Electronic Failure Detection System

The present invention relates to failure detection systems and, more particularly, to electronic failure detection systems employing an electronic processor (e.g., microprocessor).

Various electronic arrangements for detecting failures in electronic circuits are known. See, for example, the book Elevator Technology, published by Ellis Horwood Limited (England, 1986) and the book Elevators, by F. Annett, published by McGraw Hill Book Co., Inc. (1960) for discussions of certain electronic failure detection technology used in elevator systems.

However, the present inventors believe that further improvements in electronic failure detectors are achievable.

According to the present invention, a detector arrangement includes an electronic processor (e.g., microprocessor) having inputs and at least one output, a memory connected to one of the processor inputs, a logic circuit having logic circuit inputs and logic circuit outputs, the logic circuit inputs and outputs being connected to others of the processor inputs, and instructions for causing the processor to perform a logic check of the logic circuit and to generate a first electrical signal on the output if the logic check is true, and to generate a second electrical signal on the output if the logic check is false. The arrangement according to the invention can be employed, for example, as a safety feature to turn on and off motor driver circuits in elevator systems. Motor driver circuits are utilized to provide motive control in geared, gearless or hydraulic elevator systems. Typical hydraulic elevator systems are shown, for example, in U.S. Pat. No. 4,534,452, "Hydraulic Elevator," issued Aug. 13, 1985, by Ogasawara et al, and also in U.S. Pat. No. 4,726,450, "Hydraulic Elevator With Dynamically Programmed Motor-Operated Valve", issued Feb. 3, 1988, by Fossati et al., which are hereby incorporated by reference in their entireties.

It is a principal object of the present invention to detect failures in electronic circuits reliably and cost effectively.

It is an additional object of the present invention to provide a failure detection system employing redundant or parallel logic circuits or other parallel logic elements.

These and other objects, features, and advantages of the present invention will become more apparent in light of the following detailed description of a best mode embodiment thereof, as illustrated in the accompanying drawing.

FIG. 1 is a schematic block diagram showing the failure detection system 1 of the present invention coupled to motion drivers and level converters;

FIG. 2 shows details of a parallel logic circuit connected to a parallel processor control unit of FIG. 1; the logic circuit and the control unit are connected to an optional combined logic check unit, while the control unit and the check unit are each connected to a controlled circuit such as a two control input driver circuit having a feedback output and a power output;

FIG. 3 is a more detailed schematic circuit diagram of the parallel logic circuit of FIG. 2;

FIG. 4 is a high-level logic flow diagram showing relevant aspects of the operation according to the invention of the processor control unit of FIG. 1, including generation of an output control signal (e.g., Enable/Disable signal on the output line 12a) for controlling the motor driver circuit 30 of FIG. 2;

FIG. 5 is a high-level logic flow diagram explaining the operation of the combined logic check unit 25 of FIG. 2;

FIG. 6 is a schematic block diagram showing apparatus for generating the input signals A, B, C, D, E;

FIG. 7 is a Table L of four Boolean Logic Equations explaining the operation of the logic contained within the logic circuit 20 of FIG. 3; and

FIG. 8 shows Definitions, Logic Equations and a State Transition Table explaining the operation of a specific exemplary application of the invention when utilized as a safety arrangement in a hydraulic elevator system.

FIG. 1 is a schematic block diagram of the detector arrangement 1 of the present invention coupled to various level converters (e.g., including A/D converters) and motion (e.g., motor) drivers. The detector arrangement 1 includes a microprocessor control unit 10 electronically coupled by means of logical check lines to a parallel logic circuit 20. FIG. 3 shows one embodiment of the circuit 20 having a plurality of input lines for signals A, B, C, D, E and a plurality of output lines for signals F, H, I, G connected to various "AND" and "OR" gates. The circuit 20 is, for example, a suitable integrated circuit. The logical check lines connected to the unit 10 include two groups of lines 20a tapped from the input and output lines and connected to inputs of the processor 12 (FIG. 2). The logic of the circuit 20 is expressed by the Boolean equations of the Table L (FIG. 7). According to the invention, the Boolean equations of the Table L are stored at a location L in the nonvolatile memory 14 (e.g., ROM, E.sup.2 PROM, FLASH) in known manner and utilized by the processor 12 as now discussed. The microprocessor control unit 10 monitors and stores the actual input signals A,B,C,D,E to and the actual output signals F,G,H,I from the logic unit 20, calculates all proper output values for the output signals of the unit 20, compares the calculated values against the actual signal values to determine whether a first output control signal OCS (e.g., logic 1 or Enable) or a second OCS signal (e.g., logic 0 or Disable) is generated by the processor 12 onto an output line such as a line 12a. The OCS is transmitted, for example, to one electronic on/off switch D2 (e.g., a suitable triac circuit) of the motor driver unit 30 via the line 12a. A logical 1 applied to the switch D2 via 12a turns D2 on; a logical 0 turns D2 off.

