EP0109696A1

EP0109696A1 - Circuit for fail safe control of a system

Info

Publication number: EP0109696A1
Application number: EP83201384A
Authority: EP
Inventors: Cornelis Arend Vreugdenhil
Original assignee: VEG-GASINSTITUUT NV; Veg Gasinstituut NV
Current assignee: VEG-GASINSTITUUT NV; Veg Gasinstituut NV
Priority date: 1982-09-27
Filing date: 1983-09-27
Publication date: 1984-05-30
Also published as: DE3372011D1; ATE27732T1; EP0109696B1; NL8203734A

Abstract

The invention relates to a circuit for fail safe control of a system comprising a command switch, closing of which activates a control relay so that through the switched over contacts of said control relay a holding path for said control relay is closed. The circuit furthermore comprises an auxiliary relay and a capacitor, which capacitor after closing of the command switch only through at least a normally closed contact of the control relay can be charged to a predetermined voltage before the control relay is energized. Said control relay is energized through an energizing path containing at least one contact of the auxiliary relay offering the possibility to check a switching device, and is maintained in the energized state through a contact of the control relay . The capacitor is after energizing of the control relay connected to the auxiliary relay through at least one of the now switched over contacts of said control relay and forms during a predetermined period the only voltage source for said auxiliary relay, energizing said auxiliary relay.

Description

The invention relates to a circuit for fail safe control of a system comprising a command switch, closing of which activates a control relay establishing thereby a holding path for said control relay through the switched contacts of the control relay.
If circuits of this type are used to switch on a system or parts thereof after closing of a command switch, then in most cases it is preferred that this switching on can only be realized when it is certain that the whole circuit and the thereto connected parts, for instance protection devices of the system, are correctly functioning. In other words, a fail safe control on the circuit and on the protection devices should be possible.
In known circuits additional relais are necessary for fail safe control, however, it is thereby not possible to control in turn all these additional relais and therefore these circuits are not really fail safe. Furthermore, they add to the costs of the circuits and because of the expanding wiring the whole circuit becomes more and more disordered.
Welding of a switching contact of one of the components present in the circuit will, dependent on the nature of the controlled system, lead to a more or less complicated fault or even to dangerous situations. One may think for instance of simple burner control circuits, not provided with a cam shaft, in which it is e.g. possible that after a purging period the fuel valve is kept open if for one reason or another a switching contact of the control relay is welded, in which case an explosion is unavoidable. Also in protected systems comprising a cam shaft one of the switching contacts can become welded resulting into a complicated fault or even an explosion.
The application area of the circuit is, however, not restricted to burner control installations, in which the fuel valve(s) only can be actuated in a safe way.
Besides the mere fail safe applications, in which the correct positions of the relay contacts have to be controlled, the invention can also be applied to systems in which after initiating the system and eventually after a predetermined period a detectable event should take place. One may think of ventilators or pressurized air generators into which within a predetermined period a predetermined air pressure should be built up. One may further think of fluid pumps in systems into which within a predetermined period a flow of fluid has to be detected in a secure way (e.g. in the chemical or petrochemical industry). One may furthermore think of elevator control systems into which welding of relay contacts would lead to a very unpleasant situation for the persons in the elevator.
An object is now to eliminate the abovementioned disadvantages of the known circuits. In agreement with the invention the circuit of the abovementioned type is now characterized in that said circuit furthermore comprises an auxiliary relay and a capacitor, which capacitor after closing of the command switch can be charged only through at least one normally closed contact of the control relay to a predetermined capacitor voltage before the control relay, activated through an energizing path comprising at least one contact of the auxiliary relay providing the possibility to check a switching means, is energized and is held in the energized condition through a contact of the control relay, which capacitor after energizing of the control relay is connected to the auxiliary relay through at least one of the switched control relay contacts and forms during a predetermined period the only voltage source for said auxiliary relay, energizing this auxiliary relay.
In the circuit according.to the invention the auxiliary relay can only be energized if the precharged capacitor becomes connected to said auxiliary relay. Said capacitor, however, can only become charged after closing of the command switch if the control relay contact is in the normal position. Furthermore, operation of the control relay is only possible if the contact of the auxiliary relay, connected into the energizing path of the control relay, is initially in the normal state. If these start conditions are not fulfilled, in other words if e.g. one of said contacts is welded into the activated state, then it is impossible to charge the capacitor or to connect the charged capacitor to the auxiliary relay. In that case the auxiliary relay will not become operated thereby inhibiting further operation of the system.
Further details of the invention will be explained in the following part of the description with reference to the drawings.
The figures 1, 2, and 3 illustrate three variants of the circuit according to the invention.

Figure 4 illustrates an embodiment of the circuit according to the invention in which relais of the so-called forced guidance type are used.
Figure 5 illustrates another embodiment of the circuit according to the invention in which normal relais are used.
Figures 6 and 7 illustrate embodiments of the circuit according to the invention into which an air pressure responsive switch is used.
Figures 8, 9, and 10 illustrate applications of the invention in burner control circuits.

