Programmable emergency-stop circuit with testing

• US 6,734,581 B1
• Filed: 03/27/2002
• Issued: 05/11/2004
• Est. Priority Date: 10/28/1998
• Status: Expired due to Fees

• Current Assignee: Eigenpoint Company
• Original Assignee: Eigenpoint Company
• Inventors: Griffis, Michael
• Primary Examiner(s): Toatley, Jr., Gregory J.
• Assistant Examiner(s): Polk, Sharon A.
• Application Number:
  US10/107,999
• Time in Patent Office: 776 Days
• Field of Search: 307/125, 307/130, 307/131, 307/326, 361/191-193, 192/129.R, 192/131.R, 192/131.H, 192/132-135, 192/129.A
• US Class Current: 307/125
• CPC Class Codes: G05B 19/00 Programme-control systems
• CPC Class Codes: G05B 2219/24003 Emergency stop
• CPC Class Codes: H01H 47/002 Monitoring or fail-safe circuits

Abstract

The invention includes a programmable emergency-stop circuit apparatus and method that provides advanced function not found in other systems. The circuit centralizes the control of high voltage motor power into one place, by providing connections for, in its minimum configuration, several different kill switches, a motors-on button, and an AC motor power relay coil. In the present invention, kill switches, test inputs, emergency-stop and motors-on buttons, computer ready and watchdog signals are all conveniently connected in one location, alongside the AC motor power relay coil driver. Programmable options exist for testing kill inputs online, while the emergency stop is energized.

Claims

1. An electronic control system for controlling the flow of bulk power to a plurality of loads through at least one switch having a first and second position to start and stop the flow of bulk power, respectively, comprising:

a) an emergency-stop circuit for receiving a plurality of input signals from a plurality of input sources and for providing a primary output signal to control said switch, wherein said first and second position of said switch are responsive to said emergency-stop circuit being energized or de-energized, respectively;

b) at least one internal kill-type (KILL) signal, said KILL signal having an active and inactive state;

c) a corresponding plurality of kill-type input (B) signals, each said B signal being selected from said plurality of input signals, and each said B signal having an active and inactive state responsive to an associated first input source being in a safe or healthy condition or not, respectively;

d) a means to de-energize and keep de-energized said emergency-stop circuit whenever said KILL signal is active;

e) at least one testing-type input (T) signal, each said T signal being selected from said plurality of input signals, each said T signal having an active and inactive state responsive to a notification from an associated second input source that a test is occurring or not occurring, respectively, wherein each said T signal is selectively associated with at least one said B signal, wherein each said T signal maintains a dedicated testing channel with each said associated B signal;

f) a means to generate said KILL signal by activating said KILL signal whenever at least one said B signal is inactive and de-activating said KILL signal whenever all said B signals become active;

g) a substitute means for each said testing channel, in effect only during an associated testing period that begins when said T signal enters an active state signifying a test, to temporarily substitute an active signal for said associated B signal in said means to generate said KILL signal so that said associated B signal does not activate said KILL signal during said testing period, wherein said testing period ends at the first occurrence of either said associated B signal transitioning from inactive to active signifying a successful test, or said T signal returning to an inactive state; and

h) a failed-test means for each said testing channel, in effect during an associated failed-test period beginning at the end of said associated testing period, to temporarily substitute for an unsuccessful test an inactive signal for said associated B signal in said means to generate said KILL signal so that said KILL signal is activated, wherein said unsuccessful test is characterized by failure of said associated B signal to transition from inactive to active during said testing period, having remained active throughout said testing period thereby signifying a stuck said B signal, and wherein said failed-test period ends whenever said stuck said B signal does transition from inactive-to-active signifying a belated successful test.

2. The electronic control system of claim 1, wherein said testing period ends concurrently with the elapse of a selectively specified interval of time signifying a timeout failure, wherein said interval of time elapses before said associated B signal transitions from inactive to active and before said T signal returns to an inactive state, wherein said interval of time begins when said testing period starts, and wherein said timeout failure signifies an unsuccessful test.

