EP0352217B1 - Process for controlling and supervising a fuel-heated apparatus with the use of at least one microcomputer system, and apparatus to carry out this process - Google Patents

Abstract

The present invention relates to a process and apparatus for controlling and supervising a fuel-heated apparatus, in particular a circulation water heater, with the use of at least one microcomputer system which has a plurality of sensors which are present for sensing digital and analog values and positions. The invention is characterised in that, when two microcomputer systems (22, 25) are used, the safety-relevant input signals are input in both systems, whereupon each microcomputer system calculates for itself the corresponding adjusting signals and an output signal is only forwarded to the respective output stages (35, 36, 37, 45) when the adjusting commands of both microcomputer systems (22, 25) are identical, each microcomputer system additionally independently having the possibility of switching without current, with the aid of a safety cut-out (28), all output stages and actuators and consequently bringing the fuel-heated apparatus into the safe state, a number of safety-relevant functions, for example flame supervision, temperature limiters, supervision of water shortage, air and waste gas, being brought about in the same microcomputer system (Figure 2). <IMAGE>

Description

6. The present invention relates to a method for controlling and monitoring a fuel-heated device, in particular a circulation water heater, and to an apparatus for carrying out the method according to the preamble of patent claims 1 and 6 respectively.

From EP-A1-0073 717 it is known to control a circulating water heater with a microcomputer. This circulating water heater is a heat exchanger controlled by an atmospheric gas burner, the exhaust gases being extracted by a fan after passing through the heat exchanger. The circulating water heater has a solenoid valve for controlling the gas supply, a safety device for monitoring the solenoid valve, a priority changeover valve for connecting the heat exchanger heated by the burner once to a continuous-flow heater for preparing hot service water and for connecting the heat exchanger to a heating system, and also a circulation pump , an ignition device and a sensor for detecting temperatures, water and air flow and the mode of operation. The measured values are recorded, the measured values are processed and the actuators of the circulating water heater are controlled via the microcomputer.

Due to its complexity, the behavior of a microcomputer in the event of a fault is in contrast to conventional components, for example a resistor, relay, transistor or diode, can no longer be estimated. Therefore, when using a microcomputer in safety-relevant areas - as is known from EP-A2-0 308 831 and GB-A-2 139 782 - additional monitoring devices are required which recognize all possible errors of the microcomputer and a safe shutdown or locking shutdown of the Effect device. Two-channel microcomputer systems described in EP-A1-0 315 042 and EP-A1-0 315 053 are also known, in which both microcomputers monitor one another and which, however, only belong to the state of the art according to Article 54 (3) EPC.

Any device fired with gas or oil or solid fuels can be regarded as a fuel-heated device, be it a room heater, an air heating system, a heater for hot domestic water, a circulating water heater for feeding central heating with parallel domestic hot water preparation, if necessary, and a boiler.

Microcomputer systems as in the prior art give their signals to so-called output stages, which are designed as current or voltage amplifiers and which control the actuators of the fuel-heated device. These are, for example, driver transistors for solenoid or changeover valves, a phase gating or pulse pause or pulse packet control for the pump or the exhaust gas fan and the like.

The present invention is based on the object of specifying a method for controlling and monitoring a fuel-heated device, in which the device is switched off depending on the safety-related relevance if a fault is detected in any way or is to be assumed. Errors in the two-channel microcomputer system must also be taken into account.

The solution to the problem lies in the characterizing features of the process claim.

The present invention further relates to an apparatus for performing this method.

It is known to assign a flow temperature limiter to a circulating water heater, which switches off the device in a locking manner when a certain limit value of the flow temperature is exceeded. This means that the next time the control is switched on, the device will no longer go into operation, rather the customer service must be called, who can unlock the lock with a tool. The disadvantage for the user is obvious, it is not possible to supply heat for heating or hot water tap operation during this time. In order to keep this disadvantage as small as possible, the limiter cut-out temperature has so far been set relatively high, so that it is approximately in the area of the beginning steam development came to rest.

