# US 4,398,233 A · Fail-safe device for electronic control circuit > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 4,398,233 A - Document ID: US4398233A - Status: Granted - Kind: A - Application number: 06/354,352 - Filed: 1982-03-03 - Granted: 1983-08-09 - Earliest claimed: 1982-03-03 - Assignees: Electronics Corporation of America - Inventors: John L. Bala; Charles R. Boswell - Web page: https://patentgrep.com/patent/US4398233A ## CPC - G06F 11/0796: {Safety measures, i.e. ensuring safe condition in the event of error, e.g. for controlling element} - G05B 9/02: electric - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G) ## Abstract A fail-safe device is disclosed for removing power from circuitry to be controlled upon the occurrence of an undesired operating condition. The device includes circuitry for generating a fail-safe signal that is normally within a predetermined frequency range unless there is an undesired operating condition. It also includes power control circuitry for supplying power to the circuitry to be controlled only when the fail-safe signal is within the predetermined frequency range. In a preferred embodiment, the circuitry for generating the fail-safe signal includes a programmable computer which regulates the circuitry to be controlled and which, unless there is an undesired operating condition, such as a failure of the computer, also generates a sequence of bits in which a predetermined pattern occurs at a known frequency. A comparater circuit compares this sequence of bits with the predetermined pattern and generates a variation in the fail-safe signal each time there is a match. In the preferred embodiment, the power control means includes an electromechanical relay for supplying power to the circuitry to be controlled when that relay is turned on and relay actuating circuitry for keeping the relay turned on when the fail-safe signal is within the predetermined frequency range. The power control circuitry may also include latch-out circuitry for keeping the relay off once it has been turned off and reset circuitry for enabling the relay to be selectively turned on once it has been turned off. ## Claims ### Claim 1 A fail-safe device for removing power from circuitry to be controlled upon occurrence of an undesired operating condition, said device comprising: means for generating a fail-safe signal which normally varies between signal levels at a frequency in a predetermined range between a minimum and a maximum frequency unless there is an undesired operating condition, said means for generating including a programmable computing means for controlling said circuitry to be controlled, said computing means having memory means containing bit-transmit instructions for causing said computing means to generate a sequence of binary bits in which a predetermined pattern of bits appears at a frequency within a range corresponding to said predetermined range unless there is an undesired operating condition; and comparator means for receiving said sequence of binary bits, for repeatedly comparing said sequence with a predetermined pattern, and for generating an output which varies in signal level in response to a match between said sequence and said predetermined pattern; and power control means responsive to the output of said comparator means for supplying power to said circuitry to be controlled only when said output of said comparator means has a frequency in said predetermined range, said power control means including an electromechanical relay for supplying power to said circuitry to be controlled, said relay having an electromagnet and normally-open mechanical relay contacts through which power is supplied to said circuitry, which normally-open contacts remain open unless a sufficient current is supplied to said electromagnet to keep them closed; relay actuating means, having power terminals and having low-pass means for transmitting only signal level variations in the output of said comparator means which occur below said maximum frequency, for supplying sufficient current to said electromagnet to keep said normally-open contacts closed when both power is supplied to said power terminals and said signal level variations have a frequency in said predetermined range; and latch-out means for preventing a sufficient current from being supplied to said electromagnet to close said normally-open contacts once said contacts have been opened, said latch-out means having means for supplying power to said relay actuating means through said normally-open contacts, so that once said contacts are opened said relay actuating means does not receive power and said relay enters latch-out, and reset means for selectively supplying sufficient current to said electromagnet to close said normally-open contacts and terminate said latch-out. ### Claim 2 A fail-safe device for removing power from circuitry to be controlled upon occurrence of an undesired operating condition, said device comprising: means for generating a fail-safe signal which normally varies between signal levels above a minimum frequency unless there is an undesired operating condition; an electromechanical relay for supplying power to said circuitry to be controlled, said relay having an electromagnet and normally-open mechanical relay contacts through which power is supplied to said circuitry, which normally-open contacts remain open unless a sufficient current is supplied to said electromagnet to keep them closed; relay actuating means having power terminals and being responsive to said fail-safe signal for supplying sufficient current to said electromagnet to keep said normally-open contacts closed when both power is supplied to said power terminals and said fail-safe signal level variations are