Patent Application
20240012036
This application relates to electrical safety and describes a system and method for determining the absence of voltage with a permanently installed voltage tester in electrical equipment.
Traditionally, portable test instruments are used to verify the absence of voltage. Voltage verification with a portable test instrument is a multi-step process as shown in
Although the voltage verification process with a portable test instrument is considered best practice, it is not without limitations. Portable instruments are susceptible to mechanical and electrical failure, as well as misuse by the person using the portable device. Throughout the entire process, the person performing the voltage verification test is exposed to potential electrical hazards that could result in injuries or death. To ensure safety, all conductors are presumed to be energized until proven otherwise, which requires the use of additional precautions, such as personal protective equipment (PPE). Furthermore, if the process is not performed, or performed in an abbreviated fashion, the likelihood of an incident resulting in injury is even greater. Because the process is highly dependent on human input, interaction, and interpretation, it is susceptible to mistakes and errors.
In order to improve worker safety and the efficiency of the process, it is desirable to be able to determine whether electrical hazards are present before accessing electrical equipment. If voltage is not present, the risk of electrical shock, arc flash, and arc blast are eliminated.
The use of voltage indicators is becoming more common in industrial applications due to increased awareness of the need for electrical safety. These devices are effective at providing a warning when voltage is present, but they are not reliable for absence of voltage verification. Typically, voltage indicators are hardwired into the three-phase circuit and are powered only by the circuit they are monitoring. Thus, they are only able to indicate the presence of voltage. In order to verify the absence of voltage, the process with a portable test instrument is still required because voltage indicators do not have a way to determine if the lack of signal is from a faulty device, a lost connection, or a truly de-energized condition.
Injecting a test current into the device has been proposed in U.S. Pat. No. 8,013,613, so that the device could momentarily be transitioned to energized to verify the functionality of the indicators. Although this is an improvement and verifies that the indicator is functioning, it does not verify that the hardwired connection between the voltage indicator and the circuit being monitored is intact and does not directly signal the absence of voltage. Thus, a more robust method is needed to test for and verify the absence of voltage with a permanently installed device.
An installed device electrically connected to a power source. The installed device has circuitry capable of detecting voltage, performing self-diagnostics, and testing for connectivity to the power source. In one embodiment, the device can also check to see if the voltage is at a de-energized level, recheck for continuity and repeat the self-diagnostics. In another embodiment, the installed device can be electrically connected to the line and load side of a disconnect and have circuitry configured to check the status of the disconnect. In another embodiment, the device can be configured to communicate with a portable reader in order to transfer information to the portable reader. In yet another embodiment, the device can be configured to interact with a controller that controls access to the panel in which the device is installed.
In order to verify the absence of voltage, the user must be able to discern that conductors are de-energized, the test instrument used to determine that the conductors are de-energized is functional before and after use, and that the part of the circuit intended to be measured was in fact tested. Furthermore, to eliminate possible exposure of a person to electrical hazards, it is desirable to be able to make this determination without accessing the equipment. Accomplishing reliable verification before accessing electrical equipment while the door or cover is still in place greatly enhances safety in several ways. It prevents the person interacting with the equipment from inadvertently making contact with an unintended part of the circuit or shorting conductors if the equipment is in fact energized. It also increases the distance between the person and the potentially energized conductive parts as well as possibly containing any resulting effects should an arc flash occur.
