WO2016207020A1

WO2016207020A1 - Emergency lighting system driver with safeguarded tandem-input state stability filtering, validation, and correction

Info

Publication number: WO2016207020A1
Application number: PCT/EP2016/063563
Authority: WO
Inventors: Stefan-Cristian Rezeanu
Original assignee: Philips Lighting Holding B.V.
Priority date: 2015-06-23
Filing date: 2016-06-14
Publication date: 2016-12-29

Abstract

An apparatus and method of ensuring that an emergency lighting driver is in proper operation is disclosed. In one embodiment, the apparatus includes an emergency lighting driver configured to charge an energy source by an AC mains power in a charge mode, and to supply power from the energy source to a lighting load in an emergency mode, an AC input failure monitor configured to provide an AC failure activated signal indicating whether the AC main power is supplied to the AC input, a test switch monitor configured to provide a test switch activated signal indicating whether a test switch has been activated, and a detector configured to validate transitions in the AC failure activated signal and the test switch activated signal, and in response output a mode control signal to place the emergency lighting driver in either the charge mode or the emergency mode.

Description

EMERGENCY LIGHTI NG SYSTEM DRIVER WITH SAFEGUARDED TAN DEM-IN PUT STATE STABILITY FILTERING, VALI DATION, AN D CORRECTION

Technical Field

[0001] The present invention is directed generally to an emergency lighting driver. More particularly, various inventive methods and apparatus disclosed herein relate to an emergency lighting system with a manual test input for testing and verifying proper operation of the emergency lighting driver, and a method of ensuring that the emergency lighting driver is placed into, and remains in, proper operation.

Background

[0002] Emergency lighting has been employed for several decades, for example to provide power to one or more light sources for illumination of the path of egress from a building or facility. Emergency lighting is required in industrial, commercial, and institutional buildings as part of the safety equipment.

[0003] An emergency lighting system includes an emergency lighting driver (often referred to as an "emergency ballast") designed to supply power to the light source(s) exclusively during periods of AC power failure, when the emergency lighting driver is said to be in "emergency mode" (EM). The emergency lighting driver senses the absence of the AC Mains power and uses a battery and dedicated electronic circuitry to energize the light source(s) for a predetermined period of time during AC power failure in the EM mode (also sometimes referred to as "discharge mode" indicating what happens to the battery in this mode). Here, and throughout the detailed description below we use the term "battery" generally for the energy source of the emergency lighting driver, but it should be understood that this could encompass another equivalent independent energy source. In the USA, the required emergency lighting period is at least 90 minutes, while in Europe, e.g., it is 180 minutes, during which the emergency illumination level should not decline to under 60% of the initial level, as set for battery-powered emergency lighting systems by the life safety codes (e.g., section 7.9.2 of NFPA-101 and NEC 700.12). [0004] Typically, an emergency lighting driver may be combined with a conventional lighting driver (often referred to as an "AC ballast") which supplies power to the light source(s) so long as AC Mains power is available. During the time periods when AC Mains power is available, the emergency lighting driver uses the AC Mains power to maintain a charge on the battery, and is said to be in "charge mode" (CM).

[0005] Per code, it is mandatory to test the emergency lighting driver from time to time to verify its proper operation and ability to supply emergency lighting for specific time durations. Toward that end, a manual test switch is provided to allow a user to disconnect the AC Mains power from the emergency lighting driver to verify proper operation of the emergency lighting driver.

[0006] However there are some disadvantages and possible problems with this

arrangement. For example, when the manual testing of the emergency lighting driver includes the use of a high-voltage switch for the input AC lines, this requires providing high-voltage switch (AC) lines in a conduit, which can complicate and add expense to the installation. Hence, a low voltage switch might be a better alternative.

[0007] Furthermore, it is possible that glitches may occur with respect to the manual test switch and/or the AC Mains power which could possibly place the emergency lighting driver into an improper state unless proper precautions are taken. In order to be able to provide the necessary light output during the emergency mode, the internal electronic circuit of the emergency lighting driver - which can be viewed as a state machine - should be in the correct state no matter whether its input(s) is/are transiently switching (i.e."glitching") or not.

Furthermore, if the emergency lighting driver enters an invalid state, this should be detected and remedial steps taken to place the emergency lighting driver back into the correct state. This is of utmost importance for a device categorized as "life safety" such as an emergency lighting driver.

[0008] Thus, there is a need in the art to provide an emergency lighting driver with glitch rejection for its input(s). There is also a need in the art to provide an emergency lighting driver wherein the internal state of the circuitry is monitored and corrected if necessary, even if glitches on one or more of its inputs temporarily cause the emergency lighting driver to adopt an invalid internal state. There is further a need in the art to provide an emergency lighting driver whose proper operation can be tested and verified without the need to install a test switch on the AC Mains high voltage lines, or to provide test switch lines in a conduit.

Summary

[0009] The present disclosure is directed to inventive methods and apparatus for an emergency lighting system. For example, the present disclosure describes embodiments of an emergency lighting driver which can detect and verify transitions on its input(s) and reject glitches. The present disclosure describes embodiments of an emergency lighting driver which monitors its internal state, and if an invalid internal state is detected the emergency lighting driver corrects the invalid internal state to a valid state. The present disclosure also describes embodiments of an emergency lighting driver whose proper operation can be tested and verified without the need to install a test switch on the AC Mains high voltage lines, or to provide test switch lines in a conduit.

[0010] Generally, in one aspect, an apparatus comprises: an AC input configured to receive AC mains power; an emergency lighting driver configured to charge an independent energy source by the AC mains power in a charge mode, and to supply power from the independent energy source to a lighting load in an emergency mode; an AC input failure monitor configured to provide an AC failure activation signal indicating whether the AC mains power is supplied to the AC input; a test switch monitor configured to monitor a test switch and to provide a test switch activation signal indicating whether the test switch has been activated; and a detector configured to detect and validate transitions in the AC failure activation signal and the test switch activation signal, and in response thereto to output a mode control signal to selectively place the emergency lighting driver in one of the charge mode and the emergency mode.

[0011] In some embodiments, the detector is configured to validate transitions in the AC failure activation signal by rejecting glitches in the AC failure activation signal, and to validate transitions in the test switch activation signal by rejecting glitches in the test switch activation signal, and to produce a stable condition signal indicating whether the AC failure activation signal and the test switch activation signal are in a stable condition.

[0012] In some variations of these embodiments, the detector includes a stable/unstable condition detector which, in response to detecting a transition in at least one of the AC failure activation signal and the test switch activation signal, evaluates a plurality of sequenced- samples of each of the AC failure activation signal and the test switch activation signal within at least one elementary window, and based on the samples determines when the AC failure activation signal and the test switch activation signal are both stable following the detected transition.

[0013] In some variations of these embodiments, the stable/unstable condition detector is configured to determine that the AC failure activation signal and the test switch activation signal are both stable when both: (1) all of the samples of the AC failure activation signal have a same logic level as each other within one elementary window; and (2) all of the samples of the test switch activation signal have a same logic level as each other within the one elementary window; and otherwise to determine that the AC failure activation signal and the test switch activation signal are not both stable.

[0014] In some variations of these embodiments, the stable/unstable condition detector is configured to determine that the AC failure activation signal and the test switch activation signal are both stable when both: (1) a number of the samples of the AC failure activation signal greater than a first threshold number have a same logic level as each other within one elementary window; and (2) a number of the samples of the test switch activation signal greater than a second threshold number have a same logic level as each other within the one elementary window; and otherwise to determine that the AC failure activation signal and the test switch activation signal are not both stable.

[0015] In some variations of these embodiments, the detector further includes a mask- window filter configured to generate a mask-window control signal to cause the detector to disregard further transitions in the AC failure activation signal and the test switch activation signal for a set period of time after the AC failure activation signal and the test switch activation signal both become stable following the detected transition. [0016] In some variations of these embodiments, the apparatus further comprises logic configured to force, in the set period of time, a transition in one of the AC failure activation signal and the test switch activation signal for which the transition was not detected.

[0017] In some variations of these embodiments, the apparatus further comprises: at least one latch for latching an AC failure activation transition detection signal and a test switch activation transition detection signal; a safeguard state validator enabled by the mask-window control signal and configured to receive the AC failure activation transition detection signal and the test switch activation transition detection signal and in response thereto to periodically check whether the apparatus is in an invalid internal state and to output a valid/invalid signal indicating whether the apparatus is in an invalid internal state; and an internal state corrector configured to receive the valid/invalid signal and further configured to receive a flag indicating whether the emergency lighting driver is internally assumed to be in the emergency mode, and in response thereto to force the internal state of the apparatus to a valid state.

[0018] In some embodiments, the emergency lighting driver includes the independent energy source, and the test switch and the test switch monitor are powered by the

independent energy source.

[0019] In some embodiments, the test switch monitor comprises a visible derangement device which is configured to be illuminated when the test switch is not activated and the emergency lighting driver is in the charge mode, and which is not illuminated when the emergency lighting driver is in the emergency mode.

[0020] In some embodiments, the emergency mode includes an AC failure activated emergency mode generated in response to activation of the AC failure activation signal, and a test switch activated emergency mode generated in response to activation of the test switch, and the apparatus is configured to not respond to transitions in the test switch activation signal while the emergency lighting driver is in the AC failure activated emergency mode.

