Active Intrinsically Safe Circuit

An active intrinsically safe circuit for detecting and mitigating non-compliance of current, voltage, power, or heat to at a load which resides in a hazardous area, where non-compliance may cause danger to life or harm to property. The intrinsically safe circuit monitors current, voltage, power, or heat, shuts off or otherwise limits current, voltage, or power. The intrinsically safe circuit then tests for return of compliance, and acts to restore current, voltage, and power to the load upon return of compliance.

Not Applicable

Not Applicable

BACKGROUND OF THE INVENTION

The subject technology is in the technical field of intrinsically safe circuits, as well as systems, methods, and apparatus making use thereof.

SUMMARY OF THE INVENTION

Care must be taken so that electrical circuits do not create or allow operation above safe limits for voltage, current, power, or heat that would otherwise be sufficient to ignite gasses, other chemicals, or particles in hazardous areas. Prior art in the area of intrinsically safe current limiting circuit often deploys a means to divert current when an over-voltage or over-current fault arises, generally by diverting current into another electrical device. The other electrical device then generates heat while it further consumes energy from the power source and generally causes a fuse to open the circuit. Heat must be dissipated both to protect the device as well as for retaining compliance and safety in the hazardous area, but the heating must also remain below the Auto Ignition Temperature of all gases and particles expected to be in the process area.

In some instances with respect to direct current power sources, a high current transient may be initiated in normal operation by a capacitance on the load side that is charging up too fast, thus drawing excess current, or other normal circuit operations. Also, high direct current drawn by a load may be caused by a capacitor or perhaps a transistor shorting to ground, causing excess current.

A circuit that continues to draw current that is not delivered to the primary load means that the energy is wasted. When the power source is a battery, the battery must be recharged or replaced more often than would otherwise be necessary. Recharging cycles reduce the life of batteries. Furthermore, if the circuit path is not configured properly with a fuse or other means to shut off current flow, catastrophic results may take place with particular battery technologies such as Lithium-Ion.

Still further, maintaining and accessing battery-powered equipment in the field may be impractical for logistical, geographical, or other reasons.

When the power source is a battery, common problems include battery wear and tear due to avoidable recharging events, battery replacement, and battery power being wasted as heat in traditional intrinsically safe circuits.

Such problems are resolved with an active intrinsically safe circuit which detects a fault, shuts off electrical energy to the load, and then seeks to recover while it tests for current and voltage come back into compliance. Electrical energy can be limited with respect to voltage, current, or power. Still further, in some situations the load requires power for various reasons while the intrinsically safe circuit detects a fault. In such situations, the active intrinsically safe circuit may regulate voltage or current to the load at some minimal level, while it then seeks to test and recover if current and voltage come back into compliance. Among the reasons requiring power even while an over-voltage or over-current event takes places include charging ancillary and auxiliary power at the load (such as provided by a large capacitor) while the load enters a safe sleep mode. Another reason is to supply minimal operational power in order to maintain critical functions that must continue or complete.

In many situations, the intrinsically safe circuit could, if required, still deliver proper power to the load during a fault condition. However, if that cannot not be done, then power has to be prevented from passing to the load.

After detecting a fault, in one embodiment the active intrinsically safe circuit may temporarily engage a switch, acting as an electrical crowbar, to divert current from the load, and then immediately opens the current path to prevent overheating and damage to the switch acting as a crowbar. In other embodiments, the crowbar may be replaced by a voltage regulator. In still other embodiments, the switch acting as a crowbar is unnecessary and may be omitted. In all embodiments, the active intrinsically safe circuit then temporarily creates or uses existing alternative circuit paths in order to test voltage or current from the power source, denies all or a portion of power to the load, and attempts to recover when the current or voltage comes back into compliance.

Generally, use of the switch acting as a crowbar is not effective for active current limitation applications, because cutting off or otherwise limiting current is sufficient to resolve the fault. There is no need to shunt the voltage to ground. However, for active voltage limitation, the switch acting as a crowbar or other means to reduce voltage would be required.