The method shown in
Checking for the presence of voltage (step 0) leverages existing voltage indicator technology. If voltage above approximately 30-50V, for example, is detected, an indicator will activate, typically by illuminating one or more LEDs. This indicator serves as a warning that hazardous voltage is present. If the voltage presence indicator is not active, further investigation is required to determine and prove that voltage is absent. This is where the added functionality of using an installed testing device in order to verify the absence of voltage begins (although depending on techniques used to perform the remaining steps, it may be desirable to not initiate the process unless hazardous voltage is not present in order to protect the electronics of the installed testing device and the system that is being monitored). The first step (step 1) is to test the installed testing device by performing a series of self-diagnostics and/or internal checks to verify that it is indeed working and has not failed. This requires a secondary power source that is independent of the primary power source of the circuit being monitored. If the device is functioning, it is then important to verify that connectivity exists between the installed testing device and the circuit part that is intended to be monitored (step 2). This step is critical and is required to confirm that if no voltage is detected in step 3, it is because there is in fact no voltage on the circuit, and not due to an installation failure that would leave the lead of the installed testing device uncoupled from the voltage source, thus preventing false indications of the absence of voltage. Next, the absence of voltage must be verified through a detection method. A de-energized condition must be observed (step 3) (when verifying the absence of a signal, such as voltage, it is important to ensure that the signal is truly absent down to a de-energized level (˜0V), not just a non-hazardous voltage (<−30V). Then the connectivity must again be verified (step 4) to ensure that if a de-energized condition exists, it is because there is in fact ˜0V on the line and is not due to an installation failure or lack of connectivity between the installed testing device and the circuit being monitored. Finally, the installed testing device must repeat self-diagnostics (step 5) to ensure it is still functional. If the criteria for each step in the process are satisfied, it can then be concluded that the absence of voltage has been verified. The sequence of steps is important to the reliability of the method and end result so a processor can be used to ensure that these steps are performed automatically and in correct order.
Some of the key elements required in an installed system that utilizes this method and device include the combination of the following: an installed (not portable) testing device/instrument directly connected (e.g., hardwired) to the circuit being monitored, a reliable approach to conduct self-diagnostics, a connectivity test (to verify the integrity of the direct connection between the installed testing device and circuit being monitored, voltage detection technique that covers the complete range of possible voltages the equipment may experience, an ability to provide a positive indication of the absence of voltage (and optionally voltage presence), a secondary power source and infrastructure to power the installed testing device when the circuit being monitored is de-energized, and a way of ensuring the method is executed in proper sequence with output based on logic discerned from observed or measured conditions in each step. The significance of each of these elements or features and the value they provide to the overall method is described below.
Permanently installed device/system. The voltage test and verification method described herein has several advantages over the conventional method that utilizes a portable tester.
Connectivity verification. This is an important step and one missing from current state-of-the art. In order to rely on an absence of voltage indication from a non-portable system, it is important to confirm that the installed testing device is still directly coupled as intended with direct connection to the circuit part desired to be monitored. Additionally, it is advantageous to accomplish this verification without the need to directly access the equipment (i.e., keeping the doors and covers closed), which often results in no direct line of sight. In industrial electrical equipment, installation failure is typically a loose or severed connection due to a faulty termination, thermal expansion, or vibration. When verifying the absence of a signal, such as voltage, this can be accomplished by verifying that there is continuity throughout the system or device from the indicator to the main circuit. There are several techniques that can be used to verify that connectivity exists between the leads of the test device and the circuit conductors, thus ensuring that the device installation is intact.
Positive indication of absence. Typical indicators convey the presence of a signal by illuminating an LED or some other type of active indication (digital display, audio, etc.). These indicators have no means of directly communicating the absence of a signal, and default to simply allowing the person interacting with the indicator to assume that the signal is absent when there is lack of illumination of the same indicator. When conveying status that is directly related to safety, this can be a dangerous assumption. Therefore, the method described in this RS utilizes an active indicator to convey the absence of voltage. Providing positive indications is one way in which this method seeks to ensure that all indications result in a fail-safe condition.
Secondary power source. In order to provide an active indication of the absence of a signal (as well as to power any microprocessors and electronics that are utilized to perform the steps described in this method), a secondary power source that is separately derived and independent from the circuit being monitored is required. It is also essential that this secondary power source operate at a non-hazardous voltage. The secondary power can be provided from a variety of sources depending on the application and what type of power infrastructure is readily available. Secondary power can be provided on a temporary or continuous basis or some combination.
Device self-test/diagnostics. When verifying the absence of a signal, such as voltage, it is important to verify the device or circuit used to test for voltage or make the voltage measurement is functioning as expected both prior to and after the point in the process when the absence of voltage is confirmed. The self-diagnostics is likely a series of checks and verifications that are conducted to ensure that the critical components, circuits, or processes are operational and performing as expected. This helps guarantee that an installed testing device utilizing this complete method will result in a fail-safe indication and possibly be tolerant to certain types of faults or conditions.
