Abstract:
A drive circuit for delivering high-level power to a load, and method of stopping a high power load from operating, are disclosed. The drive circuit includes a high power circuit capable of being coupled to the load and delivering the high level power thereto, and a to power circuit that controls the high power circuit. The low power circuit includes a first circuit portion that provides at least one control signal that is at least indirectly communicated to the high power circuit and that controls the delivering of the high level power by the high power circuit, and a second circuit portions coupled to the first circuit portion. The second circuit portion is capable of disabling the first circuit portion so that the at least one control signal avoids taking on values that would result in the high power circuit delivering the high level power to the load.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application is a divisional of U.S. patent application Ser. No. 10/730,430, filed Dec. 8, 2003, which is hereby incorporated by reference for all purposes. 
     
    
     FIELD OF THE INVENTION 
       [0002]    The present invention relates to drive circuits that are used to control the delivery of high power levels to high power loads such a motors and more particularly, to the disabling of the power delivered by of such drive circuits so that the loads are no longer driven. 
       BACKGROUND OF THE INVENTION 
       [0003]    High power devices are commonly employed in a variety of environments including, for example, industrial facilities and construction environments. High power devices generally include a variety of different devices including, for example, motors and heating devices. Although the operation of such de ices under normal conditions does not pose undue risk, there are circumstances in which such devices must be reliably disabled so as not to pose risks to human beings or other devices. 
         [0004]    For example, high power motors often rotate at high speeds and/or provide significant torques that in certain situations could pose risks to human beings or other devices that come into contact with the motors themselves or with other devices coupled to those motors. In particular, when such motors or devices coupled to those motors are replaced, fixed, modified, tested or otherwise operated upon b human beings such as engineers or service technicians, it is desirable that the motors be reliably disabled such that the motors cease, to rotate or deliver sustained torque. 
         [0005]    In view of the possible hazards associated with hi power devices generally, many modern industrial and other facilities employ various electronic and other technologies that reduce the risk of accidents and enhance overall system safety. Additionally, standards have been developed with a goal of further reducing the risk of accidents. For example, with respect to industrial facilities, standards from organizations such as the NFPA, ISO, CEN, CENELEC, and the IEC have been developed to establish requirements for safety. The technologies used to enhance system safety often are designed to comply with, or to assist in making a facility compliant with, standards from one or more of these organizations. 
         [0006]    Some of the technologies employed to enhance system safety are designed to reliably disable high power devices. For example, technologies such as high power contactors are often used to couple and decouple the driven devices to and from their high power drive circuits. Such contactors often include multiple, redundant high power contacts that are physically coupled to one another in such a way that, if one or more of the contacts become locked/welded in position, a signal is provided indicating that a fault has occurred. The signal can be, for example, the turning on of an indicator light at an operator interface or simply the failure of the high power device to start operating when commanded to do so. 
         [0007]    Such high power contactors are often used because of their relative technical simplicity and reliability. Nevertheless, high power contactors are disadvantageous insofar as they are relatively expensive, and physically large and bulky. Further, in certain circumstances, the disconnecting and connecting procedures for implementing these high power contactors can be complicated and/or time consuming. Consequently, the implementation of such high power contactors can negatively impact the overall efficiency of an industrial or other system in which the high power devices are employed. 
         [0008]    Because of these disadvantages, efforts have been made to find other mechanisms that could be used to disable high power devices. One alternate method of disabling a high power motor that has been attempted, for example, has involved disabling high power transistors of a drive circuit that deliver the high levels of power to the motor. However, this method has thus far proven to be insufficiently reliable. 
         [0009]    Therefore, it would be advantageous if a new mechanism could be developed that allowed for reliable disabling of high power devices such that the high power devices could not inadvertently start operating in a manner that might present a hazard. In particular, it would be advantageous if the new mechanism could avoid the disadvantages associated with using high power contactors in between the high power drive circuits and the driven devices, and at the same time was equally or even more reliable than such high power contactors (or other conventional technologies). Further, it would be advantageous if the new mechanism was relatively easy and inexpensive to implement. 
