Solid-state signalling relay

Abstract

Disclosed herein is a fail-safe solid-state signalling relay (100). The fail-safe relay (100) is implemented utilising a composite fail-safe architecture, having two channels (System A, System D). Particular embodiments utilise a "two-out-of-two voting" (2oo2) architecture, also referred to as "2 on 2", that uses two separate processors (Microcontroller A, Microcontroller D) to provide a fault-tolerant system. In such a system, both of the processors (Microcontroller A, Microcontroller D) must separately activate a respective output signal to change the state of the relay contacts (190a, 190b). If only one of the processors (Microcontroller A, Microcontroller B) activates an output signal, then the relay contacts (190a, 190b) do not change state. The architecture of the relay (100) is configured to ensure that any failure in the relay (100) results in the relay (100) defaulting to a predefined safe state.

Description

SOLID-STATE SIGNALLING RELAYRelated Application

[0001] This application is related to International Patent Application No. PCT / AU2024 / 050449 titled “Time Delay Relay” and filed 8 May 2024 in the name of DAVID STUCKEY INVESTMENTS PTY LTD, the entire content of which is incorporated by reference as if fully set forth herein.Technical Field

[0002] The present disclosure generally relates to a solid-state signalling relay and, in particular, to a fail-safe relay. Some embodiments relate to a fail-safe relay that may be used in railway applications. It will be convenient to hereinafter describe various embodiments in relation to this particular application. It should be appreciated, however, that the present disclosure is not limited to that application only.Background

[0003] A relay is an electrically operated switch that is actuated by changes in an electric circuit to open or close contact terminals, which are often referred to simply as “contacts”. Changes in an electric circuit may relate, for example, to the presence of a current or voltage above or below a predefined threshold. As switches, relays are often used to control the activation of other electrical devices in a circuit.

[0004] Electromechanical relays typically use an electromagnet to control a set of signalling contacts. Such signalling contacts include normally open (NO) (front) and normally closed (NC) (back) signalling contacts.

[0005] Existing electromechanical relays, such as those used by British Rail, for example, often experience a number of problems, such as high contact resistance, mechanical wear and tear, susceptibility to environmental conditions, and variability of performance based on mechanical and material variation, such as, for example, of the contact spring tension and the like.

[0006] In critical applications, such as railways, it is important for relays to function correctly. A failure in a relay in such applications can be catastrophic.

[0007] Thus, a need exists to provide an improved relay.Summary

[0008] The present disclosure provides a fail-safe solid-state signalling relay. The fail-safe relay is implemented utilising a composite fail-safe architecture to ensure that the relay defaults to a safe operating state.

[0009] A first aspect of the present disclosure provides a fail-safe solid-state relay comprising: a printed circuit board having a first region and a second region, wherein said first and second regions are electrically isolated from each other; a pair of normally open contacts located in a third region of said printed circuit board, wherein a first contact is controlled by a first pair of MOSFETs and a second contact is controlled by a second pair of MOSFETs; a first control system located within said first region of said printed circuit board, said first control system including: a first power supply module; a first microcontroller coupled to said first pair of MOSFETs, said first microcontroller including: a first processor; and storage means for storing computer-readable instructions that when executed on the processor perform the steps of: controlling activation of said first pair of MOSFETs to activate said first contact, upon detection of an activation voltage; and sending a signal to blow said fuse, upon detection of a fault; and a second control system located within said second region of said printed circuit board, said second control system including: a second power supply module; a second microcontroller coupled to said second pair of MOSFETs, said second microcontroller including: a second processor; and second storage means for storing computer-readable instructions that when executed on the second processor perform the steps of: controlling activation of said second pair of MOSFETs to activate said second contact, upon detection of an activation voltage; and sending a signal to blow said fuse, upon detection of a fault;a fuse coupled to each of the first microcontroller and the second controller, wherein blowing said fuse causes the pairs of MOSFETs to return to a default state, resulting in the first and second contacts being open; wherein said first power supply is coupled to each of said first microcontroller and said second microcontroller, and further wherein said second power supply is coupled to each of said first microcontroller and said second microcontroller.

[0010] A second aspect of the present disclosure provides a fail-safe solid-state relay comprising: a fuse; a first control system located on a first printed circuit board, said first control system including: a first power supply module; a first set of MOSFETs; a first microcontroller coupled to said first set of MOSFETs, said first microcontroller including: a first processor; and storage means for storing computer-readable instructions that when executed on the first processor perform the steps of: controlling activation of said first set of MOSFETs, upon detection of an activation voltage; and sending a signal to blow said fuse, upon detection of a fault; and a second control system located on a second printed circuit board, said second control system including: a second power supply module; a second set of MOSFETs; a second microcontroller coupled to said second set of MOSFETs and said fuse, said second microcontroller including: a second processor; and second storage means for storing computer-readable instructions that when executed on the second processor perform the steps of: controlling activation of said second set of MOSFETs, upon detection of an activation voltage; andsending a signal to blow said fuse, upon detection of a fault; a plurality of contacts, wherein a first set of contacts is controlled by said first control system and a second set of contacts is controlled by said second control system, wherein activating said first set of MOSFETs activates said first set of contacts and activating said second set of MOSFETS activates said second set of contacts; wherein blowing said fuse causes the pairs of MOSFETs to return to a default state, resulting in each of said contacts being open; wherein said first power supply is coupled to each of said first microcontroller and said second microcontroller, and further wherein said second power supply is coupled to each of said first microcontroller and said second microcontroller.

[0011] According to another aspect, the present disclosure provides methods associated with implementing any one of the aforementioned apparatuses.

[0012] Other aspects of the present disclosure are also provided.Brief Description of the Drawings

[0013] One or more embodiments of the present disclosure will now be described by way of specific examples with reference to the accompanying drawings, in which:

[0014] Figure 1 is schematic representation of an architecture of a fail-safe signalling relay 100 implemented on a single printed circuit board;

[0015] Figure 2 is a schematic block diagram representation of a low current system module;

[0016] Figure 3 is a schematic block diagram representation of a relay in accordance with an embodiment of the present disclosure;

[0017] Figure 4 is a circuit diagram of an implementation of a switch mode regulator;

[0018] Figure 5 is a circuit diagram of an implementation of a coil power detection circuit;

[0019] Figure 6 is a circuit diagram of an implementation of an over voltage protection circuit;

[0020] Figure 7 is a schematic block diagram representation of a temperature sensor;

[0021] Figure 8 is a schematic block diagram representation of a microcontroller;

[0022] Figure 9 is a schematic block diagram representation of analogue input circuits coupled to the microcontroller;

[0023] Figure 10 is a schematic block diagram representation of a feedback voltage detection circuit;

[0024] Figure 11 is a boost circuit 1100 suitable for boosting the current to switch a FET driver;

[0025] Figure 12 shows the output voltage to the MOSFETs connected opto-coupler;

[0026] Figure 13 is a circuit diagram illustrating how the communications channel is optically isolated using an open collector output opto-coupler;

[0027] Figure 14 is a circuit diagram illustrating a portion of an embodiment of a relay having two front contacts;

[0028] Figure 15 is a schematic block diagram representation of a JTAG interface for debugging and diagnosing a microcontroller;

[0029] Figure 16 is a circuit diagram of a circuit 1600 for monitoring power supply failure;

[0030] Figure 17 is a schematic block diagram representation of a relay in accordance with an embodiment of the present disclosure, illustrating physical isolation and galvanic opto-coupler isolation;

[0031] Figure 18 is a circuit diagram of a power supply; and

[0032] Figure 19 is a circuit diagram illustrating connections to a microcontroller utilised to implement a solid-state signalling relay.