[0021] In another aspect, a method comprises: determining whether AC mains power is supplied to an AC input of the emergency lighting driver, and in response thereto providing an AC failure activated signal indicating whether the AC mains power is supplied to the AC input; monitoring a test switch, and in response thereto providing a test switch activated signal indicating whether the test switch has been activated; detecting and validating transitions in the AC failure activated signal and the test switch activated signal, and in response to a detected and validated transition selectively placing the emergency lighting driver in one of a charge mode and an emergency mode; when the emergency lighting driver is in the charge mode, charging an independent energy source by the AC mains power; and when the emergency lighting driver is in the emergency mode, supplying power from the independent energy source to a lighting load.

[0022] In some embodiments, the validating transitions in the AC failure activated signal includes rejecting glitches in the AC failure activated signal, and validating transitions in the test switch activated signal includes rejecting glitches in the test switch activated signal, the method further comprising producing a stable condition signal indicating whether the AC failure activated signal and the test switch activated signal are in a stable condition.

[0023] In some variations of these embodiments, the method further comprises, in response to detecting a transition in at least one of the AC failure activated signal and the test switch activated signal: evaluating a plurality of sequenced-samples of each of the AC failure activated signal and the test switch activated signal within at least one elementary window; and based on the samples determining when the AC failure activated signal and the test switch activated signal are both stable following the detected transition.

[0024] In some variations of these embodiments, the method further comprises:

determining that the AC failure activated signal and the test switch activated signal are both stable when both: (1) all of the samples of the AC failure activated signal have a same logic level as each other within one elementary window; and (2) all of the samples of the test switch activated signal have a same logic level as each other within the one elementary window; and otherwise determining that the AC failure activated signal and the test switch activated signal are not both stable.

[0025] In some variations of these embodiments, the method further comprises:

determining that the AC failure activated signal and the test switch activated signal are both stable when both: (1) a number of the samples of the AC failure activated signal greater than a first threshold number have a same logic level as each other within one elementary window; and (2) a number of the samples of the test switch activated signal greater than a second threshold number have a same logic level as each other within the one elementary window; and otherwise determining that the AC failure activated signal and the test switch activated signal are not both stable.

[0026] In some variations of these embodiments, the method further comprises

disregarding further transitions in the AC failure activated signal and the test switch activated signal for a set period of time after the AC failure activated signal and the test switch activated signal both become stable following the detected transition.

[0027] In some variations of these embodiments, the method further comprises forcing, in the set period of time, a transition in one of the AC failure activated signal and the test switch activated signal for which the transition was not detected.

[0028] In some variations of these embodiments, the method further comprises: latching an AC failure activated transition detection signal and a test switch activated transition detection signal; in response to the mask-window control signal, the AC failure activated transition detection signal, and the test switch activated transition detection signal, periodically checking whether the apparatus is in an invalid internal state; and in response to determining that the apparatus is in an invalid internal state, forcing the internal state of the apparatus to a valid state, the valid state being determined in response to whether the emergency lighting driver is internally assumed to be in the emergency mode.

[0029] In some embodiments, the method further includes powering the test switch and the test switch monitor by the independent energy source.

[0030] In some embodiments, the method further comprises: illuminating a visible derangement device when the test switch is not activated and the emergency lighting driver is in the charge mode; and turning off the visible derangement device to be not illuminated when the emergency lighting driver is in the emergency mode. [0031] In some embodiments, the emergency mode includes an AC failure activated emergency mode generated in response to activation of the AC failure activated signal, and a test switch activated emergency mode generated in response to activation of the test switch, the method further including ignoring transitions in the test switch activated signal while the emergency lighting driver is in the AC failure activated emergency mode.

[0032] As used herein for purposes of the present disclosure, the term "LED" should be understood to include any electroluminescent diode or other type of carrier injection/junction- based system that is capable of generating radiation in response to an electric signal. Thus, the term LED includes, but is not limited to, various semiconductor-based structures that emit light in response to current, light emitting polymers, organic light emitting diodes (OLEDs), electroluminescent strips, and the like. In particular, the term LED refers to light emitting diodes of all types (including semiconductor and organic light emitting diodes) that may be configured to generate radiation in one or more of the infrared spectrum, ultraviolet spectrum, and various portions of the visible spectrum (generally including radiation wavelengths from approximately 400 nanometers to approximately 700 nanometers). Some examples of LEDs include, but are not limited to, various types of infrared LEDs, ultraviolet LEDs, red LEDs, blue LEDs, green LEDs, yellow LEDs, amber LEDs, orange LEDs, and white LEDs (discussed further below). It also should be appreciated that LEDs may be configured and/or controlled to generate radiation having various bandwidths (e.g., full widths at half maximum, or FWHM) for a given spectrum (e.g., narrow bandwidth, broad bandwidth), and a variety of dominant wavelengths within a given general color categorization.

[0033] For example, one implementation of an LED configured to generate essentially white light (e.g., a white LED) may include a number of dies which respectively emit different spectra of electroluminescence that, in combination, mix to form essentially white light. In another implementation, a white light LED may be associated with a phosphor material that converts electroluminescence having a first spectrum to a different second spectrum. In one example of this implementation, electroluminescence having a relatively short wavelength and narrow bandwidth spectrum "pumps" the phosphor material, which in turn radiates longer wavelength radiation having a somewhat broader spectrum. [0034] It should also be understood that the term LED does not limit the physical and/or electrical package type of an LED. For example, as discussed above, an LED may refer to a single light emitting device having multiple dies that are configured to respectively emit different spectra of radiation (e.g., that may or may not be individually controllable). Also, an LED may be associated with a phosphor that is considered as an integral part of the LED (e.g., some types of white LEDs). In general, the term LED may refer to packaged LEDs, non-packaged LEDs, surface mount LEDs, chip-on-board LEDs, T-package mount LEDs, radial package LEDs, power package LEDs, LEDs including some type of encasement and/or optical element (e.g., a diffusing lens), etc.

[0035] The term "light source" or "lighting load" should be understood to refer to any one or more of a variety of radiation sources, including, but not limited to, LED-based sources

(including one or more LEDs as defined above), incandescent sources (e.g., filament lamps, halogen lamps), fluorescent sources, phosphorescent sources, high-intensity discharge sources (e.g., sodium vapor, mercury vapor, and metal halide lamps), lasers, other types of

electroluminescent sources, pyro-luminescent sources (e.g., flames), candle-luminescent sources (e.g., gas mantles, carbon arc radiation sources), photo-luminescent sources (e.g., gaseous discharge sources), cathode luminescent sources using electronic satiation, galvano- luminescent sources, crystallo-luminescent sources, kine-luminescent sources, thermoluminescent sources, triboluminescent sources, sonoluminescent sources, radioluminescent sources, and luminescent polymers.

[0036] A given light source may be configured to generate electromagnetic radiation within the visible spectrum, outside the visible spectrum, or a combination of both. Hence, the terms "light" and "radiation" are used interchangeably herein. Additionally, a light source may include as an integral component one or more filters (e.g., color filters), lenses, or other optical components. Also, it should be understood that light sources may be configured for a variety of applications, including, but not limited to, indication, display, and/or illumination. An

"illumination source" is a light source that is particularly configured to generate radiation having a sufficient intensity to effectively illuminate an interior or exterior space. In this context, "sufficient intensity" refers to sufficient radiant power in the visible spectrum generated in the space or environment (the unit "lumens" often is employed to represent the total light output from a light source in all directions, in terms of radiant power or "luminous flux") to provide ambient illumination (i.e., light that may be perceived indirectly and that may be, for example, reflected off of one or more of a variety of intervening surfaces before being perceived in whole or in part).

[0037] The term "lighting unit" is used herein to refer to an apparatus including one or more light sources of same or different types. A given lighting unit may have any one of a variety of mounting arrangements for the light source(s), enclosure/housing arrangements and shapes, and/or electrical and mechanical connection configurations. Additionally, a given lighting unit optionally may be associated with (e.g., include, be coupled to and/or packaged together with) various other components (e.g., control circuitry) relating to the operation of the light source(s). An "LED-based lighting unit" refers to a lighting unit that includes one or more LED- based light sources as discussed above, alone or in combination with other non LED-based light sources. A "multi-channel" lighting unit refers to an LED-based or non LED-based lighting unit that includes at least two light sources configured to respectively generate different spectrums of radiation, wherein each different source spectrum may be referred to as a "channel" of the multi-channel lighting unit.

[0038] It should be appreciated that all combinations of the foregoing concepts and additional concepts discussed in greater detail below (provided such concepts are not mutually inconsistent) are contemplated as being part of the inventive subject matter disclosed herein. In particular, all combinations of claimed subject matter appearing at the end of this disclosure are contemplated as being part of the inventive subject matter disclosed herein. It should also be appreciated that terminology explicitly employed herein that also may appear in any disclosure incorporated by reference should be accorded a meaning most consistent with the particular concepts disclosed herein. Brief Description of the Drawings

[0039] In the drawings, like reference characters generally refer to the same parts throughout the different views. Also, the drawings are not necessarily to scale, emphasis instead generally being placed upon illustrating the principles of the invention.

[0040] FIG. 1 shows a functional block diagram of a portion of one embodiment of an emergency lighting unit.