After testing continuously, or until a “stop testing” criteria is reached, the active intrinsically safe circuit either restores current to the load if current from the source comes back into compliance or finally cuts off power to the load until other intervention resolves the root cause of the fault.

Control in the active intrinsically safe circuit is provided by active analog devices, discrete digital logic, digital processors, or combinations thereof. To provide additional safety, the active intrinsically safe circuit may be organized in sets of two or more in various topologies and placed in advantageous connection with each other, between the power source and the load.

Other objects and features of the technology presented herein will become apparent from the detailed description considered in conjunction with the accompanying drawings. It is to be understood, however, that the drawings are designed solely for purposes of illustration and not as a definition of the limits of the invention, for which reference should be made to the appended claims. It is further understood that the drawings are intended conceptual illustrations of the structures and procedures described herein.

DETAILED DESCRIPTION OF THE INVENTION

In these descriptions, we may generally refer to voltage, current, or power generically as electrical energy or energy. However, specific applications of active current, active voltage, or active power limitation are contemplated in the embodiments.

FIG. 1shows the general concept of an intrinsically safe circuit110placed between an electrical energy source and a load150, where the intrinsically safe circuit110is in a hazardous area. An electrical energy source140may entail direct or alternating current. A fault recovery circuit130is connected generally in parallel so as to be able to monitor and control voltage and current from the source. Together, the active energy limiter120the fault recovery circuit130comprise the intrinsically safe circuit110. When a fault arises, such as an over-current or over-voltage condition, the active energy limiter120will cut off or otherwise limit voltage or current to the load150. Thus, the load150is protected. After that, the fault recovery circuit130engages, upon information from and control from the intrinsically safe circuit110indicating that a fault occurred. The fault recovery circuit130then tests voltage and/or current for return to compliance. Upon return of voltage and/or current to compliance, the fault recovery circuit130provides information and control to the active energy limiter120to return full voltage and/or current to the load150.

The intrinsically safe circuit110generally may still deliver proper electrical energy142to the load150during a fault condition, if so required. In such cases, testing for recovery must be done under an appropriate load150in order to verify that voltage, current, or power formerly at fault, but actually being delivered under proper load150conditions, has returned to compliance. However, if the fault remains while power is being delivered to the load150, then power, as electrical energy142, to the load150must be prevented.

FIG. 2is an implementation of the intrinsically safe circuit110comprising a controller220, a current pass element240(shown generically as a switch230“B,” but could be another limiting component), and a shunt320ing, or switch230“A,” shown as crowbar. A primary current path to the load150is through switch230“B.” In many situations, this may not be needed, but is disclosed here for discussion. The controller220may be processor-based, discrete digital logic, analog, or any combination thereof. The controller220monitors for an over-voltage or over current condition. Upon detecting such, it first engages the switch230“A,” if present, to send voltage (denoted as Vout) to zero and to divert current to ground and away from the load150. This often creates considerable stress on switch230“A” as current flows through it. It also wastes energy from the electrical energy source140. In order to relieve the stress, the controller220then disengages the current pass element24b“B” so as to deny current flow towards the load150and towards the switch230“A”.

FIG. 3expands on the implementation to show detection on an over-current condition by use of measuring the voltage drop across a shunt resistor1420and from that computing the current through it. With some current compliance reference established in the circuit, if value of current as computed from the voltage drop across the shunt resistor1420exceeds the current compliance reference, then the controller220disengages the current pass element240at “B” as previously described.

FIG. 4is a variation to detect an over-voltage condition by measuring the voltage between ground and a reference voltage420. With some voltage compliance reference established in the circuit, if value of voltage at input exceeds compliance with respect to the reference voltage420, then the controller220engages the switch230“A” and disengages the current pass element240at “B” as previously described.

FIG. 5is a combined implementation that checks for and reacts to both over-current and over-voltage conditions, either of which directs the controller220to engage the switch230“A” (for active voltage limitation) and disengage the current pass element240at “B” as previously described.