[0033] Method steps or features in the accompanying drawings that have the same reference numerals are to be considered to have the same function(s) or operation(s), unless the contrary intention is expressed or implied.Detailed DescriptionOverview

[0034] The present disclosure provides a fail-safe solid-state signalling relay. The fail-safe relay is implemented utilising a composite fail-safe architecture, having two channels (also referred to herein as systems). Particular embodiments utilise a “two-out-of-two voting” (2oo2) architecture, also referred to as “2 on 2”, that uses two separate processors to provide a fault-tolerant system. In such a system, both of the processors must separately activate a respective output signal to change the state of the relay contacts. If only one of the processors activates an output signal, then the relay contacts do not change state.

[0035] The 2oo2 architecture implements identical relay functionality within two channels. A first channel activates a first set of solid-state contacts associated with the first channel and checks a second set of contacts associated with a second channel. Conversely, the second channel activates the second set of solid-state contacts and checks the first set of contacts.

[0036] The architecture is configured to ensure that any failure in the relay results in the relay defaulting to a predefined safe state. Contact checking is restricted to non-intrusive passive detection of potential across the contacts in the closed and open state.

[0037] In some embodiments, a programmable time delay interface is provided by which a user can select a time delay before the relay is activated. In such embodiments, the RC timing circuit of a typical electromechanical relay is replaced by a microcontroller that is inherently more accurate and predictable. Embodiments of the electronic time delay relay of the present disclosure utilise a time delay unit to control the time delay utilised by the relay, wherein the time delay unit has a set of time delay controls. The time delay controls may be user-configurable. For example, some implementations utilise DIP switches to set a time delay.

[0038] In some embodiments, a single printed circuit board (PCB ) is utilised. In alternative embodiments, multiple PCBs are utilised.

[0039] Some embodiments are configured to operate at relatively low power, in some cases consuming in the range of 50mW to 1W and, in some implementations, no more than lOOmW at 20°C. Some embodiments satisfy SIL4 safety requirements.

[0040] In some embodiments, the signalling relay includes a DIN-rail mountable enclosure.

[0041] Some embodiments of the signalling relay described herein are suitable for use in railway applications. While embodiments herein may be described with reference to railway applications, it will be appreciated that such embodiments are illustrative and not restrictive, and that solid-state signalling relays described herein may equally be practised in other applications.

[0042] For the sake of clarity, it is to be understood that any and all combinations of embodiments are possible, unless explicitly excluded.Common Cause Failures

[0043] The relay uses a composite fail safe architecture with two independent systems, whereby each system must perform correctly to ensure an operational relay. Detection of a failure in one channel results in the relay not operating. Each independent channel employs separate power supplies, separate microcontrollers and separate diagnostic circuits. The outputs from both systems are then combined to switch the relay contacts, if and only if, both systems are fully operational.

[0044] Figure 17 is a schematic block diagram representation of the relay 100, illustrating physical isolation and galvanic opto-coupler isolation, in accordance with some embodiments. The dotted line indicates the physical separation between the first and second channels.

[0045] The relay 100 receives external power 1702, which is fed to first and second power supply 1704a, 1704b on each of the respective channels. The first power supply 1704a provides power to a first microcontroller 1706a on the first channel. The first microcontroller 1706a receives inputs from a first feedback logic unit 1708a and produces an output to a first switching logic 1710a. First switching logic 1710a is coupled to a first optical isolation unit 1712a to control operation of a first contact 1720a. The first contact 1720a is coupled to a second optical isolation unit 1714a, which returns to the first feedback logic 1708a.

[0046] The same functionality is repeated in respect of the second channel. The second power supply 1704b provides power to a second microcontroller 1706b on the second channel. The second microcontroller 1706b receives inputs from a second feedback logic unit 1708b and produces an output to a second switching logic 1710b. Second switching logic 1710b is coupled to a third optical isolation unit 1712b to control operation of a secondcontact 1720b. The second contact 1720b is coupled to a fourth optical isolation unit 1714b, which returns to the second feedback logic 1708b.

[0047] The first and second microcontrollers 1706a, 1706b are coupled by a fifth optical isolation unit 1750. An external contact 1790 is coupled in parallel to the first and second contacts 1720a, 1720b.

[0048] The potential for a common cause failure is minimised (assumed to be zero), as there is no common physical or functional interface between the channels. A failure in the external power supply is not considered hazardous, as the relay would not operate and therefore remain in the defined safe state.Housing and Hardware

[0049] Some embodiments of the signalling relay include a housing suitable for mounting in an NS35 DIN-rail. In particular embodiments, the housing is a substantially rectangular prism, having dimensions of: 133mm high x 99mm wide x 23mm deep, suitable for enclosing the relay. In some implementations, the housing is a 2713625 housing manufactured by Phoenix Contact. In some embodiments, the housing is configured to prevent unauthorized access to programming / adju sting ports.

[0050] Some embodiments utilise a plastic housing. Plastic is light and readily available and can be readily produced in custom shapes and form, such as through blow moulding . Alternative embodiments utilise a metal housing. Metal housings are useful in applications that require electromagnetic compatibility (EMC) shielding to protect the relay enclosed within the housing from electromagnetic interference and / or to prevent the relay components from emitting electromagnetic radiation beyond the housing.

[0051] The housing may be perforated to allow air flow to cool the relay housed therein. The perforations can be located on one or more sides of the housing. Some embodiments position a single PCB implementing the relay in a vertical manner within the housing, enabling the relay to dissipate heat to the surrounding environment. In particular embodiments, the PCB is captured within a clam-shell type housing, allowing the PCB to move slightly in any direction, which provides some degree of flexibility when the housing is subjected to external shock impacts and thus reduce the risk of shock impact damage. In some embodiments, a non-conductive conformal coating is applied to the circuit board used to implement the relay, in order to protect the components from ingress of dust, dirt andmoisture. In order to reduce the risk of components detaching from the PCB, the PCB is optionally conformally coated with a silicon-based polymer.