The power supply voltage of the circuit illustrated in fig. 1, in many cases the mains voltage, is supplied to the terminals 1 and 2 and is rectified by the diode Dl. The resulting DC voltage is used to supply the control relay AR and to load the capacitor C1. The diode D2 bridges the second half period into which no current flows and functions furthermore, just as the diode D3 which is connected parallel to the auxiliary relay HR, to extinguish the self-inductance voltage appearing when the relay AR respectively HR is de-energized.
A command switch RT is connected between the terminals 3 and 4. Between the terminals 4 and 2 the start condition circuit is connected comprising a series circuit of a contact HR1 of the auxiliary relay HR and a contact AR3 of the control relay AR, and furthermore the already mentioned rectifying diode Dl, a pair of current limiting resistors Rl and R2 and the control relay AR with the already mentioned diode D2 parallel therewith. A holding path for the relay AR extends from the terminal 4 through the contact AR1, the diode D6 and the resistor R3. The junction between AR1 and D6 is connected to the normally open contact of AR3. The auxiliary relay HR is through the diode D4 connected to the normally open contact of AR1. The capacitor Cl can be connected through the contact AR4 either to the junction between R1 and R2 or through D5 to the auxiliary relay HR.
As appears from the figure the energizing path for the relay AR between the terminals 4 and 2 can only become closed if both the contact HR1 as well as AR3 are closed, in other words if both relais AR and HR are not energized and both mentioned contacts are in the normal position.
If these conditions are fulfilled then, after closing of the command switch RT first of all the capacitor Cl will become charged through Dl and Rl. Initially the uncharged capacitor will cause such a low voltage over R2 and AR that operation of AR is prevented. If the capacitor however becomes charged to a sufficiently high voltage, then AR is operated and the contacts AR1, AR3 and AR4 will switch into the other operating state. A relatively small capacitor C2 is connected parallel to the relay AR to prevent that the relay AR as a result of the switching of the contact AR3 releases immediately. The contact ARl forms the holding path for maintaining the relay AR energized through D6 and R4 as long as the command switch RT is closed and irrespective of the further position of the contacts AR1 or AR3. Because the contact AR4 switches over to the other state the now charged capacitor Cl is through D5 connected to the terminals of the auxiliary relay HR. It is remarked that the values of Rl, R2 and Cl should be selected such that on the one hand the capacitor C1 can become charged before especially contact AR2 switches over and on the other hand the capacitor Cl has to be charged such that the auxiliary relay HR can become energized during a sufficiently large period during the discharging of this capacitor Cl to bridge'the switching operation of HR. As is already remarked the capacitor Cl will, after switching of the contact AR4, function as voltage source for the auxiliary relay HR, energizing said relay. Therefore, the contact HR1 will switch to the other position so that through the already switched contact AR3 and through HR1 and D4 a holding path for the auxiliary relay HR is formed, with the result that HR maintains energized even if in the meantime-Cl is discharged.
For charging the capacitor Cl after switching of the command switch RT it is therefore necessary that HR1, AR3 and AR4 are in the normal position. If the only further contact AR1 is not in the normal position, then at the moment the command switch RT switches a direct energizing path for AR is formed through D6 and R3, so that C1 does not have time enough to become charged. In that case the auxiliary relay HR will not become energized even if AR4 switches to the other position and the output U of the circuit will not become connected to the power supply terminal 1.
The resistor R3 is present to prevent a rapid charging of the capacitor Cl and thereafter energizing of AR in the very unlikely case that AR1 was welded and R2 is short-circuited. The resistance of R3 is preferably equal to that of R1 + R2.
It is furthermore possible to select for AR a relay which operates e.g. at 6 V and to select for HR a relay which operates e.g. at 12 V. With adapted values for R1, R2 and C1 the capacitor C1 will in the normal case become charged to at least 12 V before AR operates. However, in case R2 is short-circuited then Cl will only be charged to 6 V and HR will not become operated.
In the following figures R3 is eliminated because it is presumed that resistors are used which are resistent to short-circuiting.
The power supply voltage of the circuit illustrated in fig. 2, in many cases the mains voltage, is again supplied to the terminals 1 and 2 and is rectified by the diode D1. The resulting DC voltage is used to supply the control relay AR and to charge the capacitor Cl. The diode D2 bridges the second half period into which no current flows and functions furthermore, just as the diode D3 which is connected parallel to the auxiliary relay HR, to extinguish the self-inductance voltage appearing when the relay AR respectively HR is de-energized.
A command switch RT is connected between the terminals 3 and 4. Between the terminals 4 and 2 the start condition circuit is connected comprising a series circuit of the contacts S1 and S2 of the switching relais S, a contact HR1 of the auxiliary relay HR and a contact AR3 of the control relay AR, and furthermore the rectifying diode D1, a pair of current limiting resistors R1 and R2 and the control relay AR with the diode D2 parallel therewith. Also in this case a small capacitor C2 is connected parallel to the control relais.
A series circuit of contacts AR1 and AR2 is connected parallel to contacts S2 and S1, whereby the junction between AR1 and AR2 is connected on the one hand to the control relais AR through D6 and on the other hand to the make contact terminal of AR3. The make contact terminal of S2 and the make contact terminal of HR1 are both connected to relais S. The auxiliary relay HR is on the one hand connected to terminal 2 and can be connected through the change over contact AR4 to the capacitor Cl of which the other side is connected to terminal 2.
As appears from the figure the energizing path for the relay AR between the terminals 4 and 2 can only become closed if both the contacts S1 and S2, the contact HR1 as well as AR3 are closed, in other words if none of the relais AR, HR and S is energized and contacts thereof are in the normal position.
If these conditions are fulfilled then, after closing of the command switch RT, first of all the capacitor Cl will become charged through Dl and Rl. Initially the uncharged .capacitor will cause such a low voltage over R2 and AR that operation of AR is prevented. If the capacitor however becomes charged to a sufficiently high voltage, then AR is operated and the contacts AR1, AR2, AR3 and AR4 will switch into the other position. The contact AR4 connects the now charged capacitor Cl to the terminals of the auxiliary relay HR. Also in this case the values of Rl, R2 and C1 should be selected such that on the one hand the capacitor Cl can become charged before especially contact AR2 switches over and on the other hand the capacitor Cl has to be charged such that the auxiliary relay HR can become energized during a sufficiently large period during the discharging of this capacitor Cl to activate relais S.