FIG. 2 shows details of the preferred arrangement 10, 20 connected to an optional combined logic check unit 25, and also shows a motor driver circuit 30 which is controllable by means of OCS signals. Other logic circuits are shown, but are unimportant for an understanding of the present invention. An input of the microprocessor 12 is coupled to the memory 14 via a bus 16. A RAM 15 is also coupled to an input of the processor 12 via a bus 16. Alternatively, the memories 14, 15, the CPU (not shown) of the processor 12 and various I/O ports are all connected to a common data, address and control bus (not shown) to permit transfer of information among RAM, ROM and the processor 12 in a manner well understood by those skilled in the electronic computer arts. The memory 14 includes instructions, for example, as shown in FIG. 4, for causing the microprocessor 12 to perform a complete logic check of the logic unit 20 and to generate either the first signal or the second signal on the output line 12a depending upon the result of the logic check. As an example, actual input signals A, B, C, D and E, and the output signals F, I, H and G are read and stored by the microprocessor 12; the microprocessor calculates a proper value F', I', H+, G' for each of the output signals F, I, H and G, and then compares the calculated proper values against the actual signal values to generate either the first or the second electrical signal on the line 12a. A logic 1 is generated on line 12a if F'=F, I'=I, H'=H and G'=G. Otherwise, a logic 0 is generated by the processor 12.

FIG. 3 and FIG. 7 show only one embodiment for the parallel logic unit 20. Preferably, I is determined by all of the input signals to the circuit 20. Other hardware and software implementations of the logic unit of FIG. 3 or other logic can be employed, provided that the control unit 10 compares all actual values of the output signals against calculated values (result signals) of the output signals to determine an output control signal (OCS) on the output line such as 12a. This comparison is performed using logic equations stored in the memory 14 which express logic equal to the logic which resides within the circuit 20.

In FIG. 4, the processor 12 reads and stores data equivalent to the input signals A, B, C, D, E and to the output signals F, G, H, I in any conventional fashion, steps 100, 110. Preferably, simultaneously with the steps 100, 110, the processor 12 fetches the Logic Equations (Table L) and executes the Equations using the stored (e.g., in RAM) actual data values for the input signals A, B, C, D, E to produce calculated values (result signals) F', G', H', I', step 200. The calculated values are suitably output from and input to respective internal portions of the processor 12 in any conventional manner, step 120. The calculated output signal values are compared against the actual output signal values, step 130. If each of the calculated values does not equal its respective actual value in a step 140, a step 160 causes the processor 12 to generate a disable signal (logic 0, low) on the line 12a and the processor executes routine failure management (e.g., turns on a trouble indicator light or executes other suitable software instructions to manage the failure), step 170. If the calculated values equal the actual values (step 140), the step 160 causes generation of an enable signal (e.g., logic 1, high) on the line 12a, and the routine returns to the step 100.

In a preferred variation of the routine of FIG. 4, a step 180 reads a feedback signal (e.g., digitized signal from an input line 30a to the processor 12) generated, for example, by any suitably digitized feedback circuit of the controlled circuit 30. The circuit 30 includes, for example, an on/off electronic switch D1 series connected to an identical on/off electronic switch D2. The switch D1 is connected to a suitable motor voltage supply source V (e.g., 120 VAC). When D1 and D2 are on, the load supply voltage appears at the output 30b and a digitized feedback signal FB which appears on the line 30a is, for example, high or a logic 1. If either D1 or D2 is off, the signal FB is low or a logic 0.

Returning to FIG. 4, a step 185 determines if the signal FB is proper, for example, a logic 1. If yes in the step 185, return to step 100. If no in the step 185 (e.g., if a logic 0 is read by the microprocessor), go to step 160.

