Patent Description:
A relay may be subjected to a variety of ambient conditions during actual use resulting in unexpected failure. The use of flammable and/or toxic refrigerants in heating and cooling systems requires the use of failsafe mechanisms to prevent accidental build-up of refrigerant, particularly if the system is in an enclosed area. Refrigerant systems may use relays to operate failsafe systems that ensure concentration levels of refrigerants remain below specified limits. In some applications, these failsafe systems may preferably have an expected product life of over twenty years to be commensurate with the life of the system in which they operate, but existing failsafe systems can go through years of non-use and may become unreliable.

For example, refrigerant concentration may be monitored by sensors to maintain concentrations below a flammability level. Typically, should concentrations build to a hazardous level, mitigation operations must be performed. Mitigation operations may include, for example, stopping the compressor, opening dampers, and/or turning on a fan to disperse refrigerant gas. Such mitigation operations need to be performed under any fault conditions and in situations involving main power loss, such as when a main power supply falls below a predetermined threshold. As referenced above, refrigerant systems may use relays to operate failsafe systems so that any necessary mitigation operations can be performed, but there remains a need for further contributions in this area of technology to ensure reliable relay operation to perform the mitigation operations.

<CIT> discloses an electronic circuit with a fail-safe relay drive circuit for driving the output state in the case of an abnormality.

The application relates to providing more reliable relay operation in failsafe conditions. Aspects of the current application include a control circuit with a latching relay coupled to a normal operation circuit and a relay status monitoring circuit, a reset coil monitoring circuit, a set coil monitoring circuit, fan control circuitry, a power loss activation circuit, compressor control circuitry, and a watchdog circuit. The novel application of latching relays, power loss detection, and failsafe operation may be employed to enable emergency mitigating action initiation. Emergency mitigating actions include maintaining the relay in a set position, maintaining the relay in a reset position, or causing the relay to switch positions.

The systems and methods described herein provide for normal controlled operation and emergency mitigating action initiation during power loss and component failure situations. For example, the system may maintain the relay in the reset position on power loss or component fault to implement operation of a failsafe system, such as an exhaust fan. In another example, the system may maintain the relay in the set position on power loss or component fault to prevent undesirable operation of a system component, such as a compressor. Additionally, the system may cause operation of the relay to switch positions on and/or off after power loss or component fault to enable initiation of other types of emergency mitigating actions as may be warranted in particular circumstances.

A control circuit operates to control operative components in parallel with power and fault detection. Under a normal operation, a microcontrol unit (MCU) operates to constantly reinforce a state of a latching relay of the control circuit by supplying a signal of a given period and pulse width. The MCU further inputs a periodic signal to the watchdog circuit that also is electrically connected to the control circuit. When the MCU ceases inputting the periodic signal to the watchdog circuit, indicating a potential MCU fault condition, the watchdog circuit switches the latching relay into a failsafe position to initiate mitigation operations. The mitigation operations also may be powered by a power loss activation circuit that provides alternative power in the event of a power loss. In an example of a refrigerant system, mitigation operations may include stopping compressor operation and turning on a fan to disperse leaked refrigerant that can build up to hazardous concentrations during a power loss.

To the accomplishment of the foregoing and related ends, the invention, then, comprises the features hereinafter fully described and as defined in the claims. The following description and the annexed drawings set forth in detail certain illustrative embodiments of the invention. These embodiments are indicative, however, of but a few of the various ways in which the principles of the invention may be employed. Other objects, advantages and novel features of the invention will become apparent from the following detailed description of the invention when considered in conjunction with the drawings.

The following detailed description and appended drawings describe and illustrate various exemplary embodiments of the invention. The description and drawings serve to enable one skilled in the art to make and use the invention, and are not intended to limit the scope of the invention in any manner. With respect to the methods disclosed, the steps presented are exemplary in nature, and thus, the order of the steps is not necessary or critical.

