Abstract:
An electronic control that monitors the switching means used to operate transducers to detect conditions that can cause improper transducer operation. In the application the unenergized state of the transducer is always safe. Should a switch in the transducer circuitry be in an erroneous state, the control uses another switch to prevent improper operation of the transducer without requiring the involvement of the operator. Monitoring enables the control to prevent transducer operation before failures allow hazardous operation. Any switching means, activated by the control, an override, or both may be monitored as long as its intended state is known to the control. The control can also open the transducer circuitry when an externally controlled switch in the transducer circuitry changes state at a destructive rate.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
   Not Applicable 
   STATEMENT REGARDING FEDERALLY SPONSORED RESEARCH 
   Not Applicable 
   REFERENCE TO SEQUENCE LISTINGS 
   Not Applicable 
   BACKGROUND OF THE INVENTION 
   The present invention relates to controls that operate transducers. In particular to controls that operate transducers that if erroneously active may result in hazardous operation but are always safe when inactive. In this application, a transducer is a device whose function is to turn the electrical energy into some other energy form. As the operation of the transducers may also be suspended by external switches or circuits the present invention is related to devices that include override(s). 
   Controls operate transducers using switching means hereinafter referred to as a switch, that may be a switch, relay, transistor, other solid state switch, or the like. Controls use either open or closed loop systems. In an open loop system any failure of switch goes undetected. True closed loop systems monitor the output of transducers, indirectly this may react to a switch in an erroneous state after the fault affects output but it is an expensive and less reliable means to detect switch failures. Further unless the feedback results in opening every switch in a transducer circuit, a switching failure(s) can still produce erroneous operation while the circuit still has a functional switch since the faulty switch(s) could be the one the feedback uses to alter operation. 
   U.S. Pat. No. 5,760,493 addresses the problem of improper transducer operation in appliances. The method does not detect faults. The intention of U.S. Pat. No. 5,760,493 is to limit improper transducer operation should one of its switches fail. In this approach two switches must be closed to permit transducer operation. If one switch shorts the transducer is erroneously active when the functional switch is closed to operate another transducer. This method only prevents improper operation during part of a cycle. Since faults are not detected, operation continues allowing the possibility of additional faults developing, further compromising safe operation. 
   U.S. Pat. No. 5,760,493 points out that switching faults are not uncommon when driving large inductive loads. The appliance industry has relied on a plurality of switches to ensure that operation of transducers is stopped at least at the end of a cycle. This plurality of switches includes overrides which directly switch the transducers. However the plurality of switches adds to the cost and reduces overall system reliability. 
   U.S. Pat. No. 4,866,955 uses switching means to prevent an appliance from operating if its door lid switch has not been opened since the end of the last cycle. The intended state of the switch is not known, it is assumed that the switch must open between cycles. The control is therefore incapable of stopping the appliance should the switch fail to open as intended during a cycle. The prior art shown in U.S. Pat. Nos. 3,367,089, 4,307,392, 4,951,037, shows methods of detecting switching faults that affect transducers. The transducers are display elements. U.S. Pat. Nos. 4,307,392 and 4,951,037 determine the functionality of the transducer and any fault causing any switch to be in an erroneous state. U.S. Pat. No. 3,367,089 only detects faults affecting the switches. These approaches apply only to switching means operated solely by the control. 
   The application of transducers in these patents can produce unsafe conditions when erroneously unenergized. For this reason the methods in these patents seek to detect erroneously unenergized transducers in addition to detecting erroneously energized transducers. Additionally U.S. Pat. Nos. 4,307,392 and 4,951,037 seek to verify the functionality of the transducer. These are burdens the present invention does not share. In the applications of the present invention a fault in the switching means or its transducer causing it to be inactive does not pose a safety hazard. 
   In the display verification patents no method is presented to automatically stop hazardous transducer operation. The approach is to signal the operator that a fault has been found to prevent a fault from causing a hazard. If the operator does not receive the fault indicating signal, operation remains potentially unsafe. While the control of the present invention may signal the operator that a fault has been detected, if the operator fails to observe this signal operation is still safe because the control halts transducer operation. 