By connecting Cl parallel to the auxiliary relay HR this relay will become activated. By switching over the contact HR1 the relay S will become activated. Thereby the contacts S1 and S2 will switch over, so that on the one hand a connection is realized between the terminal 1 and the output U through AR1, AR2 and Sl, and on the other hand a holding path is formed for the switching relay through S2.
As soon as the capacitor voltage is decreased to a predetermined minimum level the relay HR will become de-energized, which has, however, taking into account the holding paths for AR and S, no further influence.
If onto the switching moment of RT one of the contacts AR1 or AR2 would be in the made position, then also in this embodiment a direct energizing path for AR is formed and the capacitor C1 will not become charged so that HR and S will not become activated.
It is remarked that S1 can be replaced by any security or protection means to be tested, for instance in the form of a limit switch.
It is furthermore remarked that in this circuit the contact AR2 can be eliminated in principle, in which case preferably the moving contact element of S1 and the normally open contact terminal of S1 should be come exchanged. The complete operation of the circuit is in principle the same.
Figure 3 illustrates a third embodiment of the circuit according to the invention of which a large part is identical to the circuit of figure 2. The differences can be traced around HR1 and Sl and the possible connections to HR through the circuits A and B. The start condition circuit comprises in this case the series circuit of HR1, S2 and AR3, connected to the rectifying diode Dl, the current limiting resistors R1 and R2, and the control relay AR with parallel thereto again the diode D2. A series circuit of contacts AR1 and AR2 is connected in parallel to HR1, whereby the junction of said series circuit is on the one hand hand through D6 connected to AR and on the other hand connected to the make contact terminal of AR3. The make contact terminal of S2 is connected to the output U and can become connected through circuit b to HR. The make contact terminal of HR1 is connected to the switching relay S and can become connected to the auxiliary relay HR through circuit b. The diodes D4 and D5 are again used for preventing currents in false directions. Again a small capacitor C2 is connected parallel to the relay AR.
As appears from the figure the energizing path for the relay AR between the terminals 4 and 2 can only become closed if the contact HR1, the contact S2 as well as AR3 are closed, in other words in case none of the relais AR, HR and S is energized and the contacts thereof are in the normal position.
If these conditions are fulfilled then, after closing of the command switch RT first of all the capacitor C1 will become charged through D1 and Rl. Initially the unloaded capacitor will cause such a low voltage over R2 and AR that operation of AR is prevented. If the capacitor however becomes charged to a sufficiently high voltage, then AR is operated and the contacts AR1, AR2, AR3 and AR4 will switch into the other position. The contact AR1 forms the holding path for maintaining the relay AR energized as long as the command switch RT is closed and irrespective of the further state of the contacts HR1 or S2. The contact AR4 connectes the now charged capacitor C1 to the terminals of the auxiliary relay HR. It is again remarked that the values of Rl, R2 and Cl should be selected such that on the one hand the capacitor Cl can become charged before especially contact AR2 switches over and on the other hand the capacitor Cl has to be charged such that the auxiliary relay HR can become energized for a predetermined period during the discharging of this capacitor Cl. As result of the energizing of HR the switching relais S will be energized through contact HR1 and the now closed contacts AR1 and AR2, so that S2 switches over.
In the figures two paths a and b are denoted which in this case can be used to maintain the auxiliary relay HR in the energized condition. If, for instance, during the abovementioned predetermined time period in which the relay HR is energized a connection is realized in said path b, then the relay HR will be maintained in the energized condition through the contact S2 and the relay S will be maintained in the energized condition through the contact HR1. If, on the other hand, during said predetermined time period a connection is realized into the path a, then both relais HR and S will be maintained in the energized condition through contact HR1. Also in this case it applies that if one of the contacts AR1 or AR2 was welded or otherwise kept in the made position, then at the moment RT switches a direct activation path for AR is formed and Cl will not become charged.
The power supply voltage of the circuit illustrated in fig. 4, in many cases the mains voltage, is again supplied to the terminals 1 and 2 and is rectified by the diode D1.· The resulting DC voltage is used to supply the control relay AR and to charge the capacitor Cl. The diode D2 bridges the second half period into which no current flows and functions furthermore, just as the diode D3 which is connected parallel to the auxiliary relay HR, to extinguish the self-inductance voltage appearing when the relay AR respectively HR is de-energized.
A command switch RT is connected between the terminals 3 and 4. Between the terminals 4 and 2 the start condition circuit is connected comprising a series circuit of a contact HR1 of the auxiliary relay HR and a contact Sl of the switching relay S, and furthermore the already mentioned rectifying diode D1, a pair of current limiting resistors R1 and R2 and the control relay AR with the already mentioned diode D2 parallel therewith.
Parallel to the series circuit of the contacts HR1 and Sl a contact AR1 of the control relay AR is connected.
There is a connection between on the one hand the junction between contact Sl and diode Dl and on the other hand the junction between HR2 and contact S2. The contact HR2 is at the other side connected to the switching relay S of which the other side is connected to terminal 2. The contact S2 is through a further contact S3 connected to relay S. The auxiliary relay HR is connected on one side to the terminal 2 and can become connected with the other side through the switch over contact HR2 to the capacitor Cl of which the other side is connected to terminal 2. In the not-energized condition of the control relay AR the contact AR2 closes the path from the junction between the resistors Rl and R2 through the capacitor C1 to the terminal 2.
As appears from the figure the energizing path for the relay AR between the terminals 4 and 2 can only become closed if both the contact HR1 as well as Sl are closed, in other words if both relais S and HR are not energized and both mentioned contacts are in the normal position.
If these conditions are fulfilled then, after closing of the command switch RT first of all the capacitor Cl will become charged through D1 and Rl. Initially the unloaded capacitor will cause such a low voltage over R2 and AR that operation of AR is prevented. If the capacitor however becomes charged to a sufficiently high voltage, then AR is operated and the contacts AR1 and AR2 will switch into the other position. The contact AR1 forms the holding path for maintaining the relay AR energized as long as the command switch RT is closed and irrespective of the further position of the contacts HR1 or S1. Because the contact AR2 switches over to the other position the now charged capacitor C1 is connected to the terminals of the auxiliary relay HR. It is remarked again that the values of Rl, R2 and Cl should be selected such that on the one hand the capacitor C1 can become charge before especially contact AR2 switches over and on the other hand the capacitor C1 has to be charged such that the auxiliary relay HR can become energized for a predetermined period during the discharging of this capacitor Cl.