Referring to <FIG>, embodiments of the current application relate to a control circuit <NUM> suitable for implementing mitigative failsafe operational methods and actions in the event of a power loss, such as when a main power supply falls below a predetermined threshold, or failure of a microcontrol unit (MCU) <NUM> to provide refresh pulses to a watchdog circuit <NUM> using a relay. The control circuit <NUM> may be incorporated into a single package to provide single fault tolerant mitigating actions for electrical systems. The control circuit <NUM> may be utilized to provide required single fault tolerant mitigating actions as defined in various safety standards, such as UL <NUM>-<NUM>-<NUM> Annex GG for Electrical Heat Pumps, Air-Conditioners and Dehumidifiers, or others. For heating, ventilation, and air conditioning (HVAC) systems, the control circuit <NUM> may be configured to cause a desired mitigating action that would occur in a power loss or component fault event of the HVAC system. In consideration of this, the mitigating action depends on a system to which the control circuit <NUM> is coupled. This requires relays to actuate with regards to either a set (e.g., MCU <NUM> controlled) or reset (e.g., failsafe) state when the system detects that any fault has occurred, including power loss to the system such as when a main power supply falls below a predetermined threshold or a component fault, otherwise referred to as a failsafe mechanism. Non-latching relays may not remain powered for the duration required for the product life, so latching relays may be used. It is possible for latching relays to change state by external forces (vibration, magnetic pull, etc.). The control circuit <NUM> may include one or more circuit elements to automatically detect and correct erroneous relay states. Additionally, the periodic pulse control from the MCU <NUM> supplies a continuous reinforcement of the intended state to the latching relay(s).

An embodiment of the present application includes the control circuit <NUM> that is generally comprised of a number of circuit components, such as a relay contact status monitoring circuit <NUM>, a RESET coil monitoring circuit <NUM> (or a first monitoring circuit), a SET coil monitoring circuit <NUM> (or a second monitoring circuit), a fan operation circuit <NUM>, a power loss activation circuit <NUM>, a fan override circuit <NUM>, and a watchdog activation circuit <NUM>, wherein circuits <NUM> and <NUM> in combination act as MCU control and watchdog override. Comparable compressor control circuitry similarly may be provided as is illustrated in <FIG>, whereby the compressor is deactivated for the failsafe state while the fan is activated for the failsafe state. The control circuit <NUM> shown in <FIG>, specifically, is generally comprised of comparable components, such as the relay contact status monitoring circuit <NUM>, the RESET coil monitoring circuit <NUM>, the SET coil monitoring circuit <NUM>, the power loss activation circuit <NUM>, a compressor deactivation circuit <NUM>, and a compressor activation control circuit <NUM>, wherein circuits <NUM> and <NUM> in combination act as MCU control and watchdog override. As shown in <FIG> and <FIG>, each of the components of the control circuit <NUM> are electrically connected to each other forming the control circuit <NUM>.

In general, the control circuit <NUM> operates to provide the MCU <NUM> with control of the operative components of the system (e.g., fan, compressor) in parallel with power detection, whereby a mitigative device (not shown), such as a fan, is forced to the active mitigation state in the event of a power loss or component fault, and maintained under MCU <NUM> control during normal (powered) operation. Under normal operation, the MCU <NUM> operates to constantly reinforce a selected state of a latching relay K1 and/or K3 of the control circuit <NUM> by inputting a signal of a given period and pulse width to the appropriate coil of the latching relay K1 and/or K3. The MCU <NUM> further inputs a periodic signal to the watchdog circuit <NUM> that also is electrically connected to the control circuit <NUM>. When the MCU <NUM> ceases inputting the periodic signal to the watchdog circuit <NUM>, indicating a fault condition of the MCU, the watchdog circuit <NUM> switches the latching relay K1 and/or K3 into a failsafe position to initiate mitigation operations. In an example of a refrigerant system, mitigation operations may utilize the operation of the fan/compressor control circuitry to stop compressor operation and turn on a fan to disperse refrigerant that can build up to hazardous concentrations in the event of a refrigerant leak. Specifically, in the event of an MCU failure a compressor function stops running and a fan function starts to run instead to disperse refrigerant gas.