   
     DESCRIPTION OF DRAWINGS 
       FIG. 1  is a schematic of the control interfacing to the ac source and motor. 
       FIG. 2  is a schematic of the circuits used to drive the dc valves. 
       FIG. 3  shows the signals produced on the control inputs connected to ac nodes. 
   

   SUMMARY OF INVENTION 
   The present invention is a control with means to verify the switches in the energizing circuitry of transducer(s) are in the intended state. If a fault is detected, the control automatically uses another switch to open the affected circuit to prohibit the transducer from being erroneously energized. Improper transducer activation is prevented not just limited. While the control may attempt to signal the operator of a fault, hazardous operation is suspended without requiring operator knowledge of the fault. The present invention can detect faults in any switch, including externally operated switching, as long as the intended state of the switch is known to the control. 
   While commonly either on or off, variable switching is included as long as the control can determine when a transducer is unenergized (switch open). The signal to have a switch open a transducer circuit may originate at: 1) the control. 2) an override. 3) either the control or an override. When the scan of a switch indicates it is in the wrong state, another switch is employed to stop and/or prevent current to the transducer. 
   Failures in the switch itself, in the interfacing of the control or an override to that switch, or an incorrectly open or shorted path in the energizing circuitry can cause the switch to be non-functional. Scanning the energizing circuitry allows the control to detect non-functional switches regardless of the cause. 
   As long as one control operated switch in a circuit is functional the control is able to prevent operation of the transducer(s) in a faulty circuit. The scanning methods included and introduced in an application filed concurrently by the same inventor are very inexpensive. In many cases one resistor connecting a single digital input to a node common to similar transducers allows the control to verify the state of the switches for a plurality of transducers. 
   The preferred implementation of an override is to share with the control a monitored transducer switch(s) that either can open regardless of the functionality of the other. The ability of an override to stop operation independently of the control is maintained and the control can signal the switch to open at anytime to verify its functionality. Fewer load switches lower cost and increase reliability. Further the control can monitor the override input to the transducer switch, should the primary load switch fail to open as the override dictates, the control opens the transducer circuit with a backup switch(s). 
   Generally the only non-functional switches the control must detect are erroneously closed. An exception is when the switch(s) of a transducer circuit determines the polarity of the voltage across a transducer. If the state of any switch permits an incorrect voltage to be present at the transducer the control opens a switch(s) ensuring the transducer can not be energized. 
   The control can also open a transducer circuit when the frequency at which an externally operated switch changes state rather than the state itself can lead to hazardous operation. The control extends the period the transducer circuit is open reducing the switching rate. This prevents damage to the switch and/or the transducer. 
   DESCRIPTION OF PREFERRED EMBODIMENT 
   Although the following embodiment is a commercial washing machine employing relays to switch a 120 vac motor and transistors to switch 24 v valves it is to be understood that the inventor contemplates the invention being applied to other devices with the same or different transducers and switching means operating off various voltages. 
   In the preferred embodiment the control scans the circuitry used to energize the +24 v solenoid valves P 1 - 5  and the 120 vac motor  60  of a commercial washing machine the control operates. If a fault in the circuitry is found that could cause a valve or the motor to be erroneously energized, the control uses another switch to open or keep open the faulty circuitry until it is repaired. Then the control signals the operator that the washer requires service. 
   The motor drive circuitry is shown in  FIG. 1  and the valve drive circuitry is shown in  FIG. 2 . In addition to the valves and motor, the washer includes a power supply  10  that produces +24 v, +5 v relative to ground that is in common with ac source ground. The switches of the energizing circuitry in this embodiment include the output transistors of U 2 , transistor T 2 , relays K 1 -K 4 , centrifugal switch S 3  and thermal limit switch S 4 . 
