Electrical Disconnect Kill Switch

Abstract

A system (1) for cutting off power to one or more powered devices (8) includes an actuator (5) controlling the power to the one or more powered devices, the actuator or one or more controllers (3) connected to the actuator configured to receive a kill command via a network (21), and the actuator (5) configured to cut off power to the one or more powered devices when the actuator or at least one of the one or more controllers receives the kill command, the actuator or one or more controllers configured to receive a heartbeat signal via the network, and the actuator (5) configured to cut off power to the one or more powered devices when the heartbeat signal is no longer received by the actuator or, if applicable, all of the one or more controllers.

Description

[Technical Field]

[0001] The present invention relates to a system for cutting power to one or more devices. [Background technology]

[0002] In some situations, it is important to reliably shut off power to a powered device. For example, U.S. Patent Application Publication No. US2014 / 126594 discloses a killswitch system for a laser. The system shuts off power to the laser for safety reasons upon detecting a fault. In trading, this became clear in 2012 when Knight Capital unsuccessfully attempted to shut down its trading system.

[0003] Removing power to computer and network systems ensures an immediate shutdown, thereby ending malfunctions and unexpected behavior. Although there are Power Distribution Units (PDUs) that can be remotely switched on and off, such as the APC Rack PDU 9000 (e.g., APDU9941), these PDUs are not designed to malfunction in an orderly manner, and a loss of connection can cause the PDU itself to become uncontrollable. Summary of the Invention [Problem to be solved by the invention]

[0004] It is an object of the present invention to provide a system that can cut off power to a powered device, for example a powered device installed in a rack, after control of the powered device is lost. [Means for solving the problem]

[0005] In a first aspect of the present invention, there is provided a system for cutting power to one or more powered devices, the powered device including an actuator controlling the power to the one or more powered devices, the actuator or one or more controllers connected to the actuator configured to receive a kill command over a network, and the actuator configured to cut power to the one or more powered devices when the actuator or at least one of the one or more controllers receives the kill command, the actuator or the one or more controllers configured to receive a heartbeat signal over the network, and the actuator configured to cut power to the one or more powered devices when the heartbeat signal is no longer received by the actuator or all of the one or more controllers.

[0006] Thus, the actuator will cut off power if the actuator or controller is commanded to do so, and also if the actuator is not receiving the heartbeat signal or if none of the one or more controllers is receiving the heartbeat signal.

[0007] This kill switch system is an out-of-band system that can be used to power down most of the infrastructure in a colocation. No power means that electrical devices connected to the switch cannot operate, which is the desired effect. The kill switch system is preferably located in the places that change least: in the racks and power distribution units in a colocation. The kill switch system is often installed once at build time and then remains stable for the life of the rack, which can be decades. Rack-mounted equipment, such as servers and network connections, change at a much faster pace.

[0008] When a heartbeat signal is no longer received on the network by the actuator or by the controller, which may mean that the actuator or the controller cannot receive a kill command, the actuator or the controller goes fail-safe and shuts off power to the powered device via the actuator.

[0009] The system may include the one or more controllers, and the actuator may be configured to cut off power to the one or more powered devices when the actuator loses connection to all of the one or more controllers, which is an additional fail-safe.

[0010] The system may include the one or more controllers, which may include a plurality of controllers, and the plurality of controllers may be connected to the actuator, wherein the plurality of controllers are configured to receive the kill command over the network, and the actuator is configured to cut off power to the one or more powered devices when at least one of the plurality of controllers receives the kill command, and wherein the plurality of controllers are configured to receive a heartbeat signal over the network, and the actuator is configured to cut off power to the one or more powered devices when all of the plurality of controllers no longer receive the heartbeat signal.

[0011] When more than one controller is used, it is particularly useful to have multiple controllers control more than one actuator. This can be used to provide redundancy in case of a single communication error. In this case, the more than one actuator will only power down if all controllers fail to receive a heartbeat. If one controller receives a kill command, all actuators will power down, regardless of whether other controllers have received a similar kill command.