Under normal operation, the control circuit <NUM> receives power from an external power source, such as a +5V power supply. The latching relay K1 and/or K3 is maintained in the MCU controlled state. <FIG> and <FIG> illustrate inputs to the control circuit <NUM> from the MCU <NUM> and the watchdog circuit <NUM> (which is depicted in <FIG>). The MCU <NUM> may be configured as any suitable electronic processing device, including one or more of a logic circuit, CPU, firmware, hardware circuit, memory device storing executable program code, and other forms of electronic controller as is known in the art. The MCU <NUM> outputs a periodic refresh signal to the watchdog circuit <NUM> concurrently with the normal operation of the control circuit <NUM>. In the event of component or circuit failure, the MCU <NUM> stops outputting the periodic refresh signal to the watchdog circuit <NUM>. The latching relay K1 and/or K3 is then placed in the failsafe state by a pulse sent from the watchdog circuit until normal operation of the control circuit <NUM> is resumed. To that end, the control circuit <NUM> includes SET controls (a first portion) and RESET controls (a second portion). Both SET controls and the RESET controls are coupled to the latching relays K1 and K3. In <FIG> and <FIG>, the latching relays K1 and K3 are two-coil latching relays with an input/common terminal, a first terminal associated with a SET state/position, and a second terminal associated with a RESET state/position. During normal operation, the latching relays' K1 and K3 associated control circuit <NUM> is powered from a power supply, while in the event of a power loss, the latching relays K1 and/or K3 are powered from a backup power source, such as a capacitor, through the power loss activation circuit <NUM>.

The control circuit <NUM> may include one or more terminals configured to send status signals from the latching relays K1 and K3 to the MCU <NUM>. The status signals may be received from the latching relays K1 and/or K3 via the RESET coil monitoring circuit <NUM>, the SET coil monitoring circuit <NUM>, or the relay contact status monitoring circuit <NUM>.

For the control circuit <NUM> shown in <FIG> and <FIG>, failsafe operation is assumed when the latching relay K1 is in the RESET state and latching relay K3 is in the SET state. In this embodiment, the MCU <NUM> monitors and assesses the operation of the latching relay K1 and K3 and the components of the control circuit <NUM>. Specific (non-limiting) examples of signals sent to the MCU <NUM> so that the MCU <NUM> may monitor and assess the operation of the control circuit <NUM> are shown in <FIG> and <FIG>. For example, RL1_FAN_ST is a signal from the relay status monitoring circuit <NUM> that permits the MCU <NUM> to assess whether the latching relay K1 has switched its position, or if the fan has been activated. RL1_COIL_SET_ST / RL1_COIL_RESET_ST are two individual signals from the SET coil monitoring circuit <NUM> and the RESET coil monitoring circuit <NUM>, respectively, that permit the MCU <NUM> to monitor any control signals being sent to the latching relay K1 and that there is no failure in the control circuit or its componentry. Further RL1_FAN_ST in <FIG> and RL3_COMP_ST in <FIG> provide signals which allow the MCU <NUM> to assess whether the latching relay K1 and the latching relay K3, respectively, have their contacts in a desired state. In this instance, the MCU <NUM> alerts an external system (not shown) of the potential failure of the control circuit <NUM>. The MCU <NUM> also supplies a periodic refresh signal that refreshes the watchdog circuit <NUM> of <FIG>, in a pulsating manner if the MCU <NUM> is performing under normal operation.

<FIG> illustrates the interaction of the MCU <NUM> with the watchdog circuit <NUM>, wherein the periodic refresh signal supplied from the MCU <NUM> is represented by an IN portion of <FIG> and the watchdog circuit <NUM> rising edge detection is represented by a portion of <FIG>. As is further shown in <FIG>, there is no output pulse to the latching relay control transistors Q11 and Q20 of <FIG>, respectively, which is represented by an OUT portion of <FIG>. This is because the watchdog circuit <NUM> has not been activated, which means the MCU <NUM> is operating normally and in the non-failsafe state. Additionally, the watchdog circuit <NUM> output B is seen as a constant high value. This is because B is electrically connected to WDG_COMP_RUN and WDG_FAN_STOP in a way that a high level enables full MCU <NUM> control of the non-failsafe coils of the relays.