   Switches S 1 -S 4  are overrides. Switches S 3 -S 4  directly switch the motor. Pressure switch S 1  shares operation of T 2  with the control enabling either to open the valves P 1 -P 5 . The pressure switch S 1  is closed until the fill level is reached. The lid switch S 2  shares operation of K 1  with the control enabling either to stop the motor. S 2  is closed when the lid of the washer is closed. The motor start switch S 3  ensures the HIGH and START windings are energized to start the motor, it opens shortly after the motor starts. The thermal switch S 4  is closed unless the motor overheats. 
   The motor is switched using relays K 1 -K 4 .  FIG. 1  shows the interfacing of the control to the ac source and the motor. The thermal limit switch S 4  and both K 1  and K 2  must close to turn on the motor. K 1  is the switching relay responsible for starting and stopping the motor. K 2  is the safety relay and serves as the backup switch for K 1 . Both K 1  and K 2  are protected by varistor V 2  to limit arcing when either is opened. 
   The speed of the motor is determined by K 3 . When K 3  is energized the motor will run in HIGH. When K 3  is unenergized the motor will start in HIGH and run in LOW once the centrifugal switch S 3  opens shortly after the motor starts. The direction the motor turns is determined by the polarity of the connections made by K 4  though C 1  and S 3  to the START winding. When K 4  is energized the washer will agitate. When K 4  is off the washer will spin. When the motor reaches speed, the centrifugal switch S 3  opens the START winding circuit and switches the motor speed to LOW if K 3  is unenergized. 
   The control uses the npn transistor driver IC U 2  to turn on K 2 , K 3  and K 4 . The coil of each of these relays has a direct connection to +24 v. Q 1  connects K 2  to ground when RC 7  takes D 1  high. Q 2  connects K 3  to ground when RC 6  takes D 2  high. Q 3  connects K 4  to ground when RC 5  takes D 3  high. The control only partially controls the operation of K 1 . The connection of K 1  to +24 v is made through T 7 . U 1  turns on T 7  by turning on T 5  through R 5 . When on, T 5  takes the common node of R 7 , R 6  and T 7  low enough to turn on T 7 . The connection of K 1  to ground is made directly by the lid switch S 2  and/or by Q 3  through D 13 . The diode D 14  protects S 2 , diode D 9  protects T 7  and the internal diodes of U 2  protect its output transistors when the coils of the relays are turned off. 
   To start the washer in agitate Q 3  connects K 4  to ground. In agitate Q 3  also connects the coil of K 1  to ground through D 13 . In agitate opening the lid switch S 2  has no effect on the operation of the washer. To start the washer in spin Q 3  disconnects K 4  from ground and leaving S 2  as the sole connection of K 1  to ground. In spin if S 2  opens K 1  will open stopping the motor regardless of the state and functionality of U 1  and T 7 . 
   The control verifies the state of the ac switches K 1 , K 2  and K 4 . The sensing means for the relays also determines the state of the thermal switch S 4 . If the thermal switch S 4  is open the control suspends operation until the motor cools sufficiently to close S 4 . If K 1  or K 2  is erroneously closed when the motor is off, the control will not close the other until repairs have been made. If K 1  fails to open as intended by the control or the lid switch S 2 , the control opens K 2  stopping the motor until repairs are made. The state of K 4  is verified to ensure that the motor is started in the proper direction. If the connections to the START winding are not at the proper voltages during start up the control opens K 1  to stop the motor. 
   The signals on RA 0 -RA 2  produced by the connections through R 2 , R 8  and R 9  respectively are used to determine the state of the ac switches. The ac nodes driving these inputs are in one of three states—L 1 , Neutral or floating. A node at L 1  produces the truncated 60 hz sine wave in  FIG. 3A . A floating node is taken high by the pull-up resistor (R 1 , R 11  or R 12 ) on its input producing the signal in  FIG. 3B . A Neutral node produces a low input signal in  FIG. 3C . The resistance of each connection is sufficient to allow the input protection diodes of inputs RA 0 -RA 2  and RTCC to limit the signals to +5.6 v and −0.6 v, a safe range for U 1 . The input RTTC is connected to L 1  through R 10  producing the signal in  FIG. 3A . 
