EP2073608B1 - Secure lighting management system - Google Patents

Description

The present invention relates to automatic lighting management systems.

An automatic lighting management system is used to illuminate a room at appropriate times, that is to say when it is occupied by a person, an extinction occurring if the person leaves the premises or if the natural lighting becomes sufficient. It can be a living room or hallway, especially in a building or school.

The system includes a person presence sensor, for example providing an infrared captured image for thermally detecting the presence of a person, and then controlling the desired illumination.

However, such a system, based on electronic circuits and relays, can obviously be subject to failures due to failures of its components, and it may therefore no longer be able to perform its function, that is to say the safety of people by providing the desired lighting. The publication WO 02/17691 disvulgue a similar system.

The present invention aims to better ensure this personal safety function, even in the event of failure of one of the components of the system.

For this purpose, the invention relates to an automatic lighting management system comprising a group of circuits constituted by a central unit and at least one event sensor for activating it so that it controls a change of state of a power switch of a lighting source of a volume, in which there are provided failure detector means arranged to detect at least one type of failure of at least one component of said group and arranged to generate a safety control, passage, or hold, in an ignition state of the lighting source, characterized in that the failure detector means comprise an arranged voltage comparator for comparing a supply voltage of the at least one event sensor with a reference voltage and for detecting a said failure if the comparison result provides a comparison deviation exceeding a predetermined limit value. An abnormal drop, or even disappearance, of the sensor supply is thus detected. Thus, for example, the failure of an infrared sensor to detect the presence of people in order to control the ignition, however, will immediately cause such ignition, and this regardless of the presence of a person, that one can no longer detect. In other words, the system works in inverse of a conventional system, that is to say that the detector must provide, explicitly, information of absence of any person (for example "infrared" image "empty") for a command to open the switch is allowed. Of course, such operation may be limited to certain time slots, for example at night.

In addition, the likelihood of a system failure manifesting itself unfavorably is reduced, as some failures force the system into a desired predetermined security state. The switch can be any type of switch, for example an electromechanical relay or a static semiconductor switch such as transistor or thyristor.

Note that the above system may also relate, more generally, comfort, that is to say that the system could control, in place of the light source, any other element or electrical appliance or electronics such as radiators, music restitution devices and others.

Preferably, the central unit controls the transition from an extinction state to said ignition state by suppressing a muting voltage of the switch which held it in an open state.

The muting voltage of the switch is therefore an excitation control which keeps it open, and any disappearance of this voltage, by failure of the power supply of the circuits or cutting of a wire, will allow the "fallout" of the switch in the closed state, that is to say conductive. The energy allowing the "fallout" of the switch is for example provided by gravity, or by a spring or by a magnetic or electromagnetic force.

The central unit may comprise sequencing means arranged to cyclically control an ignition of a test light source intended to be detected by a an ambient light level sensor connected at the output to the central unit whose comparator circuits are arranged to compare the ambient light level with a threshold in memory and allow to command the closing of the switch if the threshold is crossed at the descent .

It can for example be a "twilight" sensor, which controls the ignition at night, or which only allows it if a person is detected by the presence sensor, that is to say during the day, the action of the latter presence sensor is inhibited, the ignition being prohibited during the day.

In particular, said light source can also serve as said test light source, and the central unit is then arranged to cyclically control the closing of said switch to detect the ignition of the light source by means of said at least one event sensor.

It is thus possible to monitor the proper functioning of the switch and also of the light source and for example to detect that a bulb or a neon tube is faulty if the light response provided by the ambient light level sensor is less than one. minimum threshold level in memory.

The failure detection means may also comprise a comparator arranged to detect the state of the switch and compare it to said safety command, and to, in case of discrepancy, to control the closing of an emergency switch to supply the power supply. lighting source.

This is for example to measure the voltage at both terminals of the switch. If it is commanded to remain closed, any non-zero voltage at its terminals, to a margin of uncertainty of measurement, means that it has not (perfectly) closed, that is to say that its control circuit (coil or equivalent) is defective or that its contact itself, or equivalent, has a defect, for example charbonne if it is a relay. Conversely, a relay contact bonding will be detected if the corresponding voltage is permanently zero while the relay is controlled to remain open.

The failure detector means advantageously comprise signaling circuits of a said failure.