       SUMMARY OF THE INVENTION 
       [0010]    The present inventors have recognized that, in some circumstances, high power loads are satisfactorily disabled such that the loads stop moving Or otherwise operating, regardless of whether high power levels of some sort continue to be provided to the loads. Indeed, in some of these circumstances, for example, the load is only capable of operating if it receives carefully controlled power levels that vary in time in addition to being of high magnitude. With this in mind, the present inventors have additionally recognized that in these circumstances it would be possible to disable the operation of the loads simply by ceasing to provide the control signals that govern the time-variation of the power. Further, the present inventors have recognized that, in situations where the drive circuits providing high power to their loads include both high power drive sections and low power logic sections that provide control signals to the high power drive sections to govern the delivery of power, the disabling of the loads can be achieved simply by setting the control signals of low power logic sections to low-level for other disabling) values. 
         [0011]    In particular, the present invention relates to a drive circuit for delivering high-level power to a load. The drive circuit includes a high power circuit capable of being coupled to the load and delivering the high level power thereto, and a low power circuit that controls the high power circuit. The low power circuit includes a first circuit portion that provides at least one control signal that is at least indirectly communicated to the high power circuit and that controls the delivering of the high level power by the high power circuit, and a second circuit portions coupled to the first circuit portion. The second circuit portion is capable of disabling the first circuit portion so that the at least one control signal avoids taking on values that would result in the high power circuit delivering the high level power to the load. 
         [0012]    The present invention additionally relates to a high power drive circuit for delivering power to a motor. The high power drive circuit includes first means for delivering high power to the motor, second means for generating low power control signals for the first means, and third means for disabling the second means so that the low power control signals take on values that would tend to cause the first means to stop delivering the high power to the motor. 
         [0013]    The present invention also relates to a method of stopping a high power load from operating, where the high power load receives power from a drive circuit having a high power drive section and a low power logic section, and where the low power logic section provides a control signal to the high power drive section and the high power drive section during normal operation provides the power to the high power load in response to the control signal. The method includes receiving a command to stop the high power load from operating, and switching a status of at least a first component of the low power logic section in response to the command. The switching of the status affects one of the first component and a second component of the low power logic section so that the control signal provided by the low power logic section takes on a value that would tend to cause the high power drive section to cease providing, the power to the high power load. The method further includes ceasing to provide the power to the high power load in response to the control signal taking on the value. 
         [0014]    The present invention additionally relates to a drive circuit for delivering high-level power to a load. The drive circuit includes a high power circuit capable of being coupled to the load and delivering the high level power thereto, and a low power circuit that controls the high power circuit, where the low power circuit includes a first circuit portion that provides at least one control signal that is at least indirectly communicated to the high power circuit and that controls the delivering of the high level power by the high power circuit. Further, the first circuit portion is at least one of coupled to, and adapted to be coupled to, a second circuit portion that is capable of providing to the first circuit portion at least one additional signal causing the first circuit portion to become disabled so that the at least one control signal avoids taking on values that would result in the high power circuit delivering the high level power to the load. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0015]      FIG. 1  is a schematic diagram of a first exemplary embodiment of a drive circuit coupled to a motor; 
           [0016]      FIG. 2  is a schematic diagram of a second exemplary embodiment of a drive circuit coupled to a motor; and 
           [0017]      FIG. 3  is a schematic diagram of a third exemplary embodiment of a drive circuit coupled to a motor. 
       
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
       [0018]    Referring to  FIG. 1 , an exemplary drive circuit  10  for providing high levels of power to a motor  20  is shown. The drive circuit  10  includes a high power drive section  30  and a low power logic section  40 . The high power drive section  30  also can be termed a power structure, while the low power logic section  40  can be termed a control structure. 
