Failsafe Electrical Circuitry

This invention relates to electrical control circuits, and is particularly, though not exclusively concerned with `fail safe` circuits.

Electrical circuits are now often used to control and initiate potentially hazardous conditions such as the detonation of explosives, the ignition of gas supplies, and the switching of high power electrical circuits. It is most important that the control circuit should operate only under specified, predetermined circumstances. When designing such circuits great consideration must be given to ensuring that the failure of a component (resistor, capacitor, transistor, integrated circuit, etc.) does not result in the circuit initiating the hazardous condition, and preferably the circuit should detect the malfunction and be inhibited from operating--i.e. the system should be `fail safe`.

In accordance with the present invention, there is provided an electrical control circuit comprising amplifier means arranged to amplify signals received at an input terminal of the circuit, means arranged to inhibit operation of the amplifier means, and comparator means arranged to nullify the inhibiting means in response to the value of said signals lying between two predetermined limits, whereby a control output is derived from the circuit.

Preferably the inhibiting means comprises a depletion mode field effect transistor arrangement.

The amplifier means preferably comprises two series-connected amplifiers, and the output of a first of these may be combined with the output of the other amplifier, preferably after the other output has been passed through a comparator that is conductive only in respect of inputs exceeding a predetermined value. The combined outputs, together with one of the individual amplifier outputs together constitute the control output of the circuit, and this is preferably provided in optical form by means of light-emitting diodes.

Preferably the control circuit is operatively associated with an electrical system to be controlled by optoelectronic switching means. The switching means may comprise the light-emitting diodes of the control circuit in combination with phototransistors of the electrical system, and the phototransistors may be connected to respective further phototransistors which are shielded from the light-emitting diodes but otherwise subject to the same ambient light as the said phototransistors. Spurious operation of the said phototransistors, and thus of the electrical system, is thereby avoided. Preferably two phototransistors and two further phototransistors are employed, independently connecting the control circuit and the controlled system.

Furthermore, the opto-electronic switching means may comprise a light-emitting diode/phototransistor arrangement whereby a light-emitting diode is illuminated only if power is being supplied to the electrical system, and the output from the diode is detected by a phototransistor that interconnects the comparator means and the inhibiting means, whereby the latter means are not nullified if power is not being supplied to the electrical system.

An electrical control circuit and its control of an electrical system, in accordance with the present invention, will now be described, by way of example, with reference to the accompanying drawing.

A control circuit CC has an input terminal T for receiving signals, which are then integrated in two stages, provided certain criteria are met as hereinafter described, and used for initiating operation of an electrical system ES.

The integration is carried out by integrated circuit operational amplifiers A.sub.1 and A.sub.2 with respective input resistors R.sub.1 and R.sub.2 and feedback capacitors CP1 and CP2. The integral is computed from prescribed initial conditions, usually zero voltage. If the initial conditions are not held accurately and reliably, at zero for example, the computed value could be in considerable error and hence the system could become operable under potentially unsafe conditions. To compute the integral accurately the integrating amplifiers A.sub.1 and A.sub.2 are held short circuited to prevent the capacitors CP1 and CP2 from being charged until certain conditions, as set out below, are satisfied, indicating that the system ES may be allowed to operate. Depletion mode field effect transistors (FET's) F.sub.1 and F.sub.2 provide short circuiting of the integrating capacitors CP1 and CP2 respectively, and contribute to the fail safe characteristics of the circuit. These FET's are conducting when no voltage is applied thereto, and need a control voltage on the gate terminal to turn them off (whereas enhancement FET's and bipolar transistors require a voltage or current to turn them on). Hence, the control circuit CC is prevented from operating if there is a loss of power supply to the FET's F.sub.1 and F.sub.2.

The FET's F.sub.1 and F.sub.2 are arranged to operate only in response to three input signals, thereby providing an AND gate control for these devices. An integrated circuit device is not chosen for this function, since it could result in a non fail safe arrangement due to the output of the gate failing in the `on` condition without all the inputs being present. The conditions which have to be met for the integrating amplifiers A.sub.1 and A.sub.2 to be unclamped are that the input signal at terminal T must fall between predetermined limits and that a mechanical switch S in the power supply line to the system ES is closed.