[0052] The housing can be used to secure the relay in a DIN-rail. The housing also provides protection for the relay. In some embodiments, the housing provides ingress protection (IP) rating of 20. Different applications may require housings, having lower or greater IP ratings. For example, in particularly dusty environments an IP rating of 50 - 54 may be utilised.

[0053] Some embodiments of the housing have a transparent front cover or a transparent region on a front cover to enable visual inspection of the relay, such as to view a status display of the relay. In some embodiments, the relay includes one or more status LEDs viewable by a user through a transparent region of the housing.

[0054] One or more embodiments include a quick-release clip to allow mounting on a standard DIN-rail and a 4- way screw terminal block for external cable attachment. Two screw terminals are used for powering the internal circuitry, and two screw terminals are used for each of the signalling contacts. In some embodiments, Phoenix 2098485 terminal blocks are utilised. These terminal blocks are able to accommodate a minimum of 100mA of continuous current, survive 4kV transients without flash-over, and to comply with any required creepage and clearance requirements. For some applications, embodiments of the relay satisfy or exceed the creepage and clearance requirements as set out in the European Standard EN 50124-1:2017 (Railway applications - Insulation coordination - Part 1: Basic requirements - Clearances and creepage distances for all electrical and electronic equipment). In some embodiments, each screw terminal block is soldered directly to a printed circuit board to provide mechanical rigidity, whilst still allowing the attached cables to flex reducing the potential for vibration related faults.

[0055] In some embodiments, all components of the signalling relay operate over a temperature range of -40°C to +70°C. In some embodiments, one or more components of the relay are non-hygroscopic, self-extinguishing, and have been selected to prevent detrimental warping, deformation, or embrittlement. In some embodiments, the relay has a weight of less than 2kg and in some embodiments, the relay has a weight of 1.5kg or less.

[0056] Other embodiments utilise a housing suitable for mounting in other rails, including other sized DIN rails.

[0057] It will be appreciated that other enclosure sizes, shapes, and ingress protection ratings may equally be practised, depending on the application, without departing from the spirit and scope of the present application.Electrical insulation / isolation

[0058] Some embodiments of the relay described herein utilise a single printed circuit board (PCB) housed in a non-metallic enclosure with a non-conducting front panel. The circuit board is electrically isolated from the enclosure using substantial air gaps. External connections to the relay are made through metal screw contacts that are soldered to the PCB. Any leakage current between the contacts and non-conducting parts of the relay must either travel through the PCB substrate, or the enclosure material itself. Track routing on the PCB satisfies the necessary creepage and clearance requirements and the material composition of the enclosure complies with the material standards required by BR 947. As all currentcarrying components of the relay are electrically isolated, minimal leakage current occurs between conducting and non-conducting parts.Overall Architecture

[0059] The 2oo2 architecture is achieved using dual composite systems, referred to as first and second channels. Some embodiments electrically isolate the first and second channels. This may be achieved in different ways, such as mounting the first and second channels on separate PCBs, or by mounting the first and second channels on first and second regions of a single PCB, wherein the first and second regions are electrically isolated from each other. Figure 1 is schematic representation of an architecture of a fail-safe signalling relay 100 implemented on a single PCB 105. A first, upper region 115 of the PCB 105 is electrically isolated from a second, lower region 120 of the PCB 105 by an isolation barrier 110. The isolation barrier 110 may be implemented in many ways, including, for example, but not limited to, a physical separation such as a gap or insulating material, so as to prevent unintended electrical current flow between the first region 115 and the second region 120. In some implementations, the isolation barrier 110 is a gap in the layout of copper on the printed circuit board.

[0060] A first channel, System A, is located on the first region 115 and a second channel, System D, is located on the second region 120. Each of System A and System D include a power supply, a microcontroller, contact feedback monitoring circuitry, FET drivers and circuitry to blow a fuse to ensure the relay fails in a permanent safe state. The first andsecond channels, System A and System D, communicate with each other via optically isolated UARTs.

[0061] The normally open switching contacts use enhancement mode MOSFETs with optically isolated MOSFET drivers to ensure that a safe electrical isolation barrier is maintained between the outside world and the internal relay circuitry.

[0062] In the example of Figure 1, all modules are designed to ensure the entire unit consumes no more than lOOmW at 20°C. This is achieved by the number of contacts utilised, minimising current flow by using relatively high resistor values, using metal oxide transistors, and through the selective use of LEDs with reduced brightness. It will be appreciated that other implementations and applications with different power consumption figures and component selection may equally be practised.

[0063] The relay 100 receives as input a 48V direct current voltage across input terminals 122 and 124. The input voltage is presented to each of a first and second input protection over-voltage module 126a, 126b on the first channel and second channel, respectively. The first and second over-voltage modules 126a, 126b include reverse bias EMC filtering. An output of the first over-voltage module 126a is presented to each of a first power supply on the first channel and a second power supply on the second channel. Similarly, an output of the second over-voltage module 126b is presented to each of the first power supply on the first channel and the second power supply on the second channel.

[0064] The relay 100 includes two normally open (N / O) contacts 190a, 190b. A N / O contact is an electrical contact that is open (non-conductive) in its default, unactuated state and closes to become conductive when activated. The N / O contacts 190a, 190b are protected by a surge / transient protection module 130.

[0065] In the architecture of the relay 100 of Figure 1, the relay 100 includes two normally open contacts 190a, 190b, which are coupled to external pins 128. The external pins 128 enable the relay 100 to be coupled to an external device to be switched on or off by the relay 100. Each contact uses two MOSFETs, one MOSFET 134a driven by channel A and one MOSFET 134b driven by channel D. Each respective contact 190a, 190b has two optically isolated feedback voltage detectors, one feedback voltage detector 132a for channel A and one feedback voltage detector 132b for channel D. Thus, there are four feedback voltage detectors in total for the relay 100 of Figure 1.

[0066] The first channel is coupled to a contact 190a by each of a first optically isolated feedback module 132a and a first optically isolated MOSFET driver module 134a. Similarly, the second channel is coupled to a contact 190b by each of a second optically isolated feedback module 132ba and a second optically isolated MOSFET driver module 134b.

