Method for operating a safety-critical function using a touch sensor

A method for initiating a safety-critical function in an appliance. The method including receiving a first user input for the safety-critical function via a touchscreen and receiving a second user input confirming the safety-critical function via a first separate input element adjacent to the touchscreen. The operation of the touchscreen can be manipulated externally, directly or indirectly, via wireless communication while a safety-critical function is active. The first separate input element communicates via a wired connection to a control device that is not capable of being manipulated externally via wireless communication while a safety-critical function is active, wherein the control device controls initiation of the safety-critical function. In the method, both the first user input and the second user input are required to initiate the safety-critical function.

FIELD

The present invention relates generally to a method for controlling a cooking appliance and, more particularly, to a method for implementing a safety-critical function using a capacitive key.

BACKGROUND

For safety reasons, the Underwriters Laboratories (UL) mandates (via standard UL 858) that a cooking appliance meet a Two-Steps-On and One-Step-Off requirement for certain ‘safety-critical functions.’ Such functions typically are those involving high temperatures, for example a pyrolytic-clean cycle for a cooking oven.

Under the current UL standard, one step of the Two-Steps-On process must be performed by a UL 60730 Class B compliant device. To be complaint, among other requirements the device must not be manipulable externally via wireless communication, e.g., via Bluetooth or Wi-Fi while a safety-critical function is active. For the One-Step-Off process, the appliance must provide at least one way to cancel the safety-critical function by a single user input (e.g. one touch) to a UL 60730 Class B compliant device.

Conventional appliances comply with the Two-Step-On and One-Step-Off requirements by using physical knobs or touchscreen displays that are UL 60730 Class B compliant. However, physical knobs are less visually appealing, and touchscreen displays that are UL 60730 Class B compliant are costly.

The present application discloses a method for performing a safety-critical function that makes use of an independent touch sensor not integrated with a touchscreen display.

SUMMARY

There is provided a method for initiating a safety-critical function in an appliance. The method including receiving a first user input for the safety-critical function via a touchscreen and receiving a second user input confirming the safety-critical function via a first separate input element adjacent to the touchscreen. The operation of the touchscreen can be manipulated externally, directly or indirectly, via wireless communication while a safety-critical function for the appliance is active. The first separate input element communicates via a wired connection to a control device that is not capable of being manipulated externally via wireless communication while the safety-critical function is active, wherein the control device controls initiation of the safety-critical function. In the method, both the first user input and the second user input are required to initiate the safety-critical function.

Furthermore, there is a provided an appliance adapted to perform a safety-critical function. The appliance includes a user interface having a touchscreen display adapted to receive a first user input and a separate input element disposed adjacent to the touchscreen display and adapted to receive a second user input. A microcontroller is provided that is not capable of manipulation externally via wireless communication while a safety-critical function is active. The microcontroller is adapted to initiate the safety-critical function. The separate input element is in communication with the microcontroller via a wired connection. The microcontroller is programmed to initiate the safety-critical function only upon receiving a first signal calling up that safety-critical function originating from the first user input, and a second signal confirming the safety-critical function originating from the second user input.

Furthermore, there is provided a method for initiating a safety-critical function in an appliance. The method includes receiving a first user input selecting the safety-critical function via a touchscreen display; thereafter indicating on the touchscreen display a specific separate input element adjacent to but not part of the touchscreen display to confirm the safety-critical function; thereafter receiving a second user input via the specific separate input element adjacent to the touchscreen display via a signal supplied via a wired connection therefrom to a control device that cannot be manipulated externally via wireless communication while the safety-critical function is active; and the control device thereafter initiating the safety-critical function.

DETAIL DESCRIPTION

Examples will now be described more fully hereinafter with reference to the accompanying drawings in which example embodiments are shown. However, aspects may be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Moreover, certain terminology is used herein for convenience only and is not to be taken as a limitation.

FIG.1shows a front perspective view of a cooking appliance10(i.e. a free-standing range) according to an embodiment. It is contemplated that the cooking appliance10can be built-in or wall-mounted, or have another configuration. The illustrated appliance10includes a cooktop12and a cooking cavity18open at the front16of the appliance. A door22is attached at the front of the appliance10for selectively closing the cavity18. The cavity18is dimensioned to receive one or more racks26therein for supporting food to be cooked. The racks26may engage embossments (not shown) on the side walls of the cavity18.