3. The electronic control system of claim 1, further comprising means to generate audio, visual, or electronic status to communicate to an operator or to a computer which B signal activated said KILL signal and whether said B signal failed a test.

4. The electronic control system of claim 1, wherein at least one of said B signals is a watchdog-type kill input (WD) signal, having an active and inactive state, wherein said WD signal is active only when its rate of toggling exceeds a selectively specified value and is otherwise inactive, wherein at least one said WD signal is associated with at least one of said T signals, wherein each said T signal and each associated WD signal form one said testing channel, and wherein a successful test is characterized by no toggling of said WD signal for a selectively specified interval during said testing period.

5. The electronic control system of claim 1, wherein at least one of said T signals is simultaneously and optionally utilized as a test watchdog-type kill input (TWD) signal, having an active and inactive state, wherein said TWD signal is active only when its rate of toggling exceeds a selectively specified value, and wherein said means to generate said KILL signal uses said TWD signal in the same manner as one of said B signals whenever said TWD is selectively utilized, thereby placing a requirement on how often tests are run.

6. The electronic control system of claim 1, further comprising a means for determining when a first energizing cycle has not yet occurred since application of power to logic of said emergency-stop circuit, said means for determining when a first energizing cycle has not yet occurred initializing said substitute means into an inactive state, and said failed-test means into an inactive state.

7. The electronic control system of claim 1, further comprising:

a) means to dynamically add and remove at least one additional T signal to an original at least one said T signal, wherein each said additional T signal is selected from said plurality of input signals, each said additional T signal having an active and inactive state responsive to a notification from an associated third input source that a test is occurring or not occurring, respectively, wherein each said additional T signal is associated with at least one said B signal, wherein each said additional T signal and each said associated B signal create an additional testing channel, wherein said means to dynamically add and remove dynamically adds when or after said emergency-stop circuit energizes and dynamically removes when said emergency-stop circuit de-energizes;

b) wherein said substitute means utilizes said additional testing channel like an original said testing channel during the period said additional testing channel is added; and

c) wherein said failed-test means utilizes said additional testing channel like an original said testing channel during the period said additional testing channel is added.

8. The electronic control system of claim 7, wherein an original at least one said T signal is absent.

9. The electronic control system of claim 1, wherein said means to generate said KILL signal also utilizes, in the same manner as one of said B signals, at least one internal health-type (OK) signal representing internal circuit health of at least a section of said emergency-stop circuit, wherein said OK signal is active or inactive responsive to the existence of no errors or errors, respectively.

10. The electronic control system of claim 9, wherein one of said T signals is associated with said OK signal forming said testing channel, wherein said electronic control system further comprises a shut down means to temporarily shut down said section of said emergency-stop circuit in response to the beginning of a testing period, wherein said shut down means, when effective, inactivates and re-activates said OK signal during said testing period, and, when ineffective, does not cycle said OK signal to signify an unsuccessful test, wherein said failed-test means is activated when said shut down means is ineffective and said OK signal is stuck active.

11. The electronic control system of claim 1, further comprising:

a) at least one kill-type input (A) signal, said A signal being selected from said plurality of input signals, and said A signal having an active and inactive state responsive to an associated third input source being in a safe or healthy condition or not, respectively; and

b) a first means to dynamically add and remove said A signal, dynamically adding said A signal upon or after energizing said emergency-stop circuit and dynamically removing said A signal upon or after de-energizing, wherein said means to generate said KILL signal also utilizes said A signal during the period it is added in the same manner as one of said B signals.

12. The electronic control system of claim 11, further comprising:

a) a second means to dynamically add and remove at least one additional T signal to an original at least one said T signal, wherein each said additional T signal is selected from said plurality of input signals, each said additional T signal having an active and inactive state responsive to a notification from an associated fourth input source that a test is occurring or not occurring, respectively, wherein each said additional T signal is associated with at least one said A signal, wherein each said additional T signal and each said associated A signal create an additional testing channel, wherein said second means to dynamically add and remove adds, upon or after the time said associated A signal is dynamically added, and dynamically removes when said emergency-stop circuit de-energizes;

b) wherein said substitute means utilizes said additional testing channel like an original said testing channel during the period said additional testing channel is added; and

c) wherein said failed-test means utilizes said additional testing channel in the same manner as an original said testing channel during the period said additional testing channel is added.