[0067] Figure 3 is a schematic block diagram representation of a high-level architecture for a fail-safe solid-state relay, in accordance with an embodiment of the present disclosure.Low Current System Modules

[0068] Each of the first channel and second channel is implemented using low current systems modules. Figure 2 is a schematic block diagram representation of a low current system module 200 suitable for use in implementing the first channel, System A, and second channel, System D, in the relay 100 of Figure 1. In the example of Figure 2, the low current system module 200 is described when implementing the first channel, System A. The low current system 200 includes a first microcontroller 236 for controlling operation of the first channel. The microcontroller 236 receives inputs from each of a power supply 206, a temperature sensor 220, the optically isolated feedback module 132a, and an optically isolated UART communication module 260 from the second channel, System D.

[0069] The microcontroller 236 has a bi-directional link to a programming interface module 226. The microcontroller 236 outputs to each of a status LED module 228, a current boost module 242, a safety logic module 250, and an optically isolated UART communication module 258.

[0070] The microcontroller section has three major outputs:• S AFE_SW 1 and S AFE_SW2 - In the case of a critical fault being detected, both signals are driven high to activate the SAFE circuits. An optically isolated output is coupled to the opposite system channel and a fuse is blown in the power rail to the MOSFET board ensuring all contacts default to their safe, non-powered state. Figure 8 is a schematic block diagram representation of the microcontroller 236 of Figure 2, in which SAFEJSWI and SAFE_SW2 are output from pins 15 and 16 of the microcontroller 236.• xx_BST - These pins toggle the inputs to the MOSFET driver ICs , ultimately being used to control the state of the contact switches.• UART_Tx - This communications port is used to ensure switching times between the two system microcontrollers are synchronised.Power Supply Module

[0071] The low current system module 200 includes a power supply 206 that receives as inputs the outputs of the first and second over-voltage modules 126a, 126b. The power supply 206 includes: a switch mode regulator 208, a coil power detection module 212, and an over-voltage protection module 214.

[0072] Figure 18 is a circuit diagram of one implementation of the power supply 206, which has four outputs.

[0073] VCC0 is the regulated supply voltage used to feed all logic circuitry, including the microcontroller 236. VCC0 is the output of the switch mode regulator 208 and is protected by a fuse that shall blow open circuit, in case of excessive current draw.

[0074] COIL_PWR is derived from the coil power detection module 212, which utilises an opto-coupler to provide high voltage isolation, effectively protecting the microcontroller 236 from high voltage inputs. The output COIL_PWR is used to indicate the presence of sufficient input voltage. In electro-mechanical relays, the input voltage is applied across a coil, wherein current through a coil creates a magnetic field to attract a metal plate and close a contact. In solid-state relays, there is no physical coil. Instead, an optocoupler is used to detect the presence or absence of a voltage. When a sufficient input voltage is applied, an LED light source is turned on and an adjacent photo sensitive detector detects the presence of light and is activated. The photo sensitive detector may be, for example, a transistor, darlington pair, triac, or the like.

[0075] If there is voltage applied to the coil, COIL_PWR will be low, otherwise COIL_PWR will be pulled high. COIL_PWR is presented as a logic input to the microcontroller 236. In some embodiments, the power to the relay must consist of a smoothed, rectified DC voltage of greater than 12V in order to activate the relay. In some embodiments, the input voltage to the relay must be less than 68V, otherwise the relay will shut down to protect itself. The recommended typical operating voltage is 48VDC @ 20mA.

[0076] ADC 218 is output from the over voltage protection circuit 214 and is presented as a first ADC input (ADC_A_uC) to the microcontroller 236. The microcontroller 236 utilises ADC_A_uC to measure an analogue voltage level. ADC is not optically isolated, but is protected by a Zener diode at the input to the microcontroller 236. The level of ADC scaleslinearly with the voltage applied across the coil. ADC_A_uC output from the over voltage protection circuit 214 is also presented as a second ADC input to the microcontroller of the second channel, System D. Similarly, a corresponding ADC_D_uC signal output from the over voltage protection circuit of the second channel, System D, is presented as a second ADC input to the microcontroller 236.

[0077] PWR_VIN is a protected representation of the coil voltage and is fed to the opposite channel, so that both channels each receive a filtered, protected supply. This ensures that each microcontroller has a stable supply voltage, even if one power supply should fail.Switch Mode Regulator

[0078] Figure 4 is a circuit diagram of an implementation of the switch mode regulator 208. In the example of Figure 4, the switch mode regulator 208 is implemented using a stepdown converter chip MP9486GN 410 manufactured by Monolithic Power Systems (MPS), which is rated to a maximum of 100V input. Other suitable step-down converter chips may equally be practised and may have different associated maximum operating voltages.

[0079] The switch mode regulator 208 outputs as VCC a constant 5V output at up to 1A. A 500mA slow blow fuse is used to provide over current protection, in case of a failed circuit downstream or if the output voltage should inadvertently exceed 5.6V, which may result from a failure in feedback resistors.

[0080] The circuit for the switch mode regulator 208 includes a Pi-filter 405 on the input to reduce undesirable conducted emissions. Capacitor banks on the input and output of the regulator 208 provide sufficient hold-up capacity to ensure the relay 100 remains operational during a temporary power glitch of up to 30ms.Coil Power Detection

[0081] Figure 5 is a circuit diagram of an implementation of a coil power detection circuit 212, in which a simple opto-coupler 510 is utilised to detect the presence of DC voltage across the coil. The circuit 212 is designed to ensure the microcontroller 236 can monitor the coil voltage, even when the coil voltage is below an activation voltage. This allows software executing on the microcontroller 236 to initialize values, prepare outputs, and test contacts prior to activating the relay outputs. COIL_PWR 216, the output from the coil power detection circuit 212, is routed as a discrete digital input to the microcontroller 236 and the optical isolation ensures safety and protection from voltage surges.Over-voltage Protection

[0082] Figure 6 is a circuit diagram of an implementation of the over voltage protection circuit 214 employed at the front end of the power supply 206. This circuit 214 ensures that for any voltage across the coil of greater than 68 V, the output will be deactivated. The switch mode regulator 208 may be destroyed if greater than 100V is applied, so this circuit provides a margin of safety.

[0083] In some embodiments, the signalling relay does not include any external communications channels by which to report an over-voltage event. In these embodiments, there is no requirement to monitor over voltage events.Under Voltage Protection

[0084] In order for the signalling relay of the present disclosure to operate, an applied voltage needs to exceed a predefined minimum voltage, such that the microcontrollers of the respective channels can function correctly. The predefined minimum voltage, below which the microcontroller is not expected to function correctly, is referred to as a brown-out threshold level. The brown-out voltage applies only to the microcontroller, not the relay as a whole. While a received input voltage at external terminals of the relay may be above the brown-out voltage, the voltage applied to the microcontroller may be less than the brownout voltage, due to voltage losses across electronic components (e.g., diodes, inductors, regulator efficiency, resistors, etc.) between the external inputs and microcontroller inputs.