[0012] It is also cost-effective to have one controller control multiple actuators. For example, the system may further include an additional actuator controlling power to one or more additional powered devices, the additional actuator may be connected to the one or more controllers, the additional actuator may be configured to cut off power to the one or more additional powered devices when at least one of the one or more controllers receives the kill command, and the additional actuator may be configured to cut off power to the one or more additional powered devices when the heartbeat signal is no longer received by all of the one or more controllers. The actuator, the additional actuator, and the one or more controllers may be connected to each other via, for example, a bus or a local network.

[0013] The system may include one or more controllers, and each of the one or more controllers may be configured to receive the heartbeat signal via the network and, in response to determining that the heartbeat signal is no longer being received by the individual controller, to cease transmitting a signal to the actuator. The actuator may be configured to cut off power to the one or more powered devices when the actuator does not receive the signal from any of the one or more controllers. The signal may be, for example, an analog signal. The signal may be, for example, transmitted over a bus. For example, a controller may transmit the signal by connecting a power source to a control signal line of the bus. The controller may then disconnect the power source from the control signal line to stop transmitting the signal. This ensures that the one or more actuators only cut off power when all controllers fail to receive a heartbeat, when the controller is configured not to transmit the signal in response to loss of a heartbeat.

[0014] An individual controller of the one or more controllers may be configured, in response to determining that the individual controller has received the kill command, to cease transmitting the signal to the actuator (5) and to prevent the actuator from receiving the signal from any other controller of the one or more controllers (3, 13). For example, a controller may connect a control signal line of the bus to ground. This not only causes the controller to cease transmitting the signal, but also prevents the actuator from receiving the signal when another controller is transmitting the signal. This ensures that receiving a kill command will cause the actuator to shut down, regardless of whether the other controllers have received similar kill commands.

[0015] Each of the one or more controllers may be configured to generate a watchdog signal, receive the watchdog signal, and, upon determining that the watchdog signal is no longer being received by the individual controller, cease transmitting the signal to the actuator. The watchdog signal may be generated, for example, by the controller's microprocessor or by a separate watchdog circuit in the controller. This is an additional fail-safe to ensure that the actuators lose power if all controllers fail. The controller may, for example, disconnect power from the control signal lines of the bus to cease transmitting the signal.

[0016] The system may include the one or more controllers, and each of the one or more controllers may be configured to receive the heartbeat signal via the network and, in response to determining that the heartbeat signal is no longer being received by the individual controller, to send a signal to the actuator. The actuator may be configured to cut off power to the one or more powered devices when the actuator receives the signal from all of the one or more controllers. The signal may be, for example, a digital signal. The signal may be transmitted, for example, via a local network. This ensures that the one or more actuators are only caused to cut off power when all controllers fail to receive the heartbeat.

[0017] Each of the one or more controllers may be configured to send a further signal to the actuator in response to determining that the individual controller has received the kill command. The actuator may be configured to cut off power to the one or more powered devices when the actuator receives the further signal from at least one of the one or more controllers. This ensures that one of the multiple controllers that receives a kill command will cause the actuator to cut off power, regardless of whether other controllers have received similar kill commands. The further signal may be, for example, a digital signal.

[0018] Each controller of the one or more controllers may be configured to generate a watchdog signal, to receive the watchdog signal, and, in response to determining that the watchdog signal is no longer being received by the individual controller, to transmit the signal to the actuator. The watchdog signal may be generated, for example, by the controller's microprocessor or by a separate watchdog circuit in the controller. This is an additional fail-safe to ensure that the actuator will cut power if all controllers fail.

[0019] The one or more controllers may comprise a first controller and a second controller, and the first controller and the second controller may be powered by different power sources. This may be used to ensure that a failure of one power source does not cause both controllers to shut down, thereby cutting power to the one or more powered devices. Furthermore, by not making an actuator responsible for powering the one or more controllers, a chain of dependencies in which one controller powers down another controller is prevented.

[0020] The actuator may be powered from two independent main power sources, which may be used to ensure that a failure of one main power source does not prevent the actuator from supplying power to one or more powered devices when the actuator wants to supply power to the one or more powered devices, i.e. when the actuator is not being controlled by a controller (or controllers) to cut power to the one or more powered devices.