It can be any means of human-machine relations, for example a voice announcement circuit on a control panel or a simple light emitting diode, LED.

Said signaling circuits preferably comprise data transmission interface circuits arranged to transmit a failure alarm to management means, circuits for example arranged to transmit on a data transmission network to a management center.

In particular, it is possible to think of circuits of a telephone of the public network PSTN or wireless, cellular or satellite, for calling on a telephone network, or for circuits of specialized network interface of data transmission as per example the Internet network.

The management center can, in turn, warn the user that the system is locked in the ignition state, and it can also automatically send a troubleshooter.

The invention will be better understood with the aid of the following description of an embodiment of a system according to the invention, with reference to the single appended figure which is a functional block diagram of said system.

The figure represents a central unit 10 for managing an automatic lighting management system intended to control the lighting of one or more light sources of a volume to be secured by lighting, such as a living room, office, parking or corridor, sources represented here schematically by a single bulb 1 electric powered here from the general network or 220 volts electrical distribution area.

The system is intended to control the ignition of the bulb 1 when it detects the presence of a person in the secure volume assigned to it. The central unit 10 comprises a time base 11 punctuating the operations of a calculation block 12 controlled by a memory 13 of programs for managing the basic function, automatic lighting management, and a security function intrinsic to the basic function. A sequencer 14 controls the cyclical launch of the desired programs.

In this example, the detection of at least one person is carried out by means of a camera forming an infrared sensor 9 supplying image signals to an image analysis circuit 19 belonging to the central unit 10 The image analysis circuit 19 cyclically compares a received current image with a reference image, stored locally, of the volume considered in the "empty" state of persons, to search for any area of the current image that would have a current image. aspect different from that of the same area in the reference image. The reference image can therefore, without inconvenience, include zones of hot spots, for example radiators, since it is the abrupt drift relative to the reference image which is detected.

In the event of a discrepancy, greater than a noise protection threshold, between the current image and the reference image, the image analysis circuits 19 supply this information to the calculation block 12 which then controls control 17A, output interface, controlling the transition to the closed state, that is to say driver, a contact 3, a relay switch 2, supplying the bulb 1 from the 220-volt network.

To ensure an intrinsic safety with regard to the supply of lighting, the contact 3 is of the "rest" type, or else "normally closed", so that, in the absence of the need for lighting, the unit 10 controls the permanent excitation of a coil 4 of the relay 2. In the event of detection of presence of person, the central unit 10 will therefore control the control interface circuits 17A, to interrupt the excitation of the coil 4, through a "low" end thereof, so that a blade of the contact 3 goes to the closed state, conductive.

Thus, and moreover, any total failure of the central unit 10 which would be due to the disappearance, or the excessive fall, of a supply voltage thereof, coming from a power supply unit 6, will switch to the ignition state of the bulb 1.

In addition, it is also expected to detect otherwise a partial failure of the power supply unit 6, that is to say a drop in the voltage supplied, here 12 volts, without there necessarily being total disappearance of that -this. Indeed, such a voltage drop can cause it to fall below the allowable range for the various circuits of the central unit 10, which could then continue to have an activity, but incorrect by a seizure or an incorrect interpretation of external events detected or by an incorrect reaction, such as the lack of ignition control when it is needed.

For this purpose, the supply voltage from the power supply unit 6 is applied to a first input of a comparator 16, a second input of which is connected to the output of a low power supply memory 16S. The supply voltage here being 12 volts DC for the various circuits, which are type C MOS and therefore with a wide range of supply voltage, the low threshold is here set at 8 volts. The voltage comparator 16 may be an operational amplifier circuit, that is to say an analog comparator, or a digital circuit comprising an analog / digital converter (ADC) on the first input. Overall, the functions of the comparator 16 and others indicated below can be provided by a signal processing integrated circuit, usually called DSP, associated in input to a two-way output multiplexer, each read the pair of wanted signals, in buffer registers.

At the same time, the power supply 6 also powers +12 volts at the "high" end of the coil 4. In practice, any drift with a descent below about 7 volts will cause the coil 4 to be insufficiently powered, so that the magnetic field can no longer oppose an elastic restoring force of the contact blade 3 to the closed position. The coil 4 thus constitutes a voltage comparator, however less accurate than the comparator 16, because its threshold depends on the magnetic properties of the coil 4, which properties vary from one relay to the other in the same batch of relays.