A heating element28is disposed within the cavity18. In the embodiment illustrated, the heating element28is an electric broil element that is position along a top wall of the cavity18. It is contemplated that the heating element28can be a gas burner. It is further contemplated that a convection heating element (not shown) can be disposed along a rear wall19of the cavity18and/or a bake element (not shown) can be disposed along a bottom wall of the cavity18. Indeed, one or more heating elements may be disposed within or associated with the cavity18to cook food therein, and also to perform other functions (such as pyrolytic clean).

The cooking appliance10includes a user interface (UI)50for allowing a user to input commands to the cooking appliance10. The UI50is configured to control the operation of the cooking appliance10based on input received from the user. Referring toFIG.2, the UI50includes a touchscreen display52and a plurality of separate input elements such as touch sensors (e.g. capacitive-touch buttons) disposed outside of and adjacent to the display52, e.g. on opposite sides thereof. In the embodiment illustrated there are four capacitive-touch buttons54a,54b,54c,54d. It is contemplated that the UI50can include more or fewer buttons outside of the display52. Moreover, the separate input elements can be or include other control elements, including dial, knobs, tactile push-buttons, touch buttons that operate other than via capacitance sensors, or any other suitable input element. The touchscreen display52can be a resistive, capacitive, surface acoustic wave, infrared, optical imaging, or an acoustic pulse recognition touchscreen. It is also contemplated that the touchscreen display52can include a liquid crystal display (LCD) that is used in combination with one of the foregoing. Alternatively, the touchscreen display52may be configured and operable in any manner, the specific mode of its operation to receive and process touch inputs and to display graphical images or information being not critical to the present disclosure. The touchscreen display52is configured to display information regarding the operation of the appliance10and to accept touch inputs from the user regarding a function that the user desires the cooking appliance10to perform.

FIG.3illustrates a block diagram of the UI50. In addition to the aforementioned display52(which can be a touchscreen) and separate input elements, such as buttons54a,54b,54c,54d(e.g. capacitive-touch buttons), the UI50includes at least two distinct computer processors; i.e. a graphical processing unit (GPU)90and a microcontroller70(also referred to as a “control device”). In the instant embodiment the GPU90is not a UL 60730 Class B compliant device; for example it can be a UL 60730 Class A-compliant device. As appreciated by those skilled in the art, such devices may be subject to manipulation externally via wireless communication such as Bluetooth or Wi-Fi while a safety-critical function is active. In contrast, the microcontroller70preferably is a UL 60730 Class B compliant devices, which among other things, as noted above, cannot be manipulated via wireless communication.

It is appreciated that the UL 60730 Class B compliant standard is updated periodically by UL. In the present application, the term “UL 60730 Class B compliant” refers to a device that meets the requirements of that standard in-effect as of October 2021 (i.e., the 4thEdition of UL 60730), and as that standard may be revised or updated from time to time so long as the revised/updated standard requires a device to conform substantially with safety and operational requirements at least as stringent, when taken together, as required by the standard as of October 2021. Chief among these is the requirement that a UL 60730 Class B compliant device must not be capable of manipulation externally via wireless communication, such as Bluetooth or Wi-Fi, while a safety-critical function is active.

Referring toFIG.3, when a user supplies a command input via touch on the touchscreen display52, that command is communicated to the GPU90for processing. The GPU90is primarily responsible for accepting and processing inputs entered via user interactions with the touchscreen display52. Upon receiving and processing such inputs, the GPU90operates the display52in response to those inputs (e.g. adjusting or displaying different information responsive to user inputs, as appropriate), as well as sends command signals associated with those inputs to the microcontroller70. The microcontroller70serves as an interface for processing commands to execute cooking functions via operational components72(e.g. heating elements, fans, etc.) of the appliance.

As noted, the microcontroller70preferably is a UL 60730 Class B compliant device, i.e. among other requirements it cannot be manipulated wirelessly while a safety-critical function is active. The microcontroller70can be an electronic controller and can include one or more processors for executing programmed instructions that cause the microcontroller70to operate operational components72of the appliance.