As is already remarked the capacitor C1 will, after switching of the contact AR2, function as voltage source for the auxiliary relay HR, energizing said relay. As result thereof the contact HR1 will open which has however no influence anymore because contact AR1 is closed in the meantime and furthermore HR2 will become closed energizing the switching relay S. During the period Cl discharging through the relay HR, in other words during the period into which the relay HR is energized, the relay S should become activated through AR1 and the now closed contact HR2. If the relay S is energized then through AR1, the then closed contacts S2 and S3 a holding path for said relay S is built up, so that S will be maintained in the energized condition even if HR becomes de-energized. The output U of the circuit, to which switching means of the control system are connected, is now through S2, AR1, and RT connected to the power supply terminal 1.
If, for some reason the relay S is not energized within the discharge period of the capacitor C then after release of the auxiliary relay HR the control relay AR will be maintained energized, so that an electronic lock is created because the control relay AR is still activated and therefore the contacts thereof are maintained in the switched over position preventing a recharging of the capacitor Cl. The same applies to the embodiments already discussed.
To make this circuit absolutely "fail safe" in this embodiment relais of the so-called forced guidance type should be used, that means relais of which all contacts are simultaneously in the one or in the other position. If for instance for some reason one of the contacts would become welded into the made position, then in this type of relais all the other contacts are maintained in the made position even if the energizing current through the relay coil is switched off.
In figure 4 a further variant is indicated comprising the switch over contact SI' which can be installed instead of S1, and which can be used for connecting the output U' instead of U. In that case one of the contacts S2 or S3 can be eliminated.
It is remarked that any security or protection device to be tested can be included into the start condition circuit, e.g. a limit switch. The security or protection means to be tested can be inserted e.g. between the common contact terminal of S1 (or Sl') and D1.
Figure 5 illustrates an embodiment into which all relais contacts are included into either the energizing path for the control relay AR or into the charging path of the capacitor Cl.
Besides the command switch RT, the contacts AR1, Sl, S2 and AR4 are included into the energizing path for the control relay AR. The diode D1 is used again for rectifying the AC voltage and the resistor R2 is used together with the capacitor C2 for determining a delay period before the relay AR will become energized. The diode D2 has just as the diode D3 the same function as the corresponding diodes D2, D3 in the preceding figures. After closing the command switch RT the capacitor C1 will become charged through contacts AR2 and AR3, the rectifying diode D4, the resistor Rl and the contact AR1. If the capacitor becomes charged to a sufficiently high voltage to energize the relay AR, then the contacts AR1, AR2 and AR3 will switch over and charging of the capacitor Cl is ended. The amount of charge into C1 depends therefor onto the values of R1, Cl, R2 and C2.
The holding path for the relais AR runs through AR2, D1 and R2 and as long as the command switch RT is closed therefore AR will be maintained in the energized position.
Through the switched over contact AR1 the capacitor C1 is connected as voltage source to the auxiliary relay HR, which will become energized so that the contact HR1 switches over. Thereafter the switching relay S can become energized through the contacts HR1 and AR3 within the period into which the capacitor C discharges through the auxiliary relay HR. If the switching relay S becomes energized then a holding path is formed through AR2, AR4 and S2.
If the relay S will not become energized within said period then HR becomes de-energized and the contact HRl returns back into the illustrated position. Because still AR is energized again a locked condition is reached in which the capacitor C1 cannot become recharged because of the switched over contact AR1.
Because in this embodiment all contacts of the auxiliary relay HR, the switching relay S and the control relay AR are included into either the "start condition" circuit for the control relay or in the charging path of the capacitor Cl, it is only possible to connect a charged capacitor Cl to the auxiliary relay in case all contacts are in the normal position before closing the command switch RT. Therefore normal relais can be used in this embodiment.
It is also possible to use another switching means instead of the switching relay S together with e.g. a security or protection switch, which should be switched over within the discharge period of the capacitor Cl to establish a holding path for said switching means as well as an activation path for at least part of the control system. With reference to figures 6 and 7 a number of possibilities will be discussed, whereas thereafter with reference to figures 8, 9 and 10 practical applications in burner control systems will be discussed.
The power supply voltage of the circuit illustrated in fig. 6, in many cases the mains voltage is supplied to the terminals 1 and .2 and is rectified by the diode Dl. The resulting DC voltage is used to supply the control relay AR and to charge the capacitor Cl. Also in this embodiment the diodes D2 and D3 are connected across AR and HR respectively to bridge the second half period into which no current flows and to extinguish the self-inductance voltage appearing when the relais AR respectively HR is de-energized.
The series circuit of the command switch RT, a contact HR1 of the auxiliary relay HR, a switching contact LD2 of some switching means, the rectifying diode Dl, a pair of current limiting resistors R1 and R2 and the control relay AR with the diode D2 parallel thereto is connected between the terminals 1 and 2. A normally open contact AR1 of the control relay AR is connected parallel to the series circuit of the contact HR1 and said contact LD2 of the switching means.
The auxiliary relay HR is with the one side connected to terminal 2 and can be connected with the other side through the switch over contact AR2 to the capacitor C1 of which the other side is connected to terminal 2. In the not energized condition of the control relay AR the contact AR2 forms a path from the junction between the resistors R1 and R2 through the capacitor C1 to the terminal 2.
The voltage, supplied to the auxiliary relay HR .is rectified by the diode D4. The supply voltage for said auxiliary relay HR can be supplied through a circuit a, through which circuit a connection is realized to the terminal 1 in case the command switch RT is closed and the contact HR1 is switched over into the other position.
Furthermore, the voltage for the auxiliary relay can be supplied through circuit b, which circuit can be connected with terminal 1 in case both the control relay contact AR1 as well as the contact LD2 of the switching means are switched over. One side of the circuit b is furthermore connected to the output U.
The diode D5 is inserted to prevent false charging of the capacitor through one of the circuits a or b. If this possibility is not real then D5 can be eliminated.
