| CPC F17C 5/06 (2013.01) [B60K 15/04 (2013.01); B60K 15/07 (2013.01); B67D 7/32 (2013.01); F17C 13/02 (2013.01); F17C 2270/0168 (2013.01)] | 16 Claims |
|
1. A multiple redundant safety system for compressed or liquefied gas, or liquid fuel vehicle fuelling or transfers comprising:
first and second independent operational isolated control systems with first and second separate power sources having separate isolation transformers, wherein the second operational isolated control system is a safety instrumented system (SIS);
the first and second independent operational isolated control systems comprising:
first and second processors, first and second networks, first and second sensor sets, first and second actuator sets, first and second human interfaces, first and second peripherals, first and second independent operating systems; wherein, the first network, first sensor set, first actuator set, first human interface, first peripherals comprise the first control system with the first operating system executing on the first processor, and wherein, the second network, second sensor set, second actuator set, second human interface, second peripherals comprise the second control system with the second operating system executing on the second processor;
wherein, the second independent operational isolated control system is configured to have no communication with the first independent operational isolated control system, and the second independent operational control system is also configured to have no communication external to the second independent operational control system;
first and second redundant vehicle motion devices connected respectively to the first and second control systems, each vehicle motion device configured to detect motion of a vehicle, each redundant vehicle motion sensor utilizing at least one sensor chosen from the group consisting of mechanical tethers, switches, magnetic sensors, optical sensors, ultrasonic sensors, accelerometers, inertial motion units, gyros and gyroscopic effect instruments configured to detect vehicular motion during fuelling or fuel transfer events;
first and second gas detection sensors connected respectively to the first and second control systems, the first and second gas detection systems utilizing at least one sensor chosen from the group consisting of magnetic sensors, catalytic sensors, optical sensors and chemical sensors;
first and second fire or explosion sensors connected respectively to the first and second control systems;
wherein, at least one of the two independent operational isolated control systems shuts down fuel transfer or disables the vehicle upon detection of vehicle motion greater than a predetermined amount, or upon detection of gas concentration above a predetermined level or upon detection of fire or explosion.
|