above said minimum frequency; means for supplying power to said relay actuating means through said normally-open contacts, so that once said normally-open contacts are opened said relay actuating means does not receive power and said relay enters latch-out; and reset means for selectively supplying sufficient current to said electromagnet to close said normally-open contacts and terminate said latch-out. ### Claim 3 (depends on 2) A fail-safe device according to claim 2 in which said relay actuating means includes a switching means for switching between a first and a second state in response to said fail-safe signal level variations, storage capacitor, means for charging said storage capacitor when said switching means is in said firt state, and means for discharging said storage cpacitor through said electromagnet to supply current to said electromagnet when said switching means is in said second state. ### Claim 4 (depends on 2) A fail-safe device according to claim 2 in which said relay further includes normally-closed contacts which remain closed unless a sufficient current is supplied to said electromagnet to keep said normally-open contacts closed, and in which said reset means includes means for selectively supplying power to said relay actuating mens through said normally-closed contacts. ### Claim 5 (depends on 4) A fail-safe device according to claim 4 in which said means for selectively supplying power to said relay actuating means includes a transistor, having two current conducting electrodes and a control electrode which switches the conductance across said conducting electrodes between a first and a second state, a resistor connected in series with said conducting electrodes and a power supply, a connection between the junction of said resistor and said transistor and one power terminal of said relay actuating means through said normally-closed contacts for supplying power to said relay actuating means when said transistor is in said first state, a timing capacitor connected to said control electrode, a resistor for supplying charge to said timing capacitor so that after a given time the charge on said timing capacitor builds up to a level that switches said transistor to said second state, and a reset switch for selectively conducting charge away from said timing capacitor so as to return said transistor to said first state. ### Claim 6 (depends on 5) A fail-safe device according to claim 5 further including a zener diode between said capacitor and said control electrode. ### Claim 7 A fail-safe device for removing power from circuitry to be controlled upon occurrence of an undesired operating condition, said device comprising: means for generating a fail-safe signal which normally varies between signal levels at a frequency within a predetermined range between a minimum and a maximum frequency unless there is an undesired operating condition; an electromechanical relay for supplying power to said circuitry to be controlled, said relay having an electromagnet and normally-open mechanical relay contacts through which power is supplied to said circuitry, which normally-open contacts remain open unless a sufficient current is supplied to said electromagnet to keep them closed; and relay actuating means, having power terminals and having low-pass means for transmitting fail-safe signal level variations which occur below said maximum frequency, for supplying sufficient current to said electromagnet to keep said normally-open contacts closed when both power is supplied to said power terminals and said signal level variations have a frequency in said predetermined range. ### Claim 8 (depends on 7) A fail-safe device according to claim 7 in which said relay actuating means includes a switching means for switching between a first and a second state in response to said fail-safe signal level variations transmitted by said low-pass means, a storage capacitor, means for charging said storage capacitor when said switching means is in said first state, and means for discharging said storage capacitor through said electromagnet to supply current to said electromagnet when said switching means is in said second state. ### Claim 9 (depends on 7) A fail-safe device according to claim 7 in which said low-pass means includes a photo-resistive optocoupler. ### Claim 10 (depends on 7) A fail-safe device according to claim 7 further including latch-out means for preventing a sufficient current from being supplied to said electromagnet to close said normally-open contacts once said contacts have been opened, causing said relay to enter latch-out, said latch-out means having reset means for selectively supplying sufficient current to said electromagnet to close said normally-open contacts and terminate said latch-out. ### Claim 11 (depends on 10) A fail-safe device according to claim 10 in which said latch-out means includes means for supplying power to said relay actuating means through said normally-open contacts, so that once said normally-open contacts are opened said actuating means does not supply current to said electromagnet until said reset means closes said contacts. ### Claim 12 (depends on 10) A fail-safe device according to claim 10 in which said relay further includes normally-closed contacts which remain closed unless a sufficient current is supplied to said electromagnet to keep said normally-open contacts closed, and in which said reset means includes means for selectively supplying power to said relay actuating means through said normally-closed contacts. ### Claim 13 A fail-safe device for removing power from circuitry to be controlled upon occurrence of an undesired operating condition, said device comprising: means for generating a sequence of binary bits in which a