The higher the limiter cut-out temperature, the less the safety aspect is guaranteed, since the cut-out should already take place at the lowest possible extraordinary temperature.

Accordingly, it is an object of the present invention to lower the limiter cut-out temperature, but at the same time to allow heat to be delivered despite the resulting after-heat if the temperature increase state is likely to exist only in two due to the after-heat. The effect of the storage heat that occurs in the primary heat exchanger heated by the burner after the end of operation of the device is to be regarded as residual heat. In the case of hot water tapping, the heat exchanger is switched to a secondary hot water heat exchanger, so that the heat is first transferred from the exhaust gas to the heating system in the primary heat exchanger, then from the heating system to the hot water in the secondary heat exchanger. Opening and closing of the nozzle is recognized by a water switch, which starts when the water is drawn off and switches the burner and the circulation pump on. So that it is possible that the primary heat exchanger is heated and that on the other hand the heat from the heating water in the domestic water heat exchanger is transported. When the nozzle is closed, the burner goes out, but at the same time the pump comes to a standstill, since it is to be prevented that warm heating water - for example in summer operation - gets into the heating system. The water in the primary heat exchanger thus comes to a standstill, but the highly heated fins of the heat exchanger, especially when it is designed as a stainless steel heat exchanger, reheat the water.

The object is achieved according to the invention by the features of the independent claims.

Further refinements and particularly advantageous developments of the invention emerge from the remaining subclaims and the following description, the exemplary embodiments of the invention are explained in more detail with reference to FIGS. 1 to 5 of the drawing.

• Figur 1 eine schematische Darstellung eines Umlaufwasserheizers,
• Figur 2 eine Schaltungsanordnung und
• Figur 3 die Sicherheitsabschalteinrichtung,
• Figur 4 ein Prinzipschaltbild eines Umlaufwasserheizers und
• Figur 5 eine logische Prinzipschaltung.

Show it:

• FIG. 1 shows a schematic illustration of a circulating water heater,
• Figure 2 shows a circuit arrangement and
• FIG. 3 the safety shutdown device,
• Figure 4 is a schematic diagram of a circulation water heater and
• Figure 5 shows a basic logic circuit.

Here, the same reference symbols denote the same details.

A control, regulating and monitoring system 1 is connected via two lines 2 and 3 to a gas control device 4 which is inserted into a gas line 5 between a gas connection 6 and a gas burner 7. An ignition electrode 8 and a flame sensor 10 are assigned to the burner 7, the electrode 8 being connected to the control system 1 via a line 9 and the flame sensor 10 via a line 11. A heat exchanger 12 of the circulating water heater shown is located above the burner 7. The heat exchanger is provided with a flow line 13 against which two temperature sensors 14 and 15 are connected, which are connected to the control system 1 via lines 16 and 17. A pump 19 connected to the control system 1 via a line 18 and provided with an electric motor ensures that the heating water is circulated via the supply line 13, the return line 20, the heat exchanger 12 and the heating system 21 to be heated.