Referring back specifically to <FIG> and <FIG>, under normal operation of the exemplary control circuit <NUM>, a gate terminal Q5 is a P-Channel FET in the instance wherein the latching relay K1 and/or K3 is in a SET state/position. When the latching relay K1 and/or K3 is in a SET state/position, gate terminals Q9 and Q10 provide a path to a ground, to place the latching relay K1 and/or K3 under control of the MCU <NUM> or the watchdog circuit <NUM>. This would then turn off the gate terminal Q5 through a resistor R80 and send a high signal to the MCU <NUM>, indicating that the latching relay K1 and/or K3 SET coil is receiving control pulses. A diode D11 is a fly-back diode, utilized to shunt over-voltage spikes transmitted back to the power supply.

<FIG> illustrates the modification of the circuit operation as compared to <FIG>, with <FIG> illustrating failsafe operation such as may occur during a component or circuit failure that interrupts MCU <NUM> operation. For the control circuit <NUM> shown in <FIG> and <FIG>, a mitigating action is assumed to be active when the latching relay K1 is in the RESET state/position and latching relay K3 is in the SET state/position. In this embodiment, a failsafe operation portion of the control circuit <NUM> is configured to energize the latching relay K1 to be positioned in the failsafe position when the MCU <NUM> stops refreshing the watchdog circuit <NUM> of <FIG>. As shown in <FIG>, which illustrates the interaction of the MCU <NUM> with the watchdog circuit <NUM> in failsafe operation, the MCU <NUM> again is represented by the IN portion of <FIG>. In comparing the failsafe operation shown in <FIG> to the normal operation shown in <FIG>, there is a value in the OUT portion of <FIG> that activates once the IN portion stops transmitting/receiving information, which is indicative of the activation of the watchdog circuit <NUM> to initiate mitigation operations.

<FIG> depicts the electrical control circuit schematically illustrating a configuration for a watchdog circuit <NUM>, and <FIG> depicts a block diagram of the watchdog circuit that may be employed in the circuitry of <FIG>. As depicted in <FIG> and <FIG>, the watchdog circuit <NUM> is generally comprised of a rising edge detector <NUM>, a watchdog <NUM>, a falling edge detector <NUM> and a pulse generator <NUM>. <FIG> illustrates the general flow of information communicated through the watchdog circuit <NUM>, wherein an input is received by the rising edge detector <NUM> in S1. The rising edge detector outputs a positive pulse (rising then falling edge) for each rising edge detected (S1) to the watchdog circuit in S2. The watchdog then outputs a level high signal while pulses from S2 are detected or level low signal a short time after pulses from S2 stop.

The output of the watchdog <NUM> is sent to the falling edge detector <NUM> in S3, which outputs a negative pulse (falling then rising edge) when a negative edge input is detected. The falling edge detector <NUM> sends its output to the pulse generator <NUM> in S4. The pulse generator <NUM> outputs a positive pulse when a negative pulse is detected from S4 or a level low signal otherwise. The watchdog circuit <NUM> is connected to the control circuit <NUM> so that the output of the pulse generator <NUM> is outputted to the control circuit <NUM> in S5. The duration of the pulse output from S5 is selected to be within the minimum and maximum pulse time required to operate the coils of the latching relays K1 and/or K3. Additionally, the outputs of the watchdog <NUM> (S3 and S6) S6 are electrically outputted so that S6 has the same characteristics as described for S3. S6 is output to the control circuit <NUM> as an enable/disable signal to the MCU <NUM> controlled side of the relay control. Level high (normal operation) in S6 activates an N-channel MOSFET in the control circuit <NUM> that passes the MCU <NUM> controlled signals to put the latching relay K1 and/or K3 in its MCU controlled state. Level low (watchdog circuit <NUM> detected fault) in S6 deactivates the N-channel MOSFET and blocks the MCU <NUM> control and thereby prevents MCU <NUM> override of the watchdog circuit <NUM> controlled relay actuation (MCU <NUM> control for putting the latching relay K1 and/or K3 into its failsafe state is not disabled because it is the same control the watchdog circuit <NUM> is attempting to execute and would not interfere). The S5 output of the watchdog circuit <NUM> is connected to the N-channel MOSFET of the control circuit <NUM> such that a positive pulse from S5 generates an equivalent length current pulse through the failsafe coil of the latching relay K1 and/or K3 to either reinforce or actuate the latching relay K1 and/or K3 to the failsafe state and thereby trigger the failsafe function. Such function may include mitigation operations such as referenced above, for example stopping the compressor and turning on the fan for dispersing of a refrigerant. Normal operation may include, for example, allowing the running of the compressor and fan under control of the external HVAC system.