predetermined pattern of bits appears at a frequency within a range corresponding to a predetermined range between a minimum and a maximum frequency unless there is an undesired operating condition; comparator means for receiving said sequence of binary bits, for repeatedly comparing said sequence with a reference pattern, and for generating an output which varies in signal level in response to a match between said sequence and said reference pattern; an electromechanical relay for supplying power to said circuitry to be controlled, said relay having an electromagnet and normally-open mechanical relay contacts through which power is supplied to said circuitry, which normally-open contacts remain open unless a sufficient current is supplied to said electromagnet to keep them closed; and relay actuating means having power terminals and being responsive to the output of said comparator means for supplying sufficient current to said electromagnet to keep said normally-open contacts closed when both power is supplied to said power terminals and said signal level variations in said output of said comparator means occur above said minimum frequency. ### Claim 14 (depends on 13) A fail-safe device according to claim 13 in which said binary bits are successive in time and in which said comparator means includes, a shift register with a serial input and a parallel output for receiving said succession of bits and a parallel output for receiving said succession of bits and a comparator having a two parallel inputs, one of which is supplied with said reference pattern and the other of which receives as an input the output of said shift register, said comparator also having an output which produces on signal level when the patterns supplied to its two parallel inputs are equal and another signal level when they are not. ### Claim 15 (depends on 13) A fail-safe device according to claim 13 in which said relay actuating means includes a switching means for switching between a first and a second state in response to said signal level variations at said output of said comparator means, a storage capacitor, means for charging said storage capacitor when said switching means is in said first state, and means for discharging said storage capacitor through said electromagnet, to supply current to said electromagnet, when said switching means is in said second state. ### Claim 16 (depends on 13) A fail-safe device according to claim 13 in which said relay actuating means includes low-pass means for transmitting only signal level variations in said output of said comparator means which occur below a maximum frequency. ### Claim 17 (depends on 16) A fail-safe device according to claim 16 in which said low-pass means includes a photo-resistive optocoupler. ### Claim 18 (depends on 13) A fail-safe device according to claim 13 further including means for supplying power to said relay actuating means through said normally-open contacts, so that once said normally-open contacts are opened said relay actuating means does not receive power and said relay enter latch-out; and reset means for selectively supplying sufficient current to said electromagnet to close said normally-open contacts and terminate said latch-out. ### Claim 19 (depends on 18) A fail-safe device according to claim 18 in which said relay further includes normally-closed contacts which remain closed unless a sufficient current is supplied to said electromagnet to keep said normally-open contacts closed, and in which said reset means includes means for selectively supplying power to said relay actuating means through said normally-closed contacts. ### Claim 20 (depends on 13) A fail-safe device according to claim 13 in which said means for generating a sequence of binary bits includes a programmable computing means. ### Claim 21 A fail-safe device for removing power from circuitry to be controlled upon occurrence of an undesired operating condition, said device comprising; means for generating a sequence of binary bits in which a predetermined pattern of bits appears at a frequency within a range corresponding to a predetermined frequency range unless there is an undesired operating condition; comparator means for receiving said sequency of binary bits, for repeatedly comparing said sequence with a reference pattern, and for generating an output which varies in signal level in response to a match between said sequence and said reference pattern; power control means responsive to the output of said comparator means for supplying power to said circuitry to be controlled only when said output of said comparator means has a frequency in said predetermined frequency range. ### Claim 22 (depends on 21) A fail-safe device according to claim 21 in which said power control means includes latch-out means for preventing said power control means from supplying power once it has stopped doing so, causing said power control means to enter latch-out, said latch-out means having reset means for selectively terminating said latch-out. ### Claim 23 (depends on 21) A fail-safe device according to claim 21 in which said binary bits are successive in time and in which said comparator means includes a shift register with a serial input and a parallel output for receiving said succession of bits and a comparator having a two parallel inputs, one of which is supplied with said reference pattern and the other of which receives as an input the output of said shift register, said comparator also having an output which produces one signal level when the patterns supplied to its two parallel inputs are equal and another signal level when they are not. ### Claim 24 (depends on 21) A fail-safe device according to claim 21 in which said means for generating a sequence of binary