The structure of the control, regulating and monitoring system 1 is shown in FIG. A microcomputer system A with the reference symbol 22 is connected to a safety shutdown device 28 via a control line 23a, 23b and a feedback line 24. A second identical microcomputer system B with the reference numeral 25 is connected to the same safety shutdown device 28 via a control line 26a, 26b and a feedback line 27. The microcomputer systems 22 and 25 can exchange data via a bidirectional interface 29. Each microcomputer system has a program for self-monitoring, the self-monitoring module 30 or 31. The microcomputer system 22 is assigned an additional circuit for running time monitoring, the running time monitoring module 32, which also acts on the safety shutdown device 28 via a line 33. The safety shutdown device 28 is supplied with voltage from a network or a battery via the line 34. All final stages of actuators, the gas valve final stage 35, the gas flow setting final stage 45, the pump final stage 36 and the ignition device 37 are supplied with voltage by the safety shutdown device 28 via a line 38. The gas valve output stage 35 is from the microcomputer system 22 via line 50, the pump output stage 36 from the microcomputer system 25 the line 51 and the ignition device 37 are controlled by the microcomputer system 25 via the line 52. The output signal of the gas valve output stage 35 is reported back to the microcomputer system 22 via a line 39 and to the microcomputer system 25 via a line 40. The state of the pump output stage 36 and the ignition device 37 are reported to the microcomputer system 25 via lines 46 and 47, respectively. The gas valve output stage 35 is connected via line 2, the pump output stage 36 via line 18 and the ignition device 37 via line 9 to the circulating water heater. Via line 16 the microcomputer system 22, via line 17 the microcomputer system 25 receives information from the circulating water heater. The signal of line 11 is processed by flame monitor 41 and made available to microcomputer systems 22 and 25 via lines 42 and 43. Via the inputs 44 a and 44 b, the microcomputer systems 22 and 25 receive additional parameters necessary for the regulation and control, which, however, are not explained in more detail here (flow temperature regulation, return temperature regulation, process water temperature regulation and the like). Both microcomputer systems 22 and 25 are connected to the interference suppressor 49 via the lines 48 a and 48 b. An output stage for gas flow control 45 is assigned to the microcomputer system 25, which in turn is coupled via line 3 to the gas control device 4, which is a proportional gas valve.

FIG. 3 shows the structure of the safety shutdown device 28. The lines 23 a, 26 a and 33 lead to a link 60, the lines 23 b and 26 b to a further link 61. An output of the link 60 controls a winding of a normally open relay 62 a . The link 61 controls a winding of a normally closed relay 63 a. The line 34 is connected to a fuse 64, the second pole of which is led to the first pole of the normally open relay contact 62 b. The second pole of the normally open relay contact 62 b is connected to the first pole of the normally closed relay contact 63 b and the lines 24, 27 and 38. The second pole of the normally closed relay contact 63 b is grounded. A resistor 65 is connected in parallel with the contact of the normally open relay 62 b. Supply voltage 34 is routed to the side of fuse 64 facing away from normally open relay contact 62 b.

The circulating water heater shown in the drawings or the control method works as follows:

The control, regulating and monitoring system 1 consists of two independent microcomputer systems 22 and 25, that perform the same security-related but different non-security-related tasks. The first includes the functions of the temperature limiter (the temperature on the flow line 13 must not exceed a certain value), the function of the burner control (after opening the gas valve 4, a flame must be reported after a certain time, which is the safety time, otherwise there is a closing of the gas valve and a fault message), the control and monitoring of the safety time shutdown device 28 and the monitoring of fault states. Additional sensors and actuators also monitor for a lack of water (enough water throughput through the heat exchanger 12), a monitoring of the air supply (if there is sufficient air throughput through the combustion shaft of the circulating water heater, which corresponds to the set gas throughput), and monitoring for the exhaust gas to escape ( A flow safety device is located above the heat exchanger; if exhaust gas exits through its openings - except in the chimney - the circulating water heater must be stopped) and monitoring of any flue gas flap in the exhaust pipe to the chimney. The control system 1 fulfills the flow temperature control, possibly also hot water temperature control, for non-safety-related tasks or a burner output control. Additional sensors can also be used to implement weather-compensated flow or return temperature control.