         [0019]    As shown, first, second and third phases of power  32 ,  34  and  36 , respectively, are delivered to the motor  20  from six power transistor devices  41 - 46 . In the present embodiment, each of the power transistor devices  41 - 46  is an insulated gate bipolar transistor (IGBT) although, in alternate embodiments, other types of power transistor devices (or other, non-transistor power delivery devices) can be used. Each of the first, second and third phases  32 ,  34  and  36  receives voltage from a respective pair of the power transistor devices  41 - 42 ,  43 - 44 , and  45 - 46 , respectively. Current flows toward or away from the motor  20  in each phase  32 ,  34 ,  36  depending upon which of the pair of corresponding power transistor devices is switched on. If neither of the power transistor devices of a given pair is on, no current flows toward or away from the motor in the corresponding phase. First, second and third coils  50 ,  52  and  54 , respectively, are coupled in series between the motor  20  and each of the respective pairs of power transistor devices  41 - 42 ,  43 - 44  and  45 - 46 . By virtue of the first, second and third coils  50 ,  52  and  54 , the respective currents in each of the respective first, second and third phases  32 ,  34  and  36  can be sensed using conventional current sensing componentry (not shown). 
         [0020]    Each of the power transistor devices  41 - 46  is electrically isolated from the remainder of the high power drive section  30  and the low power logic section  40 . However, the switching on and off of the power transistor devices  41 - 46  is nevertheless governed by signals coming from the remainder of the high power drive section  30 . As shown, the power transistor devices  41 - 46  are light sensitive devices that respond to light signals given off by six optocoupler photodiodes  61 - 66 , respectively. The six photodiodes  61 - 66  are turned on and off based upon six control signals provided from the low power logic section  40 , which are respectively provided by six control line outputs  71 - 76  of the low power logic section  40 . More specifically, the six photodiodes  61 - 66  are themselves grouped into three pairs of photodiodes  61 - 62 ,  63 - 64  and  65 - 66 , The photodiodes of each of the pairs are coupled in parallel with one another in opposite orientations, and the nodes linking the two photodiodes of each pair are then coupled to respective ones of the control line outputs  71 - 76  by way of respective resistors  70 . Although shown as part of the high power drive section  30 , the resistors  70  and photodiodes  61 - 66  are low power devices; they are considered to be part of the high power drive section insofar as they are in direct communication with the high power transistor devices  41 - 46 , and insofar as in practice the photodiodes are typically (though not necessarily) mounted on the same circuit board as the power transistor devices rather than on a separate circuit board supporting the low power logic section. Depending upon the embodiment, the respective photodiodes  61 - 66  are devices that are physically separate from the respective power transistor devices  41 - 46  or, alternately, the respective photodiodes are packaged along with their corresponding power transistor devices  41 - 46  in an integrated manner. 
         [0021]    Further as shown in  FIG. 1 , the low power logic section  40  includes a microprocessor  80  that is coupled to a hex inverter with open collector output  90 , which in turn is connected to an octal tri-state buffer/line driver  100 . The driver  100  outputs the control signals on the control line outputs  71 - 76  in response to six inverter signals provided by the hex inverter  90  on six inverter signal lines  91 - 96 . The six inverter signals on lines  91 - 96  are provided by the inverter  90  in response to six microprocessor signals output by the microprocessor  80  on six microprocessor signal lines  81 - 86 . Each of the microprocessor signal lines  81 - 86  is coupled not only to a respective input terminal on the hex inverter  90  but also is coupled to a power supply  99  by way of a respective pull-up resistor  98 . The power supply  99  is also coupled to the microprocessor  80  to provide power thereto. In the present embodiment, the power supply for the low power logic section  40  is a positive 5 volt DC power supply, and each of the pull-up resistors  98  is a 10 kΩ resistor. The hex inverter  90  essentially consists of six inverter components  97 , each of which inverts a respective one of the microprocessor signals provided by way of lines  81 - 86  to produce the inverter signals provided on lines  91 - 96 , respectively. 
         [0022]    During normal operation, the driver  100  merely acts as a buffer between the inverter signal lines  91 - 96  and the control line outputs  71 - 76 . That is, the signal level of each respective control line output  71 - 76  is the same as the signal level of the corresponding inverter signal line  91 - 96 . The buffering performed by the driver  100  is provided by way of six huller components  102  within the line driver  100 , each of which is coupled respectively between a respective one of the control line outputs  71 - 76  and its corresponding inverter signal line  91 - 96 . Further, because during normal operation the inverter  90  merely inverts the signals output by the microprocessor  80  along lines  81 - 86 , the signals output by the driver  100  on the control line outputs  71 - 76  during normal operation have values that are opposite/inverted relative to the values of the signals on the lines  81 - 86 . 