Depending on the techniques used to implement the method, the self-diagnostics required and utilized for this step may vary. For instance, it may be important to know that the electronics responsible for performing the test of making the measurement are not damaged as a result of any surges or unexpected conditions on the circuit being monitored. Alternatively, this step can help ensure that the functionality of the device was not adversely impacted by any undesirable factors that could be present in the environment where the device has been installed. Therefore, confirming the functionality of the device both before and after the actual voltage test or measurement is essential in adding confidence to and ensuring the validity of the result.
Voltage detection range. Voltage presence indicators typically illuminate in the presence of voltage above a threshold that is considered non-hazardous. This value is typically approximately 30-50V. However, when validating the absence of a signal, it is not enough to indicate non-hazardous voltage, the detection circuit must be capable of determining that the circuit is de-energized which is as close to 0V as possible based on the capability of the test instrument and surrounding environment. Additionally, the voltage detection technique(s) used to determine the absence, and possibly presence, of voltage must function reliably over the entire range of voltages that the device may be exposed to in the installation, regardless of whether the voltage is considered hazardous or non-hazardous.
Automated test procedure. Incorporating a logic based control within the device ensures that all of the steps necessary to verify the absence of voltage are completed, in the proper sequence, every time, before a final status indication is given. This improves upon the portable test instrument method where personnel are on their honor to verify the functionality of the test instrument (typically a volt meter or digital multimeter) before and after measuring voltage. It also demonstrates an improvement over the voltage presence indicators by incorporating the necessary checks for device functionality and connectivity between an installed testing device and the part of the circuit to be tested. This process may be microprocessor or controller-based and could incorporate varying degrees of fault-tolerance and may also be designed so to ensure that any failures, should they occur, result in a safe state. The system must also have the capability of communicating the result of the test (for example via LED indication, digital display, output to another device or linked network element, etc.).
One example of this method using an installed testing device is shown in
In one embodiment, an installed testing device can have increased functionality by monitoring the presence and absence of voltage on both the line (supply) and load side of an electrical disconnect, in addition to the status of the disconnect.
When separate installed testing devices are installed on both the line and load side, some increased functionality is available. For example, the line side device can be used to indicate the status of voltage within a panel or to visually provide indication of a phase loss. The load side device can be used to confirm the status of the electrical disconnect. If the disconnect experiences a mechanical failure or a circuit breaker contact becomes welded, the installed testing device can provide a visual indication. However, if the upstream disconnect is powered off prior to opening the disconnect being monitored on the line and load side (which could be the case during complex or cascading lockout/tagouts, or scheduled shutdowns), the status of the disconnect cannot be confirmed without checking for continuity across the line and load contacts of each phase. This is because if the upstream power is off, the status of the load device will show a lack of voltage regardless of the position of the disconnect.
To prevent this type of error, procedures can be put in place to dictate the order of these operations during complex lockout/tagouts. Additionally, during shutdowns qualified electrical workers will often use a voltmeter to check for voltage across the line side of the disconnect, the load side of the disconnect, and finally meter across each phase (line-to-load) to check for resistance. This is a good practice; however, it can be time consuming and is only effective if each step of the process is followed and performed in sequence.
Additionally, installing two separate devices may be cost-prohibitive (both component cost and cost of installation should be considered) and there may be spatial constraints on the electrical enclosure.
To increase functionality even more, a setup as shown in
This method allows the user to determine the status of voltage and the disconnect before opening the panel regardless of whether the equipment is operational, shutdown for maintenance, or if a breakdown has occurred in the LOTO process.
In a further embodiment, this system can build upon the concept of a permanently installed testing device. Although the voltage indicator described above could be part of a system or network, it is also often embodied as a standalone device with supplemental power being provided by a battery for brief periods upon a prompt from the user. Basic operation of this device, to initiate a test for the absence of voltage when the device is in an unpowered state, is shown in
To accomplish this, several elements are needed: test algorithm that writes results to memory, wireless transmission capability must exist within the device, a portable reader/display with wireless capability must be available, and corresponding software.