The microcomputer systems 22 and 25 exchange the detected input variables, i.e. flame detection, exhaust gas outlet, flow temperature as well as the determined intermediate and output variables (necessary position of the gas valve or igniter in operation) via the bidirectional interface 29. If there are contradictions between the results of both microcomputer systems, the operation of the circulation water heater is prevented. The safety-relevant input variables, that is the temperature at the heat exchanger outlet in the flow line 13, detected by the temperature sensors 14 and 15, the signal from the interference suppressor 49, the feedback on the lines 24, 27 of the safety shutdown device 28 and the gas valve output stage 39, 40 and the signal of the flame monitor 41 are read by both microcomputer systems 22 and 25. Two temperature sensors are therefore used to measure the temperature at the heat exchanger outlet because they do not have a fail-safe behavior. This means that a failure would certainly be recognizable at the latest during the next shutdown or start-up phase. Since the If other input variables 39, 40, 41 and 49 are obtained in a fail-safe manner, it is possible to supply these two microcomputer systems, although decoupling must be ensured. The non-safety-relevant input variables, including the inputs 44 a for the microcomputer system 22 and the inputs 44 b and for the feedback signals 46 and 47 for the microcomputer system B, are each recorded by only one microcomputer system. The gas valve output stage 35, that is the output stage which acts directly on the gas release, is controlled by the microcomputer system 22, but is checked by both microcomputer systems 22 and 25 via the feedback lines 39 and 40. All other output stages, the pump output stage 36, the ignition device 37 and the gas flow control 45 are only controlled by the microcomputer system 25. The state of the pump output stage 36 is monitored via line 37, the state of the ignition device via line 47. The runtime monitoring module 32 is triggered cyclically by the microcomputer system 22. If the trigger pulses fail to appear, the operation of the circulating water heater is prevented. The self-monitoring modules 30 and 31 cyclically test the components, which are erasable and non-erasable memories, the central unit of the microcomputer and the input and output circuitry of the microcomputer systems. If one fails These components prevent the circulation water heater from operating. If the maximum temperature at the heat exchanger outlet is exceeded or if an unauthorized state according to DIN 4788/3 (flame monitoring device) is reached, the operation of the circulating water heater is prevented. The operation of the circulating water heater is prevented by blocking all output stages 35, 36, 37 and 45 and by switching off the safety shutdown device 28 via the control line 23 a, 23 b, 26 a and 26 b. Pressing the reset button 49 can suppress interference that was not caused by an error in the control unit (1), which means that operation is then possible again.

The safety shutdown device 28 provides the output stages 35, 36, 37 and 45 with the supply voltage via the relay make contact 62b. The relay closer contact 62 b is only closed when both microcomputer systems 22 and 25 give their release via the control lines 23 a and 26 a and the runtime monitoring 32 via the line 33. With the relay opener contact 63 b, which only opens when it is controlled by both microcomputer systems 22 and 25 via the control lines 23 b and 26 b, the supply voltage 34 can be short-circuited to ground. Through the resistance 65, the position of the relay opener contact 63 b can be determined when the relay closer contact 62 b is open. When the safety shutdown device 28 is switched on normally, the following sequence is followed. Switching off takes place by blocking (passive setting) the control lines 23 a, 26 a, 23 b and 26 b.

Sequence table:

Control line (23 a) (23 b) (26 a) (26 b) OUT passive passive passive passive Step 1 passive active passive passive 2nd step passive passive passive active 3rd step active passive passive passive 4th step passive passive active passive 5th step passive active passive active A active active active active

In steps 1 to 5, the feedback lines 23 and 27 must not report a signal, since otherwise there is an error in the safety shutdown device 28, the control lines 23 a, 23 b, 26 a and 26 b or the feedback lines 23 and 27.

• 1. Bei einer Verschweißung des Relaisschließerkontaktes 62 b wird durch den oben beschriebenen Ablauf die Sicherung 64 zerstört.
• 2. Bei einem in der Anlaufphase der Sicherheitsabschalteinrichtung 28 festgestellten Fehler oder bei sicherheitskritischen Ausfällen des Systems, zum Beispiel Kurzschluß in der Gasventilendstufe 35, kann die Sicherung 64 definiert zerstört werden und damit die Inbetriebnahme des Umlaufwasserheizers ohne Zeitbegrenzung verhindert werden.

In combination with fuse 64, the following two tasks result for relay break contact 63 b:

• 1. When the relay closer contact 62 b is welded, the fuse 64 is destroyed by the sequence described above.
• 2. In the event of an error detected in the start-up phase of the safety shutdown device 28 or in the event of safety-critical failures of the system, for example a short circuit in the gas valve output stage 35, the fuse 64 can be destroyed in a defined manner and thus the start-up of the circulation water heater can be prevented without a time limit.

