Abstract:
A method for performing an “AND” operation on two independent inputs in a fail-safe manner includes cascading two charge pumps to output a condition signal representing the “AND&#39;ed” state of the inputs. Each independent input has an active state asserted by a waveform of predetermined frequency and duty cycle, and an inactive fail-safe state asserted by a zero voltage. The method includes supplying power to a first charge pump, supplying power from the first charge pump to a second charge pump, and supplying each of the independent inputs to one of the respective charge pumps. A condition signal is output using an output from the second charge pump. Additionally, the method verifies the correctness of the frequency and duty cycle of each independent input using a cross connection scheme. This method provides a high-power, low-loss, and low-cost electrical circuit for operating devices responding to specific voltages, for example, vital relays.

Description:
CROSS REFERENCE TO RELATED APPLICATIONS 
     This application claims the benefit of U.S. provisional application Ser. No. 60/173,878, filed Dec. 30, 1999. 
    
    
     BACKGROUND OF THE INVENTION 
     This invention relates generally to electrical circuit components and, more specifically, to vital “AND” gates. 
     As generally understood in the art, a vital component of a system is one configured to fail-safe under credible failure conditions. For example, a vital relay in a control system operating under the closed circuit principle is normally held energized with its front contacts closed. In a fail-safe condition, if a vital relay fails, the front contacts open. Failure, then, of a vital circuit that drives a vital relay de-energizes the relay, resulting in the front contacts of the relay opening. Logic elements such as “AND” gates often are required to be vital. Any failure of a vital “AND” gate must not result in a permissive, e.g. “on”, output by the gate. 
     It is known to use charge pump circuits for driving vital biased-neutral devices, such as relays. Charge pumps are utilized to develop a DC voltage from a pulse train input signal. In a charge pump circuit, input and output voltages can be of opposite polarity. Although known vital electronic circuits that include vital “AND” gates generally provide acceptable operational characteristics, they typically include inductive components that are heavy, bulky and expensive. It is also known for high power charge pumps to perform switching using transistors, for example, bipolar transistors along with complicated drive circuitry. Charge pump efficiency is increased if such semiconductor switches have low loss. MOSFPTs have low loss, but when arranged in a charge pump totem pole configuration, exhibit undesirable cross conduction or “shoot through”. To minimize shoot-through time, switching often is performed at high frequencies which are not optimal for some applications. 
     BRIEF SUMMARY OF THE INVENTION 
     In one embodiment, a method for performing an “AND” operation on two independent vital inputs in a fail-safe manner includes cascading two charge pumps to output a condition signal representing the combined, or AND&#39;ed, state of the vital input devices. Each independent input has an active, or less restrictive, state asserted by a waveform of predetermined frequency and duty cycle. Each independent input also has an inactive, or fail-safe, state asserted by a zero voltage. The method includes supplying power to a first charge pump, supplying power from the output of the first charge pump to a second charge pump, and supplying each of the independent inputs to one of the respective charge pumps. A condition signal is achieved using an output from the second charge pump. More specifically, a DC voltage of a first polarity is asserted to place the output in an active state, or, alternatively, a zero voltage is asserted to place the output in an inactive state. Under certain failure conditions, such as a DC voltage of a second and opposite polarity being output from the second charge pump, a biased neutral device being driven must safely tolerate the failure condition. 
     Each charge pump receives an independent input signal, e.g. a square waveform generated by one of two independent microcontrollers, or any independently vital means, and the second charge pump output drives a vital biased-neutral device, such as a relay. More specifically, the second charge pump drives the biased-neutral relay only if an independent square waveform is present at the input to each charge pump. One square waveform drives the first charge pump which supplies electrical energy to the second charge pump. The square waveform supplied to the second charge pump generates a voltage that drives the output device. Failure of any charge pump component results in either zero voltage to the output device, or a voltage of polarity opposite to a voltage polarity to which the output device responds. Either condition is considered a fail-safe state. 
     In another embodiment, the first and second charge pumps are implemented using MOSFET switching components in totem pole configurations. Only one MOSFET at a time is switched on in the charge pump totem pole configuration. 
     The above-described “AND” gate and method provide a high-power, low-loss, and low-cost electrical circuit for operating vital devices responding to specific voltages, for example, vital relays. Because only one MOSFET in each totem pole is on at a time, MOSFET current shoot-through is avoided. 
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS 
     FIG. 1 is a block diagram of an “AND” gate including charge pumps in accordance with one embodiment of the present invention; 
     FIG. 2 is a circuit schematic diagram of one embodiment of the charge pumps illustrated in FIG. 1; 
     FIG. 3 is a circuit schematic diagram of the “AND” gate shown in FIG. 1 along with a circuit that supplies voltage signals to the charge pumps; and 
     FIG. 4 is a circuit schematic diagram of an alternative embodiment of an “AND” gate. 
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
     Generally, vital “AND” gates including cascaded charge pumps are described herein. The present invention, however, is not limited to the specific exemplary embodiments described herein. 