[0041] FIG. 2 shows an example embodiment of a portion of an emergency lighting driver with a test switch, a derangement signal, and failure prevention mechanisms.

[0042] FIG. 3A shows a functional block diagram of an example embodiment of a two wire illuminated test switch and test switch associated interface signals/blocks.

[0043] FIG. 3B shows a functional block diagram of an example embodiment of an input converter and AC input failure associated interface signals/blocks.

[0044] FIG. 4 shows a functional block diagram of an example embodiment of a sequenced- window and mask-window filter.

[0045] FIG. 5 shows a functional block diagram of an example embodiment of a

stable/unstable condition detector.

[0046] FIG. 6 illustrates a portion of a sequenced-window filtering operation which may be employed for glitch rejection.

[0047] FIG. 7 illustrates an example sequence of states and waveforms for an emergency lighting driver with failure prevention mechanisms, including a sequenced-window filter, a mask-window filter, and safeguard state validation.

[0048] FIG. 8 shows a functional block diagram of a portion of an example embodiment of a state machine action controller.

[0049] FIG. 9 illustrates an example embodiment of a method of operating and preventing failures in an emergency lighting driver for an emergency lighting system. Detailed Description

[0050] In general, an emergency lighting system includes an emergency lighting driver which is in a charge mode for charging an internal battery so long as AC Mains power is available, and which transitions into an emergency mode when the AC Mains power is lost, or when the emergency lighting system is being tested. As "life safety" equipment it is critical that the emergency lighting driver be placed into and maintained in the correct state at all times.

However glitches on one or more of its input lines could possibly trigger a transition of the emergency lighting driver into an incorrect or invalid state if precautions are not taken to prevent this from happening.

[0051] More generally, Applicants have recognized and appreciated that it would be beneficial, and that there is a need in the art, to provide an emergency lighting driver wherein the internal state of the emergency lighting driver is monitored and corrected if necessary, even if glitches on one or more of its inputs temporarily cause the emergency lighting driver to adopt an invalid internal state. There is further a need in the art to provide an emergency lighting driver whose proper operation can be tested and verified without the need to install a test switch on the AC Mains high voltage lines, or to provide test switch lines in a conduit.

[0052] In view of the foregoing, various embodiments and implementations of the present invention are directed to methods and apparatus for an emergency lighting driver which can detect and verify transitions on its input(s) and reject glitches. Also, various embodiments and implementations of the present invention are directed to methods and apparatus for an emergency lighting driver which monitors its internal state, and if an invalid internal state is detected corrects it to a valid state. Furthermore, various embodiments and implementations of the present invention are directed to methods and apparatus for an emergency lighting driver which allow the proper operation of the emergency lighting driver to be tested and verified without the need to install a test switch on the AC Mains high voltage lines, or to provide test switch lines in a conduit. [0053] FIG. 1 shows a functional block diagram of a portion of one embodiment of an emergency lighting system 100. Emergency lighting system 100 includes an AC input 110, a rectifier 120, a battery charger converter 130, a switch 135, a battery 140, an output converter 150, an AC ballast 160, and an output switch and controller 170. Battery charger converter 130 includes a converter input 132, a rectifier (e.g., diode), and a low pass filter 134.

[0054] Also provided are a switch (e.g., a wall switch) 10 and a lighting unit 20 (e.g., an LED- based lighting unit) which includes one or more light sources (e.g., LEDs), which may be provided as separate components from emergency lighting system 100. Although LEDs have been specifically mentioned, it should be understood that in various embodiments, lighting unit 20 may include various types and combinations of light sources.

[0055] Emergency lighting system 100 selectively operates in one of two modes: a charge mode (CM), and an emergency mode (EM).

[0056] So long as AC Mains power 15 is supplied to AC input 110, then emergency lighting system 100 is in the charge mode. In this mode, battery charger converter 130 receives the rectified AC input voltage and in response thereto produces an output current at battery charger converter output 133 for charging battery 140. In the charge mode, switch 135 remains closed (e.g., under control of output switch and controller 170) and battery 140 is charged by the AC Mains power, via battery charger converter 130, to a battery voltage Vbatt. Meanwhile, output switch and controller 170 connects the output of AC ballast 160 to lighting unit 20 to electively energize lighting unit under control of switch 10, and disconnects battery 140 and output converter 150 from lighting unit 20. That is, when switch 10 is closed, then AC ballast 160 supplies power to drive lighting unit 20 to produce illumination, and when switch 10 is open, then AC ballast 160 does not supply power to drive lighting unit 20 and no illumination is produced.

[0057] On the other hand, when AC Mains power 15 is no longer provided to AC input 110, then emergency lighting system 100 is in the emergency mode. In this mode, switch 135 is opened (e.g., under control of output switch and controller 170) and output switch and controller 170 connects battery 140 and output converter 150 to supply power to lighting unit 20. In some embodiments the switch 135 can be a simple diode.

[0058] As discussed above, it is mandatory (per code) to be able to test an emergency lighting driver from time to time to verify its proper operation and ability to supply emergency lighting. Additionally, it is possible that glitches may occur which could possibly place the emergency lighting driver into an improper state unless proper precautions are not taken to prevent this. Furthermore, if the emergency lighting driver enters an invalid state, this should be detected and remedial steps taken to place the emergency lighting driver back into the correct state.

[0059] Described below with respect to FIGs. 2-9 is an emergency lighting system, emergency lighting driver, and a method that allow for ensuring that this life-safety equipment does not fail to provide the light required by the current safety codes, even if the AC mains power and/or manual test switch present glitches. An AC failure activated (ACFA) signal is produced in response to monitoring the AC mains power, and test switch activated (TSA) signal is produced in response to the state of the manual test switch. Together these two signals are referred to herein as "tandem-input" signals. By performing a sequenced-window filtering operation and a temporary mask-window filtering operation on the tandem-input signals, the correct emergency lighting driver state, either the CM or the EM, is validated and corrected if necessary, even if glitches on either or both tandem-input signals temporarily cause the emergency lighting driver to adopt an invalid internal state. The sequenced-window filtering operation validates transitions in one or both of the tandem-input signals, and ensures that a change in the internal state of the emergency lighting driver driven by a transition in one or both of the tandem-input signals happens only after the tandem-input signals are determined to be stable. During the temporary mask-window filtering of the tandem-input signals, after a transition has been detected and validated in one of the input signals, the input signal that did not transition is forced internally to change its level (binary state). Furthermore, safeguard state validation circuitry automatically checks, and potentially corrects, the present internal state of the emergency lighting driver, even in the absence of input transitions, for example in case the input signal state changed in the very short time interval between the validation of a transition and the resulting state change command. [0060] FIG. 2 shows an example embodiment of a portion of an emergency lighting driver 200 with a test switch, a visible derangement signal, and failure prevention mechanisms to address one or more of these issues. It should be noted that in order to emphasize certain features to be described in detail below, many standard elements which may be included in emergency lighting driver 200, such as an input rectifier, a battery, a battery charger converter, an output converter, etc. are not shown in FIG. 2, but one or more of these elements may the same as are shown in FIG. 1.

[0061] Emergency lighting driver 200 is equipped with a test switch (TS) 30 and a visible derangement signal 40 (e.g., an LED), further details of some embodiments of which will be described below. Emergency lighting driver 200 includes a test switch monitor in the form of a test switch and visible derangement signal interface 210, and an AC input failure monitor in the form of an input converter and AC Failure (ACF) interface 220. Emergency lighting driver 200 further includes an AC input 110, a Transition and Stable State Detection and Validator 230, a State Machine Action Controller 240, and an Output Controller 250 which selectively supplies power to lighting unit 20.

[0062] In some embodiments, Transition and Stable State Detection and Validator 230 may comprise a Transition and Stable State Detection and Validation circuit, State Machine Action Controller 240 may comprise a State Machine Action Control circuit, and Output Controller 250 may comprise an Output Control circuit. In some embodiments, one or more of Transition and Stable State Detection and Validator 230, State Machine Action Controller 240, and Output Controller 250 may be realized, in whole or part, by a processor (e.g., a general purpose microcontroller) executing software algorithms in conjunction with instructions stored in a memory associated with the processor. In that case, Transition and Stable State Detection and Validator 230, State Machine Action Controller 240, and/or Output Controller 250 may be considered to be realized by the processor executing corresponding software modules. Other embodiments are possible as would be understood by those skilled in the art.

[0063] In operation, test switch and visible derangement signal interface 210 monitors test switch (TS) 30 and in response thereto, and further in response to a series controlled switch control (SCSCtrl) signal 245 output by State Machine Action Controller 240, outputs TSA signal 213.

[0064] Input converter and ACF interface 220 monitors AC Mains power 15 and in response thereto, and further in response to an input converter feedback control (InConvFBCtrl) signal 249 output by State Machine Action Controller 240, outputs an ACFA signal 217.

[0065] In response to TSA signal 213, ACFA signal 217, and a Mask-Window control (M- WCtrl) signal 243 output by State Machine Action Controller 240, Transition and Stable State Detection and Validator 230 outputs a Test Switch Activated Transition Detection (TSATD) signal 233, an AC Failure Activated Transition Detection (ACFATD) signal 237, and a Stable Condition Detection (SCD) signal 235. These signals will all be described in greater detail below.