FIG. 6adds testing and recovery circuitry to the combined implementation ofFIG. 4. An additional over-current detection circuit, current pass element240“D,” and switch230“C” are added as shown. Intrinsically safe components used in previous figures are shown in dashed lines, to indicate relative placement of the testing and recovery circuit. In this implementation both the load150side of current pass element240“D” and the non-grounded side of switch230“C” are connected to Vout. In an alternative implementation, pass element240“D” and switch230“C” may be in series creating a path for the current from input to ground through pass element “D” and switch230“C.” As shown inFIG. 6, however, the controller220further engages or disengages pass element240“D” and switch230“C” to create an alternate path for testing current and/or voltage from the source. The general idea is to test until voltage and/or current returns to compliance, and then to re-engage switch230“B” to allow current to flow to the load150through the primary path. If the voltage and/or current does not return to compliance but a “stop testing” criteria is reached, switch230“B” remains in the open state, power is not reinstated to the load150, and no further testing takes place.

FIG. 7is a flow chart710, applied to the configuration ofFIG. 6, generally showing the control of switch230“B,” switch230“C,” and pass element240“D” so as first to protect the load150from over current, then to test for compliance while the load150is protected, and finally return power to the load150upon return of compliance. The embodiment contemplated inFIG. 7pertains to complete shut off of current to the load150upon detection of an over-current fault. However, the method can be adapted to allow some current to pass to the load150during a fault, to detect over-voltage conditions under load, to operate with or without switch230“C,” and with other variations that a particular design may require. Upon detecting a fault, current pass element240“B” is disengaged to cut current to the load150. Then alternate paths are created, by closing pass element240“D” and switch230“C.” When current, as measured via an additional over-current detection circuit620, returns to compliance then Vout is also compliant. The method inFIG. 7tests a certain number of times, but may be revised to test indefinitely or until some other condition arises. When testing indicates that Vout and current have returned to compliance, then power is returned to the load150: switch230“C” and pass element240“D” are opened, and then switch230“B” is closed. Power to the load is restored, and further fault detection710takes place.

FIGS. 8 and 9show embodiments of the active intrinsically safe circuit110with fault recovery circuit130, respectively, solely detecting over-current (FIG. 8) and over-voltage (FIG. 9). In both, electrical energy142is allowed to flow to the load150, during recovery testing.

FIG. 10shows a further embodiment of the fault recovery circuit130connected to the active energy limiter120. InFIG. 10, as discussed above with respect toFIG. 6, some energy is still delivered to the load150because of how pass element240“D” and switch230“C” are connected to the load150. When switch230“B” is disengaged while pass element240“D” and switch230“C” are engaged, limited electrical energy142can still flow to the load150through pass element240“D.”

In an alternative embodiment, not shown inFIG. 10, pass element240“D” and switch230“C” are not connected to the primary power path. When switch230“B” is disengaged, power is shut off from the load150. And yet, when pass element240“D” and switch230“C” are engaged, testing recovery can take place while the load150receives no power.

FIG. 11is yet another embodiment of the intrinsically safe circuit110, further with separate sensing combined with complete current shut off upon detection of an over-voltage and/or over-current condition. A primary path144and a secondary path146for electrical energy142are provided. Separate sensing of voltage or current along the primary path144and the secondary path146, with respect to active energy limiter120and fault recovery130, may be convenient or required.

Intrinsic safety standards dictate whether single, double or triple redundancy is required based upon a particular ignition/explosion risk category for which certification is sought.FIG. 12shows an embodiment and implementation of triple redundancy, where three instances of active energy limiters120may operate independently, with each detecting over-current or over-voltage faults and limiting or denying power to the load150accordingly.FIG. 12shows one fault recovery circuit130serving all instances. An alternative would have fault recovery circuits130deployed in each instance of active energy limiter120.

