Fail-safe microprocessor-based control and monitoring of electrical devices

• US 6,381,506 B1
• Filed: 03/23/1999
• Issued: 04/30/2002
• Est. Priority Date: 11/27/1996
• Status: Expired due to Fees

• Current Assignee: Victor Grappone
• Original Assignee: Victor Grappone
• Inventors: Grappone, Victor
• Primary Examiner(s): Grant, William
• Assistant Examiner(s): RODRIGUEZ, PAUL L
• Application Number:
  US09/274,523
• Time in Patent Office: 1,134 Days
• Field of Search: 700/11, 700/12, 700/17, 700/18, 700/79-82, 714/715, 714/716, 714/735, 714/736, 714/738, 714/744, 326/9, 326/14, 361/1, 361/824
• US Class Current: 700/79
• CPC Class Codes: G05B 19/042 using digital processors G05B19/05 takes precedence
• CPC Class Codes: G05B 2219/24036 Test signal generated by microprocessor, for all I-O tests
• CPC Class Codes: G05B 2219/24039 Test sequence time and sequence profile
• CPC Class Codes: G05B 2219/24053 Diagnostic of controlled machine
• CPC Class Codes: G05B 2219/25428 Field device
• CPC Class Codes: G05B 9/03 with multiple-channel loop, i.e. redundant control systems

Abstract

A fail-safe microprocessor-based system and method permits the controlling and monitoring of electrical devices for use in fail-safe interfacing of electrical devices to microprocessor-based control equipment in applications that are highly safety-critical. Such devices as relays, lamps, motors, contactors, pushbuttons, limit switches, solenoids and the like are monitored and controlled using codes. These functions are performed by standard, “off-the-shelf” microprocessor-based systems that are not ordinarily employed in or configured for such safety-critical applications. The fail-safe system provides for sufficiently fail-safe checking for such systems to be rendered highly reliable. The fail-safe system monitors or controls a device having at least first and second contacts, with the fail-safe system having a processor which operates using a program for generating an input signal, for applying the input signal to the first contact, for detecting a response signal at the second contact, and for comparing the response signal with the input signal to monitor the operational condition of the device or to control the device.

Claims

1. A fail-safe system for monitoring of at least one device, each of said at least one device having at most two pairs of positive and negative output points and at most two pairs of positive and negative inputs, said fail-safe system comprising:

a processor, operating using a program, for generating a primary code comprising at least one predefined interval of time during which a first input signal is positive in polarity and at least another predefined interval of time during which the first input signal is negative in polarity, for applying the primary code to the output points, for detecting a first response signal at the input points, and for comparing the first response signal with the primary code to detect an active state of said at least one device, wherein the processor generates at least one secondary code, each of said at least one secondary code comprising a predefined interval of time selected from the group consisting of;

a predefined interval of time during which a second input signal is positive in polarity and a predefined interval of time during which a second input signal is negative in polarity, said at least one secondary code being generated in response to the failure of components of said at least one device selected from the group consisting of;

at least one input point and at least one output point, the processor applies said at least one secondary code to the output points, the processor detects a second response signal at the input points, and the processor compares the second response signal with said at least one secondary code to detect an active state of said at least one device.

2. The fail-safe system of claim 1, wherein the processor generates a tertiary code comprising a predefined interval of time selected from the group consisting of:

a redefined interval of time during which a third input signal is positive in polarity and a predefined interval of time during which a third input signal is negative in polarity, said tertiary code being generated in response to the failure of components of said at least one device selected from the group consisting of;

a plurality of input points and a plurality of output points, said plurality of input points and said plurality of output points being greater in number than a number of failures of the components of said at least one device which the secondary code is able to detect, the processor applies said tertiary code to the output points, the processor detects a third response signal at the input points, and the processor compares the third response signal with said tertiary code to detect an active state of said at least one device.

3. The fail-safe system of claim 2, wherein the primary code, the secondary code, and the tertiary code further determine whether the wiring and interconnection of said at least one device is correct.

4. The fail-safe system of claim 2, wherein each of said at least one device has two pairs of positive and negative output points and two pairs of positive and negative input points, each of said at least one device having two independent circuits allowing the processor to apply the primary code, the secondary code, and the tertiary code and allowing the processor to detect the first response signal, the second response signal, and the third response signal to detect an active state of said at least one device.

5. The fail-safe system of claim 4, wherein the two independent circuits each provide an input to two independent and functionally identical instances of application logic.

6. A fail-safe system for monitoring at least one device, said fail-safe system comprising, for each such device:

at most two pairs of positive and negative output points connected to input signals to the device;

at most two pairs of positive and negative input points connected to receive signals from the device; and

a processor, operating using a program, for generating a primary code comprising a series of three-state digits, each of said digits having a state selected from the group consisting of a first state corresponding to a direct current pulse of positive polarity, a second state corresponding to a direct current pulse of negative polarity and a third state corresponding to an absence of both the direct current pulse of positive polarity and the direct current pulse of negative polarity, said primary code comprising at least one digit having the first state and one digit having the second state,

said processor further being for applying the primary code to said output points and for detecting a first response signal at said input points,

said processor further being for comparing the first response signal with the primary code to detect an active state of the device.