[0066] In response to TSATD signal 233, ACFATD signal 237, and SCD signal 235, State Machine Action Controller 240 outputs M-WCtrl signal 243 (mentioned above), SCSCtrl signal 245 (mentioned above), InConvFBCtrl signal 249 (mentioned above) and Emergency

Mode/Charge Mode Control (EM/CMCtrl) signal 247. EM/CMCtrl signal 247will be described in greater detail below.

[0067] In some embodiments, Output Controller 250 may perform operations such as those described above for output switch and controller 170 of emergency lighting system 100. In particular, in response to EM/CMCtrl signal 247 indicating that emergency lighting driver 200 is to be placed in a CM, Output Controller may generate one or more signals which connect the battery of emergency lighting driver 200 to be charged via AC Main power 15, and to connect lighting unit 20 to be powered by an AC ballast. On the other hand, in response to EM/CMCtrl signal 247 indicating that emergency lighting driver 200 is to be placed in an EM, Output Controller 250 may generate one or more signals which disconnect the battery of emergency lighting driver 200 from AC input 110, and to connect lighting unit 20 to be powered by emergency lighting driver 200.

[0068] As will be explained in greater detail below, when emergency lighting driver 200 is operating in a stable state (either CM or EM), TSA signal 213 and ACFA signal 217 are each in a predefined state, or at a predefined logic level, which depends only on the state of emergency lighting driver 200. That is, when ACFA signal 217 transitions, in response to loss of AC Mains power 15, to a logic level which indicates an AC failure activated emergency mode (ACFAEM), then SCSCtrl signal 245 serves as a feedback signal to cause TSA signal 213 to transition to whatever logic level corresponds to a test switch failure activated emergency mode (TSAEM). Conversely, when TSA signal 213 transitions, in response to activation of test switch 30, to the logic level which indicates the test switch failure activated emergency mode (TSAEM), then InConvFBCtrl signal 249 serves as a feedback signal to cause ACFA signal 217 to transition to whatever logic level corresponds to the AC failure activated emergency mode (ACFAEM). Thus, TSA signal 213 and ACFA signal 217 together may be considered to be a "tandem input" wherein a change of state or logic level at one input subsequently triggers a change in the state or logic level of the other input.

[0069] Here, for the sake of a clear example, it will be assumed that both TSA signal 213 and ACFA signal 217, reflecting the state of the tandem-input, are at the same logic level (binary value) when emergency lighting driver 200 is operating in a stable state, either CM or EM - the latter being either test-switch activated or AC-failure activated. In particular, in the illustrated embodiment of FIGs. 2, 3A and 3B, and the description to follow, both TSA signal 213 and ACFA signal 217 are at a "logic 1" when activated and are at a "logic 0" when deactivated. That is, in a stable condition, TSA signal 213 and ACFA signal 217 will both have a logic 1 level when emergency lighting driver 200 is in EM - whether it be a TSAEM or an ACFAEM - and will both have a logic 0 level when emergency lighting driver 200 is in CM. In should be understood that in other embodiments the logic levels could be reversed, or could be different from each other.

[0070] The digital filter or "windowing" procedure as generally described above (and which may include: a sequenced-window filtering operation looking for stability of the tandem-input, followed by a mask-window filtering operation, wherein the input that did not transition is forced internally to change its binary state), is only illustrated in general terms related to Transition and Stable State Detect and Validator 230. The digital filtering operations will be described in greater detail below with respect to respect to FIGs. 4-7. [0071] FIG . 3A shows a functional block diagram of an example embodiment of a two wire illuminated test switch (TS) and test switch monitor 300. Test switch and test switch monitor 300 includes a series controlled switch (SCS) 310, a test switch activated (TSA) conditioner 320, and a two wire illuminated test switch (2W-ITS) 330.

[0072] Here, 2W-ITS 330 includes an illumination device 332 in the form of an LED, although in other embodiments other illumination devices could be employed.

[0073] The two dashed-lines in FIG. 3A illustrate that the physical depiction of 2W-ITS 330 (on the right hand side) correspond to a circuit whose generic embodiment may be as depicted on the left hand side , where R_SLED is included for current limiting and protection of the visible derangement LED device 332.

[0074] In some embodiments, SCS switch 310 may be a transistor switch, and is connected in series with 2W-ITS 330 between the battery voltage Vbatt and ground. Although FIG. 3A shows an embodiment where SCS 310 is connected in series between the battery voltage Vbatt and 2W-ITS 330, in other embodiments SCS switch 310 may be connected in series between 2W-ITS 330 and ground.

[0075] As mentioned above, in the embodiments described herein with respect to FIGs. 2, 3A and 3B, TSA signal 213 at a logic 1 level signifies a TSAEM state, which is produced when 2W- ITS 330 is activated - that is, kept pushed or closed. In that case, the input to TSA conditioner 320 is pulled down to ground, or a logic 0 level, by the closed 2W-ITS 330. For this reason TSA conditioner 320 in FIG. 3A is assumed to be a logic inversion block which outputs TSA signal 213 at a logic 1 level when 2W-ITS 330 is activated. Also, TSA conditioner 320 may include a "standard" debouncing circuit for 2W-ITS 330, as may be employed with any switch.

[0076] In operation, SCS 310 is opened and closed in response to feedback signal SCSCtrl signal 245 output by State Machine Action Controller 240 (see FIG. 2). In particular, in the CM, SCSCtrl signal 245 is maintained at a logic level (e.g., a logic 1 level) by State Machine Action Controller 240 which closes SCS 310. In that case, until and unless an emergency test mode is activated by a user depressing 2W-ITS 330, current from Vbatt flows through LED 332 thereby providing a visible derangement signal (please note that the "derangement" indication is produced by the LED 332 being off). Furthermore, the resistors R_Sscs and R_SLED are selected so that under this condition, the input voltage to TSA conditioner 320 is at a level which causes TSA signal 213 output by TSA conditioner to be at a logic 0 level, indicating the CM .

[0077] However, when a user initiates a test of emergency lighting 200 by closing the TS of 2W-ITS 330, then the input to TSA conditioner 320 is pulled to ground irrespective of whether SCS 310 is opened or closed. TS closed causes TSA signal 213 output by TSA conditioner to be at a logic 1 level, indicating the EM. I n particular, when 2W-ITS 330 is depressed while emergency lighting driver 200 is in CM, a transition to logic 1 occurs on TSA signal 213, triggering a TSAEM as will be described in greater detail below. Depressing 2W-ITS 330 also ensures that that LED 332 is turned off.

[0078] Additionally, when AC main power 15 is lost to cause a transition on ACFA signal 217 (as described in greater detail below), then the transition is detected and validated by

Transition and Stable State Detection and Validator 230, which in turn outputs to State Machine Action Controller 240 ACFATD signal 237 and SCD signal 235 having levels (e.g., each having a logic 1 level) which indicate that a valid transition for ACFAEM has been detected. In response to ACFATD signal 237 and SCD signal 235, then at some point during a subsequent mask- window period T_M-w, State Machine Action Controller 240 outputs SCSCtrl signal 245 having a level which opens SCS 310. This causes the input to TSA conditioner 320 to be pulled to ground, which in turn causes LED 332 to turn off and TSA signal 213 output by TSA conditioner to be at a logic 1 level, consistent with the EM .

[0079] It should also be noted that the depicted battery voltage (Vbatt) is provided as the supply voltage for test switch monitor 300, and in particular is connected at the top side of SCS 310 in series with the 2W-ITS, rather than, e.g., some voltage in emergency lighting driver 200 which depends on the presence of AC mains power 15 - for example, the voltage at battery charger converter output 133 of FIG. 1, which is used to charge battery 140. This is because in TSAEM, the voltage at battery charger converter output 133 goes to ground in response to InConvFBCtrl signal 249 from State Machine Action Controller 240, as will be described in greater detail below with respect to FIG. 3B. However, in TSAEM, a supply voltage is absolutely needed for test switch monitor 300 in order to be able to detect the release (opening) of 2W- ITS 330, marking the end of the desired manual test (of EM) and a return to CM.

[0080] FIG. 3B shows a functional block diagram of an example embodiment of an input converter and AC input failure monitor 302. In particular, input converter and AC input failure monitor 302 includes an ACFA signal generator 350, a feedback conditioner 360, and an opto- isolated interface 370.

[0081] In operation, ACFA signal generator 350 generates ACFA signal 217 in response to AC mains power 15 and InConvFBCtrl signal 249 output by State Machine Action Controller 240.

[0082] In particular, in the CM, AC mains power 15 is present and InConvFBCtrl signal 249 has a level which, via feedback conditioner 360, and opto-isolated interface 370, enables converter input 132 of Battery Charger Converter 130. In that case, the voltage at battery charger converter output 133 causes ACFA generator 360 to output ACFA signal 217 having a logic 0 level, consistent with the charge mode.

[0083] However, when AC mains power 15 is lost while emergency lighting driver 200 is in CM, then the voltage at battery charger converter output 133 is lost (e.g., goes to ground voltage) and ACFA generator 360 outputs ACFA signal 217 having a logic 1 level, indicating the EM. In particular, when AC mains power 15 is lost, a transition to logic 1 occurs on ACFA signal 217, triggering an ACFAEM as will be described in greater detail below.