   Before the functionality of switches at least partially operated by the control can be verified, the control verifies that the override switch S 4  is closed. When S 4  is closed either RA 1  or RA 2  (or both RA 1  and RA 2  when either K 1  or K 2  is open) will have the signal produced by a Neutral node— FIG. 3C . When S 4  is open neither RA 1  or RA 2  has the signal in  FIG. 3C  since there is no connection to Neutral. To verify that S 4  is closed RA 1  and RA 2  are read when RTCC goes high. If at least one is low, S 4  is closed since only a Neutral node is low when RTCC is high. 
   With S 4  closed, the control scans the state of K 1 , K 2  and K 4 . To verify the states of K 1  and K 2  the control reads the signal on RA 0  through R 2 . Before a cycle is started the ac node sensed by RA 0  is floating if K 1  and K 2  are open as expected. R 1  pulls RA 0  high when the ac node is floating ( FIG. 3B ). If K 2  alone has shorted the ac node connected to RA 0  is at Neutral producing the signal in  3 C. If K 1  is closed the ac node is at L1 producing the 60 hz signal in  FIG. 3A . The control reads RA 0  when RTCC goes low, if RA 0  is high both K 1  and K 2  are open. If it is low there is a fault and the control will not close K 1  or K 2  to start a cycle until repairs are made. 
   The control also checks the state of the switching relay K 1  each time the motor is stopped. K 1  is opened by the control to stop the motor as required during a cycle or by the opening of the lid switch S 2  when the motor is rotating in the spin direction. The control reads the state of S 2  on RB 1  through R 3 . In spin R 4  pulls RB 1  high if S 2  is open. The state of K 1  is verified each time either the control or S 2  attempts to open it. If K 1  has opened the signal on RA 1  is pulled low through K 2  by the connection of the motor to Neutral. If RA 0  is not low when RTCC goes high the control opens K 2  stopping the motor until repairs can be made. 
   The control also monitors the connections of K 4  to the START winding to verify the motor will rotate in the correct direction. In the operation of this washer it is critical that the motor stops if S 2  is opened during spin. If a fault causes the START winding to have the incorrect voltage when the motor is started the washer could be in spin when the control intends for it to be in agitate. In this state the motor would not stop when S 2  is opened during this erroneous spin since S 2  has no effect on the motor in agitate. 
   To start the motor in agitate, K 4  is energized. When functioning correctly the ac node sensed by RA 1  is at L 1  and the ac node sensed by RA 2  is at Neutral producing the signals in  FIGS. 3A and 3C  respectively. When RTCC goes high RA 1  should be high and RA 2  should be low. When RTCC goes low both RA 1  and RA 2  should be low. If either of these conditions are not met the control stops the operation of the motor by opening K 1  using K 2  as backup until repairs are made. 
   The method shown to scan the ac circuitry depends on the sharing of ground between the source and the supply. In consumer appliances the common ground approach is generally not employed. An application filed concurrently by the same inventor provides a cost effective method of sensing ac path states, including paths containing switches, when the control is floating relative to the ac source. 
   In addition to monitoring the state of K 1  and K 2  the control monitors the frequency at which the K 1  is switched in spin by S 2 . Should the rate of switching become destructive, the time K 1  is open is prolonged by taking RB 0  low turning off T 7 . This breaks the connection of K 1  to +24 v preventing the motor from restarting when S 2  is closed. After pausing to allow the contacts of K 1  to cool RB 0  goes high turning on T 7  allowing normal operation to resume. The rate is monitored by reading RA 0  whenever RTCC is high. If K 1  is open RA 0  is low if K 1  is closed RA 0  is high. The frequency at which K 1  is switched by S 2  can also be indirectly monitored by reading the input RB 1 . 