         [0023]    The driver  100  does not, however, output signals on lines  71 - 76  that are the same as those on lines  91 - 96  and inverted relative to those on lines  81 - 86  in all circumstances. Rather, the driver  100  only outputs the correct signals on lines  71 - 76  in response to the inverter signals on lines  91 - 96  if three conditions are met. First, power must be provided to the driver  100 . Second, each of the lines  91 - 96  is coupled to a respective pull-up resistor  104 , and each of these pull-up resistors must in turn be provided with power. In the embodiment shown, the power supply to which the resistors  104  are coupled can again be a positive 5 volt DC power supply, and each of the pull-up resistors  104  can have a value of 4.7 kΩ. Third, power must be provided to an enable input  106  of the driver  100 , which in turn results in the enabling of each of the buffer components  102 , If any of these conditions are not met, the driver  100  ceases to consistently provide signals on lines  71 - 76  that are the same as the signals on lines  91 - 96  and inverted relative to the signals on lines  81 - 86 , and instead the signals output by the driver each take on a zero value or effectively-zero value in which no current is conducted to any of the photodiodes  61 - 66 . 
         [0024]    The failure to meet any one of these conditions results in the control line outputs  71 - 76  being nonconductive for the following reasons. If the power supply is decoupled from the pull-up resistors  104 , then currents will not flow through those resistors  104  when the inverter signal lines  91 - 96  take on a zero value. Further, because the inverter  90  is an open collector output device, the absence of power being supplied to the pull-up resistors  104  causes the six inverter components  97  of the inverter to enter high impedance, indeterminate states. While the inverter components  97  are in these indeterminate states, they are unable to take on high voltage values, and consequently, the lines  91 - 96  and input terminals of the buffer components  102  of the driver  100  remain at zero volts. Likewise, if the power supply  99  is entirely decoupled from the driver  100  itself, the buffer components  102  are unable to output nonzero currents on the control output lines  71 - 76 . Further, if a zero voltage level is applied to the enable input  106  of the driver  100 , then each of the buffer components  102  likewise is unable to provide a nonzero current on any of the control output lines  71 - 76 . 
         [0025]    In accordance with one embodiment of the present invention, these features of the low power logic section  40  are employed to provide two redundant mechanisms for shutting down the low power logic section such that none of the power transistor devices  41 - 46  is commanded by any of the photodiodes  61 - 66  to deliver high power to the motor  20 . Specifically, a first mechanism for shutting down the low power logic section  40  involves a safety relay circuit  110  that governs whether the power supply  99  is coupled to each of the pull-up resistors  104  as well as to the driver  100  itself. As shown, the safety relay circuit  110  includes a safety on input  112  that includes a coil  114 . So long as a predetermined voltage level is applied across the coil  114  (for example, 24 volts), a normally-open contact  116  within the safety relay circuit  11   0  is closed and a second, normally-closed contact  118  within the safety relay circuit is opened. The closing of the normally-open contact  116  links first and second ports  120 ,  122  of the safety relay circuit  110  so that the power supply  99 , which is coupled to the first port  120 , is in turn coupled to the pull-up resistors  104  and the driver  100  itself, each of which are coupled to the second port  122 . However, if the necessary voltage is no longer applied across the coil  114 , then the power supply  99  is decoupled from both the pull-up resistors  104  and the driver  100  itself, thus causing the control output lines  71 - 76  to shut off and provide no voltage. Therefore, by applying or not applying a voltage across the coil  114  of the safety relay circuit  110 , an operator can thereby determine whether the signals on control line outputs  71 - 76  reflect the microprocessor signals on lines  81 - 86  to provide normal control of the motor  20 , or take on null values such that the power transistor devices  41 - 46  do not provide voltage to the motor  20 . 
