EP0508081B1 - Circuit and method for monitoring a fuel-heated apparatus - Google Patents

Circuit and method for monitoring a fuel-heated apparatus Download PDF

Info

Publication number
EP0508081B1
EP0508081B1 EP92103323A EP92103323A EP0508081B1 EP 0508081 B1 EP0508081 B1 EP 0508081B1 EP 92103323 A EP92103323 A EP 92103323A EP 92103323 A EP92103323 A EP 92103323A EP 0508081 B1 EP0508081 B1 EP 0508081B1
Authority
EP
European Patent Office
Prior art keywords
circuit
control unit
safety
valve
safety circuit
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Expired - Lifetime
Application number
EP92103323A
Other languages
German (de)
French (fr)
Other versions
EP0508081A2 (en
EP0508081A3 (en
Inventor
Hans-Jochen Dr.-Ing. Schwarz
Klaus Krieger
Markus Dipl.-Ing. König (FH)
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Robert Bosch GmbH
Original Assignee
Robert Bosch GmbH
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Robert Bosch GmbH filed Critical Robert Bosch GmbH
Publication of EP0508081A2 publication Critical patent/EP0508081A2/en
Publication of EP0508081A3 publication Critical patent/EP0508081A3/en
Application granted granted Critical
Publication of EP0508081B1 publication Critical patent/EP0508081B1/en
Anticipated expiration legal-status Critical
Expired - Lifetime legal-status Critical Current

Links

Images

Classifications

    • F—MECHANICAL ENGINEERING; LIGHTING; HEATING; WEAPONS; BLASTING
    • F23—COMBUSTION APPARATUS; COMBUSTION PROCESSES
    • F23N—REGULATING OR CONTROLLING COMBUSTION
    • F23N5/00—Systems for controlling combustion
    • F23N5/24—Preventing development of abnormal or undesired conditions, i.e. safety arrangements
    • F23N5/242—Preventing development of abnormal or undesired conditions, i.e. safety arrangements using electronic means
    • F—MECHANICAL ENGINEERING; LIGHTING; HEATING; WEAPONS; BLASTING
    • F23—COMBUSTION APPARATUS; COMBUSTION PROCESSES
    • F23N—REGULATING OR CONTROLLING COMBUSTION
    • F23N5/00—Systems for controlling combustion
    • F23N5/20—Systems for controlling combustion with a time programme acting through electrical means, e.g. using time-delay relays
    • F23N5/203—Systems for controlling combustion with a time programme acting through electrical means, e.g. using time-delay relays using electronic means
    • F—MECHANICAL ENGINEERING; LIGHTING; HEATING; WEAPONS; BLASTING
    • F23—COMBUSTION APPARATUS; COMBUSTION PROCESSES
    • F23N—REGULATING OR CONTROLLING COMBUSTION
    • F23N2223/00—Signal processing; Details thereof
    • F23N2223/08—Microprocessor; Microcomputer
    • F—MECHANICAL ENGINEERING; LIGHTING; HEATING; WEAPONS; BLASTING
    • F23—COMBUSTION APPARATUS; COMBUSTION PROCESSES
    • F23N—REGULATING OR CONTROLLING COMBUSTION
    • F23N2223/00—Signal processing; Details thereof
    • F23N2223/22—Timing network
    • F—MECHANICAL ENGINEERING; LIGHTING; HEATING; WEAPONS; BLASTING
    • F23—COMBUSTION APPARATUS; COMBUSTION PROCESSES
    • F23N—REGULATING OR CONTROLLING COMBUSTION
    • F23N2227/00—Ignition or checking
    • F23N2227/12—Burner simulation or checking
    • F23N2227/14—Flame simulation
    • F—MECHANICAL ENGINEERING; LIGHTING; HEATING; WEAPONS; BLASTING
    • F23—COMBUSTION APPARATUS; COMBUSTION PROCESSES
    • F23N—REGULATING OR CONTROLLING COMBUSTION
    • F23N2227/00—Ignition or checking
    • F23N2227/12—Burner simulation or checking
    • F23N2227/16—Checking components, e.g. electronic
    • F—MECHANICAL ENGINEERING; LIGHTING; HEATING; WEAPONS; BLASTING
    • F23—COMBUSTION APPARATUS; COMBUSTION PROCESSES
    • F23N—REGULATING OR CONTROLLING COMBUSTION
    • F23N2227/00—Ignition or checking
    • F23N2227/36—Spark ignition, e.g. by means of a high voltage
    • F—MECHANICAL ENGINEERING; LIGHTING; HEATING; WEAPONS; BLASTING
    • F23—COMBUSTION APPARATUS; COMBUSTION PROCESSES
    • F23N—REGULATING OR CONTROLLING COMBUSTION
    • F23N2229/00—Flame sensors
    • F—MECHANICAL ENGINEERING; LIGHTING; HEATING; WEAPONS; BLASTING
    • F23—COMBUSTION APPARATUS; COMBUSTION PROCESSES
    • F23N—REGULATING OR CONTROLLING COMBUSTION
    • F23N2231/00—Fail safe
    • F23N2231/10—Fail safe for component failures
    • F—MECHANICAL ENGINEERING; LIGHTING; HEATING; WEAPONS; BLASTING
    • F23—COMBUSTION APPARATUS; COMBUSTION PROCESSES
    • F23N—REGULATING OR CONTROLLING COMBUSTION
    • F23N2235/00—Valves, nozzles or pumps
    • F23N2235/12—Fuel valves
    • F23N2235/14—Fuel valves electromagnetically operated
    • F—MECHANICAL ENGINEERING; LIGHTING; HEATING; WEAPONS; BLASTING
    • F23—COMBUSTION APPARATUS; COMBUSTION PROCESSES
    • F23N—REGULATING OR CONTROLLING COMBUSTION
    • F23N2235/00—Valves, nozzles or pumps
    • F23N2235/12—Fuel valves
    • F23N2235/18—Groups of two or more valves

