Fig. 8, Construction of majority op

Fig. 8, Construction of majority operation by
window comparators (a) and majority
operation logic (b).
circuits LC1, LC2 and LC3 indicated by the dotted
lines are level converters that change the input
signals U, v and w (triple redundant system output
signals) to such levels that the two-input window
comparators Ai, A2 and A3 shown in Figure 8(b)
can oscillate. In the figure, AI, A2, ..., A5 are
window comparators.
In Figure 8(a), the binary input signals U E { 1,
0}, v E { 1, 0} and w E { 1,0 } are converted to the
output signals SEs/(R + S) and Es of the level
converters. The window comparators AI, A2 and A3
have the windows at the input level SEs/(R + S),
oscillate, and produce the dc output signals a = 1, b =
l a n d c = l .
The dc output signals a, b and c are the binary
output signals obtained by rectifying the output
signals of the window comparators with rectifier
circuits (marked by H). The output signals a, b and
c of the window comparators are summed to a + b +
~ = 3 w h e n u = l , v = l a n d w = l a n d t o a + b + c <
2 when the input signals do not coincide with each
other. The window comparator & has the window
in a + b + c 2 1 and the window comparator A5 has
the window in a + b + c = 3. The output signals M =
1 and Er = 1 are produced from the window
comparators & and A5 when a = 1, b = 1 and c = 1.
When two of a, b and c are 1, the output signal is
produced only from the window comparator &.
The circuit shown in Figure 8(a) is thus a fail-safe 2-
out-of-3 circuit that performs the following
operation for U = 1, v = 1 and w = 1 and produces
the output M, which goes zero in the faulty
condition:
M = U*VVV*WVW*U (13)
The window comparator A6 is a three-input
window comparator that oscillates (has the window
in Es) only when U = 0, v = 0 and w = 0. The output
&(fault decision output) goes Er = 0 in the window
comparator A6 when U = 1, v = 1 and w = 1 or when
non-coincidence occurs between the output signals of
the corresponding level converters. The output Er =
0 is produced from the window comparator A5 when
U = 0, v = 0 and w = 0 or when a fault occurs in any
of the corresponding level comparators AI, A2, A3
and As. The output signal E, of the fault monitoring
circuit comprised by the level comparators A5 and
A6 is given by
Er = U-V-WV U . v - w
Let L1*, L2* and L3* be the operating states of
the level converters LC1, LC2 and LC3 in the circuit
shown in Figure 8(a); Ll”, L2” and L3” be the output
states of the level converters LC1, LC2 and LC3 in
the faulty condition; and Ai*, A2*, A3*, A4*, A5*
and &* be the operating states of the window
comparators, including the rectifiers. Also assume
that Lu = u.Ll*v L1* .L1”, Lv = v -L~ * vL 2* .L2”,
---
(14)
- -
- -
Lw = w.L3*v L3* .L3”, Lu’ = U.Ll*V L1* *L1”,
L”’ = V.L2*V L2*.L2)$, Lw’ = W.L3*V L3*.L3?
Then, the output signals M and Er are as given by
where L1* , L2* and L3* signify the negation of
the logic variables L1*, L2* and L3*, respectively.
For instance, La = u.L1*v L1* .L1” signifies Lu = U
when the level converter LC1 is normal (Li* = 1)
and signifies Lu = L1” when the level converter LCl
is faulty (L1* = 0; i.e., L1* = 1).
In the faulty condition, Ai* (i = 0, ..., 6) is 0 and
Li” E { 1, 0) is a binary logic variable. In a triple
redundant system, the logic variables that indicate the
operating states of the triple operation processing
circuits correspond to L1*, L2* and L3*.
Figure 8(a) shows a majority circuit for U = 1, v
= 1 and w = 1. It can perform majority operations
for U = 0, v = 0 and w = 0 if the window
comparators Ai, A2 and A3 have the windows set in
Fig.9. Majority operation by fail-safe window
comparators (double rail logic output signal).
the output signal Es of the level converters LCi, LC2
and LC3. The circuit configuration shown in Figure
8(a) can be, of course, applied to fail-safe m-out-of-n
circuits.