[0084] Additionally, when 2W-ITS 330 is depressed to cause a transition on TSA signal 213, then the transition is detected and validated by Transition and Stable State Detection and Validator 230, which in turn outputs to State Machine Action Controller 240 TSATD signal 233 and SCD signal 235 and having levels (e.g., each having a logic 1 level) which indicate that a valid transition for TSAEM has been detected. In response to TSATD signal 233 and SCD signal 235, then at some point during a subsequent mask-window period T_M-w, State Machine Action Controller 240 outputs InConvFBCtrl signal 249 having a level which, via feedback conditioner 360, and opto-isolated interface 370, disables converter input 132 of Battery Charger Converter 130. In that case, the voltage at battery charger converter output 133 causes ACFA generator 360 to output ACFA signal 217 having a logic 1 level, consistent with the EM. [0085] FIG. 4 shows a functional block diagram of an example embodiment of a sequenced- window and mask-window filter 400. Sequenced-window and mask-window filter 400 may comprise the main elements of Transition and Stable State Detection and Validator 230 of FIG. 2.

[0086] Sequenced-window and mask-window filter 400 includes a transition detector 410, a Tandem-Input Signal Stable/Unstable Condition Detector 420, a latch 430, a divide-by-N divider 440, a divide-by-K retriggerable counter 450, and a Filter Reset and Restarter 460. In some embodiments, Filter Reset and Restarter 460 may comprise a Filter Reset and Restart circuit. In some embodiments, Filter Reset and Restarter 460 may be realized, in whole or part, by a processor (e.g., a general purpose microcontroller) executing a software algorithm in conjunction with instructions stored in a memory associated with the processor. In that case, Filter Reset and Restarter 460 may be considered to be realized by the processor executing a corresponding software module. Other embodiments are possible as would be understood by those skilled in the art.

[0087] An example operation of sequenced-window and mask-window filter 400 will be described below.

[0088] FIG. 5 shows a functional block diagram of an example embodiment of a portion of a TSA Signal Stable/Unstable Condition Detector 500. In particular, TSA Signal Stable/Unstable Condition Detector 500 may be one embodiment of a portion of Tandem-Input Signal Tandem Signal Stable/Unstable Condition Detector 420 of FIG. 4.

[0089] TSA Signal Stable/Unstable Condition Detector 500 includes an N-sample

accumulator 510, a divide-by-N frequency divider 520, first and second Compare-and-Latch blocks 530 and 532, and logic element 540. In some embodiments, first and second Compare- and-Latch blocks 530 and 532 may each comprise a Compare-and-Latch circuit. In some embodiments, first and second Compare-and-Latch blocks 530 and 532 may be realized, in whole or part, by a processor (e.g., a general purpose microcontroller) executing a software algorithm in conjunction with instructions stored in a memory associated with the processor. In that case, first and second Compare-and-Latch blocks 530 and 532 may be considered to be realized by the processor executing a corresponding software module. Other embodiments are possible as would be understood by those skilled in the art.

[0090] In particular, TSA Signal Stable/Unstable Condition Detector 500 determines whether TSA signal 213 is stable or unstable, as will be explained below. In operation, TSA Signal Stable/Unstable Condition Detector 500 receives TSA signal 213, an enable signal 405, and a system clock 415, and outputs a TSA signal stable condition output signal 543 and a TSA signal unstable condition output signal 547.

[0091] It should be understood that Tandem-Input Signal Stable/Unstable Condition Detector 420 may also include an ACFA Signal Stable/Unstable Condition Detector which determines whether ACFA signal 217 is stable or unstable. The ACFA Signal Stable/Unstable Condition Detector may be constructed the same as TSA Signal Stable/Unstable Condition Detector 500, with the difference being that the input TSA signal 213 is replaced with ACFA Signal 217. In that case, TSA signal stable condition output signal 543 from TSA Signal

Stable/Unstable Condition Detector 500 may be logically combined (e.g., AND-ed) with a corresponding stable condition output signal from the ACFA Signal Stable/Unstable Condition to produce SCD signal 235. Similarly, TSA signal unstable condition output signal 547 from TSA Signal Stable/Unstable Condition Detector 500 may be logically combined (e.g., OR-ed) with a corresponding unstable condition output signal from the ACFA Signal Stable/Unstable Condition to produce an unstable condition detection (UCD) signal 425 as shown in FIG. 4.

[0092] Details of an example embodiment of a sequenced-window filtering operation which might be performed by sequenced-window and mask-window filter 400 and Stable/Unstable Condition Detector 500 will now be described with respect to FIG. 6.

[0093] FIG. 6 illustrates a portion of a sequenced-window filtering operation which may be employed by emergency lighting driver 200 for glitch rejection. The sequenced-window filtering operation may be implemented by Stable/Unstable Condition Detector 420 in conjunction with TSA Signal Stable/Unstable Condition Detector 500. In particular, FIG. 6 illustrates an example of a "tandem-input stability test" which may be performed by

Stable/Unstable Condition Detector 420. In the description to follow, for clarity of explanation reference may be made to operations of TSA Signal Stable/Unstable Condition Detector 500. However it should be understood that corresponding operations would also be performed by an ACFA Signal Stable/Unstable Condition Detector which may be included in sequenced- window and mask-window filter 400 as part of the "tandem-input stability test."

[0094] As shown in FIG. 6, one overall time window 600 is divided into a number (k) of smaller elementary windows 610-1, 610-2, . . . 610-k. Within each elementary window 610-i (l≤i≤k), N samples are taken of TSA signal 213 (and, in parallel, of ACFA signal 217), one sample for each clock cycle of system clock 415 as shown in FIGs. 4 and 5.

[0095] In particular, the samples of TSA signal 213 within first elementary window 610-1 are processed (as discussed below) to determine whether or not TSA signal 213 is stable within first elementary window 610-1. So long as at least one of TSA signal 213 and ACFA signal 217 is not stable, then the samples of TSA signal 213 within second elementary window 610-2 are processed to determine whether or not TSA signal 213 is stable within second elementary window 610-2 (the same applies for ACFA signal 217). If necessary, this is repeated until the k^th elementary window 610-k is reached - unless TSA signal 213 and ACFA signal 217 are both stable within an earlier elementary window 610-i. As described in greater detail below, when TSA signal 213 and ACFA signal 217 are both determined to be stable within one of the elementary windows 610-i, then enable signal 405 becomes deactivated and the "tandem-input stability test" is ended.

[0096] If overall window 600 is exhausted without both TSA signal 213 and ACFA signal 217 being stable, and therefore ending the "tandem-input stability test", everything is reset and yet another cycle of overall window 600 is repeated. In many cases, the "tandem-input stability test" may be declared finished after one or two elementary windows 610-i. In an example implementation, N=10 and K=20, providing N=10 samples per elementary window 610-i, with K=20 elementary windows 610-i per overall window 600. Furthermore, if the pulse period is around 1ms, then overall window 600 would extend for about 200ms, or 20 attempts of 10 ms each to find stable signals within each elementary window 610-i. [0097] Turning back to FIG. 5, one can see how TSA Signal Stable/Unstable Condition Detector 500 accomplishes the above-described stability check on TSA signal 213. When enable signal 405 is activated (as will be discussed in greater detail below), then N-sample accumulator 510 receives TSA signal 213, samples it in response to system clock 415, and accumulates the N samples. The accumulated output of N-sample accumulator 510 is compared (every N samples) by Compare-and-Latch block 530 to an upper threshold (reference 1) and by Compare-and- Latch block 532 to a lower threshold (reference 0).

[0098] Whenever the accumulated output of N-sample accumulator 510 is greater than the upper threshold, this indicates that TSA signal 213 was stable at a logic 1 level during the elementary window 610-i, and as a result Compare-and-Latch block 530 outputs to logic 540 an output signal 531 at a level (e.g., a logic 1 level) which indicates that TSA signal 213 is stable at a logic 1 level. Whenever the accumulated output of N-sample accumulator 510 is less than the lower threshold, this indicates that TSA signal 213 was stable at a logic 0 level during the elementary window 610-i, and as a result Compare-and-Latch block 532 outputs to logic 540 an output signal 533 at a level (e.g., a logic 1 level) which indicates that TSA signal 213 is stable at a logic 0 level. In response to output signal 531 being at a level (e.g., a logic 1 level) which indicates that TSA signal 213 is stable OR output signal 533 being at a level (e.g., a logic 1 level) which indicates that TSA signal 213 is stable, then logic 540 outputs TSA signal stable condition output signal 543 at a level (e.g., a logic 1 level) and TSA signal unstable condition output signal 547 at a level (e.g., a logic 0 level) which indicates that TSA signal 213 is stable.

[0099] On the other hand, whenever the accumulated output of N-sample accumulator 510 is in between the lower threshold and the upper threshold, this indicates that TSA signal was unstable in the elementary window - for example toggling between the logic 0 level and the logic 1 level. In that case, Compare-and-Latch block 530 outputs to logic 540 an output signal 531 at a level (e.g., a logic 0 level) which indicates that TSA signal 213 is not stable at a logic 1 level, and Compare-and-Latch block 532 outputs to logic 540 an output signal 533 at a level (e.g., a logic 0 level) which indicates that TSA signal 213 is not stable at a logic 0 level. As a result, logic 540 outputs TSA signal stable condition output signal 543 at a level (e.g., a logic 0 level) and TSA signal unstable condition output signal 547 at a level (e.g., a logic 1 level) which indicates that TSA signal 213 is unstable.