13. The electronic control system of claim 12, wherein an original at least one said additional T signal is absent.

14. The electronic control system of claim 12, wherein said associated A signal is added upon its transition from inactive to active and said additional T signal is added thereafter.

15. The electronic control system of claim 14, wherein said associated A signal is connected to a dedicated input source for sensing the presence of bulk power whenever said emergency-stop circuit is energized, wherein said electronic control system further comprises a bypass means to temporarily redirect the flow of bulk power, maintaining the flow of bulk power, around said dedicated input source in response to the beginning of a testing period, wherein said bypass means, when effective, inactivates and re-activates said associated A signal and, when ineffective, does not cycle said associated A signal to signify an unsuccessful test, wherein said failed-test means is activated when said bypass means is ineffective and said associated A signal is stuck active.

16. An electronic control system for controlling the flow of bulk power to a plurality of loads through at least one switch having a first and second position to start and stop the flow of bulk power, respectively, comprising:

a) an emergency-stop circuit for receiving a plurality of input signals from a plurality of input sources and for providing a primary output signal to control said switch, wherein said first and second position of said switch are responsive to said emergency-stop circuit being energized or de-energized, respectively;

b) at least one internal ready-type start (RS) signal, said RS signal having an active and inactive state;

c) a means to activate said RS signal in response to a final cycle or a surplus cycle of a selectively programmable first number of deactivation and reactivation cycles of a corresponding ready-type input (RI) signal that is selected from said plurality of input signals, said RI signal having an active and inactive state;

d) a means to deactivate said RS signal in response to the deactivating of said corresponding RI signal or whenever said emergency-stop circuit is energized, wherein said means to deactivate said RS signal also resets the accumulated count of said deactivation and reactivation cycles whenever said emergency-stop circuit is energized;

e) a corresponding testing-type input (T) signal, said T signal being selected from said plurality of input signals, said T signal having an active and inactive state responsive to a notification from an associated input source that a test is occurring or not occurring, respectively, wherein said RI signal is associated with said T signal, thereby creating a testing channel;

f) a means to optionally utilize said RS signal to inhibit said emergency-stop circuit from energizing whenever said RS signal is inactive;

g) a means to optionally utilize said RI signal to de-energize said emergency-stop circuit in response to the deactivating of said RI signal;

h) a substitute means for said testing channel, in effect only during an associated testing period that begins when said T signal enters an active state signifying a test, to temporarily substitute an active signal for said RI signal in said means to deactivate said RS signal so that said RI signal does not deactivate said RS signal during said testing period and for said RI signal in said means to optionally utilize said RI signal to de-energize said emergency-stop circuit, wherein said testing period ends at the first occurrence of either said RI signal transitioning from inactive to active signifying a successful test or said T signal returning to an inactive state; and

i) a failed-test means for said testing channel, in effect during a failed-test period beginning at the end of said associated testing period, to temporarily substitute for an unsuccessful test an inactive signal for said RI signal in said means to deactivate said RS signal and in said means to optionally utilize said RI signal to de-energize said emergency-stop circuit, where said unsuccessful test is characterized by failure of said RI signal to transition from inactive to active during said testing period, having remained active throughout said testing period thereby signifying a stuck RI signal, and wherein said failed-test period ends whenever said stuck RI signal does transition from inactive-to-active signifying a belated successful test.

17. The electronic control system of claim 16, further comprising a means for determining when a first energizing cycle has not yet occurred since application of power to logic of said emergency-stop circuit, said means for determining when a first energizing cycle has not yet occurred initializing said RS signal in the inactive state, initializing said substitute means and said failed-test means in the inactive state, resetting for the first energizing cycle, an accumulated count of said deactivation and reactivation cycles, and altering, for the first energizing cycle, a requirement of said first number of deactivation and reactivation cycles of said RI signal to a selectively programmable second number, said second number being greater than said first.