In case of descent below the low threshold of 8 volts, the output of the comparator 16 provides a signal corresponding to the calculation block 12, which controls the closure of the contact 3.

In this example, it is further ensured a similar monitoring for a power supply block of the infrared sensor 9. For this purpose, according to a diagram of identical to that of the elements 6, 16, 16S, the output of the power supply unit 5 is applied to a first input of a comparator 15 of which a second input receives a low threshold signal stored locally in a low threshold memory 15S . The output of the comparator 15 controls the calculation block 12, just like that of the comparator 16, to control the ignition of the bulb 1 in the event of an excessive drop in the power supply of the infrared sensor 9.

It is assumed here that the monitored volume is not a naturally dark room such as corridor or basement, so that to avoid unnecessarily controlling the lighting of the bulb 1 in daylight, there is provided a panel 8 photo-voltaic cell detecting the level of ambient light. An output signal from the ambient detector panel 8 is applied to a first input of a comparator 18, a second input of which receives from an ambient light level memory 18S an ambient light threshold signal so that, if the detected level is greater than the threshold, the comparator 18 transmits to the calculation block 12 an inhibition signal, prohibiting lighting the bulb 1, and even prohibiting to keep it on. The program in memory 13 is thus arranged so that, on receiving such a signal, the calculation block 12 emits or confirms an extinction command.

It is furthermore intended here to monitor the good functioning of the relay 2, that is to say the fact that its coil 4 is not cut, or that its control end, connected to the output of the control circuit 17A , is not in short circuit with the mass, which would correspond to a permanent excitation, therefore a contact 3 impossible to close. The proper functioning of the contact 3 is also monitored by means of a comparator 17 whose first input is connected to the mains supply, therefore to a "high" terminal of the contact 3, and a second input of which is connected to a "low" terminal of the contact 3, itself connected to a "hot" terminal of the bulb 1, opposite a "cold" terminal connected to a ground wire. The comparator 17 thus provides the calculation block 12 with a voltage representing the voltage difference between its two inputs.

Preferably, the comparator 17 is powered by a separate power supply unit (not drawn), galvanically isolated from the rest of the circuits, since it is connected to the AC mains 220 volts, that is to say to voltage incompatible with these circuits because it is excessive and moreover negative half of the time. The output of the comparator 17 then controls the input diode of an opto-coupler, not drawn, of which an output transistor provides the connection to the calculation block 12. In a variant, it is possible to provide only a protection for the two inputs, by two respective dividing bridges, voltage step-downs, each having a diode blocking the negative half-wave of the 220 V sector.

Note that, alternatively, the comparator 17, which serves as a voltmeter, could be connected to the two terminals of the bulb 1. It can also be thought to replace it with an opto-coupler input diode connected in parallel with one another. the bulb 1 and protected by current by a series resistor and, in reverse voltage, by a series or parallel diode. However in this type of connection, a beginning of deterioration of the contact 3, causing a voltage drop of only a few volts, would be more difficult to detect, because of the lack of direct measurement of the mains voltage 220 V. The contact 3 may however be of the type with twin blades, that is to say two blades in parallel.

Thus, in the present diagram and its variants, the calculation block 12 can compare the actual state of the contact 3 with respect to the desired state, as defined by the last command sent to the control circuits 17A and stored in the calculation block 12. In the event of a discrepancy between the actual state and the desired state of the contact 3, and precisely if the contact 3 is detected to be open when it should be closed, the calculation block 12 controls a other relay switch 2B contact 3B and coil 4B, controlled by control circuits 17B. The relay 2B and the control circuits 17B, backup, are respectively identical to the relay 2 and the control circuits 17A and their connection is also identical. A repetition of the corresponding description is therefore unnecessary. The contact 3B, in parallel with the contact 3, thus ensures the passage of the current to the bulb 1.

Conversely, to secure the opening of the switch 1, it can be expected to use two contacts 3 relay 2 connected in series. Note however that this is not the essential purpose of the invention, which is to control the ignition in case of default. The secure opening above simply avoids troubleshooting.

As explained at the very beginning, the relay 2 can be replaced by a semiconductor switch, such as a transistor or a thyristor, with the necessary protections against the negative alternation of the mains voltage 220 V.