[00100] Thus TSA Signal Stable/Unstable Condition Detector 500 may filter out glitches in TSA signal 213. The upper and lower thresholds are selected to ensure that the signal is truly stable. In some embodiments, TSA Signal Stable/Unstable Condition Detector 500 may implement a "unanimity vote", requiring that all N samples within an elementary window 610-i be at the same level - either a logic 1 level or at a logic 0 level - in order to declare TSA signal 213 as stable. In other embodiments, TSA Signal Stable/Unstable Condition Detector 500 may implement a "majority vote", requiring that only a certain number of the samples < N (e.g., N-l) within an elementary window 610-i be at the same level - either a logic 1 level or at a logic 0 level - in order to declare TSA signal 213 as stable.

[00101] Returning now to FIG. 4, an example operation of sequenced window and mask- window filter 400 will now be described. Transition detector 410 receives the tandem input signals 213/217 and detects transitions in either signal. The detected transition enables Tandem-Input Signal Stable/U nstable Condition Detector 420 to perform the sequenced- windowing filter operation as described above and determine when the tandem input signals 213/217 have reached a stable condition. In particular, in response to a transition on one or both of tandem input signals 213/217, Tandem-Input Signal Stable/U nstable Condition Detector 420 initially outputs SCD signal 235 and UCD signal 425 at respective levels which indicate that tandem input signals 213/217 are unstable. So long as UCD signal is at a level (e.g., a logic 1 level) which indicates that tandem input signals 213/217 are unstable, Tandem-Input Signal Stable/Unstable Condition Detector 420 remains enabled by enable signal 405 and continues checking for stability in tandem input signals 213/217.

[00102] Meanwhile, divide-by-N divider 440 is clocked by system clock 415 and whenever it counts to N system clocks, indicating the end of another elementary window 610-i, the output of divide-by-N divider 440 triggers divide-by-K retriggerable counter 450 for an overall window 600. If stability of tandem input signals 213/217 is not detected by the end of overall window 600 (at the end of the elementary window 610-k), then divide-by-K retriggerable counter 450 generates an end of overall window (EoOW) signal to Filter Reset and Restarter 460, causing a reset and restart from scratch of the sequenced-window filtering operation.

[00103] On the other hand, and as will be described in greater detail below with respect to FIG. 8, in response to SCD signal 235 indicating that tandem input signals 213/217 are stable, a mask-window is initiated by causing M-WCtrl signal 243 to temporarily transition to a logic level or binary state which, via enable signal 405, disables transition detector 410 and

Stable/Unstable Condition Detector 420 for a mask-window period T_M-w, at the end of which period M-WCtrl signal 243 latches tandem input signals 213/217 via latch 430 to produce therefrom TSATD signal 233 and ACFATD signal 237.

[00104] FIG . 7 illustrates an example sequence 700 of states and waveforms for an emergency lighting d river, with failure prevention mechanisms, including a sequenced-window filtering operation, a mask-window filtering operation, and safeguard state validation operations. To provide a concrete example, example sequence will now be described with respect to emergency lighting driver 200.

[00105] At the beginning of example sequence 700, at a time designated 710, it is assumed that both 2W-ITS 330 and SCS 310 are in a closed position, and AC mains power 15 is supplied to emergency lighting driver 200. Thus emergency lighting driver 200 is in the TSAEM .

Accordingly, TSA signal 213 is at a logic 1 level, and as shown by reference numeral 715, ACFA signal 217 is also at a logic 1 level due to the feedback control of InConvFBCtrl signal 249, meaning that tandem-input signals 213/217 have a logic state of "11." As a result, EM/CMCtrl signal 247 has a logic level (e.g., a logic 1 level) which maintains emergency lighting driver 200 in the EM .

[00106] At time 720, 2W-ITS 330 is released (opened) by a user, thereby indicating that it is desired to end the test of emergency lighting driver 200. In response to 2W-ITS 330 being opened, TSA signal 213 transitions to the logic 0 level. [00107] In response to the transition in TSA signal 213, Transition and Stable State Detection and Validator 230, and in particular sequenced-window and mask-window filter 400, perform a sequenced-window filtering operation during time window 721 to check for stability on both TSA signal 213 and ACFA signal 217. In response to determining that TSA signal 213 and ACFA signal 217 are both stable, then Transition and Stable State Detection and Validator 230, and in particular sequenced-window and mask-window filter 400, perform a mask-window filtering operation during time window 722. During mask-window 722, I nConvFBCtrl signal 249 transitions to a logic level (e.g., a logic 0 level) which enables converter input 132 of battery charger converter 130, thereby causing ACFA signal 217 to transition to a logic 0 level at time 725, since it is still assumed that AC mains power 15 is still supplied to emergency lighting driver 200.

[00108] Accordingly, with TSA signal 213 at a logic 0 level and ACFA signal 217 also at a logic 0 tandem-input signals 213/217 have a logic state of "00." As a result, EM/CMCtrl signal 247 has a logic level (e.g., a logic 0 level) which causes emergency lighting driver 200 to return to the CM .

[00109] At time 730, an AC failure occurs and AC mains power 15 is lost. In response to the disappearance of AC mains power 15, ACFA signal 217 transitions to the logic 1 level, indicating an AC failure.

[00110] In response to the transition in ACFA signal 217, Transition and Stable State Detection and Validator 230, and in particular sequenced-window and mask-window filter 400, perform a sequenced-window filtering operation during time window 731 to check for stability on both TSA signal 213 and ACFA signal 217. In response to determining that TSA signal 213 and ACFA signal 217 are both stable, then Transition and Stable State Detection and Validator 230, and in particular sequenced-window and mask-window filter 400, perform a mask-window filtering operation during time window 732. During mask-window 732, SCSCtrl signal 245 transitions to a logic level (e.g., a logic 0 level) which opens SCS 310, thereby causing TSA signal 213 to transition to a logic 1 level at time 735. [00111] Accordingly, with TSA signal 213 at a logic 1 level and ACFA signal 217 also at a logic 1 tandem-input signals 213/217 have a logic state of "11." As a result, EM/CMCtrl signal 247 has a logic level (e.g., a logic 1 level) which causes emergency lighting driver 200 to return to the EM, in this case an ACFAEM .

[00112] At time 740, AC mains power 15 is restored. In response to the reappearance of AC mains power 15, ACFA signal 217 transitions to the logic 0 level.

[00113] In response to the transition in ACFA signal 217, Transition and Stable State Detection and Validator 230, and in particular sequenced-window and mask-window filter 400, perform a sequenced-window filtering operation during time window 741 to check for stability on both TSA signal 213 and ACFA signal 217. In response to determining that TSA signal 213 and ACFA signal 217 are both stable, then Transition and Stable State Detection and Validator 230, and in particular sequenced-window and mask-window filter 400, perform a mask-window filtering operation during time window 742. During mask-window 742, SCSCtrl signal 245 transitions to a logic level (e.g., a logic 1 level) which closes SCS 310, thereby causing LED 332 to turn on and TSA signal 213 to transition to a logic 0 level at time 745.

[00114] Accordingly, with TSA signal 213 at a logic 0 level and ACFA signal 217 also at a logic 0 tandem-input signals 213/217 have a logic state of "00." As a result, EM/CMCtrl signal 247 has a logic level (e.g., a logic 0 level) which causes emergency lighting driver 200 to return to the CM .

[00115] At a time designated 750, 2W-ITS 330 is closed, for example by a user intending to initiate a test of emergency lighting driver 200. In response to 2W-ITS 330 being closed, LED 332 turns off and TSA signal 213 transitions to the logic 1 level.

[00116] In response to the transition in TSA signal 213, Transition and Stable State Detection and Validator 230, and in particular sequenced-window and mask-window filter 400, perform a sequenced-window filtering operation during time window 751 to check for stability on both TSA signal 213 and ACFA signal 217. I n response to determining that TSA signal 213 and ACFA signal 217 are both stable, then Transition and Stable State Detection and Validator 230, and in particular sequenced-window and mask-window filter 400, perform a mask-window filtering operation during time window 752. During mask-window 752, I nConvFBCtrl signal 249 transitions to a logic level (e.g., a logic 1 level) which disables converter input 132 of battery charger converter 130, thereby causing ACFA signal 217 to transition to a logic 1 level at time 755.

[00117] Accordingly, with TSA signal 213 at a logic 1 level and ACFA signal 217 also at a logic 1 tandem-input signals 213/217 have a logic state of "11." As a result, EM/CMCtrl signal 247 has a logic level (e.g., a logic 1 level) which causes emergency lighting driver 200 to return to the EM, in particular a TSAEM .

[00118] Although for explanation purposes FIG. 7 shows example sequence 700 having a large number of transitions to different states, in general for the vast majority of the time emergency lighting d river 800 is in either the EM or CM, with tandem input signals 213/217 at the same logic level as each other, awaiting a transition in one or both tandem input signals 213/217 to change the system state from EM to CM or vice-versa. Indeed, it is expected that most of the time emergency lighting driver would be in the CM.