FIG. 5 is a high-level logic flow diagram describing an optional preferred feature of the invention which includes the combined logic check unit 25 (e.g., an AND gate) having at least one input 25a connected to an output of the circuit 20 and having another input connected to a second output 12b of the processor 12. An output 25b of the circuit 25 is connected to, e.g., the electronic on/off switch D1. See FIG. 2. When the unit 25 is employed in the invention, the processor 12 generates simultaneously first and second enable signals in the step 150 or first and second disable signals in the step 160 of FIG. 4. In a step 152 (FIG. 5), the unit 25 receives the OCS (enable or disable) from the processor 12 on the line 12b and a signal I on the input line 25a from the logic circuit 20. The unit 25 performs a combined logic check, step 154. If the combined check is true (for example, I equals 1 and OCS equals 1 and all other inputs to unit 25 are 1) , then the unit 25 generates an OCS signal (e.g., logic 1) on the line 25b to turn the switch D1 on. If the combined logic check is false (either I or OCS or another input to 25 is logic 0), the unit 25 generates an OCS signal (logic 0) on the line 25b to turn switch D1 off.

FIG. 6 is a schematic block diagram showing various hardware for generating the input signals A, B, C, D, and E. For example, such input signals may be several of those generated within an hydraulic elevator system while the logic checked by the microprocessor control unit 10 may be determined according to the logic equations of table L1 shown in FIG. 8.

In FIG. 8, an exemplary output for the signal CDFC (e.g., safety chain and doors fully closed) is shown as "failed high" (e.g., logic "1"). The proper value of CDFC is zero, i.e., CDFC=C*HDFC*HGS=1*1*0=0. According to the routine of FIG. 4, the microprocessor 12 detects this failure and transmits a suitable electrical OCS signal (e.g., logic 0) on the line 12a. That signal turns off the switch D2 and, thus, power to the load.

To reiterate the example, the last line of the table (FIG. 8) shows a failure of the output signal CDFC. CDFC shows high "1", when it should be low (0):

The processor control 10 detects this failure of the circuit 20 when the processor 12 performs logic checks using the Logic Equations of the Table L1 stored, e.g., in the memory portion L. When the processor 12 detects this single failure, the processor 12 generates an output control signal (OCS) on the line 12a to disable or deactivate the controlled circuit 30. In this case, OCS is, for example, a logic 0 for disabling the switch D2 of the motor driver 30. Optionally, the processor 12 also generates an identical OCS (logic 0) on the output line 12b for disabling the optional combined logic check unit 25 having an output line 25b also connected to the controlled circuit 30. In this case, OCS on the line 12b is, e.g., a logic 0 for disabling, e.g., the unit 25 which then also disables the switch D1.

In the step 152 (FIG. 5), the unit 25 receives the OCS (disable) from the processor 12 on the line 12b and a signal I or SAFE on the input line 25a from the logic circuit 20. The unit performs a combined logic check (e.g., AND gate), step 154. If the combined check is true (e.g., I=1 and OCS=1 and each other input to 25 equals 1), then the unit 25 generates an OCS logic 1 on the line 25b to turn switch D1 on. In our example, SAFE=0 so that the unit 25 generates an OCS=0 to turn switch D1 off.

In this further preferred embodiment of the present invention, the combined logic unit 25 permits an enablement signal on the line 25b only if all inputs I, OCS, E, D etc. to unit 25 have the proper value (e.g., 1). In addition, if the microprocessor 12 fails (e.g., outputs a logic 1 on the line 12a or 12b when the output should be 0), the logic unit 25 should still receive a signal I=0 on the line 25a and still transmit a signal on the line 25b which causes the motor driver 30 to turn off.

Finally, those skilled in the art will readily understand how to code and otherwise implement the present invention in view of the instant specification.

Although the invention has been shown and described with respect to a best mode embodiment thereof, it should be understood by those skilled in the art that the foregoing and various other changes, omissions and additions and the form and detail thereof may be made therein without departing from the spirit of and scope of the invention. For example, the processor can be programmed to read, evaluate and respond to the feedback signal FB (i.e., to generate a suitable OCS) at other desired locations in the routine of FIG. 4.