The circuit illustrated in figure 6 can be used e.g. for controlling a system comprising a ventilator M which is indicated in figure 6. In that case the switching means related to that ventilator is e.g. embodied as a means reacting onto air pressure or air current, e.g. a switch LD2 responding to a predetermined minimum air pressure.
As appears from the figure the energizing path for the relay AR between the terminals 1 and 2 can only become closed if both the contact HR1 as well as LD2 are closed, in other words in case both relais AR and the air pressure switch are not energized and both mentioned contacts are in the normally closed position.
If these conditions are fufilled then, after closing of the command switch RT first of all the capacitor Cl will become charged through Dl and R. Initially the unloaded capacitor will cause such a low voltage over R2 and AR that operation of AR is prevented. If the capacitor however becomes charged to a sufficiently high voltage, then AR is operated and the contacts AR1 and AR2 will switch over into the other position. The contact AR2 forms the holding path for maintaining the relay AR energized as long as the command switch RT is closed and irrespective of the further state of the contacts HR1 and LD2. Because the contact AR4 switches over to the other position the now charged capacitor Cl is connected to the terminals of the auxiliary relay HR. It is remarked again that the values of R1, R2 and Cl should be selected such that on the one hand the capacitor Cl can become charged before especially contact AR2 switches over and on the other hand the capacitor Cl has to be charged such that the auxiliary relay HR can become energized for a predetermined period during discharging of this capacitor Cl.
As is already remarked the capacitor Cl will, after switching of the contact AR2, function as voltage source for the auxiliary relay HR, energizing said relay. As a result thereof the contact HR1 will close activating the motor M of the ventilator causing a gradually increase in air pressure. Dependent onto the selection of circuit a or circuit b there are now several possibilities. If circuit b is selected and if the ventilator motor M should be maintained in the activated condition through AR1 then within the period into which the capacitor Cl discharges through the auxiliary relay HR, that means within the period into which this auxiliary relay or ventilator relay HR is energized, a holding path should be formed into figure 6 for said ventilator relay HR. As soon as a sufficient air pressure is developed the switch LD2 responding to said air pressure, will switch over so that a holding path for the auxiliary relay HR is formed through the command switch RT, the now closed contact AR1 and the now switched over contact LD2 as well as through circuit b. By forming of this holding path the auxiliary relay HR is maintained energized and contact HR1 is maintained in the switched over position and furthermore the ventilator motor is maintained in the activated condition. In the above description it is assumed that circuit b, which can include further contacts or other components, forms as a whole a closed path.
As appears from figure 6 the one side of circuit b is furthermore connected to the output U of the circuit. At the moment the holding path for the auxiliary relay HR is formed the power supply voltage is switched through from the terminal 1 to the output U, through which output further parts of the control system can be energized.
In case the air pressure does not reach a sufficient level within the discharging period the auxiliary relay HR will become de-energized and the ventilator motor M will be switched off. In that case the circuit will become electrically locked because the control relay HR maintains energized and the contacts thereof will be maintained in the switched over position so that recharging of the capacitor Cl is impossible.
As is already remarked above it is also possible to create a holding path for the auxiliary relay through circuit a. If one- assumes again that circuit a, comprising eventually further con-. tacts and other components, is in itself a closed path, then the holding path through circuit a will be a fact as soon as HR1 switches over. In that case the capacitor C1 is only needed to bridge the switching operation of the contact HR1 and it is not necessary to wait for the activation of contact LD2. In the illustrated example of the ventilator motor this means that said ventilator motor M will be switched on and maintained in that position even if the air pressure is very low, however, the output U will not become connected to terminal 1 because LD2 does not switch over, so that further parts of the system to which said ventilator belongs, will not become activated.
To make the circuit of figure 6 absolutely "fail safe" it is necessary to use relais of the so-called "forced guidance" type, that means relais of which the contacts are always simultaneously in the one or in the other position. If e.g. for some reason one of the contacts would be welded or for another reason maintained in the made position, then in relais of this type all the other contacts will be maintained in that position, even in case the energizing current to the relay coil is switched off.
Because of the presence of the contacts HR1 and LD2 in the energizing path of the control relay AR the correct functioning of the auxiliary relay HR and of the air pressure switch LD2, or instead thereof the part of the system to be controlled, is checked each time before the control relay AR is activated. The contacts HR1 and LD2 in this start condition circuit will in the situation into which said contacts are stuck into the made position, prevent that the control relay AR becomes energized. Furthermore in that case no voltage is supplied to further parts of the system through the output U.
In case the control relay AR does not function properly, e.g. if the contact AR1 is welded, then also the other contact AR2 will be maintained into the made position, preventing thereby the energizing of the auxiliary relay HR. In that case the ventilator motor M will not start and therefore the air pressure switch LD2 is maintained in the inactive state and no voltage will be supplied to further parts of the system through the output U.
If the use of relais of the so-called "forced guidance" type is objectionable e.g. because of financial reasons, then another embodiment illustrated in figure 7 can be used. In this figure the components corresponding to the components in figure 6 are indicated by the same reference characters. Also in figure 7 we find therefore the control relay AR, the auxiliary relay HR, the motor M, a number of resistors R, two capacitors C and a number of diodes D.
The start condition circuit comprising the contact HR1 of the auxiliary relay HR and the air pressure switch LD2 is now extended with the contact AR3 of the control relay AR. If all said contacts are in the normal inactive position at the moment the command switch RT switches over, then an energizing path for the control relay AR is set up through said contacts, the rectifying diode Dl and the resistors Rl and R2. In the same way as is already described with reference to figure 1 first of all the capacitor C1 will become charged before the control relay AR will be energized. To prevent the-immediate release of the relay AR, caused by switching over of the contact AR3 when said relay is energized, a relatively small capacitor C2 is connected parallel to said relay AR. Said capacitor C2 only bridges the short period into which the contact AR3 switches over. After switching of the contacts of AR a holding path for the control relay AR is formed through AR1 and D6.