     Referring now specifically to the drawings, FIG. 1 is a block diagram of a vital “AND” gate  10  including charge pumps CP 1  and CP 2  in accordance with one embodiment of the present invention. Input signals to charge pumps CP 1  and CP 2  are independent, i.e. generated independently, for example, by microcontrollers A and B. Microcontroller A supplies an independent input  16  to charge pump CP 1  and microcontroller B supplies an independent input  18  to charge pump CP 2 . Charge pumps CP 1  and CP 2  are cascaded. More specifically, an output  30  of charge pump CP 1  is utilized to supply power to charge pump CP 2 . A power supply PS is configured to energize charge pump CP 1  via an input  32 . An output  40  of charge pump CP 2  is supplied to a biased-neutral relay R. Of course, charge pumps CP 1  and CP 2  could be used in connection with any device that responds only to a predetermined voltage polarity, and biased-neutral relay R is one exemplary application. 
     Each of independent inputs  16  and  18  to vital “AND” gate  10  has an active state asserted by a waveform of predetermined frequency and duty cycle. For example, microcontrollers A and B each generate square waveforms having fifty-percent duty cycles. Signals input to charge pumps CP 1  and CP 2  may have different frequencies and duty cycles, depending on the overall configuration of vital “AND” gate  10  and specifications of any device to be driven by vital “AND” gate  10 . Each independent input to vital “AND” gate  10  also has inactive and fail-safe states asserted by a zero voltage. 
     In operation, and in one embodiment, charge pump CP 2  drives biased-neutral relay R only if: (a) microcontroller A, independently of microcontroller B, generates a waveform input  16  having a frequency and duty cycle predetermined as exhibiting an active state, (b) microcontroller B, independently of microcontroller A, generates a waveform input  18  also having a frequency and duty cycle predetermined as exhibiting an active state, and (c) each of charge pumps CP 1  and CP 2  is energized and operating normally. If either or both inputs  16  and  18  exhibit an inactive (also fail-safe) state as described above, or if any components of charge pumps CP 1  and CP 2  fail, one of only two possible outcomes results: either a zero voltage at an output  40  of charge pump CP 2 , or a voltage of polarity opposite to a voltage polarity to which relay R is configured to respond. Both results are fail-safe conditions. 
     As described above the square waveform from microcontroller A is supplied to microcontroller B, and the square waveform from microcontroller B is supplied to microcontroller A. Microcontroller A and microcontroller B check the frequency and duty cycle of the waveform output by the other microcontroller. The microcontrollers may or may not be performing other vital and/or non-vital missions. The square waveforms output by the microcontrollers typically have specific diverse frequencies and operate generally with a 50% duty cycle. If the frequency or duty cycle of either waveform is in error or out of tolerance, the microcontroller that detects the error stops generating its square waveform output. If both waveforms are not in error and within tolerance, then microcontroller A and B continue to generate independent square waveform outputs. By programming the microcontrollers to perform the frequency and duty cycle checks, a need for physical filters for the two pulse trains is eliminated. 
     Charge pump CP 1  receives the square waveform output from microcontroller A, and charge pump CP 2  receives the square waveform output from microcontroller B. Each of charge pumps CP 1  and CP 2  is a voltage inverting circuit such that DC output voltage from each of charge pumps CP 1  and CP 2  has a polarity opposite to a polarity of its input voltage. Accordingly and as shown in FIG. 2, during normal operation, for example, charge pump CP 1  outputs a DC signal having a negative polarity and charge pump CP 2  outputs a DC signal having a positive polarity. Thus independent input  16  is used to drive charge pump CP 1  to generate a supply voltage to charge pump CP 2 , and independent input  18  is used to generate a driving voltage to biased-neutral relay R, thereby achieving the function of ANDing the two inputs. 
     When the square waveforms output by microcontroller A and microcontroller B are acceptable, and all, other circuit components are operating properly, CP  2  generates a positive DC voltage signal to energize, or activate, relay R. If microcontroller A detects an error in the square waveform signal output by microcontroller B, then microcontroller A immediately interrupts its generation of an output square waveform. As a result, CP  1  is biased to generate a DC voltage which is of the opposite polarity required to energize relay R, i.e., a fail safe condition. Likewise, if microcontroller B detects an error in the square waveform signal output by microcontroller A, then microcontroller B immediately interrupts its generation of an output square waveform. As a result, CP  2  does not generate a DC voltage signal and no signal is supplied to relay R, i.e., a fail safe condition. 
     Referring to FIG. 2, each of charge pumps CP 1  and CP 2  includes a switch SW 1 , a charge capacitor C, a filter capacitor C F  and control diodes D 1  and D 2 . Power source PS supplies a biasing voltage of, for example, +24 volts to switch SW 1  of charge pump CP 1  via input  32 . A voltage is supplied to switch SW 1  of charge pump CP 2  from output  30  of CP 1 . 
     Charge pump CP 2  drives vital relay R by asserting a voltage configured to place relay R in either an active or an inactive state, dependent on the voltage polarity. More specifically, provided that all other “AND” gate  10  components are operating normally, charge pump CP 2  generates a positive DC voltage signal to energize, or activate, relay R. If the square waveform signal from microcontroller B is halted or interrupted, then, as a result, a fail-safe condition occurs, i.e. charge pump CP 2  does not generate a DC voltage signal and thus a zero voltage signal is supplied to relay R. Thus an “AND” operation is performed on the two input signals, resulting in an output condition signal supplied by charge pump CP 2  to relay R. 
     FIG.  3 . is a circuit schematic diagram of “AND” gate  10  including charge pumps CP 1  and CP 2  as shown in FIG.  2 . “AND” gate  10  is connected to a circuit  50  that supplies voltage signals from, e.g., microcontrollers A and B to charge pumps CP 1  and CP 2 . A circuit  60  supplies a biasing voltage of, for example, +24 volts to circuit  50 . In the exemplary embodiment illustrated in FIG. 3, the following values are used. 
     