Figure 9 shows a majority operation circuit that
produces the 2-out-of-3 operation olitput signal M
for the input signals U = 1, v= 1 and w = 1, the 2-
out-of-3 operation output signal XT for the input
signals U = 0, v = 0 and w = 0, and the fault detection
output signal Er = 0 when either of the two output
signals M and M includes an error. In Figure 9, the
input signals U, v and w may erroneously assume the
logic value 1 or 0. It follows that the output signals
of the level converters may also erroneously assume
the logic level SEs/(R + S ) or Es. When a fault
occurs in any of the window comparators Ai, A2,
A3, &, As, Ai’, A2’, A3’and A5’ comprising the
voter or in the summing circuit, the output signal Er
E 11, 0) becomes Er = 0 and makes the fault
apparent. The fault detection output signal becomes
Er = 0 when an error occurs in any of the input
signals U, v and w given as triple redundant system
output signals, when a fault occurs in any of the
triple redundant system circuit components for the
majority operation or when a fault occurs in the fault
detection circuit A5 or As’. The output signals of the
circuits A4 and A4’ not constructed as triple
redundant systems become M = 0 or M = 0 in the
faulty condition or have fail-safe output
characteristics.
The fail-safe 2-out-of-3 circuit (producing the
output signal M) in Figure 8(b) is composed of AND
gates of fail-safe interlock construction and OR gates
with the majority operation function. As shown in
Figure 10, the fail-safe interlock is basically
comprised by AND gates that produce the
implementation output Po E (1, 0) only when the
output instruction CM E { 1, 0) that permit an error
and the permit signal Pa = 1 (permit) are available
[4]. This basic configuration allows errors in both
the binary signals 1 and 0 for the output instruction
CM and does not allow an error on Pa = 1 alone for
the permit signal Pa E { 1, 0) and requires that the
AND gate G does not produce the instruction
implementation output Po = 1 when it fails. The
output Po is expressed by
where G* E { 1,O) is a logic variable that indicates
the operating state of the AND gate G.
Using this basic interlock configuration, a
circuit for checking a double redundant system for
the coincidence or non-coincidence of the output
signals can be built by utilizing two-input window
comparators as shown in Figure 11. In Figure 11,
WC1, WC2, WC3 and WC4 are window comparators,
and U’ and v’ are the output signals of level converter
circuits like the ones shown in Figure 8(a), for
instance. The window comparator WC1 or WC2 has
the window set at the logic value 1 or 0 of both input
signals , respectively, and produces the coincidence
signal Mc = 1 (U’ = 1, v’ = 1 or U’ = 0, v’ = 0). The
window comparators WC3 and WC4 have the
windows set at the different logic values 1 and 0 or 0
and 1 of both input signals, respectively, and produce
the output Md = 1 only when the logic values of the
input signals U’ and v’ are 1 and 0 or 0 and 1,
respectively. The output signals Mc and Md are
given by
--
Mc = (u’.v’*W~*)VU(’ - V’ *W2*) (18)
Md = (u,.V).W~*)V(U).V’.W~*) (19)
where Wi*, W2*, W3* and W4* are logic variables
that indicate the operating states of the window
comparators WCi, WC2, W C 3 and WC3,
respectively.
In Figure 11, the output Md is given as the
wired-OR of the rectified output signals (marked 8>
of the window comparators WC3 and WQ, because
the two rectified output signals alternately occur and
call for no majority operations. (This is also true of
the output signal &.)
The output signals Mc and Md, as expressed by
Eqs. (18) and (191, comprise interlock circuits, each
of which is shown as the AND gate G in Figure 10
and uses the input signal U’ or v’ as permit signal.
Since the errors in the input signals U’ and v’ are not
asymmetrical (or errors do not occur in one logic
value alone), the interlock circuit may be regarded as
an incomplete one. The AND gates Ai, A2 and A3
shown in Figure 8(a) have the same function as the
interlock circuits shown in Figure 11.
The majority summing circuit shown in Figure
8(a) is constructed by an OR gate and fault detection
is as shown in Figure 12. Hence, faults in the
rectifier circuits RC1, RC2 and RC3 that comprise
the OR gate cannot be detected immediately.
Namely, multiple-valued operation by the summing
circuit and threshold value computing circuits and
A5 is inevitable.