[0021] These and other aspects of the present invention will be further elucidated and explained, by way of example, with reference to the accompanying drawings, in which: [Brief explanation of the drawings]

[0022] [Figure 1] FIG. 1 is a block diagram of a first embodiment of the system. [Figure 2] FIG. 2 is a block diagram of one embodiment of the controller of FIG. [Figure 3] FIG. 3 is a block diagram of a second embodiment of the system. [Figure 4] FIG. 4 is a block diagram of a third embodiment of the system.

[0023] Corresponding elements in the drawings are indicated by the same reference numerals. DETAILED DESCRIPTION OF THE INVENTION

[0024] A first embodiment of a system for interrupting power to one or more powered devices is shown in Figure 1. Figure 1 shows system 1, which includes an actuator 5 that controls power to a powered device 8, such as a server in a rack, and a controller 3 connected to actuator 5. The controller 3 receives power from a power supply 4, and the actuator 5 receives power from a mains power supply 6, which may be on different power circuits.

[0025] The controller 3 is configured to receive a kill command via a network 21, e.g., the Internet, and the actuator 5 is configured to cut off power to the powered device 8 when the controller 3 receives the kill command. The controller 3 is further configured to receive a heartbeat signal via the network 21, and the actuator 5 is further configured to cut off power to the powered device 8 when the heartbeat signal is no longer received by the controller 3.

[0026] In other words, system 1 is a kill switch / dead man's switch that triggers a power down in response to a lack of communication (heartbeat) from further system 23. In the example of Figure 1, the kill command and the heartbeat signal are received from further system 23.

[0027] In a typical scenario, the further system 23 attempts to communicate with the powered device 8 but does not get a response or does not get the expected response from the powered device 8. In this scenario, the further system 23 sends a kill command to the controller 3, i.e., instructs the controller 3 to cut off power to the powered device 8, either automatically or in response to user input. If the further system 23 can no longer contact the powered device 8, the further system 23 may also be able to contact the controller 3.

[0028] If the controller 3 does not receive the heartbeat signal, the system automatically cuts off power to the powered device 8. This can happen even before the further system 23 attempts to communicate with the powered device 8, and works even if the controller 3 is no longer reachable. In this case, it can be assumed that when the controller 3 is no longer reachable, the powered device 8 will also no longer be reachable.

[0029] In an alternative embodiment, the system does not include a controller. Instead, the actuator 5 is configured to receive a kill command via the network 21 and to cut off power to the powered device 8 when the kill command is received by the actuator 5. The actuator 5 is further configured to receive a heartbeat signal via the network 21 and to cut off power to the powered device 8 when the heartbeat signal is no longer received by the actuator 5.

[0030] Figure 2 shows an embodiment of the controller 3 of Figure 1 that features a simple analog design for controlling the actuator. In the embodiment of Figure 2, the controller 3 includes a microcontroller 71, a switch 73, a switch 75, and a pull-up resistor 77. Signals generated by the controller 3 are output to the actuator 5 via a bus 87.

[0031] In the embodiment of Figure 2, the bus 87 comprises at least two wires to the actuator 5: a control signal and ground (0V). The control signal controls the main power relay of the actuator 5. The wire carrying the ground signal is not shown in Figure 2 for simplicity. In the embodiment of Figure 2, the control signal has two possible states: High state: This closes the main power relay of the actuator 5; the powered device 8 (shown in FIG. 1) receives power. Low state: This causes the main power relay of the actuator 5 to be open; the powered device 8 does not receive power.

[0032] The controller 3 receives power from a power supply 4. The controller 3 drives a control signal line on a bus 87 through a pull-up resistor 77. The value of the pull-up resistor 77 is selected to keep the bus voltage above a high state threshold level at full load.

[0033] Switch 73 is in series with the pull-up resistor 77. Switch 73 is driven directly by a microcontroller GPIO (General Purpose Input / Output). When the microcontroller 71 no longer receives the heartbeat signal from the further system 23, it generates a signal 83 to control the switch 73 to an open state. This then cuts power to the bus, which then naturally consumes power, at least if no other controller is present, bringing the control signal to a low state.