[00119] During those long stable periods, it may be possible that an incorrect internal tandem-state of emergency lighting driver 200 can occur, e.g., if one of the inputs of tandem- input signal 213/217 is transitioning to the opposite binary logic state in the short time interval when the internal tandem-state is "aligned" (e.g., during the "mask-window" period) based on the original transition of just one signal of tandem-in put signal 213/217. Just in case some very un likely timing issue sets the internal state signals at different binary logic values, emergency lighting driver 200 may perform a "safeguard" state validation operation to check whether or not the internal state of tandem-input signals 213/217 are at the same logic levels as each other.

[00120] Accordingly, FIG. 7 also shows that example sequence 700 includes a plurality of "safeguard" (SG) state validation operations 705, which may be performed periodically, so long as emergency lighting driver 220 is not performing mask-window filtering operation, to ensure that the internal tandem-state of emergency lighting driver 220 is a valid one, and to correct it if it is not. In some embodiments, the period between SG operations 705 may be in the upper hundreds of milliseconds. It should be noted that here, SG operations are asynchronous with respect to the transitions on tandem-input signals 213/217 (the latter being essentially random).

[00121] FIG . 8 shows a functional block diagram of an example embodiment of a portion of a State Machine Action Controller 800 which may perform SG operations 705. State Machine Action Controller 800 may be a portion of one embodiment of State Machine Action Controller 240 of FIG. 2.

[00122] State Machine Action Controller 800 includes a Safeguard State Validator 810, and Internal State Correcter 820, a one-shot 830, and one or more logic elements 840. In some embodiments, Safeguard State Validator 810 may comprise a Safeguard State Validation circuit. In some embodiments, I nternal State Corrector 820 may comprise an Internal State Correction circuit. In some embodiments, Safeguard State Validator 810 and/or Internal State Corrector 820 may be realized, in whole or part, by a processor (e.g., a general purpose microcontroller) executing software algorithms in conjunction with instructions stored in a memory associated with the processor. In that case, Safeguard State Validator 810 and/or Internal State Corrector 820 may be considered to be realized by the processor executing corresponding software modules. Other embodiments are possible as would be understood by those skilled in the art.

[00123] FIG . 8 shows that TSATD signal 233 and an internal ACFAEM signal are logically combined (840) to effectively allow ACFAEM to take precedence, by gating the TSATD signal in the logic chain that ultimately produces EM/CMCtrl signal 247.

[00124] FIG . 8 also shows that SCD signal 235 triggers one-shot 830 to cause M-WCtrl signal 243 to pulse, thereby beginning a mask-window period during which: (1) transitions on tandem- input signals 213/217 are ignored, and (2) the one of tandem-in put signals 213/217 which did not trigger the immediately preceding sequence-window filtering operation is forced to transition via SCSCtrl signal 245 or InConvFBCtrl signal 249. [00125] Meanwhile, Safeguard State Validator 810 is enabled by one shot 830 whenever emergency lighting d river 200 is not performing a mask-window operation, in which case it is disabled. Safeguard State Validator 810 receives TSATD signal 233 and ACFATD signal 237 and in response thereto, when enabled, determines whether or not the internal state of emergency lighting driver 200 is valid. When enabled, Safeguard State Validator 810 also outputs a signal to Internal State Corrector 820 having a logic level which indicates whether or not the internal state of emergency lighting driver 200 is valid.

[00126] If Safeguard State Validator 810 does not find the internal state of emergency lighting driver 200 to be a valid or correct one, then Internal State Corrector 820 forces emergency lighting driver 200 to a valid or correct state, by switching the internal state of one of tandem- input signals 213/217. I n this process, for failsafe purposes, precedence is given to ACFAEM, as already explained in connection to logic elements 840. As part of this process, Internal State Corrector 820 receives and employs an internal emergency flag (EMflag) 805 (which can also be part of the decision process for the Safeguard State Validator 810), and optionally an LED lamp status signal 815 which may be produced by Output Switch and Controller 170.

[00127] In some embodiments, as an additional hardware precaution against emergency lighting driver 200 entering an incorrect state, TSA conditioner 320 and/or ACFA generator 350 may include a low pass filter that may have a time constant in the low millisecond range, which may further decrease the probability of a discrepancy between the internal and external state of tandem-input signals 213/217.

[00128] FIG .9 illustrates an example embodiment of a method 900 of operating and preventing failures in an emergency lighting driver (e.g., emergency lighting driver 200) for an emergency lighting system.

[00129] An operation 910 includes monitoring whether AC Mains power is supplied to the AC input of an emergency lighting driver, and producing an AC failure activated signal in response to the determination. [00130] An operation 920 includes monitoring a test switch and producing a test switch activated signal in response to the determination. In some embodiments, the test switch and the test switch monitor may be powered by a battery of the emergency lighting driver.

[00131] An operation 930 includes detecting and validating transitions in the AC failure activated signal and the test switch activated signal.

[00132] In some embodiments, validating transitions in the AC failure activated signal may include rejecting glitches in the AC failure activated signal, and validating transitions in the test switch activated signal includes rejecting glitches in the test switch activated signal, the method further comprising producing a stable condition signal indicating whether the AC failure activated signal and the test switch activated signal are in a stable condition.

[00133] In some embodiments, detecting and validating transitions in the AC failure activated signal and the test switch activated signal, may include, in response to detecting a transition in at least one of the AC failure activated signal and the test switch activated signal: evaluating a plurality of sequenced-samples of each of the AC failure activated signal and the test switch activated signal within at least one elementary window; and based on the samples determining when the AC failure activated signal and the test switch activated signal are both stable following the detected transition.

[00134] An operation 940 includes determining, based on any detected and validated transitions in the AC failure activated signal and the test switch activated signal, whether the emergency lighting driver should be placed in the CM or the EM, and placing the emergency lighting driver in the determined mode. In some embodiments, the emergency mode may include an ACFAEM generated in response to activation of the AC failure activated signal, and a TSAEM generated in response to activation of the test switch. In some embodiments, this may include ignoring transitions in the test switch activated signal while the emergency lighting driver is in the ACFAEM. [00135] This may include determining whether the AC failure activated signal and the test switch activated signal are both stable. In some embodiments, this may include determining that the AC failure activated signal and the test switch activated signal are both stable when both: (1) all of the samples of the AC failure activated signal have the same logic level as each other within one elementary window; and (2) all of the samples of the test switch activated signal have the same logic level as each other within the one elementary window; and otherwise determining that the AC failure activated signal and the test switch activated signal are not both stable. In some embodiments, this may include determining that the AC failure activated signal and the test switch activated signal are both stable when both: (1) a number of the samples of the AC failure activated signal greater than a first threshold number have the same logic level as each other within one elementary window; and (2) a number of the samples of the test switch activated signal greater than a second threshold number have the same logic level as each other within the one elementary window; and otherwise determining that the AC failure activated signal and the test switch activated signal are not both stable.

[00136] In some embodiments, this may include disregarding further transitions in the AC failure activated signal and the test switch activated signal for a set period of time after the AC failure activated signal and the test switch activated signal are both validated stable following the detected transition.

[00137] An operation 950 includes charging the battery of the emergency lighting driver by the AC mains power.

[00138] An operation 960 includes supplying power from the emergency lighting driver to a load, in particular a lighting unit.

[00139] Various embodiments of methods of operating and preventing failures in an emergency lighting driver may include a variety of operations besides those shown in FIG. 9.

[00140] For example, some embodiments may include illuminating a visible derangement device when the test switch is not activated; and turning off the visible derangement device to be not illuminated when the test switch is activated. [00141] Some embodiments may include, after detecting a transition in one of the AC failure activated signal and the test switch activated signal, an operation of forcing a transition in the other one of the AC failure activated signal and the test switch activated signal for which the transition was not detected.

[00142] Some embodiments may include periodically checking whether the emergency lighting apparatus is in an invalid internal state, and in response to determining that the apparatus is in an invalid internal state, forcing the internal state of the apparatus to a valid state, the valid state being determined in response to whether the emergency lighting driver is in the emergency mode.

[00143] While several inventive embodiments have been described and illustrated herein, those of ordinary skill in the art will readily envision a variety of other means and/or structures for performing the function and/or obtaining the results and/or one or more of the advantages described herein, and each of such variations and/or modifications is deemed to be within the scope of the inventive embodiments described herein. For example, in embodiments described above, the "tandem-input" signal designation for the aggregate input signal described in detail. However it should be understood that in some embodiments, the aggregate input signal may include more signals besides the manual test switch and the AC input. In that case, the aggregate input will become a "multiple-input" signal, not just a tandem-input signal which refers to two input component signals. Such a multiple-in put signal should be treated similarly to the tandem-input signal described above, with the same principles extended to multiple inputs. More generally, those skilled in the art will readily appreciate that all parameters, dimensions, materials, and configurations described herein are meant to be exemplary and that the actual parameters, dimensions, materials, and/or configurations will depend upon the specific application or applications for which the inventive teachings is/are used. Those skilled in the art will recognize, or be able to ascertain using no more than routine experimentation, many equivalents to the specific inventive embodiments described herein. It is, therefore, to be understood that the foregoing embodiments are presented by way of example only and that, within the scope of the appended claims and equivalents thereto, inventive embodiments may be practiced otherwise than as specifically described and claimed. Inventive embodiments of the present disclosure are directed to each individual feature, system, article, material, kit, and/or method described herein. In addition, any combination of two or more such features, systems, articles, materials, kits, and/or methods, if such features, systems, articles, materials, kits, and/or methods are not mutually inconsistent, is included within the inventive scope of the present disclosure.