[0085] The applied voltage is regulated to a constant 5V rail for the logic circuitry. Each microprocessor uses an internal voltage monitoring circuit to check constantly that the applied voltage exceeds the minimum operating voltage. If the 5V rail voltage should dip below the brown-out threshold level, the microcontroller 236 shall initiate a reset condition. In the example of Figure to be described below, the microcontroller 236 is implemented using the ATmega324PB-AN from Microchip Technology, which has a brown-out voltage of 2.7V. Other suitable microcontroller integrated circuits may have different associated brown-out voltages.Over Temperature Protection

[0086] Some embodiments of the signalling relay utilise over-temperature protections to prevent the signalling relay from overheating. In some embodiments, over-temperature protection is provided through the use of a pair of analogue temperature sensors, such as the temperature sensor 220 of Figure 2. In the example of Figure 2, a predefined shutdown threshold is set in software and stored in a computer-readable memory of the microcontroller236. An output of the temperature sensor 220 is provided as input ADC_TEMP to the microcontroller 236. When the temperature detected by either or both temperature sensors exceeds the predefined shutdown threshold, the software executing on the microcontroller 236 ensures that the state of the contacts correspond to a predefined safe state.

[0087] Figure 7 is a schematic block diagram representation of a temperature sensor 222. The temperature sensor 222 receives as inputs the voltage VCC and a connection to ground (GND). In the example of Figure 7, the temperature sensor is implemented using the MCP9700AT-E / TT integrated circuit temperature sensor by Microchip Technology. It will be appreciated that many other temperature sensors may equally be utilised. The output of the temperature sensor 220 is provided as ADC_TEMP 222 to the microcontroller 236.

[0088] In some embodiments, the temperature sensors are located in the centre of the printed circuit board. This helps mitigate against the influence of external ambient air currents that may provide a cooling effect and thus result in the temperature sensors recording an incorrect, lower temperature. In particular embodiments, each temperature sensor is positioned on the printed circuit board in a location between the power supply and microcontroller for the respective channel.

[0089] In embodiments in which the signalling relay is enclosed in a housing, the housing may or may not have any perforations / apertures on an upper, top side of the housing. In embodiments in which the housing does not have any perforations / apertures on an upper side, there is minimal venting to the external environment.Microcontroller

[0090] Figure 8 is a schematic block diagram representation of the microcontroller 236 of Figure 2. The microcontroller is configured and programmed to activate output contacts of the signalling relay and to monitor the feedback voltage to detect failures. When the microcontroller 236 determines that a failure has occurred, the microcontroller 236 switches the contacts of the relay to a predefined safe state. In the example of Figure 8, the microcontroller 236 is implemented using the ATmega324PB-AN from Microchip Technology. It will be appreciated that many other microcontrollers from the same or other vendors may equally be utilised to implement embodiments of the fail-safe relay of the present disclosure.

[0091] In the example of Figure 8, the microcontroller 236 is clocked from an external crystal oscillator 802 and uses an external analogue reference for the ADC inputs. In thisexample, the reference signal is 4.096V, which software executing on the microcontroller 236 utilises as a stable reference in order to calculate precise analogue values for the pick / drop / temperature inputs.

[0092] Two of the Port A pins (PA2 and PA3) are used as analogue inputs, receiving the signals ADC_A_uC and ADC_D_uC from the over-voltage protection circuits 214 of the respective first and second channels, to monitor the coil voltage in order to determine at which voltage levels the relay contacts should be activated or deactivated. Once the coil voltage exceeds the activation voltage, the microcontroller 236 closes normally open contacts. When the coil voltage falls below the deactivation voltage, the microcontroller opens normally open contacts. All other IO pins are configured as digital pins. Port D pins are used to monitor the contact feedback voltage.

[0093] Each microcontroller 236 has its own ground reference: System A uses GND0 and System D uses GND1 and both grounds are connected at a common point on the printed circuit board 105. This arrangement ensures a common reference for the coil voltage measurement, since each channel monitors the supply input for the other channel.

[0094] In this example, each microcontroller 236 uses a Serial Peripheral Interface (SPI) port for retrieving diagnostic data and programming purposes, such as uploading and downloading firmware. The SPI protocol is used to program the microcontrollers 236 on the system module and the display module. An external programming tool is used to download the FLASH memory contents via SPI. It will be appreciated that other interfaces may equally be practised without departing from the spirit and scope of the present disclosure.

[0095] A Joint Test Action Group (JTAG) interface is optionally provided for development and diagnostic purposes, which can only be accessed via dedicated pads on the rear of the PCB 105. The JTAG protocol has been implemented as an additional interface for debugging and diagnosing the microcontrollers. The JTAG interface is not safety critical and allows for more thorough debugging methods, such as halting and single- stepping the processor through the use of breakpoints in the code. The JTAG interface utilises four wires for communication, as shown in Figure 15. The JTAG 4-wire connection interface has been implemented according to the IEEE 1149.1 standard. This is an industry standard method to test circuit board connectivity (boundary scan) in an efficient manner. The JTAG interface may optionally be utilised for uploading and downloading firmware from and to the respective microcontrollers, instead of, or in conjunction with, the SPI port described above.

[0096] Figure 9 is a schematic block diagram representation of analogue input circuits coupled to the microcontroller 236. ADC_A and ADC_D inputs 218 are fed from the outputs of the respective over-voltage protection circuits 214 of the first and second channels and allow software executing on the microcontroller 236 to monitor the value of the voltage applied across the coil. Two analogue inputs are used, as each microcontroller monitors its own power supply and the power supply from the other channel.

[0097] A simple resistive divider with Zener clamping is used to provide a linearly scaled input to the software, converting the received ADC_A signal to ADC_A_uC and the received ADC_D signal to ADC_D_uC. The analogue temperature sensor 220 provides a scaled analogue output 222 that varies linearly with temperature, allowing software executing on the microcontroller 236 to determine a current ambient temperature by measuring the voltage. In this example, the analogue temperature sensor 220 operates in accordance with an equation that relates the sensor output voltage to the ambient temperature, as set out in Equation 1 below:VOUT = Tc x TA + Vo°c ... Equation 1 where:VOUT is the ambient Sensor output voltage, TA is the ambient temperature,Vo°c is the sensor output voltage at 0°C, andTc is the temperature coefficient.Figure 9 also shows a programming header 950, which is the SPI port described above for retrieving diagnostic data and programming purposes, such as uploading and downloading firmware.ADC Common Reference

[0098] In embodiments in which the relay is implemented utilising a single PCB 105, the PCB 105 includes a 0 Ohm link track between the two microcontroller sections, wherein the link track acts as a connection between the two grounds GND0 and GND1. Each of the electrically isolated regions 115, 120 of the PCB 105 has its own independent power supply. Consequently, in order for the microcontrollers located on the respective isolated regions 115, 120 to make comparative measurements of each other’s voltages, the grounds must be connected at a common point.