18. The electronic control system of claim 16, wherein said testing period ends at the elapse of a selectively specified interval of time signifying a timeout failure, wherein said interval of time elapses before said associated RI signal transitions from inactive to active and before said T signal returns to an inactive state, wherein said interval of time begins when said testing period starts, and wherein said timeout failure signifies an unsuccessful test.

19. An electronic control system for controlling the flow of bulk power to a plurality of loads through at least one switch having a first and second position to start and stop the flow of bulk power, respectively, comprising:

a) an emergency-stop circuit for receiving a plurality of input signals from a plurality of input sources and for providing a primary output signal to control said switch, wherein said first and second position of said switch are responsive to said emergency-stop circuit being energized or de-energized, respectively;

b) a means for determining whether or not a first energizing cycle has occurred since application of power to logic of said emergency-stop circuit;

c) a means to drive a dedicated error code whenever said first energizing cycle has not yet occurred, said dedicated error code superseding any other error code generated from any of said plurality of input sources;

d) a first number of clear-type input (CLEAR) signals selected from said plurality of input signals, each said CLEAR signal having an active and inactive state;

e) a means to clear said dedicated error code whenever said CLEAR signal becomes active prior to said first energizing cycle to reveal said superseded error code, and wherein said means to clear said dedicated error code also refreshes said superseded error code whenever said CLEAR signal thereafter becomes active;

f) a second number of internal ready-type start (RS) signals, each said RS signal having an active and inactive state, wherein said means for determining whether or not a first energizing cycle has occurred also initializes said RS signal in the inactive state;

g) a means to activate said RS signal in response to a final cycle or a surplus cycle of a third selected number of deactivation and reactivation cycles of a corresponding ready-type input (RI) signal that is selected from said plurality of input signals, said RI signal having an active and inactive state responsive to an associated first input source being ready to energize or not ready, respectively, wherein said means for determining whether or not a first energizing cycle has occurred also alters the requirement of said third number of deactivation and reactivation cycles of said RI signal to a fourth selected number to be required for first energizing cycle, said fourth number being greater than said third, wherein said means for determining whether or not a first energizing cycle has occurred also resets the accumulated count of said deactivation and reactivation cycles for the first energizing cycle;

h) a means to deactivate said RS signal in response to the deactivating of said corresponding RI signal or when said emergency-stop circuit is energized, wherein said means to deactivate said RS signal also resets the accumulated count of said deactivation and reactivation cycles whenever said emergency stop circuit is energized;

i) at least one motors-on-type input (MO) signal selected from said plurality of input signals, said MO signal having an active and inactive state;

j) at least one internal start-type (START) signal, said START signal having an active and inactive state, wherein said means for determining whether or not a first energizing cycle has occurred also initializes said START signal in an inactive state;

k) at least one internal kill-type (KILL) signal, said KILL signal having an active and inactive state, and a corresponding fifth number of kill-type input (B) signals, each said B signal being selected from said plurality of input signals, and each said B signal having an active and inactive state responsive to an associated second input source being in a safe or healthy condition or not, respectively;

l) a means to generate said KILL signal by activating said KILL signal whenever at least one said B signal is inactive and de-activating said KILL signal whenever all said B signals become active;

m) a means to generate a delay for at least a first selected interval of time, wherein said means to generate a delay is activated immediately following de-energizing of said emergency-stop circuit therefore creating a dying period for said emergency-stop circuit, and wherein said means for determining whether or not a first energizing cycle has occurred also activates said means to generate a delay for the first energizing cycle therefore creating a power-up-delay period for said emergency-stop circuit;

n) a means to activate said START signal when said power-up-delay period has passed prior to first energizing cycle or alternatively whenever said emergency-stop circuit has de-energized and said dying period has passed, when said KILL signal is inactive, and when optionally utilized said RS signal is not used or is used and active;

o) a means to deactivate said START signal when said emergency-stop circuit is energized, when said KILL signal is active, or whenever optionally utilized said RS signal is used and inactive;

p) a means to inhibit said emergency-stop circuit from energizing when said START signal is inactive;