       
         
               
               
               
               
               
               
               
             
               
               
               
               
               
               
               
             
               
               
               
             
               
               
               
             
               
               
               
               
             
               
               
               
               
               
             
           
               
                   
                   
               
             
             
               
                   
                 Resistors 
                   
                 Capacitors 
                   
                 Diodes 
                   
               
               
                   
                   
               
             
          
           
               
                   
                 R1 
                 475 
                 C1 
                 220 uF 
                 D1 
                 SR306 
               
               
                   
                 R2 
                 4.99K 
                 C2 
                 220 uF 
                 D2 
                 SR306 
               
               
                   
                 R3 
                 4.99K 
                 C3 
                 0.1 uF 
                 D3 
                 SR306 
               
               
                   
                 R4 
                 475 
                 C4 
                 220 uF 
                 D4 
                 SR306 
               
               
                   
                 R5 
                 4.99K 
                 C5 
                 220 uF 
                 D5 
                 1N4148 
               
               
                   
                 R6 
                 475 
                 C6 
                 220 uF 
                 D6 
                 1N4148 
               
               
                   
                 R7 
                 475 
                 C7 
                 220 uF 
                 D7 
                 1N4148 
               
               
                   
                 R8 
                 4.99K 
                 C8 
                 220 uF 
                 D8 
                 1N4148 
               
               
                   
                 R9 
                 4.99K 
                 C9 
                 220 uF 
                 D9 
                 1N4148 
               
               
                   
                 R10 
                 4.99K 
                 C10 
                 220 uF 
                 D10 
                 1N4148 
               
               
                   
                 R11 
                 4.99K 
                 C11 
                 220 uF 
                 D11 
                 1N5245A 
               
               
                   
                 R12 
                 4.99K 
                 C12 
                 0.1 uF 
                 D12 
                 1N5245A 
               
               
                   
                 R13 
                 4.99K 
                   
                   
                 D13 
                 1N5245A 
               
               
                   