bits includes a programmable computing means. ### Claim 25 A fail-safe device for removing power from circuitry to be controlled upon occurrence of an undesired operating condition, said devicing comprising: programmable computing means for controlling said circuitry to be controlled, said computing means including memory means containing bit-transmit instructions for causing said computing means to generate as an output a sequence of binary bits in which a predetermined pattern of bits appears at a frequency within a range corresponding to a predetermined frequency range unless there is a undesired operating condition; comparator means for receiving said sequence of binary bits, for repeatedly comparing said sequence with a reference pattern, and for generating an output which varies in signal level in response to a match between said sequence and said reference pattern; power control means responsive to the output of said comparator means for supplying power to said circuitry to be controlled only when said output of said comparator means has a frequency in said predetermined frequency range. ### Claim 26 (depends on 25) A fail-safe device according to claim 25 in which said power control means includes latch-out means for preventing said power control means from supplying power once it has stopped doing so, causing said power control means to enter latch-out, said latch-out means having reset means for selectively terminating said latch-out. ### Claim 27 (depends on 25) A fail-safe device according to claim 25 in which said binary bits are successive in time and in which said comparator means includes a shift register with a serial input and a parallel output for receiving said succession of bits and a comparator having two parallel inputs, one of which is supplied with said reference pattern and the other of which receives as an input the output of said shift register, said comparator also having an output which produces one signal level when the patterns supplied to its two parallel inputs are equal and another signal level when they are not. ### Claim 28 (depends on 27) A fail-safe device according to claim 27 in which the bits produced by said computing means in the absence of said undesirable operating condition do not have an equal number of one and zero bits. ### Claim 29 (depends on 27) A fail-safe device according to claim 27 in which said shift register has a strobe input which must be supplied with a strobe signal for a bit supplied to said serial input to be received by said register and in which said bit-transmit instructions cause said computing means to supply a separate strobe signal to said strobe input for each bit of said sequence. ### Claim 30 (depends on 27) A fail-safe device according to claim 27 in which said bit-transmit instructions cause said computing means to produce one bit in said sequence each time said instructions are executed unless there is an undesired operating condition in said circuitry to be controlled or in said computing means, and in which said computing means includes an interrupt device for causing said computing means to periodically execute said bit-transmit instructions at a predetermined rate. ### Claim 31 A fail-safe device for removing power from circuitry to be controlled upon occurrence of an undesired operating condition, said device comprising: means for generating a fail-safe signal which normally varies between signal levels above a minimum frequency unless there is an undesired operating condition; an electromechanical relay for supplying power to said circuitry to be controlled, said relay having an electromagnet and normally-open mechanical relay contacts through which power is supplied to said circuitry, which normally-open contacts remain open unless a sufficient current is supplied to said electromagnet to keep them closed; relay actuating means having power terminals and being responsive to said fail-safe signal for supplying sufficient current to said electromagnet to keep said normally-open contacts closed when both power is supplied to said power terminals and said fail-safe signals level variations are above said minimum frequency, said relay actuating means including a switching means for switching between a first and a second state in response to said fail-safe signal level variations, a storage capacitor, means for charging said storage capacitor when said switching means is in said first state, and means for for discharging said storage capacitor through said electromagnet to supply current to said electromagnet when said switching means is in said second state; reset means for selectively supplying sufficient current to said electromagnet to close said normally-open contacts when they are open; and means for supplying power to said relay actuating means through said normally-open contacts, so that once said normally-open contacts are opened said actuating means does not supply current to said electromagnet until said reset means closes said contacts. ### Claim 32 (depends on 31) A fail-safe device according to claim 31 in which said relay further includes normally-closed contacts which remain closed unless a sufficient current is supplied to said electromagnet to keep said normally-open contacts closed, and in which said reset means includes means for selectively supplying power to said relay actuating means through said normally-closed contacts. ### Claim 33 (depends on 32) A fail-safe device according to claim 32 in which said means for selectively supplying power to said relay actuating means includes a transistor, having two current conducting electrodes and a control electrode, which switches the conductance across said conducting electrodes between a first and a second state, a resistor connected