In operation of the watchdog circuit <NUM> as depicted in <FIG>, the rising edge detector <NUM> sends a high-pulse through a capacitor C44 to a gate terminal of an N-Channel FET Q39 when a rising edge occurs on signal MCU_WDG_CTRL. This signal is inverted and passed through FET Q39 to maintain the watchdog circuit <NUM> in a timing mode. In the event the MCU <NUM> stops communicating with the watchdog circuit <NUM>, a capacitor C45 is charged through a resistor R86. The watchdog <NUM> performs a timer function, and thus also is referred to as a timer <NUM>. The timer <NUM> receives an input from the rising edge detector <NUM> in timed intervals. In the case when a TRIG input is below <NUM>. 7V, the timer <NUM> outputs (OUT and DISCH) are maintained in a high status value. The THRES input of the timer <NUM> detects if the voltage is valued above <NUM>. 3V, in which case the outputs (OUT and DISCH) are pulled down to <NUM>. The falling edge detector <NUM> detects when the outputs (OUT and DISCH) are getting low, in which case the falling edge detector sends a negative pulse to the pulse generator <NUM>. The pulse generator <NUM> is formed from a second timer <NUM>. Each time the TRIP input of the second timer <NUM> is pulled below <NUM>. 7V, outputs are set to <NUM> and an open collector output DISCH is opened. In this case, the component output OUT is set to <NUM> and a capacitor <NUM> begins to charge through a resistor <NUM>. Otherwise, the component output OUT stays in a high state until the voltage across the capacitor <NUM> reaches the TRIG threshold, at which point the output OUT is reset.

The control circuit <NUM> in configured to perform a failsafe operation, wherein the MCU <NUM> stops sending a signal to the watchdog circuit <NUM> as described above. In this instance, the watchdog circuit <NUM> forces the unit to a failsafe state because the lack of refresh signals from the MCU <NUM> to the watchdog circuit <NUM> implies the MCU is not instructing the control circuit <NUM> any longer. In this case, the fan is activated and the compressor ceases operation. When the watchdog circuit <NUM> stops receiving the signal from the MCU <NUM>, the watchdog circuit <NUM> places the control circuit <NUM> in a failsafe mode so that the latching relay K1 is in the RESET state/position and the latching relay K3 is in the SET state/position corresponding to the fan-on/compressor-off control.

Referring back to <FIG> and <FIG>, the power loss activation circuit <NUM> has two N-Channel FETs that are used to allow current through the failsafe coil of the latching relay K1 and/or K3 in the event where power is lost. When +5V is present, Q18 is ON and Q17 is OFF. In this instance the RESET coil is controlled by the MCU <NUM> or the watchdog circuit <NUM>. However, when the power supply goes below <NUM>. 5V, Q17 is ON and Q18 is OFF, and the backup power supply +5V_BKP_1 is utilized so that the RESET coil may be energized to proceed with failsafe operations. In the present application, +5V_BKP_1 may be is stored in a capacitor. The result is a resistor-capacitor (RC) circuit where the significant capacitive source is +5V_BKP_1 and the significant resistive source is the relay coil. The capacitance on +5V_BKP_1 is sized such that the time the voltage is above the minimal coil operation threshold is within the minimum and maximum required pulse time for the relay coil. With such an appropriately scaled RC circuit, the discharge of the capacitor will act as the pulse to the relay coil.

Under normal operation of the exemplary control circuit <NUM>, a gate terminal Q6 is a P-Channel FET when the latching relay K1 and/or K3 is in a RESET state/position. When the latching relay K1 and/or K3 is in a RESET state/position, gate terminals Q19 and Q20 provide a path to a ground, to place the latching relay K1 and/or K3 under control of the MCU <NUM> or the watchdog circuit <NUM>. This would then turn off the gate terminal Q6 through a resistor R90 and send a high signal to the MCU <NUM>, indicating that the latching relay K1 and/or K3 RESET coil is receiving control pulses. A diode D12 is a fly-back diode, utilized to shunt over-voltage spikes transmitted back to the power supply.