Furthermore, to verify the overall operation of the system, the sequencer 14 periodically launches, via the calculation block 12, stimuli by ignition control of an external light source, here a light-emitting diode or LED 7, by a link not shown. The ignition is delayed, that is to say, the sequencer 14 controls the extinction of the LED 7 a short time after ignition, for example 1 second.

The lighting of the LED 7 is detected by the infrared sensor 9, and the image analysis circuits 19 can thus detect in return the change of the infrared image and provide a corresponding indication of change of state to the block of On the other hand, if the calculation block 12 does not receive such an indication in a predetermined period of time by a watchdog, the infrared sensor 9 is considered to be out of order, that is to say intrinsically failing. or failed 5 supply. The calculation block 12 then controls the transition to the default security state, that is to say of lighting the bulb 1.

Note that, as the stimuli are emitted at known times of the calculation block 12, it is sufficient that the latter receives a said indication of change of state of the image in all or nothing form, that is to say a single bit, since a person's arrival detection at exactly the same time is unlikely. And even in such a case, the person will be detected in the next cycle, which can be very close, scanning the infrared sensor 9. Alternatively, it may be the panel 8 which serves for the detection of such stimuli. In particular, the stimulus LED 7 can be replaced by the bulb 1, that is to say that the panel 8 will detect a sudden rise in the overall level of illumination. It can also be expected that it is the infrared sensor 9 which detects, on an area of its image, the on or off state of the bulb 1.

In all the cases of detecting a failure of a component of the system, the calculation block 12 controls the emission of an alarm signal, for example here the ignition, preferably flashing, of an LED 21 on a console, or management. A voice synthesis circuit command warning of the failure may also be provided. The LED 21 is also used to signal the detection of a person. The LED 21 can be bicolor with for example green ignition in the latter case and priority ignition in red in case of failure detection of a component.

It is furthermore intended here to transmit an alarm remotely, via interface circuits 30 connected to a data transmission network, here the network of the Internet 100. An alarm message is thus transmitted to a network. management center 50 connected to the network 100, to request the dispatch of a repairman and / or notify a local manager, if it is not provided the LED 21 or an output circuit of equivalent man-machine relations.

Claims (8)

1. An automatic lighting management system including a group of circuits made up of a central unit (10) and at least one event sensor (9) to activate it so that it commands a status change of a power switch (2) for a lighting source (1) lighting a space, in which failure detector means (15, 15S, 16, 16S, 17, 18, 18S) are arranged to detect at least one type of failure of at least one component of said group and arranged to create a security, passage, or keep command, in a lighted state of the lighting source (1), characterized in that the defect detector means include a voltage comparator (15, 15S) arranged to compare a supply voltage (5) of the at least one event sensor (9) to a reference voltage (15S) and to detect one said defect if the comparison result provides a comparison deviation exceeding a predetermined threshold value.
2. The lighting system according to claim 1, wherein the central unit (10) commands the passage from an unlighted state to said lighted state by eliminating an inhibit voltage of the switch (2) that kept it in the open position.
3. The system according to one of claims 1 and 2, wherein the central unit (10) includes sequencer means (12, 14) arranged to cyclically command lighting of a test light source (1, 7) provided to be detected by an ambient light level sensor (8) connected at its output to the central unit (10) whereof the comparator circuits (18, 18S) are arranged to compare the level of ambient light to a stored threshold (18S) and to authorize the command to close the switch (2) if the threshold is crossed upon descent.
4. The system according to claim 3, wherein, said lighting source (1) also serving as said test light source, the central unit (10) is arranged to cyclically command the closing of said switch (2) to detect the lighting of the lighting source (1) using said at least one event sensor (9).
5. The system according to one of claims 1 to 4, wherein the defect detector means include a comparator (17) arranged to detect the status of the switch (2) and compare it to said security command, and, in the event of discordance, to command the closing of an emergency switch (2A) to power the light source (1).
6. The system according to one of claims 1 to 5, wherein the defect detector means comprise circuits (21, 30) for signaling one said defect.
7. The system according to claim 6, wherein said signaling circuits comprise data transmission interface circuits (30) arranged to send a defect alarm to management means (50).
8. The system according to claim 7, wherein the interface circuits (30) arranged to transmit over a data transmission network (100) toward a management center (50).

Images