                 R14 
                 4.99K 
                   
                   
                 D14 
                 1N5245A 
               
               
                   
                 R15 
                 470 
               
               
                   
                 R16 
                 470 
               
               
                   
                 R17 
                 2.21K 
               
             
          
           
               
                   
                 Resistors 
                   
               
             
          
           
               
                   
                 R18 
                 2.21K 
               
               
                   
                 R19 
                 2.21K 
               
               
                   
                 R20 
                 2.21K 
               
               
                   
                   
               
             
          
           
               
                   
                 MOSFETS 
                   
                 Optoisolators 
               
               
                   
                   
               
             
          
           
               
                   
                 Q1 
                 1RF9530 
                 U1 
                 CNY17-3 
               
               
                   
                 Q2 
                 1RF530 
                 U2 
                 CNY17-3 
               
               
                   
                 Q3 
                 BS250 
               
               
                   
                 Q4 
                 BS250 
               
               
                   
                 Q5 
                 BS170 
               
               
                   
                 Q6 
                 1RF9530 
               
               
                   
                 Q7 
                 1RF530 
               
               
                   
                 Q8 
                 BS170 
               
               
                   
                   
               
             
          
         
       
     
     In FIG. 3, charge pumps CP 1  and CP 2  correspond to charge pumps CP 1  and CP 2  as shown in FIGS. 1 and 2. Each of transistor pairs Q 1 , Q 2  and Q 6 , Q 7  is configured in a totem pole configuration. Capacitors C 5 ; C 7 , C 9 , and C 11  function as charge storage devices. A circuit board (not shown) containing microcontrollers A and B is connected to connector H 1 . Microcontroller A interfaces with charge pump CP 1 , and microcontroller B interfaces with charge pump CP 2 , via circuit  50  components. 
     In one embodiment, components included in systems  10 ,  50  and  60  are mounted on one circuit board. In an alternative embodiment, components included in systems  10 ,  50  and  60  are distributed on multiple circuit boards depending on efficient utilization of board space and heat dissipation, as is known in the art. In a further alternative embodiment, interface circuitry  50  is replaced by an alternative form of interface circuitry. In a still further alternative embodiment, input signals are supplied by sources other than microcontrollers A and B. As described above, such inputs are independently generated, each having an active state asserted by a waveform of predetermined frequency and duty cycle. Each such input also has inactive and fail-safe states asserted by a zero voltage. 
     In operation, output signals are supplied by, e.g., microprocessors A and B to interface circuitry  50  to drive or enable outputs of optoisolators U 1  and U 2 . Optoisolator U 1  is configured so that a positive voltage from microcontroller A enables an output of optoisolator U 1 . A series of pulses continuously applied to optoisolator U 1  results in, e.g., a −24-volt output  62  of capacitor C 7 . More specifically, the pulses output from optoisolator U 1  result in a switching on and off of MOSFET Q 5  so that, for example, a 0 to +24-volt square wave is supplied to a junction  64  of diodes D 13  and D 14 . When voltage at junction  64  is approximately zero, MOSFET Q 1  is switched on (i.e. a gate current flows to MOSFET Q 1 ) and MOSFET Q 2  is switched off (i.e. virtually no gate current flows to MOSFET Q 2 ). As voltage at junction  64  increases and approaches a defined dead band voltage range as described below, MOSFET Q 1  switches off (i.e. the gate current to MOSFET Q 1  shuts off) and MOSFET Q 2  remains off. When voltage at junction  64  exceeds a breakdown voltage of diode D 14 , MOSFET Q 2  switches on (i.e. a gate current flows to MOSFET Q 2 ) and MOSFET Q 1  remains off. A first pulse charges capacitors C 4  and C 6  to approximately −24 volts. A second pulse charges capacitors C 5  and C 7  so that approximately −24 volts are transmitted to resistors R 5  and R 17  and MOSFETS Q 7  and Q 8 . 
     Values of zener diodes D 13  and D 14  are selected to create a dead band so that, as output voltage of MOSFET Q 5  transitions from a high level to a low level and from a low level to a high level, both MOSFETS Q 1  and Q 2  are switched off, i.e. no gate current flows to either MOSFET Q 1  or Q 2 . This dead band prevents shoot through of current through MOSFETS Q 1  and Q 2 , since no more than one of MOSFETs Q 1  and Q 2  is switched on at any time. 
     Similarly, optoisolator U 2  is configured so that a positive voltage from microcontroller B enables an output of optoisolator U 2 , but each voltage is opposite in polarity so that an output of +24 volts is produced from capacitor C 11 . Voltage at junction  66  of D 11  and D 12  ranges from zero volts to −24 volts. It is assumed that when a negative voltage, e.g. −24 volts, is produced from capacitor C 11 , the voltage results from normal operation of optoisolator U 1  and related circuitry and not from a failure mode. Additionally, in order to generate a false positive output, at least three consecutive components would be required to fail simultaneously. For example, to produce +24 volts at input  40  to relay R, MOSFET Q 7 , diode D 3 , and capacitor C 8  or C 10  would each be required to fail simultaneously in a remote failure mode. Particularly, each such component would have to short. 
     Several components of charge pump circuit  10  as shown in FIG. 3 are redundant to enhance reliability of circuit  10 . In an alternative embodiment, pairs of capacitors such as capacitors C 5  and C 7 , capacitors C 4  and C 6 , capacitors C 9  and C 11 , and capacitors C 8  and C 10 , are replaced with single capacitors. 
     If relay R inputs are removed, i.e., at least one of charge pumps CP 1  and CP 2  fails, relay R is turned off in approximately I second as a result of a time constant defined by capacitor C 9  (440 uF) and a relay impedance of 500 ohms, i.e., when DC current through relay R drops below a holding current, relay R drops out or opens. Charge pump circuit  10  operates at a frequency of less than 200 hertz in one embodiment. 
     FIG. 4 is a circuit schematic diagram of a charge pump circuit  70 , an alternative embodiment of the present invention. In circuit  70 , Darlington pairs Q 1 , Q 2  and Q 6 , Q 7  are utilized rather than MOSFETS. Other embodiments of circuits implementing the above described vital “AND” gate also are possible. In the exemplary embodiment shown in FIG. 4, the following component values are used. 
     