The microcontroller70can include memory adapted to store program instructions that, when executed by the microcontroller70, cause the microcontroller70to provide the functionality ascribed to it herein, as well as data used to execute other operations as desired. For example, the memory can include lookup tables useful in executing selected cooking functions, user-profiles (i.e. information or data stored by a user specific to that user's cooking preferences) and any other information useful in the operation of the appliance. The microcontroller70can process inputs, either directly from selected input elements such as the capacitive-touch buttons54a-54d(which interface with it directly), or from the GPU90(which receives inputs from the touchscreen display52and processes them to send corresponding commands to the microcontroller70). The microcontroller70processes all these inputs from the variety of sources and generates control signals to control the operational components72of the appliance10for executing cooking or other functions based on these signals.

As illustrated, the microcontroller70is connected directly to the capacitive-touch buttons54a,54b,54c,54d, e.g. via a direct-wired connection such as on a printed circuit board (PCB—not shown). The buttons54a,54b,54c,54dcan be positioned on opposite sides of the display52, e.g. on a common PCB. In the embodiment illustrated inFIG.2, there are two capacitive-touch buttons54a,54badjacent to one side of the display52and two capacitive-touch buttons54c,54dadjacent to an opposite side of the display52. When the capacitive-touch buttons54a,54b,54c,54dare actuated, the associated signals are sent directly to the microcontroller70.

In one embodiment, the four capacitive-touch buttons54a,54b,54c,54dcan be, for example: 1) a “Back” button, 2) an “On-Off” button, 3) a “Timer” button and 4) a “Light” button. Selection of the Back button causes the display52to return to the previous screen. Selection of the On-Off button causes the display52to turn off or on. Selection of the Timer button causes the display52to show a timer. Selection of the Light button causes an oven light in the cavity18to turn on or off.

During operation of the UI50, the GPU90causes the display52to provide information to the user regarding available functions of the cooking appliance10. In effect, the GPU90controls what is displayed on the touchscreen display52and is responsible for receiving and initially processing commands entered at that display52. When the user selects a desired function by touching the display52, that display52provides signals to the GPU90indicative of the requested function/operation. Thereafter, the GPU90provides a signal to the microcontroller70of the desired function as noted above. The microcontroller70then controls the operational components72of the appliance10(e.g. based the programmed instructions stored in its memory) to perform the requested function/operation based on the control signal from the GPU90corresponding to the original touch input at the display52. As can be seen, inputs entered via the touchscreen display52are routed ultimately to two controllers in sequence: the GPU90, which processes the touchscreen input, and thereafter the microcontroller70, which receives a corresponding signal from the GPU90. The GPU90itself does not interface with or control directly any operational component72of the appliance10. In the illustrated embodiment, it directly controls only the touchscreen display52.

When a user selects a safety-critical function, e.g. pyrolytic cleaning, the UI50operates according to method100shown atFIGS.4and5.FIG.4illustrates an exemplary Two-Steps-On control sequence executed by the UI50, whileFIG.5illustrates an exemplary One-Step-Off control sequence. Beginning with the Two-Steps-On sequence, at Step101the touchscreen display52receives an input calling up a safety-critical function, and sends a corresponding input signal201(also indicated by ‘START’ inFIG.4) to the GPU90indicative of the safety-critical function selected by the user. At Step102, the GPU90processes that input signal201and sends a corresponding initial control signal202to the microcontroller70indicative of the selected safety-critical function. Contemporaneous or in conjunction with sending the initial control signal202to the microcontroller70, the GPU90also sends display signals203to the display52instructing the display52to adjust the displayed information in relation to the selected safety-critical function; e.g. to display confirmatory indicia205to notify the user (e.g. by displaying a pop-up window) of the need to actuate one of the capacitive-touch buttons54a,54b,54c,54dto confirm that the safety-critical function should be initiated. At Step103, after receiving the initial control signal202from the GPU90indicative of the selected safety-critical function, the microcontroller70waits to receive a confirmatory input signal204signal from the correct button54a,54b,54c,54dbefore initiating the safety-critical function via a final control signal206.

In Step104, the user selects the button54a,54b,54c,54dthat the GPU90indicated should be pushed by displaying the confirmatory indicia205on the display52, in order to initiate the safety-critical function. The confirmatory input signal204from the appropriate button54a,54b,54c,54dis sent directly to the microcontroller70via a wired connection.

