Machine tools or material handling plant for example can be a source of great danger to operatives if the equipment can operate when operatives are exposed to moving parts. Accordingly it is conventional practice to protect machines with guards which cooperate with for example closure detecting switches to prevent machine starting until the guards are closed. It is also conventional practice to duplicate essential control components which if they failed could for example prevent a machine being stopped. Accordingly many machines can only be operated if two series connected contactors are both closed. If one of the contactors welds in the closed position the other can still be opened to stop the machine.

The known safety circuits greatly reduce the risk of injury to operatives but sometimes fail as a result of component failure. For example, if one of the two main contactors welds in the closed position, this can go undetected. If the other one then welds a dangerous situation results. Equally, safety circuits monitoring the position of guards can fail to an unsafe condition, indicating that a guard is closed when it is not.

It is an object of the present invention to provide safety circuits which obviate or mitigate the above problems.

According to the present invention there is provided a safety circuit for controlling the energisation of a machine through two contactors connected in series with a power supply for the machine, the safety circuit being arranged such that when energised it enables closure of both contactors only if predetermined safety conditions have been indicated, comprising two double pole changeover relays which if operating normally are switched simultaneously between a first state when the predetermined safety conditions are indicated and a second state when the predetermined safety conditions are not indicated, each relay having a pair of first contacts and a second contact which switches simultaneously with the first contacts, the second contact being switchable between first and second positions, each relay when operating normally having either the first contacts closed and the associated second contact in the first position, or

having the first contacts open and the associated second contact in the second position, each first contact of one relay being connected in series with a respective first contact of the other relay such that when both of a pair of interconnected first contacts are closed energisation of a respective contactor is enabled, and the second contacts being connected in series with each other and with a power supply for the safety circuit such that the safety circuit is energised to enable energisation of the machine only when both of the second contacts are in either the first position or the second position, whereby if one relay fails such that its first contacts remain closed when the first contacts of the other relay are open one of the second contacts is in the first position and the other is in the second position, thereby disabling the safety circuit.

Thus a failure in part of the switching arrangement controlling the machine energisation is detected and cannot lie dormant until another failure results in a dangerous condition.

The invention also provides a safety circuit for controlling the energisation of a machine through two contactors connected in series with a power supply for the machine, the safety circuit being arranged such that when energised it enables closure of both contactors only if predetermined safety conditions having been indicated, comprising a secondary set of contacts which switch in synchronism with main contacts of the contactors, a pair of changeover relays arranged such that each relay is energised in dependence upon the condition of a respective secondary set of contacts, each changeover relay having one normally closed contact and one normally open contact with one side of one contact of each relay being connected to one source of potential and one side of the other contact of each relay being connected to another source of potential, and a gate circuit connected to the said other sides of the contacts of the two relays to compare the potentials appearing at the said other sides, the gate circuit being arranged to disable the safety circuit if the compared potentials indicate that the main contacts of one contactor are open and the main contacts of the other contactor are closed.

Thus welding of one main contactor is indicated, and again the fault cannot lie dormant until a second fault results in dangerous conditions.

Each second contact may comprise a pair of contacts one of which is closed only when the second contact is in the first position and the other of which is closed only when the second contact is in the second position, the pair of contacts being interconnected to form two parallel circuits arranged to connect the power supply to the safety circuit if both second contacts are simultaneously in either the first or the second positions.

Each relay may be switchable by a respective coil, a safety circuit, according to claim 1 or 2 wherein each relay is switchable by a respective coil, each coil being energisable by a respective circuit responsive to at least two independent safety indicator inputs, and each circuit being arranged to energise the respective coil only if all said indicator inputs indicate the predetermined safety conditions. In one arrangement, one indicator input may represent detection of closure of a guard by a first sensing circuit and a second said indicator input represents detection of closure of the said guard by a second sensing circuit. One indicator input may be representative of the condition of one said contactor and the further said indicator input is representative of the condition of the other of said contactors, the circuit being arranged to disable the safety circuit unless both contactor conditions are the same.