FIG. 13is a specific embodiment of the intrinsically safe circuit110with analog control, allowing minimal power to the load150upon detection of an over-current condition, having primary power cut off except for testing purposes. The minimal power could be used, for example, to charge a large capacitor or small battery at or in the load150, where such an auxiliary storage device would supply minimal power while primary power is cut off. It is contemplated here that the load150could sense the loss of primary power and enter a “sleep” mode, which is powered by the auxiliary storage device. Not all configurations of the load150have a large capacitor to supply enough current to support a sleep mode. The use of the auxiliary storage device described here is only for an example of a possible configuration.

The active energy limiter120ofFIG. 13includes an over-current sensor330, voltage reference voltage420, current pass element240, and driver1370. Electrical energy142enters through an input1310connection, through the over-current sensor330, through the current pass element240, through an output1320connection, and to the load150. Current from the source also supplies power to the various components. The current pass element240is typically a P-channel MOSFET device, but may be any suitable device which is normally conducting and which meets other design requirements. The driver1370enables or disables the current pass element240in order to allow or to deny, respectively, passage of electrical energy142to the load150. A reference voltage420supplied to the over-current sensor330establishes the design criteria for detecting an over-current condition.

The driver1370plays a particularly important role regarding intrinsic safety. The driver1370must react quickly, according to design parameters, to disable the current pass element240. A time delay beyond certain criteria would endanger life and property to be protected.

When current through the over-current sensor330exceeds settable design criteria, thus indicating current is too high for the load150, the over-current sensor330will trip high, as indicated by the tripped1330signal sent to the driver1370and to a fault recovery circuit130. This in turn causes two events. A first event is that the tripped1330signal is conveyed to the driver1370, which is fast switching according to design parameters, which in turn disables the current pass element240. Thus, current to the load150is shut off. A second event is that the tripped1330signal initiates a reset/retry sequence in a fault recovery circuit130.

The fault recovery circuit130monitors output of the current pass element240, and compares it with settable design criteria established within the fault recovery circuit130. The fault recovery circuit130also monitors the tripped1330signal in two places. This is, in effect, creates positive feedback1340needed to introduce hysteresis, which is needed to prevent unwanted on/off switching of the over-current sensor330and at the current pass element240. The duration and period of the resetting of the over-current sensor330are settable by design. With current momentarily flowing to the load150, current can again be tested for compliance. If current still exceeds settable design criteria, then over-current sensor330will trip high again, and again causing the driver1370to disable the current pass element240.

If the newly restored current still exceeds the design limits, then the over-current sensor330will again trip, the driver1370will again disable the current pass element240, and current to the load150will again be shut off. The reset/retry sequence will begin again.

FIG. 14Ashows the over-current sensor330in greater detail, comprising a first comparator1440, a resistor network1410, and a reference voltage420. The resistor network1410further comprises a shunt resistor1420through which primary current passes, and other resistors in a bridge configuration. The resistor network1410in combination with a reference voltage420establish a set point at which when current through the shunt resistor1420exceeds the set point, the first comparator1440comparator will trip, causing its output tripped1330to go high. This is the first event, as described above. The tripped1330output will remain high until appropriately designed positive feedback1340, from the fault recovery circuit130, is applied to the first comparator1440at a positive input. Thus, the first comparator1440resets and causes the tripped1330output to go low.

FIG. 14Bshows the fault recovery circuit130. The fault recovery circuit130comprises a second comparator1450, an oscillator1480, a constant current source1470, a third comparator1460, a retry/reset driver1490, and a diode1430.

Upon initiation of the second event, the tripped1330output from the over-current sensor330initiates the reset/retry sequence. The tripped1330output is compared at the second comparator1450with a second reference voltage420, so that the output of the second comparator1450enables the oscillator1480. The oscillator1480defines retest/retry timing. Oscillator1480output is applied to the constant current source1470that, along with the test pulse1360(which is a sensing of the voltage at the load150), is applied to positive input of a third comparator1460. A third reference voltage420, set according to design parameters, is applied to negative input of the third comparator1460. Output of the third comparator1460comprises reset signals1494following the timing of the oscillator1480, passed on to the reset/retry driver1490.