FIG. 4 shows a basic circuit diagram of a circulation water heater I. Modern circulation water heaters are controlled and regulated by a microprocessor, so that it makes sense to transfer safety tasks to the microcomputer in addition to the control and regulation tasks. Control processes for reducing the residual heat or for releasing the renewed heat supply can therefore also be transmitted to microprocessors, so that, for example, the circuit according to FIG. 5 can also be represented as a software program of microcomputers.

A circulating water heater I has a stainless steel finned heat exchanger 12 which is heated by a burner 7 and which a return line 105 provided with a pump 19 and a flow line 13 provided with a priority changeover valve 106 are connected, the latter having two temperature sensors 14 and 15 which are connected to measuring lines 16 and 17 which are connected to inputs of a control, regulation and Lead monitoring unit 1. After the priority changeover valve 106, which can be actuated by a servo drive 103, the flow line 13 continues into a heating flow line 114 and a flow line 115 for a process water secondary heat exchanger 116. The priority changeover valve 106 can assume two positions; when line 114 is opened, line 115 is closed and vice versa. The flow line 114 leads to a heating system, not shown, and back via a heating return line 20 to a union point 118, to which the return line 105 is connected. The hot water heat exchanger 116 is followed by a hot water return line 119, which likewise leads to the union point 118. The domestic water heat exchanger 116 and the line 119 are arranged within the housing of the circulating water heater I. Upstream and downstream of the pump 19, two pressure lines 120 and 121 are provided which lead to a membrane switch 122 which controls a gas valve 124 located in a gas line 5 to the burner 7.

A second gas valve 125 is arranged in the line 5 between the valve 124 and the burner 7 and is controlled by a magnetic coil 126 which is connected to the control unit 1 via a control line 127. Associated with the burner is an ignition electrode 8, which is supplied with ignition energy from an ignition device 37 via a line 9, the ignition device 37 being acted upon by the control unit via a line 131. An ionization electrode 10 is connected via a line 11 to a flame detection device 134, which reports a flame signal or no flame signal back to the control unit 1 via a line 135. The pump 19 is assigned a drive motor 136, which receives its energy from the control unit via a line 18.

There are circulating water heaters that remove the exhaust gas via the convection path via a flow safety device (not shown) and an exhaust pipe, but there are also those that work with fan support. In this case, an exhaust gas fan 138 is provided, which is arranged in the exhaust gas flow of the exhaust pipe downstream of the heat exchanger 12. This has a drive motor 139, which receives its drive energy from the control unit 1 via a line 140. The servo motor 113 of the priority switch valve 106 draws its actuating energy via a line 141 in the same way from the control unit. A tap water line 142, which comes from a cold water network, leads through the hot water heat exchanger 116, leads through the heat exchanger 116 and is provided with a water switch 143 before it comes to a tap valve 144. The water switch is able to determine whether water throughput takes place through line 142 and reports a corresponding signal via line 145 to the control unit.

The control, regulating and monitoring unit 1 is assigned a temperature limiter unit 146, both of which are connected to one another via a line bundle 147, the actual value of the flow temperature being transmitted from the control unit to the temperature limiter and from the temperature limiter to the control unit, the possible switch-off and fault commands will.

