Testable protective system

Abstract

A testable protective system for an operating system is provided with redundant trip components serially connected to redundant lock-out components. The trip components are signalled by fault sensors which monitor critical conditions of the operating system. These trip components produce an output indicative of such conditions, which output is fed to certain actuated devices which may either correct the condition or shut down the operating system until the cause of the problem can be determined and the necessary repairs made. When it is desired to test one of these trip components, the operator activates the corresponding lock-out component and performs the necessary test. The activation of this lock-out component has an effect of making the protective system output signal (the output to the actuated devices to correct the fault or shut the system down) independent of the output of that trip component when it is being tested. Should an operator mistakenly activate both lock-out components at once, the protective system output signal is a function only of the fault sensor input to a first trip component and a driving signal to the protective system. Thus, even if both lock-out components are activated at once, a fault signal to the first trip component will effect a fault output signal from the protective system to the actuated devices.