[0099] In alternative embodiments in which the relay is implemented using multiple PCBs, grounds of the respective PCBs are electrically connected using appropriate means for the same purpose.Feedback Voltage Detection Circuit

[0100] Figure 10 is a schematic block diagram representation of a feedback voltage detection circuit 1000, corresponding to the optical feedback module 132a of Figure 1. The feedback voltage detection circuit is utilised to determine a fault status of an individual contact of the relay 100.

[0101] Each pair of contacts in the relay 100 is monitored using an optically isolated switch that is activated when voltage is detected across the contact. The output of optically isolated switch is OUT_A, which is active low when a voltage is detected across the contacts.

[0102] The feedback circuit 1000 includes half-wave diode rectifiers, such that only biased DC voltages across the contacts may be monitored. Any voltage (greater than approx. 4V) applied across the contact results in the output being pulled low. The example of Figure 10 utilises a high optocoupler HCPL-070A-500E made by Broadcom, but other implementations may equally be practised.FET Drivers

[0103] The relay 100 includes MOSFET drivers, but the MOSFET drivers cannot be activated using a regular Transistor-Transistor Logic (TTL) voltage from the microcontroller. Accordingly, the voltage must be boosted using a short pulse to rapidly switch the FET driver into a conduction state.

[0104] Figure 11 is a boost circuit 1100 suitable for boosting the current to switch a FET driver 1110. The output of the boost circuit 1100 is BST_OUT. When the boost circuit is in its “off’ state, the diode bypasses resistor R14 1115, thus allowing the capacitor C9 1120 to be charged. Once the circuit 1100 is in its “on” state, the fully charged capacitor 1120 will discharge almost immediately, providing sufficient current to the gate of MOSFET Q5 1110.Fail Safe Operation

[0105] When a critical failure is detected, the relay must default to a predefined safe state, where the N / O contacts are open. Figure 12 shows the output voltage to the MOSFETs connected via a fuse 1210. In the event of a failure, this fuse 1210 is purposely blown open.This results in the MOSFETs returning to their default state, which is N / O for the enhancement mode MOSFETs.

[0106] The inputs responsible for blowing the fuse are designated SAFE_SW1 / SAFE_SW2 and SAFE_IN in Figure 12, with each input being driven from a different microcontroller. With reference to the microcontroller 236 of Figure 8, SAFEJSW1 and SAFE_SW2 are the respective outputs of pins 15 and 16 of one microcontroller and SAFE_In is output from the other microcontroller. Either microcontroller may blow the fuse. For example, if the channel A microcontroller is non-operational, the channel D microcontroller can still blow the fuse on channel A, rendering all contacts safe.

[0107] Both SAFE_SW1 and SAFE_SW2 must be active in order to pull SAFE_OUT high. SAFE_OUT is an optically isolated signal that connects to the microcontroller on the opposite channel, so that if a fault occurs in the switching circuitry on one channel, the opposite channel can still blow the fuse.

[0108] At power on and in the normal operating mode, both Q9 and Q10 are “off’, so Q8 is biased “on” via R21, pulling the input to Q6 low.Microcontroller Communications

[0109] Each microcontroller on channels A and D, corresponding to microcontroller 236 of Figure 2, performs integrity checks of the IO of the processors using the Universal Synchronous / Asynchronous Receiver / Transmitter (USART) serial communication interface protocol as a means of communication between the two channels.

[0110] Figure 13 is a circuit diagram illustrating how the communications channel is optically isolated using an open collector output optocoupler in the form HCPE-0501-500E made by Broadcom, but other implementations may equally be practised. The checks involve ensuring the coil input switching, coil voltage inputs and relay outputs are consistent across channels A and D. The state of the contacts, as well as the diagnostics information, may be shown on EEDs of the optocoupler. However, if the IO on the two channels is inconsistent, the relay enters a pre-defined safe state.Switching Contacts

[0111] The switching contacts are isolated from the low current system modules and utilise enhancement mode MOSFETs and optical driver integrated circuits (ICs). In someembodiments, the MOSFETs are positioned close to a screw terminal block and thick copper tracks are used to minimise series resistance.

[0112] Each contact pair comprises two individual MOSFETs. A 2oo2 system requires two MOSFETs, one being driven by microcontroller A and one being driven by microcontroller D. Both microcontrollers need to activate the MOSFETs for the switch to change state. In this case, one MOSFET in each pair is acting as a switch, while the other MOSFET in each pair acts as a diode. Each MOSFET pair is driven by an optically isolated driver IC, controlled by the boost circuit on the low current boards.

[0113] Figure 14 is a circuit diagram illustrating a portion of an embodiment of a relay, having two front contacts (normally open). The example of Figure 14 shows a single contact implemented using two enhancement mode MOSFETs 1430, 1440 wired in series. The circuit of Figure 14 is repeated for two different contacts, such as described with reference to the relay 100 of Figure 1.

[0114] The NO contacts have an on-resistance of no more than 0.2Q and an open circuit resistance greater than IM Q. Each individual MOSFET 1430, 1440 is rated at 200V (YDS) and can carry a maximum continuous current of 3A.

[0115] In the example of Figure 14, the normally open MOSFETs 1430, 1440 use NCEP02T10D devices rated for a continuous current of 100A. Over- specifying the current rating ensures that the contacts can comfortably carry turn on transient pulses of 5A at 12V DC for at least 100ms without undue heating or damage. Other embodiments for less critical applications may be rated for lower continuous currents.

[0116] Each pair of MOSFETs 1430, 1440 is controlled by an optically isolated driver 1410, 1420, respectively, providing 3.7kV isolation between the relay contacts and internal circuitry. All high current, high voltage signals are separated from the microcontroller systems by both optical and physical isolation, such as an air gap or gap in copper on the PCB.

[0117] In the example of Figure 14, first and second MOSFET drivers 1410, 1420 are VOD 1271 MOSFET drivers manufactured by Vishay Industries, but other MOSFET drivers may equally be utilised. A first MOSFET driver 1410 is driven by channel A, receiving as inputs VCCAJSAFE, GND_A, and BST_A (being the output of the boost circuit 1100 of Figure 11 for channel A). Similarly, a second MOSFET driver 1420 is driven by channel D,receiving as inputs VCCDJSAFE, GND_D, and BST_D (being the output of the boost circuit 1100 of Figure 11 for channel D).Status Display

[0118] Some embodiments of the relay include a visual display to indicate a real-time status of the relay. The visual display may be implemented using one or more individual LEDs, an LCD display, an LED display, or the like.