in series with said conducting electrodes and a power supply, a connection between the junction of said resistor and said transistor and one power terminal of said relay actuating means through said normally-closed contacts for supplying power to said relay actuating means when said transistor is in said first state, a timing capacitor connected to said control electrode, a resistor for supplying charge to said timing capacitor so that after a given time the charge on said timing capacitor builds up to a level that switches said transistor to said second state, and a reset switch for selectively conducting charge away from said timing capacitor so as to return said transistor to said first state. ### Claim 34 (depends on 33) A fail-safe device according to claim 33 further including a zener diode between said capacitor and said control electrode. ### Claim 35 (depends on 31) A fail-safe device according to claim 31 in which said means for generating a fail-safe signal includes means for generating a sequence of binary bits in which a predetermined pattern of bits appears above a frequency corresponding to said minimum frequency unless there is an undesired operating condition; and comparator means for receiving said sequence of binary bits, for repeatedly comparing said sequence with a reference pattern, and for generating an output which varies in signal level in response to a match between said sequence and said reference pattern. ### Claim 36 (depends on 35) A fail-safe device according to claim 35 in which said binary bits are successive in time and in which said comparator means includes a shift register with a serial input and a parallel output for receiving said successive bits and a comparator having two parallel inputs, one of which is supplied with said reference pattern and the other of which receives as an input the output of said shift register, said comparator also having an output which produces one signal level when the patterns, supplied to its two parallel inputs are equal and another signal level when they are not. ### Claim 37 (depends on 31) A fail-safe device according to claim 31 in which said relay actuating means includes a low-pass means for transmitting only fail-safe signal level variations which occur below a maximum frequency. ### Claim 38 (depends on 37) A fail-safe device according to claim 37 in which said low-pass means includes a photo-resistive optocoupler. ### Claim 39 (depends on 31) A fail-safe device according to claim 31 in which said means for generating a fail-safe signal includes programmable computing means for controlling said circuitry to be controlled and memory means containing bit-transmit instructions for causing said computing means to generate as an output a sequence of binary bits in which a predetermined pattern of bits appears above a frequency corresponding to said minimum frequency unless there is an undesired operating condition in said circuitry to be controlled or in said computing means. ### Claim 40 A fail-safe device for removing power from circuitry to be controlled upon occurrence of an undesired operating condition, said devicing comprising: means for generating a fail-safe signal which normally varies between signal levels at a frequency in a predetermined range between a minimum and a maximum frequency unless there is an undesired operating condition; an electromechanical relay for supplying power to said circuitry to be controlled, said relay having an electromagnet and normally-open mechanical relay contacts through which power is supplied to said circuitry, which normally-open contacts remain open unless a sufficient current is supplied to said electromagnet to keep them closed; relay actuating means having power terminals and having low-pass means for transmitting only fail-safe signal level variations which occur below said maximum frequency, for supplying sufficient current to said electromagnet to keep said normally-open contacts closed when both power is supplied to said power terminals and the frequency of said fail-safe signal level variations are within said predetermined range, said relay actuating means including a switching means for switching between a first and a second state in response to said fail-safe signal level variations transmitted by said low-pass means, a storage capacitor, means for charging said storage capacitor when said switching means is in said first state, and means for discharging said storage capacitor through said electromagnet to supply current to said electromagnet when said switching means is in said second state; and latch-out means for preventing a sufficient current from being supplied to said electromagnet to close said normally-open contacts once said contacts have been opened, causing said relay to enter latch-out, said latch-out means having reset means for selectively supplying sufficient current to said electromagnet to close said normally-open contacts and terminate said latch-out. ### Claim 41 (depends on 40) A fail-safe device according to claim 40 in which said latch-out means includes means for supplying power to said relay actuating means through said normally-open contacts, so that once said normally-open contacts are opened said actuating means does not supply current to said electromagnet until said reset means closes said contacts. ### Claim 42 (depends on 40) A fail-safe device according to claim 40 in which said low-pass means includes a photo-resistive optocoupler. ### Claim 43 (depends on 40) A fail-safe device according to claim 40 in which said means for generating a fail-safe signal includes means for generating a sequence of binary bits in which a predetermined pattern of bits appears at a frequency within a range corresponding to said predetermined