In Step103, the microcontroller70processes the confirmatory input signal204to confirm that the correct button54a,54b,54c,54dwas selected by the user. Upon confirmation, the microcontroller70then controls the operational components72(FIG.3) via the final control signal206to implement the user-selected safety-critical function (shown at ‘INITIATE’ inFIG.4).

As described above, the UI50complies with the Two-Steps-On requirement by combining an input from the display52via the GPU90(a non-Class B compliant device) with a confirmatory input (via confirmatory input signal204) from the capacitive-touch buttons54a,54b,54c,54ddelivered directly to the microcontroller70(preferably a Class B compliant device) via a wired connection. From the perspective of the user, in a first step the user touches a section of the display52corresponding to the desired safety-critical function, e.g., pyrolytic clean. Then the user is prompted (via the confirmatory indicia205) to separately touch or press the appropriate button54a,54b,54c,54dto confirm that command, whereupon the safety-critical function will be initiated.

To comply with the One-Step-Off requirement, the illustrated method100provides two options to cancel the safety-critical function. To be compliant with UL 858, at least one of those options must be executed via a Class-B complaint device. Referring toFIG.5, one option includes Step121where a user presses the appropriate button54a,54b,54c,54dto cancel the safety-critical function. This sends a CANCEL input signal221to the microcontroller70, which processes that signal221, and executes a CANCEL control signal240to stop the safety-critical function (i.e. to de-energize or deactivate the associated operational components72of the appliance10). One or more of the available buttons54a,54b,54c,54dmay be effective to generate a CANCEL input signal221. Optionally, the display52may display appropriate indicia (not shown) similar to indicia205, to indicate which button(s)54a-54dis effective to cancel the safety-critical function while it is operating. Because this option to cancel the safety-critical function relies on a CANCEL input signal delivered directly (via a wired connection) from the input element (in this case capacitive-touch buttons54a-54d) to a Class-B complaint device (the microcontroller70), this One-Step-Off operation is UL 858 compliant.

The method100also includes a parallel option to cancel a safety-critical function, which proceeds via Steps131and132, utilizing the GPU90. In this parallel option, a user selects cancel icon on the touchscreen display52, which sends a CANCEL input signal231to the GPU90. In Step132, the GPU90receives the CANCEL input signal231from the display52indicative of the user selecting to cancel the safety-critical function. On processing that signal, the GPU90sends a corresponding initial CANCEL control signal232to the microcontroller70. Then in Step140, the microcontroller70processes that initial CANCEL control signal232and executes a corresponding final CANCEL control signal240to cancel the safety-critical operation by de-energizing or deactivating the associated operational components72.

As described in detail above, the method100complies with the One-Step-Off requirement by providing the user with the option to cancel the safety-critical function using the button54a,54b,54c,54dwhose signals are received directly and processed by the microcontroller70, i.e., a UL 60730 Class B compliant device. This way, if the second option to cancel the safety-critical function (via steps131,132) fails due to external (wireless) interference, there remains a reliable Class-B compliant pathway to cancel that function.

In one embodiment, the button54ais a Back button, button54bis an On-Off button, button54cis a Timer button and button54dis a Light button. The button54b(the On-Off button) and the button54c(the Timer button) can be used during the Two-Steps-On and One-Step-Off process explained above. In particular, during the Two-Steps-On process the button54c(the Timer button) is used in the second step of the process to initiate the safety-critical operation. The button54b(the On-Off button) can be selected during the One-Step-Off process as the single step to end the safety-critical operation. As described, the buttons54b,54chave two functions. The software in the microcontroller70can determine if the signals from the buttons54b,54care for the respective On-Off or Timer functions, or if the signals are for the respective start or cancel functions, based on the function that was previously selected on the display52by the user. For example, if the user selected BAKE and then selected button54b, the microcontroller70is configured to determine that the user intended the On-Off function, not the Start function. Similarly, if the user selected a safety-critical function and then selected button54bthe microcontroller70is configured to determine that the user intends to confirm initiation of the safety-critical function via the button54b.

Although the invention has been described with respect to select embodiments, it shall be understood that the scope of the invention is not to be thereby limited, and that it instead shall embrace all modifications and alterations thereof coming within the spirit and scope of the appended claims.