q) a means to display a first status indicator in visual form, audio form, or in the form of an electrical output signal whenever said START signal is active, to signify said emergency-stop circuit is waiting to energize and to display a second status indicator in visual form, audio form, or in the form of an electrical output signal, when said emergency-stop circuit is energized, wherein said first status indicator remains further displayed whenever said second is displayed;

r) a means to energize said emergency-stop circuit when START signal is active and said MO signal is active and remains active for at least a second selected interval of time;

s) a means to de-energize and keep de-energized said emergency-stop circuit whenever said KILL signal is active or whenever optionally utilized said RI signal is used and inactive;

t) a sixth number of kill-type input (A) signals, each said A signal being selected from said plurality of input signals, and each said A signal having an active and inactive state responsive to an associated third input source being in a safe or healthy condition or not, respectively;

u) a means for dynamically adding and removing, comprising dynamically adding said A signal upon or after energizing said emergency-stop circuit and dynamically removing it upon or after de-energizing, wherein said means to generate said KILL signal also utilizes said A signal during the period it is added in the same manner as a B signal;

v) a seventh number of monitor-contact-type input (MC) signals, each said MC signal being selected from said plurality of input signals, each said MC signal having an active and inactive state, and wherein each said MC signal is active only when the circuit is de-energized and a monitored downstream relay controlled by said primary output signal of said emergency stop circuit has fully disengaged;

w) a means to optionally utilize said MC signal to inhibit said emergency-stop circuit from energizing by inhibiting said MO signal from becoming active whenever said MC signal is inactive;

x) at least one secondary output channel providing a secondary output (SO) signal, being connected to at least one external device, wherein said external device is enabled or inhibited responsive to said SO signal being active or inactive, respectively;

y) an eighth number of enable-type input (CE) signals, each said CE signal being selected from said plurality of input signals, each said CE signal being selectively associated with at least one said SO signal, wherein each CE signal and one said associated SO signal form a secondary output channel, and wherein each said CE signal having an active and inactive state responsive to an associated fourth input source desiring said external device to be enabled or inhibited, respectively;

z) a ninth number of watchdog-type input (WD) signals, each said WD signal being selected from said plurality of input signals, and each said WD signal having an active and inactive state responsive to a corresponding fifth input source signifying that said first input source or fourth input source may be operating properly or is not operating properly, respectively, said WD signal toggling at a rate faster than a first selected rate being the condition for said WD signal to be active;

aa) a means to generate said SO signal for each said secondary output channel by;

(1) driving said SO signal inactive continuously whenever corresponding said secondary output channel is selectively programmed to be continuously inhibited;

(2) driving said SO signal inactive whenever said emergency-stop circuit is de-energized and corresponding said secondary output channel is alternatively selectively programmed to be inhibited whenever said emergency-stop circuit is de-energized;

(3) driving said SO signal inactive whenever said CE signal is inactive and corresponding said secondary output channel is alternatively selectively programmed to be inhibited whenever said CE signal is inactive;

(4) driving said SO signal inactive whenever said secondary output channel is selectively programmed to be inhibited whenever said CE signal is inactive, said secondary output channel is further selectively programmed to be inhibited whenever said WD signal is inactive, and either said CE signal is inactive or said WD signal is inactive;

(5) driving said SO signal inactive whenever said secondary output channel is selectively programmed to be inhibited whenever said CE signal is inactive, said secondary output channel is further selectively programmed to be inhibited whenever said emergency-stop circuit is de-energized and said dying period has passed, and either said CE signal is inactive or said emergency-stop circuit is de-energized and dying period has passed; and