This method could be useful if applied to an installed testing device. For instance, if using NFC with the device, when the user initiates interaction with the unpowered device by depressing the “test” button, the voltage test sequence is initiated. As the microprocessor steps through the algorithm and other steps in the test sequence, data and results from the test sequence are written to the NFC tag(s). The device completes the test sequence and displays the result of the test sequence via the door-mounted indicator (
Using this method to record and access additional data from a standalone device has several benefits and addresses several problems identified for standalone electronic devices without continuous power, specifically:
Similar functionality can be achieved with Bluetooth, beacons, Wi-Fi, or other wireless transmission methods. When using wireless signals that can transmit further than a few centimeters, an additional step can be added to ensure that when viewing result on the reader, the results being displayed are from a particular device, since there may be more than one in range of the reader. One or more of the following or similar methods could be incorporated into the device to verify results:
This method can allow the voltage indicator to be used in the following ways:
In an industrial environment, electrical equipment is often housed within a panel, cabinet, or other type of enclosure. Equipment ranging from power components (e.g., switches, circuit breakers, fuses, drives, contacts, etc.) to control and network products (e.g., PLCs, controllers, network switches, and power supplies, etc.) are often enclosed not only to provide protection from harsh or dynamic environments, but also to provide various levels of safety and security. Unauthorized access to an electrical, control, or network panel, whether intentional or unintentional, can lead to various hazards depending on the application especially if the electrical components are energized.
In recent years there has been an increased emphasis on electrical safety in the workplace with efforts to promote awareness of shock, arc flash, and arc blast hazards. When working on or near electrical equipment, hazards such as arc flash, arc blast, and electrical shock exist when voltage is present. OSHA enforces electrical safety via the general duty clause, relying heavily on content in voluntary consensus standards such as NFPA 70E, the Standard for Electrical Safety in the Workplace. With each revision of NFPA 70E, it is becoming less and less acceptable to perform tasks on energized equipment. In most cases, work involving electrical hazards is required to be performed in an electrically safe work condition (e.g., de-energized state). However, NFPA 70E also recognizes that some diagnostics and testing activities must be performed while the equipment is energized.
With industrial facilities becoming increasingly automated and networked, diagnostic activities have become more sophisticated. In many cases, startup configuration, troubleshooting, and testing of devices can be performed with only control/network power. It is generally accepted that lower voltages are less hazardous with regards to both electrical shock and arc flash. NFPA 70E Article 130(A)(3) specifically indicates that energized work on equipment rated less than 50V can be permitted. In industrial automation, control/network functions typically run at lower voltage levels (24 Vdc). Thus, for many applications it is beneficial to have a separate infrastructure for control/network power within the panel that is not derived from the main power so that the main power source can be locked out while control/network power is available while certain tasks are performed.
Advances in technology have made personnel badging and access readers commonplace in many enterprise settings. Many industrial facilities also have measures in place to restrict and monitor access to various departments, laboratories, or production areas. These systems often run on network power or control voltage <50V. As power and control systems become intelligent with network capabilities, the lines between IT staff, electricians, and controls engineers are becoming blurred. With power, control, and network equipment all housed in similar enclosures, it is likely that someone who is unqualified to work on a particular type of equipment could try to access a panel creating hazards for him or herself, surrounding people, the equipment, or process—particularly in high pressure situations such as unplanned outages or situations where schedule delays must be avoided.
When an enclosure is outfitted with a testing device, enclosure lock, controller, and optional credential reader (all powered independently from the main power circuit) new methods to address the safety, security, and maintenance problems that occur in industrial facilities are possible. Often, these elements do not exist or if a subset is present in an enclosure, they function independently. The new concept described herein presents an opportunity to solve some of these problems by presenting a new method to usher in the next generation of safety to security and maintenance practices.
