A programmable controller (41) based logic system places two electronic output converters (14,18) in series for redundant protection against the inadvertent energization, due to the failure of an image register (66,68) or due to the shorted failure of a triac (10,12) on the output converters (14,18), of an energize-to-start, deenergize-to-stop field device (28). A control and monitor circuit monitors the image registers (66,68) and the output converter (14,18) triacs (10,12) that switch power on and off to the field device (28) to assure that the triacs (10,12) have not failed in an unsafe mode or that the image registers (66,68) have not failed. The monitor circuit continuously monitors both image registers (66,68), the first triac (10) and the series combination of the two triacs (10,12). The monitor circuit intermittently monitors the second image register (66) and the second triac (12). A failure of either or both triacs (10,12) or either or both image registers (66,68) energizes an alarm.