Lines 135, 145, 127 and 18 are routed to the temperature limiter as inputs. A reset button 49 is also provided, which is connected to the temperature limiter via a line 149. A limit value sensor 150 is provided for the flow temperature, with which an adjustable limit value can be specified, specifically via a line 151 to the temperature limiter 146. If a fan 138 is present, an output 152 for controlling the fan is provided, which is connected to line 140 is connected. The function of the circuit shown is now illustrated in more detail with reference to FIG. 5:

An oscillator 160 is initially provided, which delivers a pulse voltage with a specific frequency at its output 161. The frequency is assumed to be 10 Hertz. The oscillator 160 is connected to a binary counter 162, to which a comparator 163 is assigned. A negated erase input 164 of the counter 162 is connected to the line 145, which also leads to an input of an AND gate 165, the negated input 166 of which forms the output of the comparator 163. An output 167 of the AND gate forms a negated input 168 of a further AND gate 169, on the output 170 of which a switch-off command for the entire circulating water heater I can appear. A switch-off command here means that the solenoid valve 125 is de-energized, the motor 136 for the pump 19 is de-energized. The other input 171 of the AND element 169 is formed by an output 172 of a comparator 173, the inputs of which are connected to line 151 and to the other the lines 16 or 17 are connected. The higher of the measured values of the lines 16 or 17 is taken, which can be determined via a further comparator, not shown here is. The output 172 is connected via a line branch to an input 174 of an AND gate 175, the output of which forms the line 152. Line 172 forms a further input 176 of a further AND gate 177, the output 178 of which forms a set input of a bistable multivibrator 180, whose output 181 forms the other input 182 of the AND gate 175 and a line 183 carrying a fault signal.

Finally, the output 172 is connected to a negated input 184 of an AND gate 185, the other input of which is formed by the line 149 and the output 186 of which is connected to the reset input of the bistable multivibrator 180. An OR gate 187 is provided, the three inputs of which are connected to lines 127, 135 and 18 and the output 188 of which forms the other input 189 of the AND gate 177.

Lines 170 and 183 are part of line bundle 147 and carry signals from temperature limiter 146 to control unit 1.

The function is as follows:
It is assumed that the circulating water heater supplies process water. This means that the nozzle valve 144 is more or less open, that the priority changeover valve 106 connects line 13 to line 115, pump 19 runs, both valves 124 and 125 are open, burner 7 burns and flame detection device 134 outputs a flame detection signal on line 135. The heat generated by the burner 7 is thus transferred in the heat exchanger 12 to the heating water and from there in the process water heat exchanger 116 to the process water in line 142. A flow temperature is set, which varies between 50 and 80 ° depending on the desired hot water temperature.

If the nozzle 144 is now closed, the water switch 143 registers “no water”. As a result, a corresponding signal on line 145 is sent to both control unit 1 and safety temperature limiter 146. The control unit 1 causes the solenoid valve 125 to close and the drive motor 136 of the circulating pump 19 to be shut down via the lines 127 and 137. The burner thus goes out, and the heat stored in the heat exchanger 12 can no longer be dissipated due to the pump being stopped. The temperature of the water in the flow line 13 rises considerably, it should be noted here that the temperature sensors 14 and 15 are located directly on the heat exchanger 12 in the flow line are arranged. The rising temperature is reported to the control unit 1 and likewise to the temperature limiter 146. In the temperature limiter, the increasing actual flow temperature value is compared with the limit value specified by the limit transmitter 150 and the line 151.

This is done as follows:
Until the nozzle is closed, the circuit according to FIG. 5 has the following function:
The higher of the two values supplied by the sensors 14 and 15 is connected to the comparator 173, the comparison with the switch-off limit value 150 means that the line 172 leads logically "zero". There is a signal on lines 127, 135 and 18 so that output 188 is logic "one", and gate 177 is blocked because only one input is logic "one". There is therefore no interference signal, no fan signal and no shutdown signal. If a fan is present, the fan is operated by a control signal from control unit 1.