The condition of each contactor may be detected by a coil connected in series with contacts controlled by the respective contactor, energisation of the coil indicating closure of the contacts controlled by the contactor. Each coil may control a respective further changeover relay, each further changeover relay having one normally closed contact and one normally open contact with one side of one contact being connected to one source of potential and one side of the other contact being connected to another source of potential, and a gate circuit being connected to the other sides of the contacts to compare potentials appearing at the said other sides, the gate circuit providing at least one said indicator input representative of the comparison made between the said potentials.

Embodiments of the present invention will now be described, by way of example, with reference to the accompanying drawings, in which:

Fig. 1 is a schematic illustration of a machine guard closure indicator;

Fig. 2 is a block schematic diagram of a complete machine control system according to the invention; and

Fig. 3 to 7 illustrate circuits corresponding to functional blocks shown in Fig. 2.

Fig. 1 illustrates the circuit of a sensing head intended to provide an output indicative of whether or not an actuator is in a predetermined position relative to that sensing head. Generally the actuator could be mounted on a moving component of a guard, eg a door which may be opened to gain access to a machine, and the sensing head would be mounted on a fixed assembly, for example a door frame. In Fig. 1 an actuator is indicated schematically by reference numeral 1, the actuator comprising a pick up coil 2 connected to a tuned circuit 3 and a permanent magnet 4. A broken line 5 indicates the spacing between the actuator and a transformer

6 of the associated sensing head when the actuator is in a position indicating that the associated guard is closed. If the guard is then opened the actuator 1 is moved away from the transformer 6.

The sensing head comprises a magnetically operated reed switch

7 positioned so as to be closed if the magnet 4 is in the position shown but to open if the magnet 4 is moved away from the position shown. The reed switch 7 controls a transistor 8 which provides an output on terminal 9 that is indicative of whether or not the reed switch 7 is closed and thus whether or not the magnet 4 is in a position indicating closure of the guard.

The transformer 6 forms part of a tuned oscillator based upon a standard chip integrated circuit 10. The oscillator resonates when the actuator tuned circuit is in the position shown and when resonating the positive voltage appearing across the capacitor 11 is discharged via the parallel resistor. The voltage across capacitor 11 appears at output 12. If the actuator 1 is moved away from the position shown the oscillator ceases resonating and the voltage appearing at output 12 returns to its former DC level.

Referring now to Fig. 2, this illustrates in schematic form the way in which the output signals appearing on outputs 9 and 12 of Fig. 1 are used to control the supply of power to a machine which is

guarded by sensing heads of the type illustrated in Fig. 1. The system to be described is set up to operate with up to four independent sensing heads but the same system could also be used to monitor systems incorporating one, two or three sensing heads.

In Fig. 2, a machine 13 is enclosed within a guard 14 provided with doors (not shown). The guard is intended to prevent access to the machine if the machine is being supplied with power. Thus the system must be capable of preventing energisation of the machine if any guards are open and disabling the machine if any guards are opened when the machine is operating. The machine is supplied with AC power from an AC mains supply 15 through a pair of contactors 16 arranged in series. Thus if either one of the two contactors 16 is open the machine cannot operate. It is necessary however to be able to detect if one of the contactors fails in a current delivering condition if the safety feature inherent in the duplication of the contactors is not to be compromised as a result of failure of one of the contactors. Thus outputs from the contactors 16 are provided which indicate in respect of each of the contactors whether or not the contactors are closed, that is in the current delivering condition.

When an attempt is made to start the machine, AC mains supply 15 is turned on delivering AC power to the contactors 16, a high risk safety relay assembly 17, and a power supply 18. The safety relay assembly 17 is capable of energising contactor coils 19 the energisation of which controls the state of the contactor 16. With the exception of the safety relay assembly 17, all of the other component parts of the system are energised from the power supply 18. To avoid over-complication of Fig. 2 the necessary connections from the power supply 18 to the various system components are not shown.