(6) otherwise driving said SO signal active;

ab) wherein said means to generate said KILL signal optionally utilizes said WD signal as a B signal;

ac) wherein said means to generate said KILL signal optionally utilizes said CE signal as a B signal;

ad) a tenth number of testing-type (T) signals, each said T signal being selected from said plurality of input signals, each said T signal having an active and inactive state responsive to the notification from an associated sixth input source that a test is occurring or not occurring, respectively, wherein said test determines whether said first, second, third, fourth, or fifth input source and corresponding said input signals are working properly or not, wherein each said T signal is selectively associated with at least one other signal or a plurality of other signals, wherein each said other signal is either a said RI signal, a said B signal, a said A signal, a said CE signal, or a said WD signal, wherein each said T signal maintains a dedicated testing channel with each said associated other signal;

ae) a substitute means for each said testing channel, in effect only during an associated testing period that begins when said T signal enters an active state signifying a test, to temporarily substitute an active signal for said associated other signal, in said means to generate said KILL signal when said associated other signal is one of said B signals, one of said A signals during the period said A signal is dynamically added, one of said WD signals that is being utilized as one of said B signals, or one of said CE signals that is being utilized as one of said B signals, in said means to deactivate said RS signal and said means to de-energize said emergency-stop circuit in the case where said associated other signal is a utilized RI signal, and in said means to generate said SO signal in the case where said associated other signal is one of said CE signals or one of said WD signals, where said WD signal is responsive to a corresponding said fifth input source signifying said fourth input source may be operating properly or is not operating properly, wherein said testing period ends at the first occurrence of either said associated other signal transitioning from inactive to active signifying a successful test or said T signal returning to an inactive state, and wherein said means for determining whether or not a first energizing cycle has occurred initializes said substitute means in an inactive state;

af) a failed-test means for each said testing channel, in effect during an associated failed-test period beginning at the end of said associated testing period, to temporarily substitute for an unsuccessful test an inactive signal for said associated other signal in said means to generate said KILL signal so that said KILL signal is activated in the case where said associated other signal is one of said B signals, one of said A signals during the period said A signal is added, one of said WD signals that is being utilized as one of said B signals, or one of said CE signals that is being utilized as one of said B signals, in said means to deactivate said RS signal and said means to de-energize said emergency-stop circuit so that said RS signal is de-activated and said emergency-stop circuit is de-energized where said associated other signal is a utilized RI signal, and in said means to generate said SO signal so that said SO signal is inactive where said associated other signal is one of said CE signals or one of said WD signals, where said WD signal is responsive to a corresponding said fifth input source signifying said fourth input source may be operating properly or is not operating properly, wherein said unsuccessful test is characterized by failure of said associated other signal to transition from inactive to active during said testing period, having remained active throughout said testing period thereby signifying a stuck other signal, wherein said failed-test period ends whenever said stuck other signal does transition from inactive-to-active signifying a belated successful test, and wherein said means for determining whether or not a first energizing cycle has occurred initializes said failed-test means in an inactive state;

ag) wherein said testing period optionally ends at the elapse of a selectively specified third interval of time signifying a timeout failure, wherein said third interval of time elapses before said associated other signal transitions from inactive to active and before said T signal returns to an inactive state, wherein said third interval of time begins when said testing period starts, and wherein said timeout failure signifies an unsuccessful test;

ah) wherein each said T signal is simultaneously and optionally utilized as a test watchdog-type kill input (TWD) signal, having an active and inactive state, wherein said TWD signal is active only when its rate of toggling exceeds a second selectively specified rate, and wherein said means to generate said KILL signal utilizes as a B signal said TWD signal whenever said TWD is selectively utilized, thereby placing a requirement on how often tests are run;

ai) means to generate audio, visual, or electronic status in the form of an error code to communicate to an operator or to a computer which input source of said plurality of input sources is responsible for de-energizing said emergency-stop circuit or preventing said emergency-stop circuit from energizing, and whether an unsuccessful test occurred; and

aj) wherein further remaining uncommitted input signals from said plurality of input signals are ignored.

20. The electronic control system of claim 19, further comprising:

a) a programming means to alter said first, second, fifth, sixth, seventh, eighth, ninth, and tenth numbers so that they are each greater than or equal to zero and redefine functionality of utilized and uncommitted said plurality of input signals so that each is either one of said CLEAR signals, one of said RI signals, one of said MO signals, one of said B signals, one of said A signals, one of said MC signals, one of said CE signals, one of said WD signals, one of said T signal, or an uncommitted signal that is ignored;

b) a programming means to alter said third and fourth numbers, said first, second, and third intervals of time, said first and second selected rates, and provide programming of said secondary output channel;

