Abstract: A protected digital output circuit coupled to a programmable controller, for controlling a load supplied through alternating-current (ac) power lines, including a fuse and a single controlled output switch connected in series with the load, and a pair of series-connected crowbar switches connected together across the ac power lines. The crowbar switches can be commanded closed together in the event that the output switch is commanded open but fails to open, thereby shorting the ac power lines and disconnecting the load by blowing the fuse. In routine diagnostic testing, the crowbar switches can be commanded closed separately to check their operation without blowing the fuse. A current detection circuit is used to check for current in the closed crowbar switch. A current sensor is also used to detect current through the output switch, when commanded closed for switching the load on, or for diagnostic turn-on testing when the load is disconnected.

Abstract: Circuit modules for providing digital or analog outputs from computational devices in such a manner that the components of the output circuit modules are tolerant of malfunctions in one or more of the components. In the digital output embodiment of the invention, output signals are independently derived using two voting circuits and are then applied to two switches connected in series to provide a fail-safe condition for most types of failure of the switches or the voting circuits. Two identical modules provide the ability to faithfully follow commanded on or off signals in all but a statistically small number of situations, and permit convenient replacement of a defective module without affecting output through the other module. In an analog output module, two independent voting circuits provide voted digital outputs to separate digital-to-analog converters, the outputs of which are compared to generate a validity signal that is used to control an output switch.