When the AC mains supply 15 is turned on and the safety circuits are energised from the power supply 18 the system monitors the condition of the guard 14 to decide whether or not it is appropriate to energise the safety relay assembly 17. Each door in the guard 14 is provided with an actuator 1 the position of which determines the state of a tuned oscillator 6 and a reed switch 7. Thus each of the door sensing circuit comprises the components illustrated in Fig. 1. Only one such arrangement is shown in Fig. 1 but it will be appreciated that for example up to four such arrangements could be

provided. The outputs of the reed switches 7 are passed by input amplifier stage 19 to a reed switching logic circuit 20. The outputs of the tuned oscillator 6 are applied to an oscillator switching logic circuit 21. The outputs of the logic circuits 20 and 21 are applied to a safety guard position indicator circuit 22 which simply indicates to the operator whether or not the guards are in the appropriate closed position.

The output of the oscillator switching logic circuit 21 is applied to a summing circuit 23 and the output of the reed switching logic circuit 20 is applied to a summing circuit 24. The summing circuit 23 also receives the output of a further summing circuit 25 controlled by a head sense circuit 26 which in turn is controlled by a deselection link circuit 27. The deselection link circuit 27 enables the system which is designed to cope with up to four sensing head assemblies to operate with only one, two or three assemblies by simply inserting appropriate links in the head sense circuit 26. Thus the output of the summing circuit 25 is in essence an indicator of whether or not any of the oscillator and reed switching logic circuits are deliberately isolated from respective sensing head assemblies.

A checking circuit 28 indicates to the operator the status of the guard doors. The same signals that are monitored by the circuit 28 are also applied to a pair of summing circuits 29 and 30 and combined with the outputs respectively of circuits 31 and 32. Circuit 31 provides an output indicative of whether or not the first of the two contactors 16 is switched to an appropriate condition given the status of the other of the two contactors 16. This signal is derived from a contactor weld sense circuit 33 connect to the contactor 16. The circuit 32 performs an equivalent function to circuit 31 but receives an input from a contactor weld sense circuit 34 connected to the other of the two contactors 16. Thus the circuit 29 receives a signal indicative of whether or not all the reed switches 7 of the guards are in a condition indicating guard closure, a signal indicative of whether or not the tuned circuits 6 are in a condition indicative of guard closure, and a signal indicative of whether or not the contactors 16 are in an appropriate state. The summing circuit 30 produces a similar sum and thus parallel decision channels are established through the entire system with the two circuits 29, 30 providing outputs to relay drive

circuits 35 and 36. Only if both these drive circuits 35 and 36 receive enabling inputs are the safety relays 17 switched to a condition in which the contactor coils 19 are energised to close both pairs of contactors in the contactor assembly 16.

It can be seem from the schematic illustration of the embodiment of the invention set out in Fig. 2 that parallel circuits are provided and interconnected such that if any one circuit fails its failure will either be detected immediately or on the next occasion during which the system condition is changed, for example as a result of opening one of the guards. For the guard system to fail it would be necessary for two identical components to fail simultaneously.

Referring now to Fig. 3, this illustrates in some detail circuitry corresponding to components 20, 21, 26 and 27 of Fig. 2. Assuming that there are four door sensing assemblies each providing two outputs A and B which appear at the terminals 12 and 9 respectively as illustrated in Fig. 1, the four pairs of outputs are indicated on Fig. 3 by the letter A0, Al, A2, A3 and BO, Bl, B2 and B3. The B signals are applied to input amplifiers 37 (component 19 from Fig. 2) the outputs of which are applied to the D inputs of flip-flops 38. The A inputs are applied directly to the dynamic input of the flip-flop 38. The A and B signals are also inverted in inverters 39 and applied to the dynamic and D inputs of the further flip-flop 40. The flip-flops 38 and 40 may be conventional integrated circuits. The Q output of the two flip-flops provide signals AA and BB both of which will be "high" if and only if the two signals received from the respective guard sensing assembly indicate that the guard is safely closed. Thus the arrangement of Fig. 3 produces eight output signals AAO, AA1, AA2, AA3 and BBO, BB1, BB2 and BB3. The components described for converting the A and B signals to the AA and BB signals correspond to the components identified in Fig. 2 by reference numerals 20 and 21.