c) a programming means to re-establish or omit utilization of said RS signal for said means to activate said START signal and said means to deactivate said START signal, to re-establish or omit utilization of said RI signal for said means to de-energize said emergency-stop circuit, to re-establish or omit utilization of said MC signal for said means to optionally utilize said MC signal to inhibit said emergency-stop circuit, to re-establish or omit utilization of said WD signal for said means to generate said KILL signal, to re-establish or omit utilization of said CE signal for said means to generate said KILL signal, and to re-establish or omit utilization of said T signal as a TWD signal for said means to generate said KILL signal;

d) a programming means to re-establish or omit utilization of said timeout failure applied to said testing channel;

e) a programming means to establish the association of one said CE signal with at least one said SO signal; and

f) a programming means to establish the association of one said T signal with at least one said B signal, one said A signal, one said RI signal, one said CE signal or one said WD signal.

21. A method for controlling the flow of bulk power to a plurality of loads through at least one switch having a first and second position to start and stop the flow of bulk power, respectively, comprising an emergency-stop circuit for receiving a plurality of input signals from a plurality of input sources and for providing a primary output signal to control said switch, wherein said first and second position of said switch are responsive to said emergency-stop circuit being energized or de-energized, respectively;

comprising the steps of;

(1) being in a power-up state for a selected first interval of time following application of power to logic of emergency-stop circuit, wherein said emergency-stop circuit is inhibited from energizing;

(2) being in a killed state, wherein said emergency-stop circuit is inhibited from energizing, and providing status for such including which if any input signal caused said emergency-stop circuit to de-energize or is preventing said emergency-stop circuit from energizing;

(3) remaining in said killed state until all of the said input signals that are not being tested and that have been selected for use in said killed state are active, said emergency-stop circuit does not have any internal errors, any ready-type input signals that have been selected for use have each been deactivated and reactivated a selected number of times, said selected number for first energizing cycle being greater than that for successive energizing cycles, and any said input signal that has been selected for use in said killed state and that has been tested has passed its most recent test;

(4) being in a waiting state, wherein said emergency-stop circuit is ready to energize, and providing status for such; and

(5) remaining in said waiting state until a valid motors-on signal has been recognized at which time said method goes to step (6), or until one of the said input signals that has been selected for use in said killed state is inactive while not being tested or has failed a test or said emergency-stop circuit finds an internal error at which time said method returns to step (2);

(6) going to an energized state, wherein said emergency-stop circuit becomes energized, and providing status for such;

(7) dynamically adding a selected first number of selected input signals from said plurality of input signals as each becomes active, so that each remaining active becomes a condition for said emergency-stop circuit to remain energized;

(8) dynamically adding a selected second number of selected input signals from said plurality of input signals as a selected second interval of time elapses since said emergency-stop circuit energized, so that being active at time of addition and remaining active becomes a condition for said emergency-stop circuit to remain energized; and

(9) remaining in the energized state, wherein said emergency-stop circuit remains energized until said emergency-stop circuit finds an internal error, one of the said input signals that has been selected for use in said killed state is inactive while not being tested or has failed a test, or one of the dynamically added input signals is inactive while not being tested during the period it is added or has failed a test during the period it is added, wherein said dynamically added input signals are removed when said emergency-stop circuit de-energizes;

(10) being in a dying state for a selected third interval of time, wherein the emergency-stop circuit is de-energized and inhibited from re-energizing, and providing status for such after which time said method returns to step (2).

22. The method of claim 21, further comprising in steps (6), (7), and (8), the task of dynamically adding a third number from said first or second number of said selected input signals to be dedicated to sensing the presence of said bulk power, so that the failure of building power de-energizes said emergency-stop circuit in the same way as the inactivation of any other utilized input signal;

and including in all steps the task of controlling at least one secondary output signal connected to at least one external device for the purpose of enabling and inhibiting said external device, wherein the said external device is enabled or inhibited based on programming, the current step, and current values of said plurality of input signals, wherein specifically in step (10) certain external devices so programmed remain enabled so that they may continue or react in a controlled fashion by utilizing residual power within said electronic control system as long as it remains.