[0119] Some embodiments implemented using LEDs position a set of LEDs at a front edge of the housing enclosure to permit the user to view necessary information. Some implementations utilise two LEDs, one for channel A and one for channel D, each LED indicating the status of the respective channel. As the operation of the visual display is not considered to be essential for safe operation of the relay, the relay should still pick and drop as expected even if the display fails. Alternative embodiments can trigger a fault if the display fails, causing the relay to default to a predefined safe state.Single Fault Detection

[0120] Embodiments of the relay are capable of detecting one or more of three different types of single faults: a MOSFET failure; a power failure; or a communications failure.

[0121] There are two potential types of MOSFET failure: a normally open MOSFET may fail to close, or a normally open MOSFET may fail to open if already closed. The hardware to detect these failure modes is shown in Figure 10. The hardware uses a diode rectifier to prevent reverse polarity DC being converted into a positively biased signal, which is used to activate an optocoupler switch. The switch output is normally pulled high. However, if voltage is detected across the contact, the switch output will be driven low. The microcontroller software monitors the switches and by alternately toggling the channel A and channel D MOSFETs, they can determine if a fault has occurred.

[0122] Each channel (A and D) has its own independent power supply, and each channel monitors both power rails. Figure 16 is a circuit diagram of a circuit 1600 for monitoring power supply failure. There are two monitoring points, a COIL_PWR node and an ADC node / PWR_IN node. Coil power is a digital signal that is normally high, but it is driven low when voltage is applied to the coil. The VCC rail is held up momentarily by a capacitor bank after the coil voltage is removed, so the microcontroller 236 is able to detect when the power has been switched off prior to shutting down.

[0123] The ADC node is an analogue voltage that scales linearly with the input voltage and the microcontroller 236 uses this value to determine if a predefined pick or drop threshold has been crossed. The PWR_IN signal is shared between both power supplies, so if a power supply on one channel fails, the power supply on the other channel continues to receive power. If the microcontroller 236 determines a discrepancy in either the analogue input or coil power input, the microcontroller initiates a safe state.

[0124] The two microcontrollers on channels A and D communicate with each other via an optically isolated UART, shown in Figure 13. If the transmitter fails to receive a response before a predefined response time threshold expires, or the receiver fails to receive a command before a predefined command time threshold expires, a communications-failed fault is logged in EEPROM of the microcontroller and the appropriate microcontroller initiates the safe condition.

[0125] Each microcontroller in the relay is configured to employ an internal watchdog circuit. A free -running oscillator within the microcontroller continually resets a watchdog timer, which prevents the microcontroller from resetting. In the event of a software fault, the watchdog timer will expire, initiating a software reset. This combines with the communications cross-checking described above to ensure a fault in a single microcontroller circuit is detected and logged by the opposing microcontroller.

[0126] The detection of any critical fault shall transition the relay to a state known as the safe state. In this state, the fault detected is recorded in EEPROM, fuses are blown, and the relay cannot be picked.

[0127] Detection of a critical single fault triggers the SAFE circuit, thus forcing the relay to enter a SAFE mode. The SAFE mode is a Safety Integrity Level (SIL) 4 certified safe and consistent manner in which the relay is disabled and ceases operations permanently. The relay is permanently disabled by blowing a fuse, which prevents the relay contacts from operating. The microcontrollers continue to function, and when activated the LED display will indicate the fault condition.Effects of Multiple Faults

[0128] As discussed above, the detection of a single fault by the microcontroller triggers the SAFE circuit, thus forcing the relay to enter the SAFE mode. The relay enters the SAFE mode when a single fault has been detected, thus preventing further faults from registering.As a result, the relay cannot operate when multiple faults have occurred as it ceases to operate upon detection of the first fault.Relay contacts

[0129] The relay contacts are the sole electrical interface to the external environment and as such are regarded as safety critical. The relay does not generate any voltages internally; all voltages are applied externally to the contacts. Thus, protecting the rest of the relay from external influences is critically important. From a safety point of view, the contacts are rated to carry a load of up to 110VAC. In the example of Figure 14, the relay uses two MOSFETs in series, each rated at 200V for a total of 400V. The MOSFETs are connected to a discrete driver IC with an optical isolation barrier of 3750V.Contact Testing

[0130] Embodiments of the relay optionally perform contact testing while in the picked state by momentarily opening the closed contacts. Contacts are opened for periods of approximately 1ms every second. Control of the contacts for contact testing is performed by software executing on the respective microcontrollers.Industrial Applicability

[0131] The arrangements described are applicable to the electronic, transport, and railway industries.

[0132] The foregoing describes only some embodiments of the present invention, and modifications and / or changes can be made thereto without departing from the scope and spirit of the invention, the embodiments being illustrative and not restrictive.

[0133] Further advantages and improvements may very well be made to the present invention, without deviating from its scope. Although the invention has been shown and described in what is considered to be the most practical and preferred embodiment(s), it is recognized that departures may be made therefrom within the scope and spirit of the invention, which is not to be limited to the details disclosed herein, but is to be accorded the full scope of the Claims, so as to embrace any and all equivalent devices and apparatus. Any discussion of the prior art throughout the Specification should in no way be considered as an admission that such prior art is widely known, or forms part of the common general knowledge in this field.

[0134] Reference throughout this specification to “one embodiment”, “an embodiment,”“some embodiments”, or “embodiments” means that a particular feature, structure orcharacteristic described in connection with the embodiment is included in at least one embodiment of the present invention. Thus, appearances of the phrases “in one embodiment” or “in an embodiment” in various places throughout this specification are not necessarily all referring to the same embodiment, but they may be. Furthermore, the particular features, structures or characteristics may be combined in any suitable manner, as would be apparent to one of ordinary skill in the art from this disclosure, in one or more embodiments.

[0135] While some embodiments described herein include some, but not other, features included in other embodiments, combinations of features of different embodiments are meant to be within the scope of the invention, and form different embodiments, as would be understood by those skilled in the art. For example, in the following claims, any of the claimed embodiments can be used in any combination.

[0136] Furthermore, some of the embodiments are described herein as a method or combination of elements of a method that can be implemented by a processor of a computer system, or by other means of carrying out the function. Thus, a processor with the necessary instructions for carrying out such a method or element of a method forms a means for carrying out the method or element of a method. Furthermore, an element described herein of an apparatus embodiment is an example of a means for carrying out the function performed by the element for the purpose of carrying out the invention.

[0137] In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the invention may be practised without these specific details. In other instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure an understanding of this description.

[0138] Note that when a method is described that includes several elements, e.g., several steps, no ordering of such elements, e.g., of such steps, is implied, unless specifically stated.