The reset/retry driver1490manages feedback from the tripped1330output of the first comparator1440to be applied, after conditioning, to the positive input of the first comparator1440, resulting in conditioned feedback. Conditioned feedback is a result of applying timing of the reset signals to the tripped1330output. The conditioned feedback is modulated by the timing of the reset signal1494. Positive feedback1340comprises the passing of the conditioned feedback through a diode1430of sufficient low leakage current to prevent current flow that would otherwise inhibit over-current detection according to design parameters.

Positive feedback1340is applied to the first comparator1440positive input thereby introducing hysteresis that prevents unwanted switching and/or oscillation of the first comparator1440and the tripped1330output.

Thus, the tripped1330output, after being set high because of detection an over-current condition, is momentarily reset to the non-tripped state according to the timing of the reset pulses.

FIG. 15shows a three-channel embodiment of the intrinsically safe circuit110. The three-channel embodiment comprises three substantially identical analog intrinsically safe current limiter modules in series with respect to current passed to the load150. Each may detect an over-current condition from current passed through each. Each may cause tripped1330output, which in turn disables the respective current pass element240and initiates reset/retry operations. A single fault recovery circuit130receives tripped1330from each, and supplies positive feedback1340to each. Thus, reset/retry operations proceed. When current is restored to compliance, the particular active current limiter120that tripped1330will enable the respective current pass element240.

Primary purposes of intrinsically safe circuits110include disabling power, current, or voltage when certain parameters are exceeded. Of course, complete embodiments of the intrinsically safe circuit110with analog control, including both analog intrinsically safe current limiter and fault recovery circuits130, may be connected in series. That is to say, they may be connected without separation and use of single fault recovery circuits130to serve each active energy limiter120. However, the use of one single fault recovery circuit130serving more than one active energy limiter accomplishes that primary purpose. Failure of any single fault recovery circuit130only means that energy may not be restored without other intervention.

FIG. 16shows an embodiment of separation and use of a single fault recovery circuit130to serve three active energy limiters120. Tripped1330output is received from each active energy limiter, to enable operation of the single oscillator1480, and further to engage the single third comparator1460. Output of the single third comparator1460, along with individual tripped1330output, results in positive feedback1340for each particular active energy limiter120.

We anticipate that the system will include other features, including:Use where the power source is alternating current.Use of voltage regulator in place of switch acting as a.Minimal current is supplied to charge a capacitor or other auxiliary short term power at the load while waiting for voltage and/or current compliance.Minimal current is supplied to keep critical functions alive while waiting for voltage and/or current compliance.Reacting to limit voltage, current, or power when excess heat is detected, regardless of cause. However a reasonable inference could be that excess heat is caused by voltage, current, or power that exceeds design limits.Extending the embodiments to include intrinsically safe active power limitation, with various means for computing, measuring power, limiting, or regulating power delivered to the load (constant power source)

While the foregoing written description of the fluid transport technology enables one of ordinary skill to make and use what is considered presently to be the best mode thereof, those of ordinary skill will understand and appreciate the existence of variations, combinations, and equivalents of the specific embodiment, method, and examples herein. The intrinsically safe circuit110technology presented here should therefore not be limited by the above described embodiments, methods, or examples, but by all embodiments and methods within the scope and spirit of the subject technology.

Fundamental novel features of the technology disclosed herein as applied to preferred embodiments, have thus been presented. Various omissions, substitutions, changes in the form, and changes in detail of the methods described and the devices illustrated, and in their operation, may be made by those of ordinary skill in the art without departing from the spirit of the technology presented. For example, it is expressly intended that all combinations of those elements and/or method steps which perform substantially the same function in substantially the same way to achieve the same results are within the scope of the technology presented. Moreover, it should be recognized that structures and/or elements and/or method steps shown and/or described in connection with any disclosed form or embodiment of the technology may be incorporated in any other disclosed or described or suggested form or embodiment as a general matter of design choice. It is the intention, therefore, to be limited only as indicated by the scope of the claims.