Furthermore, the functioning of the circuit illustrated in figure 7 is completely identical to that of the circuit illustrated in figure 6 and therefore a detailed discussion of the general functioning of the circuit in figure 7 is superfluous.
The diode D6 which is inserted into the holding path for the control relay AR has still another function. If in this circuit of figure 7 one of the contacts AR1 or AR3 for one reason or another becomes stuck in the made position, then this diode D6 takes care that directly after switching of the command switch RT a holding path is formed for the control relay AR. In case AR1 is stuck, then this holding path is built up through AR1 and D6. In case AR3 is stuck then this holding path is built up through AR1, LD2, AR3 and D6. If one of these two contacts therefore is welded or stuck for some reason then the control relay AR will be activated immediately so that the capacitor Cl does not have time enough to charge and therefor the auxiliary relay HR does not become activated. The circuit is therefore brought directly into the locked situation without supplying any voltage to the motor M or through the output U to further parts of the system to be protected. It is remarked that also the eventual welding of the contact AR2 forms a protection in itself. In that case the capacitor Cl cannot be charged at all.
As is already remarked above the.circuit according to the invention can be used with special advantages for controlling burner installations. Figure 8 illustrates an application of this type.
The power supply voltage of the circuit illustrated in fig. 8 in many cases the mains voltage, is supplied to the terminals 1 and 2 is rectified by the diode Dl. The resulting DC voltage is used to supply the control relay AR and to charge the capacitor C. The diode D2 bridges the second half period into which no current flows and functions furthermore, just as the diode D3 which is connected parallel to the safety period determining relay VTR to extinguish the self-inductance voltage appearing when the relay AR respectively HR is de-energized.
A flame sensing unit of known type is connected to the terminals 1 and 2. Said flame sensing unit comprises a control stage ST, a flame relay VR connected to said control stage and a flame sensing device VW also connected through the terminals 8 and 9 to said control stage. If a flame is present in the burner then said flame will be sensed by VW with the result that the flame relay VR will be activated by the control stage ST. If no flame is present then VW will not generate a signal and the flame relay will not become activated through the control stage ST.
A command switch RT is connected between the terminals 3 and 4. Between the terminals 4 and 2 the start condition circuit is connected comprising a series circuit of a contact VTR1 of the safety period determining relay VTR and a contact VR1 of the flame relay VR, and furthermore the already mentioned rectifying diode Dl, a pair of current limiting resistors R1 and R2 and the control relay AR with the already mentioned diode D2 parallel therewith.
A contact AR1 of the control relay AR is connected parallel to the series circuit of the contacts VTR1 and VR1.
The junction between the contact VR1 and the diode Dl is connected to one side of the contact VTR2 as well as to the switch over contact VR2. The other side of VTR2 is through terminal 6 connected to the fuel valve MK of which the other terminal is connected to terminal 5. The switch over contact VR2 is in the normal position inserted into the energizing path for the ignition unit OT, which path runs furthermore through contact VTR3. In the activated position the switch over contact VR2 functions to maintain the fuel valve MK activated after the safety period determining relay VTR is released.
One side of this safety period determining relay is connected to terminal 5 and the other side is through the switch over contact HR2 connected to a capacitor C to which the other side is connected to terminal 5. In the de-energized state of the control relay AR the contact AR2 determines a connection from the junction between the resistors Rl and R2 through the capacitor C to the terminal 5.
As appears from the figure the energizing path for the relay AR between the terminals 4 and 5 can only become closed if both the contact VTR1 as well as VR1 are closed, in other words in case both relais VR and VTR are not energized and both mentioned contacts are in the normally closed position.
If these conditions are fulfilled then, after closing of the termostat switch functioning as command switch RT first of all the capacitor C will become charged through Dl and Rl. Initially the uncharged capacitor will cause such a low voltage over R2 and AR that operation of AR is prevented. If the capacitor however becomes charged to a sufficiently high voltage, then AR is operated and the contacts AR1 and AR2 will switch into the other operating position. The contact AR1 forms the holding path for maintaining the relay AR energized as long as the thermostat switch R2 is closed and irrespective of the further position of the contacts VTR1 or VR1. Because the contact AR2 switches over to the other position the now charged capacitor C is connected to the safety period determining relay VTR. It is remarked that the values of R1, R2 and Cl should be selected such that on the one hand the capacitor Cl can become charged before especially contact AR2 switches over and on the other hand the capacitor C1 has to charge such that the safety period determining relay VTR can become energized for a predetermined period during the discharging of this capacitor Cl.
As is already remarked the capacitor C will, after switching of the contact AR2, function as voltage source for the safety period determining relay VTR, energizing said relay. Therefore, the contacts VTR2 and VTR3 will switch to the other position, so that both the fuel valve MK as well as the ignition unit OT will be energized. During the period into which the capacitor C discharges through relay VTR, that means within the period the relay VTR is energized, the ignition OT gets the chance to ignite a flame into the burner. The presence of a flame will be detected by the flame sensing device VW activating the relay VR. The result thereof is that the contact VR2 switches over releasing on the one hand the ignition unit OT and closing on the other hand a holding path for the fuel valve MK. In case the flame is not ignited within the safety time period then together with the release of the safety time period determining relay VTR both the ignition unit OT as well as the fuel valve MK will brought back to the non-active state. In that case the circuit becomes electronically locked because the control relay AR is maintained energized and the contacts thereof are in the switched over position preventing recharging of the capacitor C.
To make this circuit absolutely "fail safe" in this embodiment of the system relais of the so-called "forced guidance" type should be used, in other words relais of which all contacts have to be simultaneously either in the one or in the other position. If e.g. for one reason or another one of the contacts is welded in the made position, then in such a relay also all the other contacts are maintained in the corresponding position, even if the energizing current through the relay coil is switched off.