[0034] 2, the microcontroller 71 is equipped with a watchdog timer that generates a signal 81, e.g., a reset signal, to control the switch 73 to open when the microprocessor 71 fails, causing the control signal to be driven low. This is designed to catch errors in the microcontroller hardware and software.

[0035] In an alternative embodiment, the controller 3 includes a separate watchdog circuit. For example, the microcontroller 71 may generate a trigger signal that is received by the watchdog circuit. When the watchdog circuit no longer receives the trigger signal, i.e., has not received the trigger signal for a period longer than a timeout threshold, the watchdog circuit generates a control signal to control the switch 73 to an open state.

[0036] The switch 75 is used to ensure that the control signal is driven low when the microcontroller 71 receives a kill command. The microcontroller 71 generates a signal 85 depending on whether the microcontroller 71 receives a kill command. When the controller 3 is functioning properly and power should be supplied to the powered device 8, the controller 3 controls the switch 75 to open. When power to the powered device 8 should be cut off, the controller 3 controls the switch 75 to remain closed. The switch 75 may be, for example, a TE IM23TS relay.

[0037] At power-up, the control signal is naturally in a low state. After switch 73 is closed, the control signal line of bus 87 is pulled up to a high state via pull-up resistor 77. When switch 75 is also closed, the bus 87 is connected to ground, and therefore the control signal line of bus 87 is driven to a low state. This pull-down has a much lower resistance than the pull-up, and can safely pull the control signal line of bus 87 low even if the control signal line of bus 87 is pulled up to a high state by closing switch 73, or even if another controller is present on bus 87 and pulling the control signal line of bus 87 high.

[0038] 2, the controller 3 transmits the analog signal to the actuator 5 via the bus 87. In an alternative embodiment, the controller 3 transmits a digital signal to the actuator 5, e.g., via a local network. For example, the actuator 5 may be configured to cut off power to the powered device 8 when the actuator 5 does not receive a first digital control signal from any of a plurality of controllers, and may be configured to cut off power to the powered device 8 when the actuator 5 receives a second digital control signal from at least one of the plurality of controllers. The controller 3 may be configured to send the first digital control signal when the controller 3 no longer receives a heartbeat signal via the network 21, and may be configured to send the second digital control signal when the controller 3 receives the kill command via the network 21.

[0039] A second embodiment of a system for interrupting power to one or more powered devices is shown in Figure 3. Figure 3 shows a system 11 that includes the controller 3 and the actuator 5 of Figure 1. The system 11 further includes an additional actuator 15 that controls power to an additional powered device 18. The system 11 further includes an additional controller 13 that is configured similarly to the controller 3. The additional actuator 15 is connected to the controller 3 and the additional controller 13.

[0040] The controller 3 and the further controller 13 are each configured to receive a kill command via a network 21, e.g., the Internet, and the actuator 5 is configured to cut off power to the powered device 8 when the controller 3 and / or the controller 13 receives the kill command. The controller 3 and the further controller 13 are each further configured to receive a heartbeat signal via the network 21, and the actuator 5 is further configured to cut off power to the powered device 8 when the heartbeat signal is no longer received by the controller 3 and the further controller 13.

[0041] In the embodiment of Figure 3, all controllers and actuators share the same control bus. Two-way control of the bus provides the opportunity to hot-swap any single actuator and controller. If one actuator is disconnected from the bus, the other actuator remains operational since it is supplied from two sides, i.e., its power is not interrupted. Similarly, if one controller is removed, the bus remains operational because the other controller can power it.

[0042] The further actuator 15 is configured similarly to actuator 5. The further actuator 15 is configured to cut off power to the further powered device 18 when at least one of the controller 3 and the further controller 13 receives the kill command. The further actuator 15 is further configured to cut off power to the one or more further powered devices 18 when the heartbeat signal is no longer received by both the controller 3 and the further controller 13.

[0043] In the embodiment of Figure 3, the actuator 5 and the further actuator 15 are each configured to cut off power to the power receiving device 8 and the further power receiving device 18, respectively, when the actuator loses connection to both the controller 3 and the further controller 13.