Definitions

  • the invention relates to a circuit and a method according to the preamble of the preamble in claim 1 and 17, respectively.
  • a method and a device for monitoring a fuel-heated device are known, in which safety-relevant input signals simultaneously entered into two microcomputer systems, used independently in each microcomputer and then the resulting output signals are compared.
  • the conformity of the output signals represents a verifiable criterion for the faultless functioning of the control.
  • each microcomputer system has the option of disconnecting all output stages and actuators with the help of a safety shutdown.
  • This system in which two independently working microcomputers have to be coordinated with one another, is complex in terms of both hardware and software. Furthermore, this type of circuit has the disadvantage that, in the event of errors in the sensors or actuators, there is no direct possibility of switching off the entire system without a microcomputer causing this.
  • the circuit arrangement according to the invention with the characterizing features of independent claim 1 has the advantage that in the event of errors in the safety-relevant circuit parts, the safety circuit, which switches the device off immediately, is acted upon.
  • the circuit arrangement also makes it possible to check these circuit parts for error states without having to use a second microcomputer.
  • simple logical elements such as. B. AND, OR, NAND elements, etc. used. These elements have the advantage that, compared to a microcomputer, they are simpler, cheaper and can be safely controlled.
  • the signal emitted by the safety circuit to the control unit is emitted with a delay compared to the switch-off signal of the safety circuit to the valve, it is possible to check various paths acting on the control circuit, which cause a switch-off if necessary, by means of targeted false information.
  • an error is simulated with defined signals that are detected by the safety circuit in response to the signal to the control unit and within the From EP-A 308 831 a circuit arrangement for operating a fuel-heated device is known, which contains a control unit and a flame monitoring device.
  • the control unit which controls the fuel-heated device is implemented as a microcomputer which, depending on the operating program, emits a control signal to a switching stage which opens or blocks a solenoid valve arranged in a gas line.
  • the control signal can be emitted to the switching stage which blocks the solenoid valve.
  • the flame monitoring device is independent of the microcomputer and, if necessary, provides a signal which is used immediately in the event of a flame failure to switch off the solenoid valve. Feeding the output signal of the flame monitoring device into the microcomputer or into another circuit arrangement is not provided.
  • the invention has for its object to provide a circuit arrangement and a method for monitoring a fuel-heated device, which enable high operational reliability with simple circuitry means.
  • connection of the outputs of the valve checking device and the device for checking the flame monitoring device by means of a linking element, the output of which acts on the safety shutdown, makes it possible to check each actuation path of one or more valves. If, moreover, the control unit is able to briefly hide the flame detection signal during operation, this route can also be checked for possible errors.
  • control unit is connected to the safety circuit via a device monitoring the control unit and a line is branched from the line between this device and the safety circuit and leads to the control unit via an AND gate, this device can detect operational errors in the control unit. Furthermore, if this device is prevented from acting on the control unit, both this device and the route from the control unit via this device to the safety circuit can be subjected to an error check through deliberate misinformation.
  • the control unit By integrating a device checking the voltage applied to the control unit into the circuit arrangement, the control unit can be brought into a defined state if the voltage supply is faulty. If, in addition, the safety circuit acts on this device, it is possible, by triggering the safety switch, to influence this device in such a way that it keeps the control unit in the defined state.
  • FIG. 2 shows the integration of a device checking the voltage applied to the control unit into part of the circuit according to FIG. 1 and
  • FIG. 3 shows an exemplary embodiment of this device.
  • An exemplary embodiment of the safety circuit is shown in FIG.
  • FIG. 1 shows a control unit 10 which is connected to solenoid valves 16, 18 via lines 12, 14 and which in turn is connected to a current / voltage supply 24 via lines 20, 21.
  • the solenoid valves 16, 18 act on a gas supply line 22 which leads to a burner 23 and are connected in series with one another.
  • a line 26 also goes from the control unit 10 to a device 28 which checks the control unit 10, hereinafter referred to as the watchdog, the output of which is connected to a safety circuit 32 via a line 30.
  • Watchdogs are well known and check periodic events within a given time window, e.g. B. the periodicity of trigger pulses.