<FIG> is a flowchart illustrating an example of an operation of the watchdog circuit <NUM>. As is depicted in the flowchart of <FIG>, the watchdog circuit <NUM> is illustrated as being driven by the MCU <NUM>. If the MCU is normally operating (NO in S10), a signal returns to the MCU <NUM>. In the instance when the MCU detects a fault (YES in S10), the MCU <NUM> stops sending pulses to the watchdog circuit <NUM> in S12. The watchdog circuit <NUM> triggers a failsafe state of the latching relays K1 and/or K3 in S14. Simultaneously, the MCU <NUM> is blocked from triggering a non-failsafe state of the latching relays K1 and/or K3 in S16. Due to a physically imposed limitation, the MCU <NUM> then attempts control of the latching relay K1 and/or K3 in S18. The MCU <NUM> logic selects a desired latching relay K1 and/ or K3 state (failsafe/non-failsafe) in S20, and the desired state remains implemented in the latching relays in accordance with whether the MCU is in a fault state.

<FIG> depicts a flowchart illustrating the instance when the control circuit <NUM> experiences a power loss, such as when a main power supply falls below a predetermined threshold. If the power detected is appropriate for normal operation of the control circuit <NUM> (NO in S11), a signal returns to continue to monitor the power supply. When power is lost (YES in S11), the power loss triggers a failsafe state of the latching relays in S13, and the failsafe state is implemented to account for such power loss with backup power to implement the failsafe state being provided by the power loss activation circuit.

Extreme or unexpected environmental events can result in the latching relay K1 being switched to an undesired state. The configuration of the control circuit <NUM> prevents these events from adversely affecting operation with the assertion of periodic redundant signals being presented to the SET coil controls and RESET controls. Previous systems used latching relay driving circuits that require the latching relay coils to be under control of MCU or comparable, or a power loss detector using control signals alternating between SET and RESET coil activation, preventing this relay state reinforcement feature. In addition, the inclusion of a failsafe operation portion including the watchdog circuit <NUM> enables the control circuit <NUM> to ensure failsafe operation during occurrence of a component or circuit fault. Employing latching relays ensures this device has a product life commensurate with the systems in which it is installed, e.g., <NUM>-plus years for an HVAC system.

Although some embodiments have been discussed in terms of a relay, or particularly, a latching relay, the term relay should be understood such that a relay can include any number of solid state and/or electromechanical switches that are configured to make contacts, break contacts, and/or a combination thereof. Thus, the term relay is not intended to denote a single latching relay, but to encompass electrically operated switches configured to perform the desired actions described herein. One of ordinary skill in the art would recognize many variations, modifications, and alternatives. In addition, the precise circuit configurations of <FIG> for the control circuit <NUM> and the watchdog circuit <NUM> are exemplary, and variations may be employed that are encompassed with the operations described herein.

Claim 1:
A control circuit for controlling operative components of a system, comprising:
a latching relay including at least a set coil and a reset coil;
a reset monitoring circuit (<NUM>) having a first node coupled to a power supply input, the reset monitoring circuit being configured to output a reset status signal, indicating a component fault, from the latching relay to a microcontrol unit 'MCU' (<NUM>),
an input terminal of the reset coil being configured to activate the reset coil in the event of said component fault;
the control circuit comprising the MCU (<NUM>) wherein, under a normal operation, the MCU (<NUM>) operates to constantly reinforce a normal state of the relay by supplying a signal of a given period and pulse width to the set coil,
wherein under normal operation the MCU sends periodic refresh signals to a watchdog circuit (<NUM>),
wherein the MCU is configured to receive the reset status signal from the reset monitoring circuit operative to monitor the reset coil informing the MCU whether a relay contact corresponding to the reset coil is in a desired state, and
the control circuit comprising the watchdog circuit, the watchdog circuit (<NUM>) communicative with the MCU (<NUM>), wherein the watchdog circuit (<NUM>) is configured to activate the reset coil in the event that the MCU stops communication of said periodic refresh signals to the watchdog circuit indicating the component fault.