Unauthorized access to an electrical, control, or network panel, whether intentional or unintentional, can lead to safety and security hazards that may affect people, equipment, or process. Using an access control system at the enclosure level that includes an electronic lock in conjunction with a credential reader, users can control or restrict access to authorized people at authorized times. By powering the controller, lock, and credential reader via a non-hazardous source or energy storage device separate from the primary power (such as the network (PoE), battery, ultracap, etc.), voltage is limited to a safe level (50V or less) and the devices will continue to function as long as the secondary power is available, regardless of the status of the main/primary power sources within the enclosure. To further reduce risk, it may be desirable in some cases to further restrict access to situations only when the panel has been de-energized, or if special circumstances have been met (e.g., completion of an energized work permit.
As such, another embodiment includes a method that provides a novel way to mitigate the risk of exposure to electrical hazards, prevent process disruptions, and automate maintenance logs/records. As a result, increased levels of safety for personnel and equipment, reduced incidents, and trend identification, and possible liability or insurance incentives can be realized. Individually, the components that make up this system exist, however they are not leveraged collectively nor optimized for the functions described within this application.
This method, shown in its simplest form in
Another variation is to include a form of credential authentication in the process to add additional security and prevent unauthorized personnel from accessing equipment. This is shown in 24 and 25. This method is similar to the basic process in
In this embodiment, the user requests access to the system by presenting his or her credentials (something that you have—badge; something that you know— PIN or password; or something that you are—biometrics) to a credential reader. The credential reader is used to authenticate the identity of the user. If the credential presented to the reader is verified by the controller as valid based on the most-recent status from the credential verification system, a test for the absence of voltage is then conducted. If voltage is not present, the lock is opened and the user is granted access. However, if the credentials are not validated or the presence of voltage is detected or undeterminable, access is denied and the lock remains engaged.
It is possible to expand upon this concept in a more complex embodiment with advanced features, as shown in
The process begins by a user requesting access to an electrical panel with the elements shown in
Once it has been determined that the equipment attempted to be serviced was approved for access, the next step is to verify the user's credentials. The user presents his or her credentials to the reader. This process may include scanning a badge or fob, entering a PIN or password on a keypad, or presenting a fingerprint, among other methods. The systems complete the process to authenticate the credentials by validating them via the credential verification system whether it is internal to the controller or linked via a separate system. This system may be linked to an active directory with a network connection to a server where credentials are stored. The credential may be further enhanced by including additional characteristics such as making sure the employee is authorized to access a particular type of equipment (for example, distinctions can be made by job role (maintenance versus office worker), or between people authorized to access high and low voltage equipment, different types of equipment such as control and automation equipment versus power distribution, equipment from a specific manufacturer, equipment in a particular zone or work cell, etc.) and cross-referencing a training database to ensure credentials are up-to-date. By integrating the credentials with training records, access can be contingent on ensuring that required classes or skill audits have been completed and documented within the system. This also sets the foundation to deliver specific need-based training on demand. For instance, prior to accessing a motor control center the user who requested access may be required to watch a brief safety video unique to a particular model of equipment or review a safety procedure.
Once credentials are validated, the controller can seek status from the voltage detector. If the voltage test determines that the equipment is de-energized, the lock can be disengaged granting the user access. However, if the panel is energized access can be denied or an additional set-of requirements can be incorporated into the controller logic to determine if access can be granted. For instance, energized work may be dependent on having additional documentation (approved energized work permit, completed job briefing, etc.) in the workorder or other linked system. Additionally, for some tasks, procedures may require more than one person to be present. The access system could be configured to require credentials from more than one user to be presented and authenticated prior to performing energized work or performing any work in a restricted area.
If all conditions have been determined satisfactory for the lock to disengage, access is granted to the enclosure. Depending on the style of lock used, the lock could engage automatically after a pre-determined period of time, or it may be dependent on the position of the door. If a door position sensor is used, the controller could incorporate additional logic to determine when to send an alert or notification if the door has been open too long, if it is unexpectedly open, if it remains open when the panel is re-energized, etc. This further enhances safety and security of the overall system.