7. The fail-safe system of claim 6, wherein said processor further generates at least one secondary code comprising another series of the three-state digits in response to a failure at at least one of said output points and said input points, each secondary code including at least one digit having one of the first and second states, said processor applying the at least one secondary code to said output points, detecting a second response signal at the input points and comparing the second response signal with the at least one secondary code to detect the active state of the device.

8. The fail-safe system of claim 7, wherein said processor further generates a tertiary code comprising another series of the three-state digits in response to a failure at a first plurality of said output points or at a second plurality of said input points, wherein at least one of the first plurality and the second plurality is greater in number than a number of failures which use of the at least one secondary code is able to detect, the tertiary code including at least one digit having one of the first and second states, said processor applying the tertiary code to said output points, detecting a third response signal at the input points and comparing the third response signal with the tertiary code to detect the active state of the device.

9. The fail-safe system of claim 8, wherein the primary code, the at least one secondary code and the tertiary code further determine whether a connection of said fail-safe system to the device is correct.

10. The fail-safe system of claim 8, wherein each device has two independent circuits, said processor applying the primary code, the at least one secondary code and the tertiary code to inputs for the two independent circuits and detecting the first response signal, the second response signal and the third response signal at outputs from the two independent circuits.

11. The fail-safe system of claim 10, wherein the two independent circuits each provide an input to two independent and functionally identical instances of application logic.

12. A fail-safe system for controlling at least one device, the device being of a type having at least a first terminal and a second terminal and having a safe state that is an off state of the device, said fail-safe system comprising, for each such device:

first control circuitry comprising at least one independent positive control circuit for the first terminal of the device;

second control circuitry comprising at least one independent negative control circuit for the second terminal of the device, said first and second control circuitry together comprising at most a pair of independent positive and negative control circuits for each of the first and second terminals of the device,

where each said positive control circuit comprises at least one positive energy output point for outputting positive energy to a respective terminal of the device and two positive energy input points for inputting positive energy from a respective terminal of the device, and each said negative control circuit comprises at least one negative energy output point for outputting negative energy to a respective terminal of the device and two negative energy input points for inputting negative energy from a respective terminal of the device; and

means for causing the device to attain its off state through an independent removal of either the positive or negative energy from the device.

13. The fail-safe system of claim 12, further comprising a processor programmed to perform verification checks to verify proper operation of said control circuits by using a control circuit ensemble including at least one said positive control circuit and at least one said negative control circuit, and by using at least one pair of said positive and negative energy input points.

14. The fail-safe system of claim 13, wherein said processor is programmed to perform verification checks to determine whether a connection of said fail-safe system to the device is correct.

15. The fail-safe system of claim 12, wherein the at least one pair of positive and negative control circuits for each of the first and second terminals are controlled respectively by two calculated points.

16. The fail-safe system of claim 15, wherein states of said two calculated points are determined, respectively, by two independent and functionally identical instances of application logic.

17. The fail-safe system of claim 12, wherein said means for causing the device to attain its off state comprises at least one positive conditioned bus and at least one negative conditioned bus, the off state being attained by deenergization of said conditioned busses.

18. The fail-safe system of claim 12, wherein each of said control circuits includes a solid-state relay.

19. The fail-safe system of claim 12, wherein each said positive control circuit comprises two positive output points and each said negative control circuit comprises two negative output points, said fail-safe system further comprising means for ensuring proper control of the device in response to failure of one of said positive and negative output points.

20. A fail-safe system for controlling at least one device, the device being of a type having at least a first terminal and a second terminal and having a safe state that is an on state of the device, said fail-safe system comprising, for each such device:

first control circuitry comprising at least one independent positive control circuit for the first terminal of the device;

second control circuitry comprising at least one independent negative control circuit for the second terminal of the device,

where each said positive control circuit comprises at least one positive energy output point for outputting positive energy to a respective terminal of the device and two positive energy input points for inputting positive energy from a respective terminal of the device, and each said negative control circuit comprises at least one negative energy output point for outputting negative energy to a respective terminal of the device and two negative energy input points for inputting negative energy from a respective terminal of the device; and

means for causing the device to attain its on state through an independent application of both the positive and negative energy to the device.

21. The fail-safe system of claim 20, further comprising a processor programmed to perform verification checks to verify proper operation of said control circuits by using a control circuit ensemble including at least one positive control circuit and at least one negative control circuit, and by using at least one pair of said positive and negative energy input points.

22. The fail-safe system of claim 21, wherein said processor is programmed to perform verification checks to determine whether a connection of said fail-safe system to the device is correct.

23. The fail-safe system of claim 20, wherein the at least one pair of positive and negative control circuits for each of the first and second terminals are controlled respectively by two calculated points.

24. The fail-safe system of claim 23, wherein states of said two calculated points are determined, respectively, by two independent and functionally identical instances of application logic.

25. The fail-safe system of claim 20, wherein said means for causing the device to attain its on state comprises at least one positive inverse conditioned bus and at least one negative inverse conditioned bus, the on state being attained by energization of said inverse conditioned busses.

26. The fail-safe system of claim 20, wherein each of said control circuits includes a solid-state relay.

27. The fail-safe system of claims 20, wherein each said positive control circuit comprises two positive output points and each said negative control circuit comprises two negative output points, said fail-safe system further comprising means for ensuring proper control of the device in response to failure of at least one of said positive and negative output points.