If the nozzle 144 is now closed, a corresponding signal appears on the line 145, so that the counter reading of the counter 162 is reached via the clearing input 164 is deleted. Since there is no longer a signal on lines 127, 135 and 18, a fault message cannot be issued, even if the actual flow temperature value rises above the limit value, since input 189 of AND element 177 is no longer activated. If there is a renewed tap of hot water in this state, this is released for a limited period of time: The renewed tap of hot water releases the extinguishing input 164 of the counter 162, so that it now begins to count. It runs up to a counter reading which is set in the comparator 163. This is a period of around a few seconds. The time is calculated so that it corresponds to the time within which the residual heat is dissipated by the heat exchanger. After this time, the temperature sensors 14 and 15 would have to measure relatively cool flow temperature water again. The comparator 173 is tilted when it is switched off because the actual flow temperature value has exceeded the limit value due to the residual heat. After the counter delay time has elapsed, the AND gate 169 becomes conductive because its two inputs are live, and then a switch-off signal appears on line 170. If the residual heat is properly dissipated, the comparator 173 tilts back and enables the device to continue operating. This circuit can thus be used to determine whether it is merely a case of post-heating acted or a long-standing disorder. If the residual heat has been dissipated within the delay time, the control unit is released again for normal operation via line 170.

The temperature limiter function is as follows:
If the actual value of the flow temperature reported by temperature sensors 14 and 15 rises above the set flow temperature limit (set on limit transmitter 150), the comparator 173 tilts in any case. This is irrespective of whether this is the case during normal operation with hot water preparation or heating occurs or in the event of a flame cut. This means that voltage or a signal is logically "one" at input 176 of AND gate 177. The fault is only recognized and reported as a fault if one of the lines 127, 135 and 18 is live. One must then assume that an intended operation of the device is desired, but then the temperature increase of the flow line represents an impermissible operating state, which is a safety case. Then the second input 189 of the AND gate 177 carries voltage, the AND gate 177 switches through and sets the bistable multivibrator 180. This causes a fault signal on line 183, so that the control unit 1 blocks the operation of the circulating water heater.

This blocking means that the magnet 126 and the pump drive motor 136 become de-energized. However, since the fault signal is also located above an input 182 of the AND element 175 and because the input 174 is already live due to the tilting of the comparator 173, the motor 139 of the fan 138 receives Voltage and tries to dissipate the heat at the heat exchanger 12 by passing cold air through the heat exchanger 12 until the comparator 173 tilts back again. The interference can be suppressed by pressing the reset button 49 via line 149, since then the reset input of the bistable multivibrator 180 receives voltage via line 186. However, this is only possible if the temperature is below the switch-off temperature, since the output 172 of the comparator 173 is at the negated input 184 of the AND gate 185.

Claims (9)