Because of the presence of the contacts VTRl and VR1 in the energizing path for the control relay AR the correct functioning of the safety period determining relay VTR and the flame relay VR is checked each time before the control relay AR is energized. The contacts VTR1 and VR1 in the start condition circuit will in the situation in which the respective contacts are maintained in the made position, prevent energizing of the control relay AR. The energizing path for the fuel valve will not become closed because on the one hand the start condition circuit through VTR1 and VR is not closed and because on the other hand the contact AR1 will not switch over.
In case the control relay AR does not function correctly, e.g. if the contact ARl is welded in the made position, then also the other contact AR2 will be maintained in this position preventing thereby the energizing of the safety period determining relay VTR. Also energizing of the fuel valve will be prevented in this situation because the contact VTR2 will not switch over in this situation.
If the application of relais of the "forced guidance" type is objectionable e.g. because of financial reasons, then another embodiment illustrated in figure 9 can be used. In this figure the components corresponding with the components in figure 8 are indicated with the same reference symbols. Also in this figure we find therefore the control circuit ST, the flame relay VR, the flame sensing device VW, a control relay AR, a safety period determining relay VTR, a thermostat switch RT, a fuel valve MK and an ignition unit OT, and furthermore a number of resistors R and a number of diodes D. It is remarked that the number of contacts for each relay might be different in the various figures.
In the embodiment of figure 9 the control stage ST, the flame relay VR and the flame sensing device VW are powered in the same way as in figure 8 and also the functioning thereof is identical.
Also in this case the energizing path for the control relay AR comprises besides the thermostat contact RT in this case also contacts of the flame relay VR and the safety period determining relay VTR, in this case the contacts VTR1, VTR2 and VR. The diode D1 rectifies the AC voltage and the resistor R2 determines together with the capacitor C2 a delay period before the relay AR will become energized. The diode D2 has just as the diode D3 the same function as the corresponding diodes D2 and D3 in figure 8. After closing the thermostat switch RT the capacitor C1 will be charged through contacts AR2 and AR3, the rectifying diode D4, the resistor R1 and the contact AR1. Simultaneously the second capacitor C2 connected in parallel to the relay coil AR, will be charged through RT, VTR1, VTR2, VR, Dl and R2. As soon as the voltage across the capacitor C2 is sufficient to energize the relay AR the contacts AR1, AR2 and AR3 will switch over finishing thereby the charging of capacitor C1. The charge stored in C1 is therefore dependent onto the values of Rl, Cl, R2 and C2 as well as the coil resistance of the relay AR.
The holding path for the relay AR extends through AR2, D1 and R2 and therefore AR is maintained energized as long as the thermostat contact RT is closed.
Through the switched over contact AR1 the capacitor Cl is connected as voltage source to the safety period determining relay VTR1, energizing said relay, so that the contacts VTR1 and VTR2 will switch over. As a result thereof the fuel valve MK is energized through contacts VTR1 and AR3 and the ignition unit OT is energized through contacts AR2, VR and VTR2. If a flame is ignited within the safety period, then the flame relay will respond thereto, so that VR switches over and the ignition unit is switched off. The fuel valve MK is still energized through AR2 and VR, even if the safety period determining relay VTR releases.
If within the safety period no flame is ignited then the relay VTR releases bringing back the contacts VTR1, VTR2 in the illustrated position. Because AR is still energized again a locked situation is reached: because of the switched over contact AR1 recharging of the capacitor C1 is impossible and because of the switched over contacts AR2 and AR3 reactivation of the fuel valve MK and the ignition unit OT is impossible.
Because in this embodiment all contacts of the safety period determining relay VTR and of the flame relay VR are connected into the "start condition" circuit energizing of the relay AR is only possible after closing of the thermostat contact RT in case none of the contacts VTR1, VTR2 or VR is welded or for some reason maintained in the made position. In this embodiment normal relais can be used.
It is remarked that means for determining a purging period can eventually take over the function of the capacitor C2.
Figure 10 illustrates a third embodiment of the circuit according to the invention, specially designed for controlling a burner installation. Also this embodiment comprises components of the same type as the components in the already discussed embodiments and these components are also indicated by corresponding reference symbols.
The start condition circuit is formed by the series connection of the contacts VTRl, VR and VTR2 and AR3. Also in this case all contacts of the safety period determining relay VTR and of the flame relay VR are therefore connected into the start condition circuit. If all said contacts are in the normal position at the moment the thermostat contact RT closes, then an energizing path for the control relay AR is formed through said contacts, and furthermore through the rectifying diode Dl and the resistors R1 and R2. In a corresponding way as is described in relation to figure 9.the capacitor Cl will be charged before the control relay AR is energized. The capacitor C2 has in this case a relatively small value and functions only for bridging the short period into which the contact AR3 switches over.
After switching of the contacts of the control relay AR the holding path for AR is closed through AR1 and D4. Through AR4 the charged capacitor Cl is connected as the voltage source to the safety period determining relay VTR, energizing said relay resulting into switch over of the contacts thereof. The fuel valve MK is activated through AR1, AR3 and VTR2 and the ignition unit OT is activated through AR1, AR2, VR and VTR1. If a flame is ignited then the flame sensing device VW will respond thereto by energizing the flame relay VR with the result that a holding path for the fuel valve is closed through AR1, AR2 and VR. Because VR switches over furthermore the ignition unit OT will be switched off. The control relay AR is maintained energized resulting into a locked situation.
In the circuit of figure 10 the diode D4 is connected to the contacts AR2 and AR3. If in this circuit one of the contacts AR1 , AR2 or AR3 becomes for one reason or another welded or is maintained in the made position, then the function of this diode D4 is to take care that after closing of the thermostat contact RT immediately a holding path is formed for the control relay AR. In case AR1 is welded then said holding path runs through AR1 and D4. If AR2 is welded then said holding path runs through VTR1, VR, AR2 and D4. In case AR3 is welded said holding path runs through VTR1, VR, VTR2, AR3 and D4. The advantage thereof is that in all these situations the relay AR becomes immediately energized leaving no time for the capacitor Cl to charge so that the safety period determining relay VTR will not become energized. The circuit is therefore directly brought into a locked situation without activating the fuel valve or the ignition unit. It is remarked that an eventual welding of AR4 forms a protection in itself. In that case the capacitor C1 will not charge.
Although the invention is discussed above with reference to a number of embodiments it will be clear that several adaptations and modifications are within reach of the expert in this field and all these adaptions and modifications are considered to fall within the scope of the invention.