If the system is to be used with less than four guards it must be possible to in effect turn off the logic circuits that are no longer required. This can be easily achieved by inserting a diode (not shown) in the appropriate section of the circuit shown in Fig. 3. Thus the inserted diode would form a by-pass link which would be plugged in between the terminals 41 and 42. The positioning of the diode between one of the terminal pairs 41 and 42 is effective to turn on an

associated transistor 43 to produce a "link inserted signal L". As up to three of the four circuits shown in Fig. 3 could be surplus to requirements the three possible L outputs are indicated by LI. L2 and L3. If rather than a diode a simple conductive link was inserted between the terminals 41 and 42 the base of the transistor 43 would then be held at the same voltage as the emitter and the transistor 'would not conduct.

The flip-flops 40 receive a reset signal SWOP generated from the power supply (Fig. 2 component 18) when the system is first energised. The reset signal resets the flip-flops to an initial condition in which the machine is disabled.

Referring now to Fig. 4, this illustrates the component of the system illustrated in Fig. 2 which is identified by numeral 22. The pairs of signals AA0-BB0, AA1-BB1, AA2-BB2, and AA3-BB3 are applied to respective AND gates 44. The outputs of the AND gates 44 control respective transistors 45 controlling the energisation of respective light emitting diodes 46. If and only if both the inputs to one of the AND gates 44 indicates that the respective guard is closed will the respective transistor 45 be turned off. Thus as soon as either the magnetic or oscillator controlled circuits of the sensing head provide an output indicating that the respective guard is open the respective light emitting diode 46 is illuminated. Thus the operator can immediately see if any one of the four guards has not been closed properly or has been opened.

Referring now to Fig. 5, the illustrated components correspond to components 24, 25 and 28 of Fig. 2. The four B outputs of the sensing head assemblies, that is signals BBO, 1, 2 and 3 are applied to the inputs of a first AND gate 47. Thus the output of the AND gate 47 (B-sum) distinguishes between the case on the one hand of all ^' the magnetically operated reed switches of the four sensing heads being closed to indicate guard closure and on the other hand any one of the reed switches being open to indicate the guard being open. Similarly, the four AA inputs are applied to an AND gate 48 producing an output A-sum. Finally the three signals LI, L2 and L3 are applied to a still further AND gate 49. Thus the AND gates 47, 48 and 49 correspond to the components 24, 23 and 25 of Fig. 2.

The outputs on the AND gates 47, 48 and 49 control respective transistors 50, 51 and 52, and these in turn control the energisation of light emitting diodes 53 and 54. Diode 53 lights up when the last door of the guard is closed to indicate that the machine can now be powered up. The LED is then extinguished. LED 54 lights up when one of the previously closed doors is opened. Thus the indications given by the diodes 53 and 54 enable the operator to monitor the operation of the safety circuits.

Referring now to Fig. 6, the upper portion of this figure illustrates relays which are energised in dependence on the condition of the main contactors through which current is delivered to the protected machine and the lower portion illustrates the arrangement of contacts and logic circuits which derive control outputs from the condition of these relays. Thus the upper portion of Fig. 6 corresponds to components 33 and 34 of Fig. 2 and the lower portion corresponds to components 31 and 32. A first relay coil 55 is connected in series with a pair of terminals 56 and 57. Between the terminals 56 and 57 are connected a pair of contacts (not shown) which switch in unison with one of the two main contactors which are connected in series with the machine. Thus the terminals 56 and 57 are connected when the associated main contactor is closed either deliberately or inadvertently due to a failure such as contact welding. The terminals 56 and 57 are isolated from each other if the associated main contactor is open to isolate the machine. A second relay 58 is connected in series with terminals 59 and 60 which are connected to a second set of contactors that move in unison with the other of the two main contactors connected in series with the machine. Thus assuming that the two main contactors move together as they must do unless one of them becomes welded both the relays 55 and 58 will be energised or de-energised together.