1. A method of controlling and monitoring a fuelfiring appliance, particularly a circulating water heater, by means of a control, automatic control and monitoring system (1), which comprises two microprocessor systems (22, 25), each of which is arranged to receive those input signals which are relevant for safety, such as for flame detection, temperature limitation, and for monitoring the supply of water and the flow of air and exhaust gas, each microcomputer system (22, 25) for itself computes the corresponding control signals and an output signal will not be delivered to the corresponding end stages (35, 36, 37, 45) unless the control commands of both microcomputer systems (22, 25) are identical, and, in addition, each microcomputer system (22, 25) is independently adapted to de_energize all end stages (35, 36, 37, 45) by means of a safety shutdown stage (28) and thus to convert the fuelfiring appliance to the safe state, characterized in that
      in case of faults in the control, automatic control and monitoring system (1) all end stages (35, 36, 37 and 45) are shut down for the duration of the fault,
      in case of harmless faults in the fuelfiring appliance, such as a shortage of water, all end stages (35, 36, 37 and 45) are shut down until the means for applying a voltage from the power supply system are turned off or on,
      in case of dangerous faults in the fuelfiring appliance, such as an excessive temperature rise at the heat exchanger, all end stages (35, 36, 37, 45) are shutdown until the interlock has been eliminated by means of a fault-clearing pushbutton (49), and
      in case of faults in the safety shutdown stage (28) or defects in the gas valve end stage (35) all end stages (35, 36, 37, 45) are shut down for an unlimited time.
2. A method according to claim 1, characterized in that command or control functions which are not relevant for safety are assigned to the microcomputers (22, 25) in such a manner that the two microcomputers (22, 25) are uniformly utilized.
3. A method according to claim 1 or 2, characterized in that for the control of a circulating water heater its flow line temperature, pump operation, closed and open state of the fuel valve, and flame detection are sampled and a rise of the flow line temperature above a limit is permitted for a short time when no flame and no operation of the pump (19) and of the fuel valve (125/126) are indicated.
4. A method according to claim 3, characterized in that for the control of a circulating water heater which comprises a secondary heat exchanger (116) for tap water a voltage is applied to the pump (19) for a certain delay time whereas the supply of fuel is not permitted and that the supply of fuel is permitted when the delay time has elapsed, provided that the actual value of the flow line temperature is below the selected limit.
5. A method according to claim 3 or 4, characterized in that in case of a fault residing in that the flow line temperature exceeds the limit in a fan-assisted circulating water heater merely the motor (139) of the fan (138) is energized until the actual value of the flow line temperature is below the limit.
6. An apparatus for carrying out the method according to any of claims 1 to 5 in a fuelfiring appliance, particularly a circulating water heater, which comprises a heat exchanger (12) that is heated by a burner (7), a circulating pump (19), solenoid valves for supplying fuel to the burner (7), an igniting device (8) and a flame detector (10) as well as a multiplicity of sensors and pickups for detecting information concerning the temperature, throughput, and mode of operation of the appliance, wherein all functions for the automatic control, for ensuring the safety and for the continuous control of the combustion and of the water throughput are performed by a control, automatic control and monitoring system (1), which comprises two microcomputer systems (22, 25), by which the values indicated by the sensors and pickups are processed, converted and compared with preselected stored values, wherein the two microcomputer systems (22, 25) are interconnected by data exchange connections (29) and the outputs of the microcomputer systems (22, 25) are connected by control lines (23a, 23b, 26a, 26b) to a safety shutdown stage (28), which controls the application of the supply voltage (34) to the end stages (35, 36, 37, 45), wherein the activation of the safety shutdown stage (28) by one of the microcomputers (22 or 25) is sufficient for a shutdown of the controlled appliance, characterized in that both microcomputer systems (22, 25) have inputs to which a signal coming from a fail-safe pickup (41) is delivered in parallel and/or to which the non-safe sensors (14, 15) are connected by separate lines (16, 17) without a feedback.
7. An apparatus according to claim 6, characterized in that the safety shutdown stage (28) consists of a series circuit between a fuse (64), a make contact (62b), which is bridged by a resistor (65), and a break contact (63b) in series therewith, a reference voltage (34, ground) is applied to said series circuit at both ends, and the end stages (35, 36, 37, 45) are connected to the junction between the two contacts (62b, 63b).
8. An apparatus according to any of claims 6 to 7, characterized in that feedback lines (24, 27) are provided, which are parallel to the control lines (23a, 23b, 26a, 26b) and adapted to indicate the failure of any component (64, 65, 62b, 63b, 62a, 63a) of the safety shutdown stage (28), and the detection of a defect has the result that a signal train on the control lines (23a, 23b, 26a, 26b) inhibits for an unlimited time the application of the voltage by the safety shutdown stage (28) via the line (38) to all end stages (35, 36, 37, 45).
9. An apparatus according to claim 8, characterized in that a defect is assumed to exist when the control lines (23a, 23b, 26a, 26b) are disabled and the feedback lines (24, 27) deliver a signal or when the control lines (23a, 26a, 26b) are disabled and the control line (23b) is enabled and the feedback lines (24, 27) deliver a signal or when the control lines (23b, 26a, 26b) are disabled and the control line (23a) is enabled and the feedback lines (24, 27) deliver a signal or when the control lines (23a, 23b, 26b) are disabled and the control line (26a) is enabled and the feedback lines (24, 27) deliver a signal or when the control lines (23a, 26a) are disabled and the control lines (23b, 26b) are enabled and the feedback lines (24, 27) do not deliver a signal or when the control lines (23a, 23b, 26a, 26b) are enabled and the feedback lines (24, 27) do not deliver a signal.

Images