In addition to the usage already explained, another reason to implement such a system is to log and record access for energized and/or de-energized work. After access is granted or approved, the request and resulting process analysis and result can be logged. These results can then be sent as an alert or alarm if a communication mechanism is available or they could be displayed on a physical interface, for instance an HMI, mobile device, etc. Notifications of both access grants and denies are important and can be used to alert other affected personnel if work is being performed. For example, if access to energized work is approved, an alert could be sent to HMIs nearby within the arc flash boundary. Similarly, before a maintenance worker attempts to access a piece of equipment, he or she may be interested in viewing the previous access attempts and when they occurred (similar to how alarms are displayed on HMIs). The user could request to review these results via the panel HMI (or other similar visual interface); if access attempts are recent or align with when a problem began, the worker may want to get more information before beginning his work and attempting to open the panel.
The processes described herein represent three embodiments ranging from basic to advanced; one skilled in the art will recognize that there are other variations in sequence that may be just as effective or desirable based on the combination of features and functionality implemented. For example, the system could be configured to only require credentials if the system is energized, in which case the voltage test would occur before the credential verification step.
The required hardware will depend on the amount of functionality desired and implemented. In the basic embodiment, the logic could be embedded in a stand-alone controller. As additional functionality is added, a networked option and/or software to provide easier management of credentials and conditions may provide a useful interface.
When this method is implemented, the following benefits listed below are provided.
Mitigation of electrical hazards. Anytime equipment is energized, electrical shock and arc flash hazards exist; however, voltages less than 50V AC or 60V DC are generally considered safe. Utilizing a safe powered access control or enclosure “lock” could prove beneficial in the following scenarios:
Prevention of process disruptions. In applications where each minute of downtime comes with a price tag of thousands of dollars, minimizing process disruptions is essential. Additionally, certain processes may be hazardous if not properly controlled, thus limiting access to control functions and settings can have major security and safety implications. The access control or enclosure “lock” is also applicable in the following scenarios:
Next-generation maintenance & record keeping. Monitoring and controlling access at the panel or compartment level in industrial environments has the potential to revolutionize maintenance and record keeping, especially when combined with voltage testing. As companies are facing stricter documentation requirements in regulations and codes, there is a need for products and tools that simplify compliance. The following scenarios describe how an access control or enclosure “lock” can help improve basic maintenance tasks.
Additionally, the ability to lock out the primary power source and still access control functions could have the following benefits:
Adding intelligence, via the network capability, to voltage detection and indication systems enables additional information such as status of components related to safety to be available in real time. By adding network capability (or output contacts) to the voltage detector additional display and information activities are now possible. For instance, if switching is performed remotely, the output from the voltage detector could also be displayed via an HMI in remote locations. Additionally, if using a continuous power source (such as PoE), rather than an intermittent source, a positive indication for both the absence and presence of voltage will be displayed as long as power is available. Network capability also allows to supplement the physical interface with a more intricate display, for example indicating when voltage was last detected or more information on any other status changes.
Another embodiment could include an override code or key to allow access to the energized panel in special situations that may be required for certain applications or by qualified personnel if allowed by safety policy.
While particular embodiments and applications of the present invention have been illustrated and described, it is to be understood that the invention is not limited to the precise construction and compositions disclosed herein and that various modifications, changes, and variations may be apparent from the foregoing without departing from the spirit and scope of the invention as described.
This application is a continuation of U.S. patent application Ser. No. 17/020,186, filed Sep. 14, 2020, which is a continuation of U.S. patent application Ser. No. 15/508,401, filed Mar. 2, 2017, which claims the benefit of PCT/US2005/048348, filed Sep. 3, 2015, and U.S. Provisional Application No. 62/046,419, filed Sep. 5, 2014, the subject matter of which is hereby incorporated by reference in its entirety.
| Number | Date | Country | |
|---|---|---|---|
| 62046419 | Sep 2014 | US |
| Number | Date | Country | |
|---|---|---|---|
| Parent | 17020186 | Sep 2020 | US |
| Child | 18371628 | US | |
| Parent | 15508401 | Mar 2017 | US |
| Child | 17020186 | US |
