8 is restored. As a result of this the voltage on output 6 will drop to zero after a first fault in the said relation is established, to indicate that a fault has occurred. The same situation will occur when only one of the two logic signals is present on the windings 9 and 10, because the logic signals in the windings 7 and 8 will at that moment no longer be able to alter the magnetization in the ring core 2. For an optimum protection the time span within which the load in the smoothing circuit 21 comes below a minimum functioning level required for the semiconductor 4 is selected such that if a few, for example five, of the necessary alternations of the magnetization in the ring core 2 do not take place upon restoration of the relation or the signal value of the logic signals being supplied, and thus of the alternating magnetization, the signal value on output 6 will already have fallen below the minimum functioning level. In that case the signal on output 6 will

not take place, to indicate the occurrence of a fault in the monitored relation between the logic signals that have been supplied to windings 7 - 10 on ring core 2. In order to restore the operation of the device 1 following the occurrence of a fault and restoration of the correct relation between the logic signals on windings 7 - 10, a pulse-shaped signal needs to be supplied to input 23 of a starter circuit 24. The starter circuit 24 inter alia includes a differentiator circuit 25, 26, which is coupled to the control input 15 of semiconductor 16, so that the voltage on output 6 will rise to a level higher than the minimum level after a starting pulse has been supplied to the control input 15 and the main circuit of semiconductor 16 has thus been temporarily energized, and the transformer 17, which will then switch, will be able to restore the supply voltage on output 6. The logic input signals will then be able to switch semiconductor 4, which will in turn switch semiconductor 16 on and off, after which the correct operation of device 1 has been restored and will remain in that condition until a next fault occurs.

Of course various types of multilayer semiconductors may be used as switches at the positions of semiconductors 4 and 16.

The rectifier circuit 20 may be a bi-phase circuit, for example, and the smoothing circuit 21 may include several capacitors, if desired, which may or may not be separated by a resistor.