Claims

1. Circuit for fail safe control of a system comprising a command switch, closing of which activates a control relay so that through the switched over contacts of said control relay a holding path for said control relay is closed, characterized in that the circuit furthermore comprises an auxiliary relay and a capacitor, which capacitor after closing of the command switch only through at least a normally closed contact of the control relay can be charged to a predetermined voltage before the control relay is energized, which control relay is energized through an energizing path containing at least one contact of the auxiliary relay offering the possibility to check a switching device, and is maintained in the energized state through a contact of the control relay, which capacitor after energizing of the control relay is connected to the auxiliary relay through at least one of the now switched over contacts of said control relay and forms during a predetermined period the only voltage source for said auxiliary relay, energizing said auxiliary relay.

2. Circuit according to claim 1, characterized in that a holding path for the auxiliary relay to the power supply source is closed through the switched over contacts of the control relay and of the auxiliary relay.

3. Circuit according to claim 1, characterized in that the circuit furthermore comprises a switching means activated through a contact of the auxiliary relay.

4. Circuit according to claim 3, characterized in that the switching means cooperates with one or more contacts which, if they are switched over within said predetermined period, close a holding path for said switching means.

5. Circuit according to claim 3, characterized in that the switching means cooperates with at least one contact, which can become closed under the influence of said switching means within the predetermined period causing thereby a holding path for the auxiliary relay through said contact of said switching means.

6. Circuit according to claim 3, characterized in that said contact of the auxiliary relay is connected into the holding path of the switching means.

7. Circuit according to one of the claims 3-6, characterized Ln that the switching means is embodied as a switching relay.

8. Circuit according to one of the preceding claims, characterized in that initially the capacitor is through the respective contact of the control relay connected parallel to said control relay, whereby the energizing path of said control relay preferably contains a current limiting element to limit the transient effect of the capacitor.

9. Circuit according to one of the preceding claims, characterized in that the capacitor is charged through a first current limiting element and through the related contact of the control relay, whereby a second capacitor is connected parallel to the control relay, which second capacitor is charged through a second current limiting element in the energizing path of said control relay, whereby the resistance and capacitance values are selected such that the predetermined voltage onto the first capacitor is reached at the moment the voltage onto the second capacitor is sufficient to energize the control relay.

10. Circuit according to one of the preceding claims 3-9, characterized in that in case relais of the not forced guidance types are used all contacts of the auxiliary relay and of the switching means are connected into the energizing path of the control relay.

11. Circuit according to claim 9 or 10, characterized in that all contacts of the control relay are contained in the charging path of the first capacitor.

12. Circuit according to one of the preceding claims, characterized in that one contact of the control relay is connected in the energizing path of said control relay and at least one of the contacts of the control relay is connected into the holding path of said control relay, whereby at least a conducting diode is connected on the one hand to said control relay and on the other hand to said control relay contacts such that in case one of these contacts is not in the normal position at the moment the command switch closes, immediately an energizing path for the control relay is formed preventing charging of the capacitor.

13. Circuit according to one of the preceding claims 3-12, characterized in that the switching means comprises a threshold value determining unit enabling the switching over of the contacts of the switching means in case a predetermined parameter of the system has reached a predetermined value.

14. Circuit according to one of the preceding claims, destined for controlling a burner installation, whereby the command switch is embodied as thermostat switch, closing of which activates a control relay or a cam shaft, so that through the switched over contacts of said control relay respectively said cam shaft an energizing path for a fuel valve is closed, which burner installation furthermore comprises a flame relay which can be activated by means of a flame sensing device and is maintained in the activated state as long as a flame is present in the burner installation, and means for determining a safety period within which a flame has to be ignited, characterized in that the safety period is determined by a capacitor which during said period energizes the auxiliary relay embodied as a safety period determining relay, whereby the switching means is embodied as a flame relay through contacts of which the main fuel valve can be activated after a flame is sensed, whereby furthermore the energizing path for the control relay and/or the cam shaft can only be closed through the thermostat switch in case at least both the contacts of the flame relay as well as the contacts of the safety period determining relay are in the normal state.

15. Circuit according to claim 14 comprising electrically operable means for igniting a flame, characterized in that contacts of both the flame relay as well as the safety period determining relay are connected into the energizing path for said flame igniting means.