       
         
               
               
               
               
               
             
               
               
               
               
               
               
               
             
               
               
               
               
               
               
               
             
               
               
               
               
               
               
               
             
           
               
                   
                   
               
             
             
               
                   
                 Optoisolators 
                   
                 Capacitors 
                   
               
               
                   
                   
               
             
          
           
               
                   
                 U1 
                 CNY17-3 
                 C1 
                 470 uF 
                 C7 
                 470 uF 
               
               
                   
                 U2 
                 CNY17-3 
                 C2 
                 470 uF 
                 C8 
                 220 uF 
               
               
                   
                   
                   
                 C4 
                 470 uF 
                 C9 
                 220 uF 
               
               
                   
                   
                   
                 C5 
                 470 uF 
                 C10 
                 220 uF 
               
               
                   
                   
                   
                 C6 
                 470 uF 
                 C11 
                 220 uF 
               
               
                   
                   
               
             
          
           
               
                   
                 Resistors 
                   
                 Transistors 
                   
                 Diodes 
                   
               
               
                   
                   
               
             
          
           
               
                   
                 R2 
                 4.99K 
                 Q1 
                 2N6045 
                 D1 
                 SR306 
               
               
                   
                 R3 
                 4.99K 
                 Q2 
                 2N6042 
                 D2 
                 SR306 
               
               
                   
                 R5 
                 4.99K 
                 Q5 
                 BS170 
                 D3 
                 SR306 
               
               
                   
                 R12 
                 4.99K 
                 Q6 
                 2N6045 
                 D4 
                 SR306 
               
               
                   
                 R15 
                 1K 
                 Q7 
                 2N6042 
               
               
                   
                 R16 
                 1K 
                 Q8 
                 BS250 
               
               
                   
                   
               
             
          
         
       
     
     The above described charge pump circuit is configured without inductors and makes use of low-loss transistors to provide high power efficiently without cross-conduction. Since cross-conduction is eliminated, the above-described charge pumps can be operated at reduced frequencies, for example, at less than two hundred hertz. The above-described circuit also provides for performance of a vital “AND” operation on two inputs and thus provides for fail-safe operation of such devices as vital relays. 
     While the invention has been described in terms of various specific embodiments, those skilled in the art will recognize that the invention can be practiced with modification within the spirit and scope of the claims.