         [0026]    The present embodiment is further designed to allow for the detection of faults in the safety relay circuit  110 . Specifically, a safety on monitor can also be coupled to third and fourth ports  124 ,  126  of the safety relay circuit  110 , between which is coupled the normally-closed contact  118 . The safety relay circuit  110  is configured such that the normally-open contact  116  and normally-closed contact  118  are physically coupled so that only one or the other of the contacts can be closed at any given time. Consequently, if the voltage applied across the coil  114  is turned off and the normally-open contact  116  remains closed, then the normally-closed contact  118  remains open and thus the safety on monitor can determine that a fault has occurred due to the open-circuiting of the third and fourth ports  124 ,  126  and the information that the voltage has been disconnected from the coil  114 . Conversely, if the normally-closed contact  118  becomes welded, then the normally-open contact  116  cannot close despite the providing of voltage across the coil  114 , and consequently the driver  100  cannot provide nonzero signals on the control line outputs  71 - 76 . 
         [0027]    In addition to the control capability provided by way of the safety relay circuit  110  in terms of controlling whether power is provided to the pull-up resistors  104  and to the driver  100 , the embodiment of  FIG. 1  also includes additional logic circuitry  130  that determines whether the enable input  106  of the driver  100  is asserted. As shown, the additional logic circuitry  130  includes a hardware switch  132  that is coupled between ground  134  (which is also coupled to appropriate grounding terminals on the microprocessor  80 , the inverter  90  and the driver  100 ) and a low-true input  136  of a NOR gate  138 . A second low-true input  140  of the NOR gate  138  is coupled to the microprocessor  80  by way of a control line  142 , such that the microprocessor can also provide an input to the NOR gate. The output of the NOR gate  138  is coupled to a buffer component  144 , which in turn is coupled to the enable input  106  and also to a further pull-up resistor  146 . The further pull-up resistor  146  is coupled to the power supply  99  by way of the same line as the other pull-up resistors  104 , such that power is only supplied when the normally-open contact  116  of the safety relay circuit  110  is closed. The buffer  144  acts as an open collector output such that a positive, non-zero output can only be applied to the enable input  106  of the driver  100  if power is supplied to the pull-up resistor  146 , that is, only if the normally-open contact  116  of the safety relay circuit  110  is closed. 
         [0028]    Given this design, the enable input  106  only receives a positive, non-zero value such that the driver  100  is capable of outputting non-zero output signals on the control line outputs  71 - 76  if the normally-open contact  116  of the safety relay circuit  110  is closed and at least one of the hardware switch  132  is closed or the microprocessor  80  provides a zero-level control signal via the control line  142  to the inverter  140 . Thus, even if the safety relay circuit  110  is actuated such that power is provided to each of the driver  101 ) and the pull-up resistors  104 ,  146 , it is possible for either of the microprocessor  80  or an operator, by way of opening the switch  132 , to disable the driver  100  such that each of the control line outputs  71 - 76  takes on a zero or effectively-zero 
         [0029]    When implemented as shown in  FIG. 1 , the drive circuit  10  provides multiple, redundant avenues by which an operator or other control entity can cause the drive circuit to provide zero-level control signals via the control line outputs  71 - 76  to the photodiodes  61 - 66  such that the motor  20  ceases to receive power from the power transistor devices  41 - 46 . While it is possible that a human operator may trigger one or both of the hardware switch  132  or the safety on input  112  of the safety relay circuit  110 , the present embodiment also envisions the coupling of these inputs to other components such as an additional safety relay circuit that would be capable of providing a command to each of these inputs (such a safety relay circuit could, for example, be present in a factory environment). That is, the present embodiment is intended to be capable of being implemented in conjunction with a variety of other devices in a manner allowing those other devices to control whether the drive circuit  10  is disabled. 
         [0030]    The circuitry of the drive circuit  10  also is sufficiently redundant that it satisfies requirements of Category 3 of the EN 954-1 standard, which requires that no single fault in any part of the drive circuit  10  would lead to a loss of the ability to cease providing control signals such that the motor  20  might develop sustained torque. As discussed above, a failure of one of the contacts of the safety relay circuit  110  can be detected by way of the safety on monitor. In the case of the actuation of the switch  132  or a microprocessor command provided by way of the control line  142 , a failure of the signals on control line outputs  71 - 76  to become null in response to such activation/command can be sensed by way of the coils  50 ,  52  and  54 . That is, if the switch  132  is open, or the microprocessor  80  is providing a zero-level signal on the control line  142 , then none of the coils  50 ,  52 ,  54  should experience any current and, if current is sensed, a warning signal is generated. In certain embodiments, the sensed current information obtained by way of the coils  50 ,  52  and  54  is provided to and used by the microprocessor  80 . 