[00144] All definitions, as defined and used herein, should be understood to control over dictionary definitions, definitions in documents incorporated by reference, and/or ordinary meanings of the defined terms.

[00145] The indefinite articles "a" and "an," as used herein in the specification and in the claims, unless clearly indicated to the contrary, should be understood to mean "at least one."

[00146] The phrase "and/or," as used herein in the specification and in the claims, should be understood to mean "either or both" of the elements so conjoined, i.e., elements that are conjunctively present in some cases and disjunctively present in other cases. Multiple elements listed with "and/or" should be construed in the same fashion, i.e., "one or more" of the elements so conjoined. Other elements may optionally be present other than the elements specifically identified by the "and/or" clause, whether related or unrelated to those elements specifically identified. Thus, as a non-limiting example, a reference to "A and/or B", when used in conjunction with open-ended language such as "comprising" can refer, in one embodiment, to A only (optionally including elements other than B); in another embodiment, to B only (optionally including elements other than A); in yet another embodiment, to both A and B (optionally including other elements); etc.

[00147] As used herein in the specification and in the claims, "or" should be understood to have the same meaning as "and/or" as defined above. For example, when separating items in a list, "or" or "and/or" shall be interpreted as being inclusive, i.e., the inclusion of at least one, but also including more than one, of a number or list of elements, and, optionally, additional unlisted items. Only terms clearly indicated to the contrary, such as "only one of" or "exactly one of," or, when used in the claims, "consisting of," will refer to the inclusion of exactly one element of a number or list of elements. I n general, the term "or" as used herein shall only be interpreted as indicating exclusive alternatives (i.e. "one or the other but not both") when preceded by terms of exclusivity, such as "either," "one of," "only one of," or "exactly one of." "Consisting essentially of," when used in the claims, shall have its ordinary meaning as used in the field of patent law.

[00148] As used herein in the specification and in the claims, the phrase "at least one," in reference to a list of one or more elements, should be understood to mean at least one element selected from any one or more of the elements in the list of elements, but not necessarily including at least one of each and every element specifically listed within the list of elements and not excluding any combinations of elements in the list of elements. This definition also allows that elements may optionally be present other than the elements specifically identified within the list of elements to which the phrase "at least one" refers, whether related or unrelated to those elements specifically identified. Thus, as a non-limiting example, "at least one of A and B" (or, equivalently, "at least one of A or B," or, equivalently "at least one of A and/or B") can refer, in one embodiment, to at least one, optionally including more than one, A, with no B present (and optionally including elements other than B); in another embodiment, to at least one, optionally including more than one, B, with no A present (and optionally including elements other than A); in yet another embodiment, to at least one, optionally including more than one, A, and at least one, optionally including more than one, B (and optionally including other elements); etc.

[00149] It should also be understood that, unless clearly indicated to the contrary, in any methods claimed herein that include more than one step or act, the order of the steps or acts of the method is not necessarily limited to the order in which the steps or acts of the method are recited.

[00150] In the claims, as well as in the specification above, the word "substantially" means within 5%, the word "approximately" means within 10%, and the word "about" means within 25%. [00151] In the claims, as well as in the specification above, all transitional phrases such as "comprising," "including," "carrying," "having," "containing," "involving," "holding," "composed of," and the like are to be understood to be open-ended, i.e., to mean including but not limited to. Only the transitional phrases "consisting of" and "consisting essentially of" shall be closed or semi-closed transitional phrases, respectively, as set forth in the United States Patent Office Manual of Patent Examining Procedures, Section 2111.03.

Claims

CLAIMS:

1. An apparatus, comprising:

an AC input configured to receive AC mains power;

an emergency lighting driver configured to charge an independent energy source by the AC mains power in a charge mode, and to supply power from the independent energy source to a lighting load in an emergency mode;

an AC input failure monitor configured to provide an AC failure activated signal indicating whether the AC mains power is supplied to the AC input;

a test switch monitor configured to monitor a test switch and to provide a test switch activated signal indicating whether the test switch has been activated; and

a detector configured to detect and validate transitions in the AC failure activated signal and the test switch activated signal, and in response thereto to output a mode control signal to selectively place the emergency lighting driver in one of the charge mode and the emergency mode.

2. The apparatus of claim 1, wherein the detector is configured to validate transitions in the AC failure activated signal by rejecting glitches in the AC failure activated signal, and to validate transitions in the test switch activated signal by rejecting glitches in the test switch activated signal, and to produce a stable condition signal indicating whether the AC failure activated signal and the test switch activated signal are in a stable condition.

3. The apparatus of claim 2, wherein the detector includes a stable/unstable condition detector which, in response to detecting a transition in at least one of the AC failure activated signal and the test switch activated signal, evaluates a plurality of sequenced-samples of each of the AC failure activated signal and the test switch activated signal within at least one elementary window, and based on the samples determines when the AC failure activated signal and the test switch activated signal are both stable following the detected transition.

4. The apparatus of claim 3, wherein the stable/unstable condition detector is configured to determine that the AC failure activated signal and the test switch activated signal are both stable when both: (1) all of the samples of the AC failure activated signal have a same logic level as each other within one elementary window; and (2) all of the samples of the test switch activated signal have a same logic level as each other within the one elementary window; and otherwise to determine that the AC failure activated signal and the test switch activated signal are not both stable.

5. The apparatus of claim 3, wherein the stable/unstable condition detector is configured to determine that the AC failure activated signal and the test switch activated signal are both stable when both: (1) a number of the samples of the AC failure activated signal greater than a first threshold number have a same logic level as each other within one elementary window; and (2) a number of the samples of the test switch activated signal greater than a second threshold number have a same logic level as each other within the one elementary window; and otherwise to determine that the AC failure activated signal and the test switch activated signal are not both stable.

6. The apparatus of claim 3, wherein the detector further includes a mask-window filter configured to generate a mask-window control signal to cause the detector to disregard further transitions in the AC failure activated signal and the test switch activated signal for a set period of time after the AC failure activated signal and the test switch activated signal both become stable following the detected transition.

7. The apparatus of claim 6, further comprising logic configured to force, in the set period of time, a transition in one of the AC failure activated signal and the test switch activated signal for which the transition was not detected.

8. The apparatus of claim 6, further comprising:

at least one latch for latching an AC failure activated transition detection signal and a test switch activated transition detection signal;

a safeguard state validator enabled by the mask-window control signal and configured to receive the AC failure activated transition detection signal and the test switch activated transition detection signal and in response thereto to periodically check whether the apparatus is in an invalid internal state and to output a valid/invalid signal indicating whether the apparatus is in an invalid internal state; and

an internal state corrector configured to receive the valid/invalid signal and further configured to receive a flag indicating whether the emergency lighting driver is internally assumed to be in the emergency mode, and in response thereto to force the internal state of the apparatus to a valid state.

9. The apparatus of claim 1, wherein the emergency lighting driver includes the independent energy source, and wherein the test switch and the test switch monitor are powered by the independent energy source.

10. The apparatus of claim 1, wherein the test switch monitor comprises a visible derangement device which is configured to be illuminated when the test switch is not activated and the emergency lighting driver is in the charge mode, and which is not illuminated when the emergency lighting driver is in the emergency mode.

11. The apparatus of claim 1, wherein the emergency mode includes an AC failure activated emergency mode generated in response to activation of the AC failure activated signal, and a test switch activated emergency mode generated in response to activation of the test switch, and wherein the apparatus is configured to not respond to transitions in the test switch activated signal while the emergency lighting driver is in the AC failure activated emergency mode.

12. A method, comprising:

determining whether AC mains power is supplied to an AC input of the emergency lighting driver, and in response thereto providing an AC failure activated signal indicating whether the AC mains power is supplied to the AC input;

monitoring a test switch, and in response thereto providing a test switch activated signal indicating whether the test switch has been activated;

detecting and validating transitions in the AC failure activated signal and the test switch activated signal, and in response to a detected and validated transition selectively placing the emergency lighting driver in one of a charge mode and an emergency mode;

when the emergency lighting driver is in the charge mode, charging an independent energy source by the AC mains power; and

when the emergency lighting driver is in the emergency mode, supplying power from the independent energy source to a lighting load.

13. The method of claim 12, wherein validating transitions in the AC failure activated signal includes rejecting glitches in the AC failure activated signal, and validating transitions in the test switch activated signal includes rejecting glitches in the test switch activated signal, the method further comprising producing a stable condition signal indicating whether the AC failure activated signal and the test switch activated signal are in a stable condition.

14. The method of claim 13, further comprising, in response to detecting a transition in at least one of the AC failure activated signal and the test switch activated signal:

evaluating a plurality of sequenced-samples of each of the AC failure activated signal and the test switch activated signal within at least one elementary window; and

based on the samples determining when the AC failure activated signal and the test switch activated signal are both stable following the detected transition.

15. The method of claim 14, further comprising: determining that the AC failure activated signal and the test switch activated signal are both stable when both: (1) all of the samples of the AC failure activated signal have a same logic level as each other within one elementary window; and (2) all of the samples of the test switch activated signal have a same logic level as each other within the one elementary window; and otherwise determining that the AC failure activated signal and the test switch activated signal are not both stable.