[0139] In the context of this specification, the word “comprising” and its associated grammatical constructions mean “including principally, but not necessarily solely” or “having” or “including”, and not “consisting only of’. Variations of the word "comprising", such as “comprise” and “comprises” have correspondingly varied meanings.

[0140] Similarly, it is to be noticed that the term “coupled” should not be interpreted as being limitative to direct connections only. The terms “coupled” and “connected,” along with their derivatives, may be used. It should be understood that these terms are not intendedas synonyms for each other, but they may be. Thus, the scope of the expression “a device A coupled to a device B” should not be limited to devices or systems, wherein an input or output of device A is directly connected to an output or input of device B . It means that there exists a path between device A and device B, which may be a path including other devices or means in between. Furthermore, “coupled to” does not imply direction. Hence, the expression “a device A is coupled to a device B” may be synonymous with the expression “a device B is coupled to a device A”. “Coupled” may mean that two or more elements are either in direct physical or electrical contact, or that two or more elements are not in direct contact with each other, but yet are still able to co-operate or interact with each other.

[0141] As used throughout this specification, unless otherwise specified, the use of ordinal adjectives "first", "second", "third", “fourth”, etc., to describe common or related objects, indicates that reference is being made to different instances of those common or related objects, and is not intended to imply that the objects so described must be provided or positioned in a given order or sequence, either temporally, spatially, in ranking, or in any other manner.

[0142] Although the invention has been described with reference to specific examples, it will be appreciated by those skilled in the art that the invention may be embodied in many other forms.

Claims

AMENDED CLAIMS received by the International Bureau on 03 September 2025 (03.09.2025) We claim:

1. A fail-safe solid-state relay comprising: a printed circuit board having a first region and a second region, wherein said first and second regions are electrically isolated from each other; a pair of normally open contacts located in a third region of said printed circuit board, wherein a first contact is controlled by a first pair of MOSFETs and a second contact is controlled by a second pair of MOSFETs; a first control system located within said first region of said printed circuit board, said first control system including: a first power supply module; a first microcontroller coupled to said first pair of MOSFETs, said first microcontroller including: a first processor; and storage means for storing computer-readable instructions that when executed on the processor perform the steps of: controlling activation of said first pair of MOSFETs to activate said first contact, upon detection of an activation voltage; and sending a signal to blow a fuse, upon detection of a fault; and a second control system located within said second region of said printed circuit board, said second control system including: a second power supply module; a second microcontroller coupled to said second pair of MOSFETs, said second microcontroller including: a second processor; and second storage means for storing computer-readable instructions that when executed on the second processor perform the steps of: controlling activation of said second pair of MOSFETs to activate said second contact, upon detection of an activation voltage; and sending a signal to blow said fuse, upon detection of a fault; said fuse coupled to each of the first microcontroller and the second controller, wherein blowing said fuse causes the pairs of MOSFETs to return to a default state, resulting in the first and second contacts being open;wherein said first power supply is coupled to each of said first microcontroller and said second microcontroller, and further wherein said second power supply is coupled to each of said first microcontroller and said second microcontroller.

2. The relay according to claim 1, further comprising: a housing for enclosing said printed circuit board.

3. The relay according to claim 2, wherein said housing is configured for mounting to an NS35 DIN rail.

4. The relay according to either one of claims 2 and 3, wherein said housing has a transparent region on a front cover to enable visual inspection of a visual display of the relay, wherein the visual display includes at least one of an LED, an LCD display, and an LED display, or any combination thereof.

5. The relay according to any one of claims 1 to 4, wherein an isolation barrier is located between the first and second regions of the printed circuit board, said isolation barrier being implemented using at least one of a gap or insulating material, or a combination thereof.

6. The relay according to any one of claims 1 to 5, wherein said first and second microcontrollers separately activate a respective output signal to change a state of said relay contacts.

7. The relay according to any one of claims 1 to 6, further comprising: a set of DIP switches for setting a time delay associated with activation of said contacts.

8. The relay according to any one of claims 1 to 7, wherein said relay consumes no more than lOOmW at 20°C.

9. The relay according to any one of claims 1 to 8, wherein said relay is suitable for use in a railway application.

10. The relay according to any one of claims 1 to 9, wherein said first and second control systems are dual composite systems that implement a 2oo2 architecture.

11. The relay according to any one of claims 1 to 10, wherein said first and second control systems communicate via optically isolated Universal Asynchronous Receiver-Transmitters (UARTs).

12. The relay according to any one of claims 1 to 11, wherein each MOSFET is associated with a set of optically isolated MOSFET drivers to provide an electrical isolation barrier between the MOSFETs and the first and second control systems.

13. The relay according to any one of claims 1 to 12, wherein: each contact is associated with a pair of feedback voltage detectors, one for each of the first control system and the second control system.

14. The relay according to claim 13, wherein: the first microcontroller monitors a first feedback voltage derived from said feedback voltage detectors; and on detecting a failure based on said first feedback voltage, said first microcontroller activates the first pair of MOSFETs to activate said first contact; and further wherein: the second microcontroller monitors a second feedback voltage derived from said feedback voltage detectors; and on detecting a failure based on said second feedback voltage, said second microcontroller activates the second pair of MOSFETs to activate said second contact.

15. A fail-safe solid-state relay comprising: a fuse; a first control system located on a first printed circuit board, said first control system including: a first power supply module; a first set of MOSFETs;a first microcontroller coupled to said first set of MOSFETs, said first microcontroller including: a first processor; and storage means for storing computer-readable instructions that when executed on the first processor perform the steps of controlling activation of said first set of MOSFETs, upon detection of an activation voltage; and sending a signal to blow said fuse, upon detection of a fault; and a second control system located on a second printed circuit board, said second control system including: a second power supply module; a second set of MOSFETs; a second microcontroller coupled to said second set of MOSFETs and said fuse, said second microcontroller including: a second processor; and second storage means for storing computer-readable instructions that when executed on the second processor perform the steps of: controlling activation of said second set of MOSFETs, upon detection of an activation voltage; and sending a signal to blow said fuse, upon detection of a fault; a plurality of contacts, wherein a first set of contacts is controlled by said first control system and a second set of contacts is controlled by said second control system, wherein activating said first set of MOSFETs activates said first set of contacts and activating said second set of MOSFETS activates said second set of contacts; wherein blowing said fuse causes the pairs of MOSFETs to return to a default state, resulting in each of said contacts being open; wherein said first power supply is coupled to each of said first microcontroller and said second microcontroller, and further wherein said second power supply is coupled to each of said first microcontroller and said second microcontroller.

16. The relay according to claim 15, further comprising a housing for enclosing said first and second printed circuit boards, said housing being configured for mounting to an NS35 DIN rail.

Images