         [0031]    The fact that the drive circuit  10  satisfies Category 3 of the EN 954-1 standard is not meant to indicate that the drive circuit  10  guarantees that electrical voltage is not provided to the motor  20 . Indeed, despite the nullification of the control line outputs  71 - 76 , it is still conceivable that one or more of the power transistor devices  41 - 46  would apply voltage to the motor  20 . Rather, because the motor  20  can only develop sustained rotation and torque if the power transistor devices  41 - 46  apply voltage at specific times in a pulse width modulated (PWM) manner determined by the microprocessor  80 , inadvertent conduction of currents by any of the power transistor devices  41 - 46  would only, at most, cause the motor to experience a one-time movement of a limited number of degrees, such as 180 degrees for a two-pole motor or 90 degrees for a four-pole motor. If the motor  20  is running when either the safety on input  112  is triggered or the enable input  106  receives a low level signal due to the triggering of the switch  132  or a signal from the microprocessor  80 , the motor  20  will coast to a standstill. The safety relay circuit input to the driver  100  prevents power from being provided to the control line outputs  71 - 76 , while the actuation of the enable input  106  of the driver  100 , as actuated by the switch  132  or the microprocessor  80  by way of the control line  142 , acts as a logic inhibit of the control line outputs. 
         [0032]    Turning to  FIG. 2 , an alternate embodiment of a drive circuit  210  that somewhat differs from the drive circuit  10  of  FIG. 1  is shown coupled to the motor  20 . The drive circuit  210  does include the same high power chive section  30  as the drive circuit  10 , and a low power logic section  240  of the drive circuit includes the same microprocessor  80 , inverter  90 , pull-up resistors  98 ,  104  and  146 , and additional logic circuitry  130  as the low power logic section  40 . As in the case of drive circuit  10 , the additional logic circuitry  130  provides signals to an enable input  106  of an octal tri-state buffer/line driver  200  of the logic circuit  240 . However, the logic circuit  240  differs from the logic circuit  40  in that the driver  200  of the logic circuit  240  is not coupled to the power supply  99  by way of any safety relay. Further, a safety relay circuit  310  that is employed in the low power logic section  240  is essentially an inverted version of the safety relay circuit  110 . Namely, the safety relay circuit  310  includes first and second ports  320  and  322  that are respectively coupled to the ground  134  and to the pull-up resistors  104  and  146 , with a normally-closed contact  316  coupled between those ports. Also, third and fourth ports  324  and  326  of the safety relay circuit  310  have a normally-open contact  318  coupled between them. Further, the power supply  99  is coupled to the pull-up resistors  104  and  146  and to the second port  322  by a low-level resistance (in this example, a 330 ohm resistor). 
         [0033]    Consequently, when a safety on input is provided to the safety relay circuit  310  such that a coil  312  within the safety relay circuit is actuated, the normally-closed contact  316  is opened such that the power supply  99  is effectively connected to the pull-up resistors  104 ,  146 , thereby allowing the driver  200  to receive non-zero signals from the inverter  90 . However, when the safety on input is not provided to the safety relay circuit  310 , the pull-up resistors  104  and  146  are coupled to ground, thereby preventing the driver  200  from outputting non-zero signals on the control line outputs  71 - 76 . As in the case of the safety relay circuit  110 , the normally-closed contact  316  and normally-open contact  318  of the safety relay circuit  310  are physically coupled such that only one of the contacts can be closed at any given time, such that a welding of either of the normally-closed and normally-opened contacts can be detected. In comparison with the drive circuit  10  of  FIG. 1 , the drive circuit  210  of  FIG. 2  is somewhat simpler to implement and for that reason is somewhat preferred for that reason, albeit the embodiment of  FIG. 1  satisfies certain standards that may not be satisfied by the circuit of  FIG. 2 . 