[0044] Actuators 5 and 15 only cut off power to the one or more powered devices if communication to both the controller 3 and the further controller 13 fails, i.e., if both the controller 3 and the further controller 13 do not receive the heartbeat signal. When using the embodiment of controller 3 of FIG. 2, in response to communication failure, bus 87 of FIG. 2 is not pulled low, but is also not supplied to a high state. As long as one of the controller 3 and the further controller 13 is pulling the bus high, the actuators 5 and 15 do not cut off power to powered devices 8 and 18. When one of the controller 3 and the further controller 13 receives a kill command, it pulls down the bus using switch 75 of FIG. 2. This allows for the case where the other controller is still pulling the bus high due to the resistance difference between the source and drain modes.

[0045] In the embodiment of Figure 3, the controller 3 and the further controller 13 are powered by different power sources, namely power source 4 and power source 14 respectively. Furthermore, the actuator 5 is powered by two independent main power sources, namely main power source 6 and main power source 7, and the actuator 15 is powered by two independent main power sources, namely main power source 16 and main power source 17. This can be used in combination with dual power supplies, such as are commonly found in data centres, to prevent the system from becoming unavailable if one of the two power sources fails or is interrupted.

[0046] A third embodiment of the system for interrupting power to one or more powered devices is shown in Figure 4. Figure 4 shows a system 41 including the controller 3 and further controller 13 of Figure 3 and the actuators 5 and 15. The system 41 further includes additional controllers 43 and 53 and additional actuators 45 and 55. The additional controllers 43 and 53 are connected to the power source 4 and the power source 14, respectively. The additional actuators 45 and 55 are connected to the additional controllers 43 and 53.

[0047] The controller 3 and the further controller 13 may, for example, be responsible for all the switches on the A power supply side of multiple racks, and the additional controllers 43 and 53 may, for example, be responsible for all the switches on the B power supply side of multiple racks. The controller 3 and the additional controller 43 and the power supply 4 may, for example, be located in the same cabinet. The controller 13 and the additional controller 53 and the power supply 14 may, for example, be located in the same cabinet.

[0048] The powered devices whose power supply is controlled by the actuators 5, 15, 45 and 55 are not shown in Figure 4 for simplicity. The network 21 and the further system 23 of Figure 3 are not shown in Figure 4 for simplicity. The mains power supply to which the actuators 5, 15, 45 and 55 are connected is not shown in Figure 4 for simplicity.

[0049] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the present invention. As used herein, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly dictates otherwise. It will be further understood that the words "comprises" and / or "comprising," when used herein, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0050] The corresponding structure, material, acts, and equivalents of any means or step-function-added element in the following claims are intended to encompass any structure, material, or act for performing that function in combination with other claimed elements as specifically claimed. The description of the present invention has been presented for purposes of illustration and description and is not intended to be exhaustive or to limit the invention to the precise form disclosed. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the invention. The embodiments were chosen and described to best explain the principles and practical application of the invention and to enable those skilled in the art to understand the invention in its various embodiments, with various modifications suited to the particular uses contemplated.

Claims

1. A system (1, 11, 41) for interrupting power to one or more power receiving devices (8), the system (1, 11, 41) comprising: an actuator (5) for controlling the power to the one or more power receiving devices (8); It is equipped with wherein the actuator (5) or one or more controllers (3, 13) connected to the actuator (5) are configured to receive a kill command via a network (21), and the actuator (5) is configured to cut off power to the one or more power receiving devices (8) when the actuator (5) or at least one of the one or more controllers (3, 13) receives the kill command; and wherein the actuator (5) or the one or more controllers (3, 13) are configured to receive a heartbeat signal via the network (21), and the actuator (5) is configured to cut off power to the one or more power receiving devices (8) when the heartbeat signal is no longer received by the actuator (5) or by all of the one or more controllers (3, 13). The system (1, 11, 41).