The first two conditions are detected by two integrated circuit comparators C.sub.1 and C.sub.2 and the last by a phototransistor PT.sub.1 which is illuminated by a light-emitting diode L.sub.1 powered from the system supply line, and suitably poled to be conductive on supply of power through the switch S. The two comparators C.sub.1 and C.sub.2 have open collector outputs and are connected to the emitter and base terminals respectively of the phototransistor PT.sub.1 to form the 3-input AND gate. Comparator C.sub.1 senses when the input signal at terminal T is above a predetermined minimum level, its output being connected to the emitter of the phototransistor PT.sub.1 so as to be in series therewith. Comparator C.sub.2 senses when the input signal at terminal T is below a predetermined maximum level, its output transistor being `off` in this case. If the input signal is above the maximum level, comparator C.sub.2 short circuits the base of the phototransistor PT.sub.1 preventing it from being turned on by illumination from diode L.sub.1. A phototransistor is used for two reasons in this position. It allows the state of the mechanical switch S to be easily detected without complex circuitry to shift the voltage level to that of the control circuit and eliminates the possibility of device failure affecting the power supply line or bypassing the mechanical switch. Also, the control circuit CC can be physically isolated from the power supply, by use of a suitable insulating barrier of transparent material, for example. With the circuit as described the failure of any one part does not result in the FET's F.sub.1 and F.sub.2 being turned off and thereby allow the integrating amplifiers A.sub.1 and A.sub.2 to drift and produce a false output.

Thus the control circuit CC is designed so that it can only start to operate under the correct conditions and cannot be initiated by a component or circuit failure. Once the circuit is operating it is necessary to check that the integrating amplifiers are functioning correctly. This is possible with the present circuit since it is known that the input signal at terminal T must be within certain limits in a correctly operating circuit. The input signal is monitored, as described, to effect the unclamping of the amplifiers. The output of amplifier A.sub.1 is also monitored using two comparators C.sub.3 and C.sub.4, and these are arranged to give an output signal only when the output of the amplifier A.sub.1 lies between limits that have previously been calculated as occurring at that stage of the circuit as a result of the input signal at terminal T being between its predetermined limits. The most significant point during the computation at which to check the operation of the circuit is when the output of amplifier A.sub.2 reaches a preset valve, as determined by a comparator, having a reference second input. If the output of the amplifier A.sub.1 is within its calculated limits, it is implied that the control circuit CC is operating correctly since the input signal at terminal T must also be within its predetermined limits, since the integrating amplifiers A.sub.1 and A.sub.2 are unclamped. The logical function of this self-checking circuitry can be implemented using a D-type flip flop FF. The output of the comparators C.sub.3 and C.sub.4 monitoring the integrator A.sub.1 is used as the `data` input and the output of the comparator C.sub.5 is used to `clock` the flip flop FF. This arrangement also protects against a failure mode of the final comparator C.sub.5 which would result in a signal being produced to initiate operation of the controlled system ES irrespective of the correct operation of the rest of the circuit CC. The system ES is arranged so that it requires two inputs before it can operate. The two inputs are the output of the comparator C.sub.5 and the output of the flip flop FF which is only `true` if the preceding part of the control circuit CC has functioned correctly. These two signals are not combined in a conventional AND gate, since the safety of the control circuit CC would then depend solely on this element, but instead independently control the supply of power to two inter-dependent parts of the subsequent circuitry of the controlled system ES. These signals are optically coupled to the subsequent circuitry by respective light-emitting diode and phototransistor switch combinations L.sub.2,PT.sub.2 and L.sub.3,PT.sub.3 to allow physical isolation and the elimination of possible bypass paths in the event of component failures.

If the system is designed so that it may be physically spaced apart at these points it is necessary to protect against the situation where the phototransistors PT.sub.2 and PT.sub.3 are turned on by ambient light. This can be done by connecting further phototransistors, PT.sub.4 and PT.sub.5, across the base-emitter junction of the phototransistor PT.sub.2 and PT.sub.3 respectively, so that the former will also be illuminated by ambient light and thus short circuit the photocurrent generated in phototransistors PT.sub.2 and PT.sub.3, thereby keeping them turned off. The phototransistors PT.sub.4 and PT.sub.5 are physically positioned so that they are shielded from the light output of the diodes L.sub.2 and L.sub.3 by screens SN.