         [0034]    Referring to  FIG. 3 , yet a third embodiment of the present invention shows a drive circuit  410  having components identical to the drive circuit  110  except insofar as the safety relay circuit  110  has been replaced with a circuit  400  that includes a DC-to-DC conversion circuit  420 . In this embodiment, it is envisioned that another device (not shown) such as another safety relay circuit provided by a third party would be coupled to input terminal  412  of the circuit  400 . The circuit would then convert power signals provided by that other device into an output signal  415  that would govern the voltage applied to the pull-up resistors  104 ,  146  and the power supplied to the driver  100 . By using a DC-to-DC conversion circuit such as that shown, the input signals at the input terminal  412  would be isolated from the output signal  415 , and the input signals could differ in their voltage range from that required by the driver  100  in an arbitrary manner (in the embodiment shown, for example, the input signals  412  can range from 0 to 12 Volts signals, while the output signal  415  can range from 0 to 5 Volts). Although the embodiment of  FIG. 3  shows a DC-to-DC conversion circuit that provides electrical isolation, in alternate embodiments, opto-isolators or other devices could be employed to provide isolation. A DC-to-DC conversion device is advantageous insofar as it provides a reliable shut-down mechanism since it cannot operate without power being applied. 
         [0035]    Although three embodiments of the present invention are shown in  FIGS. 1-3 , the present invention is not intended to be limited to these particular electrical circuits. Rather, the present invention is intended to encompass a variety of electrical and other control circuits in which the delivery of high power levels to a high power device is governed in part by low power circuitry, and in which there are one or more control mechanisms for disabling the low power circuitry to effectively stop the operation of the high power device without taking any action to disable or disconnect the high power drive circuit devices that are directly coupled to that high power load. Indeed, the present invention is intended to encompass any such dual-stage drive circuits in which disablement occurs via the low power stage, regardless of the type of high power load that those drive circuits are powering. 
         [0036]    Also, the present invention is intended to encompass control/drive circuits that are formed from multiple distinct modules. For example, with respect to the embodiment of  FIG. 2 , all of the components of the drive circuit  210  need not be included on a single circuit board. Rather, in some embodiments, all of the low power logic circuit  240  of the drive circuit  210  of  FIG. 2  would be included within a primary module except for the safety relay circuit  310 , which could be implemented on an auxiliary module. In such an embodiment, the drive circuit  210  could be operated to control the high power drive circuit  30  and the motor  20  as normal without the auxiliary module. However, if the auxiliary module were coupled to the primary module (e.g., by way of appropriate connectors/adaptors), then it would be further possible to disable the drive circuit as discussed above by providing the safety on input and thereby coupling the pull-up resistors  104 ,  146  to the ground. A similar design could be employed in relation to the embodiments of  FIGS. 1 and 3 , particularly if a jumper was used to couple the pull-up resistors  104 , 146  and power input of the driver  100  to a power supply in the absence of the safety relay circuit  110  or the circuit  400 . An auxiliary module including a safety relay circuit or other circuit such as circuits  110 , 310  and  400  could be implemented in a variety of manners, such as on a plug-in-module or as part of an external cable. Thus, the present invention is intended to encompass embodiments in which a main control device can be coupled to one or more other devices, which depending upon the embodiment might be required or optional (or even after-market) devices. 
         [0037]    Although the terms “safety”, “reliable”, “safety system”, “safety controller”, and other related terms may be used herein, the usage of such terms is not a representation that the present invention will make an industrial or other process safe or absolutely reliable, or that other systems will produce unsafe operation. Safety in an industrial or other process depends on a wide variety of factors outside of the scope of the present invention including, for example: design of the safety system; installation and maintenance of the components of the safety system the cooperation and training of individuals using the safety system; and consideration of the failure modes of the other components being utilized. Although the present invention is intended to be highly reliable, all physical systems are susceptible to failure and provision must be made for such failure. 
         [0038]    The above description has been that of a preferred embodiment of the present invention. It will occur to those that practice the art that many modifications may be made without departing from the spirit and scope of the invention. In order to apprise the public of the various embodiments that may fall within the scope of the invention, the following claims are made.