2. the system comprises the one or more controllers (3, 13), the one or more controllers comprise a plurality of controllers (3, 13), and the plurality of controllers (3, 13) are connected to the actuator (5); the plurality of controllers (3, 13) are configured to receive the kill command via the network (21), and the actuator (5) is configured to cut off power to the one or more power receiving devices (8) when at least one of the plurality of controllers (3, 13) receives the kill command; wherein the plurality of controllers (3, 13) are configured to receive a heartbeat signal via the network (21), and the actuator (5) is configured to cut off power to the one or more power receiving devices (8) when all of the plurality of controllers (3, 13) no longer receive the heartbeat signal.

2. The system (11, 41) according to claim 1.

3. the system (1, 11, 41) comprises the one or more controllers (3, 13), each of the one or more controllers (3, 13) configured to receive the heartbeat signal via the network (21) and, in response to determining that the heartbeat signal is no longer being received by the individual controller, to cease sending a signal to the actuator (5); and the actuator (5) configured to cut off power to the one or more power receiving devices (8) when the actuator (5) does not receive the signal from any of the one or more controllers (3, 13). A system (1, 11, 41) according to claim 1 or 2.

4. 4. The system (1, 11, 41) of claim 3, wherein each individual controller of the one or more controllers (3, 13) is configured, in response to determining that the individual controller has received the kill command, to cease sending the signal to the actuator (5) and to prevent the actuator (5) from receiving the signal from any other controller of the one or more controllers (3, 13).

5. 5. The system (1, 11, 41) of claim 3 or 4, wherein each controller of the one or more controllers (3, 13) is configured to generate a watchdog signal, to receive the watchdog signal, and, in response to determining that the watchdog signal is no longer being received by the respective controller, to cease sending the signal to the actuator (5).

6. 3. The system (1, 11, 41) of claim 1 or 2, comprising the one or more controllers (3, 13), and each of the one or more controllers (3, 13) is configured to receive the heartbeat signal via the network (21) and, in response to determining that the heartbeat signal is no longer being received by the individual controller, to send a signal to the actuator (5), and the actuator (5) is configured to cut off power to the one or more power receiving devices (8) when the actuator (5) receives the signal from all of the one or more controllers (3, 13).

7. 7. The system (1, 11, 41) of claim 6, wherein each of the one or more controllers (3, 13) is configured to send a further signal to the actuator (5) in response to determining that the individual controller has received the kill command, and wherein the actuator (5) is configured to cut off power to the one or more power receiving devices (8) when the actuator (5) receives the further signal from at least one of the one or more controllers (3, 13).

8. 8. The system (1, 11, 41) of claim 6 or 7, wherein each of the one or more controllers (3, 13) is configured to generate a watchdog signal, to receive the watchdog signal, and, in response to determining that the watchdog signal is no longer being received by the individual controller, to send the signal to the actuator (5), and wherein the actuator (5) is configured to cut off power to the one or more power receiving devices (8) when the actuator (5) receives the signal from all of the one or more controllers (3, 13).

9. The system (1, 11, 41) according to any one of claims 1 to 8, wherein the system comprises the one or more controllers (3, 13), and the actuator (5) is configured to cut off power to the one or more power receiving devices (8) when the actuator (5) loses connection with all of the one or more controllers (3, 13).

10. 10. The system (11, 41) according to any one of claims 1 to 9, further comprising a further actuator (15) for controlling the power to one or more further powered devices (18), the further actuator (15) being connected to the one or more controllers (3, 13), the further actuator (15) being configured to cut off power to the one or more further powered devices (18) when at least one of the one or more controllers (3, 13) receives the kill command, and the further actuator (15) being configured to cut off power to the one or more further powered devices (18) when the heartbeat signal is no longer received by all of the one or more controllers (3, 13).

11. 11. The system (11, 41) according to claim 10, wherein the actuator (5), the further actuator (15) and the one or more controllers (3, 13) are connected to each other via a bus or a local network.

12. 12. The system (11, 41) according to any one of claims 1 to 11, wherein the one or more controllers (3, 13) comprise a first controller (3) and a second controller (13), and wherein the first controller (3) and the second controller (13) are powered by different power sources (4, 14).

13. A system (11) according to any one of the preceding claims, wherein the actuator (5) is powered by two independent main power sources (6, 7).

Images