   The valves are switched using transistors as shown in  FIG. 2 . Transistor T 2  completes the valve connections to +24 v. The npn transistors of U 2  outputs Q 8 -Q 4  complete the valve connections to ground. D 10  protects T 2  when it switches the valves. U 2  has internal protection diodes on its outputs to protect it. 
   To energize a valve, both T 2  and the corresponding output line of U 2  (Q 8 -Q 4 ) must be switched on. If the control detects a short of T 2  to +24 v or a short of any valve line Q 8 -Q 4  to ground the control will use the functional transistor(s) to open or keep open valve circuitry until repairs can be made. 
   Q 8  switches the hot valve P 1 , Q 7  switches the detergent valve P 2 , Q 6  switches the fabric softener valve P 3 , Q 5  switches the cold valve P 4 , and Q 4  switches the bleach valve P 5 . Outputs Q 8 -Q 4  are turned on when U 1  take inputs D 8 -D 4  high using RC 0 -RC 4 . 
   R 15  turns off T 2  if S 1  is open or T 3  is off. T 2  is on when the path from its base to ground through S 1 , R 17  and T 3  is complete. U 1  turns on T 3  through R 18  by taking RB 4  high. When S 1  opens, a functional T 2  opens regardless of the functionality of the rest of the control. 
   The state of the valve switches, T 2  and Q 8 -Q 4 , are scanned using input RB 2  through R 34 . The resistance of R 34  is sufficient to permit the input protection diodes of U 1  to limit the input voltage on RB 2  to +5.6 v. The scan detects any fault causing T 2  or Q 8 -Q 4  to be erroneously on. If a short is detected when the valves are inactive the control will not start a fill keeping the functional transistor(s) off. The switches are also scanned at the end of a fill. T 2  is always used to turn off the valves for all dispensing. If T 2  fails to open the circuitry, U 2  is cleared turning off Q 4 -Q 8  deenergizing the valve(s). 
   Before a fill starts both T 2  and the individual valve lines Q 4 -Q 8  are off. R 14  pulls input RB 2  high unless a U 2  output drive(s) Q 4 -Q 8  has shorted to ground pulling RB 2  low indicating the failure. If no valve line has shorted to ground, the control turns on the valve line(s) to be used, pulling RB 2  low unless T 2  has shorted. If T 2  has shorted to +24 v, RB 2  would remain high. 
   When a fault is detected the control will not start a fill cycle. For the transistors energizing the valves or their selection means to cause flooding, both T 2  and a U 2  output would have to short to their respective supply voltage between scans since the control will open the valves using the other transistor at the first failure. 
   The functionality of the valve switches is also checked when the fill is complete. A fill is complete when the pressure switch S 1  opens or when U 1  takes RB 4  low turning off T 3  to end a timed dispense. For a measured fill the control reads the state of S 1  on RB 3  through R 16 . The resistance of R 16  is sufficient to permit the input protection diodes to limit the input voltage on RB 3  to +5.6 v. R 16  also prevents a fault shorting RB 3  to ground from turning on T 2 . When S 1  opens during a fill RB 3  goes low. In either type of fill, the valve(s) are switched off when the base to ground connection of T 2  is broken by opening either S 1  or T 3 . When T 2  opens RB 2  should be low. If not the control clears U 2  turning off Q 4 -Q 8 . 
   While the pressure switch S 1  could also be monitored for destructive switching as is done with S 2 , T 2  is much less likely to fail due to switching rate and given the hysteresis of the pressure switch S 1  it is unlikely to be switched at an excessive rate. 
   While the embodiment present employs only one backup switch per transducer it is within the scope of this invention to include more. Further operation of the device can continue indefinitely or to a preferred time such as the end of a cycle after a fault is found by using a backup switch to perform the function of the failed one. With multiple backups operation can continue until only one functional switch remains. 
   Alternatively upon detection of a fault the control can trigger a fuse or circuit breaker to open, permanently stopping transducer operation until repairs are made.