The relay 55 controls contacts 61 and the relay 58 controls contacts 62. One of the contacts 61 is normally open, the other normally closed. The same is true of the contact set 62. The outputs of the two contacts of each of the contact sets 61 and 62 are combined and applied to respective inputs of a pair of exclusive OR gates 63 and 64. If only one of the relay sets 61 and 62 switches, indicating failure of one of the main contactors, all the inputs to the gates 63

and 64 will be at the same voltage. If they both switch together, one input to each of the gates will be zero volts and the other input to each of the gates will be a positive voltage. Thus both the outputs of the gates 63 and 64 will be logic "one" when the contactor sets 61 and 62 are in a position indicating that the main contactor sets are operating correctly, i.e. either both open or both closed simultaneously. These outputs appear on terminals 65 and 66.

Referring now to Fig. 7, the upper portion of this figure corresponds to components 29, 30, 35 and 36 of Fig. 2 whereas the lower portion of this figure corresponds to component 17 of Fig. 2. AND gates 67 and 68 receive identical combinations of signals, that is the signals appearing on terminals 65 and 66 (see Fig. 6) and the signals A-sum and B-sum (see Fig. 5). Only if all of these signals are logic level "one" will their outputs be at the same logic level. If the outputs are at logic level "one" respective transistors 69 and 70 are turned on to energise main contactor relays 71 and 72. Both of the relays 71 and 72 must be energised to close the pair of series connected contactors through which current must be delivered to the machine if it is to be operated. The relay 71 controls contacts 73 to 78 whereas the relay 72 controls contact 79 to 84. A live input is provided via a fuse 85 and a live output appears as described below at terminal 86. This output is used to energise the safety circuit. Thus, referring to Figure 2, if no voltage appears at terminal 86, the power supply 18 is disabled, thereby preventing further circuit operation. Power for delivery to one of the main machine contactors is applied via a fuse 87 to contact 76 and power for the other main contactor coil is delivered via a fuse 88 to contact 78. The first of the main contactor coils is connected to terminal 89 and the second to terminal 90, those two terminals being connected respectively to contacts 82 and 84.

With the contacts of Fig. 7 in the condition shown, the machine contactors are de-energised. Power is delivered via fuse 85, contact 73 and contact 79 to output 86. The signal appearing at output 86 is applied to the power supply for powering up the rest of the circuitry. If all the contacts shown in Fig. 7 are switched simultaneously, power is distributed to terminal 86 from fuse 85 via contacts 74 and 80, maintaining energisation of the power supply. If only one of the two

contactor sets of Fig. 7 is switched, the entire safety circuit is disabled as no power is delivered to the circuitry from terminal 86.

If all of the contacts shown in Fig. 7 switch simultaneously, power from fuse 87 is delivered via contacts 76 and 82 to output 89. The main contactor coil associated with terminal 89 is then energised, closing one of the two main contactors. Power supplied via fuse 88 is distributed through contacts 78 and 84 to output terminal 90. Thus both the main contactor coils are energised and the machine can start up. If only one of the two sets of contactors is energised, eg contactor set 73 to 78 switches but contactor set 79 to 84 does not, power is supplied to neither of the output terminals 89 and 90. Thus the only way the system can fail to a dangerous condition is for a combination of faults to develop simultaneously. It is highly improbable that this will occur and the circuitry is therefore inherently safe.