range unless there is an undesired operating condition; and comparator means for receiving said sequence of binary bits, for repeatedly comparing said sequence with a reference pattern, and for generating an output which varies in signal level in response to a match between said sequence and said reference pattern. ### Claim 44 (depends on 43) A fail-safe device according to claim 43 in which said binary bits are successive in time and in which said comparator means includes a shift register with a serial input and a parallel output for receiving said successive bits and a comparator having two parallel inputs, one of which is supplied with said reference pattern and the other of which receives as an input the output of said shift register, said comparator also having an output which produces one signal level when the pattern supplied to its two parallel inputs are equal and another signal level when they are not. ### Claim 45 (depends on 44) A fail-safe device according to claim 44 in which said means for generating a sequence of binary bits includes programmable computing means for controlling said circuitry to be controlled and memory means containing bit-transmit instructions for causing said computing means to generate a sequence of binary bits in which a predetermined pattern of bits appears above a frequency corresponding to said minimum frequency unless there is an undesired operating condition in said circuitry to be controlled or in said computing means. ### Claim 46 (depends on 45) A fail-safe device according to claim 45 in which said shift register has a strobe input which must be supplied with a strobe signal for a bit supplied to said serial input to be received by said register and in which said instructions cause said computing means to supply a separate strobe signal to said strobe input for each bit of said sequence. ### Claim 47 A fail-safe device for removing power from circuitry to be controlled upon occurrence of an undesired operating condition, said device comprising: means for generating a fail-safe signal which normally varies between signal levels above a minimum frequency unless there is an undesired operating condition, said means including programmable computing means for controlling said circuitry to be controlled and memory means containing bit-transmit instructions for causing said computing means to generate a sequence of binary bits in which a predetermined pattern of bits appears above a frequency corresponding to said minimum frequency unless there is an undesired operating condition; an electromechanical relay for supplying power to said circuitry to be controlled, said relay having an electromagnet and normally-open mechanical relay contacts through which power is supplied to said circuitry, which normally-open contacts remain open unless a sufficient current is supplied to said electromagnet to keep them closed; relay actuating means having power terminals and being responsive to said fail-safe signal for supplying sufficient current to said electromagnet to keep said normally-open contacts closed when both power is supplied to said power terminals and said fail-safe signal level variations are above said minimum frequency, said relay actuating means including a switching means for switching between a first and a second state in response to said fail-safe signal level variations, a storage capacitor, means for charging said storage capacitor when said switching means is in said first state, and means for discharging said storage capacitor through said electromagnet to supply current to said electromagnet when said switching means is in said second state; and latch-out means for preventing a sufficient current from being supplied to said electromagnet to close said normally-open contacts once said contacts have been opened, causing said relay to enter latch-out, said latch-out means having reset means for selectively supplying sufficient current to said electromagnet to close said normally-open contacts and terminate said latch-out. ### Claim 48 (depends on 47) A fail-safe device according to claim 47 in which said latch-out means includes means for supplying power to said relay actuating means through said normally-open contacts, so that once said normally-open contacts are opened said actuating means does not supply current to said electromagnet until said reset means closes said contacts. ### Claim 49 (depends on 47) A fail-safe device according to claim 47 in which said relay actuating means includes a low-pass means for transmitting only fail-safe signal level variations which occur below a maximum frequency. ### Claim 50 (depends on 49) A fail-safe device according to claim 49 in which said low-pass means includes a photo-resistive optocoupler. ### Claim 51 (depends on 47) A fail-safe device according to claim 47 in which said means for generating a fail-safe signal includes comparator means for receiving said sequence of binary bits, for repeatedly comparing said sequence with a reference pattern, and for generating an output which varies in signal level in response to a match between said sequence and said reference pattern. ### Claim 52 (depends on 51) A fail-safe device according to claim 51 in which said binary bits are successive in time and in which said comparator means includes a shift register with a serial input and a parallel output for receiving said succession of bits and a comparator having two parallel inputs, one of which is supplied with said reference bit pattern and the other of which receives as an input the output of said shift register, said comparator also having an output which produces one signal level when the pattern supplied to its two parallel inputs are equal and another signal level when they are not.