  • a line 34 branches off from line 30 and leads to a first input of an AND gate 36.
  • the second input is connected to the control unit 10 via a line 38 and the output is returned to the control unit 10 via a line 40.
  • the control unit 10 is connected to the safety circuit 32 via lines 42, 43.
  • Test device 46 for the flame monitoring device 47 is also connected to the controller 10.
  • the test device 46 is implemented by a simple AND gate. However, structures with a more complex structure that process a larger amount of data are also conceivable.
  • a line 48, which leads from the flame monitoring device 47, is connected to the line 45.
  • the output of the AND gate 46 is negated to an input of a further AND gate 50, the output of which is connected to the safety circuit 32 via a line 52.
  • the second input of this AND gate 50 is connected to the output of a valve checking device 54 in the form of an OR gate and its inputs to the solenoid valves 16 and 18.
  • the safety circuit 32 is mechanically connected to a switch 55, which makes it possible to interrupt the line 20.
  • FIG. 2 shows how a device 56, which checks the voltage applied to the control unit 10, is installed in the circuit arrangement according to FIG. 1 (only shown in part).
  • the line 40 is led from the AND gate 36 to a first input of an OR gate 58, the output of which is connected to the control unit 10.
  • the output 72 of the device 56 is connected to the second input.
  • a line 60 leads from the safety circuit 32 to the device 56, for which a current / voltage supply 62 is also provided.
  • FIG. 3 An embodiment of the device 56 as an undervoltage detector is shown in FIG. 3, the core of which is formed by a comparator 64, which has a positive input with a reference voltage source 66 and a negative input via a line 67, a diode 68 and a line 60 with the line 20 connected is.
  • the line 67 is also connected to the center tap of a voltage divider 70, 71 and this to the power supply 62.
  • the output 72 of the comparator leads to the OR gate 58.
  • FIG. 4 An embodiment of the safety circuit 32 as a bimetal control is shown in Figure 4.
  • the line 20 leads via the switch 55 to a coil 77, the output of which is connected via a line 74 to the collector of a transistor 76.
  • the emitter of transistor 76 is connected to ground.
  • Parallel to the collector-emitter path is a voltage divider 78, 79, at the center tap of which line 43 branches off.
  • Lines 30, 42, 52 lead in parallel via diodes 80 to the base of transistor 76.
  • the solenoid valves 16, 18 are closed and there is no flame. If a heat request occurs, the control unit 10 first opens one of the solenoid valves 16, 18. This leads to the safety circuit 32 being energized via the OR gate 54 and the AND gate 50. This energization of the control unit 10 is indicated via line 43 . If there is no current supply, this control path must be defective, the control unit closes the valve again and supplies current to the safety circuit 32 via line 42.
  • the control unit 10 When functioning correctly, the control unit 10 opens the second of the valves 16, 18 and triggers the ignition. If the flame monitor 47 delivers a valid signal after the ignition via line 48, this leads via the AND gate 46 to the negated input of the AND gate 50. This prevents an output signal at 50, the energization of the safety circuit 32 is terminated and the heating is operating. If no flame signal appears within a safety time of approximately 10 seconds, the control unit 10 closes the solenoid valves 16, 18 and maintains the current supply to the safety circuit 32 until the switch 55 trips. A time of approximately 25 seconds usually elapses between the energization of the bimetal control 32 and the triggering of the switch 55.
  • the watchdog 28 is tested at constant time intervals (approx. 40 sec in the exemplary embodiment) by controlled false triggering.
  • the tests are carried out alternately with the trigger pulse period being too short and too long.
  • the control unit 10 "blocks" the AND gate 36 and thus prevents the watchdog 28 from bringing the control unit into a defined state during the check via the lines 34, 40.
  • the control unit 10 is thus able to check via the line 43 whether the watchdog 28 is energizing the safety circuit 32.
  • the test duration is shorter than the response time of the switch 55, so that it does not switch when the test is running correctly.
  • the AND gate 36 is "released" again.
  • the watchdog 28 Since the watchdog 28 is already energizing the safety circuit 32 during the test, the blocked AND gate 36 does not impair safety, even if an error should occur in the control unit 10 during test operation. In this case, the false triggering continues for the time of the test and the watchdog maintains the current on the safety circuit 32 until the switch 55 trips.
  • self-tests of the control unit 10 can be provided in such a way that the control unit 10 transfers itself to a defined state when errors occur and causes the safety circuit 32 to be energized via the line 42.
  • a first test to ensure that the safety circuit 32 was free from faults by means of a signal via line 52 was already carried out when the furnace was started.
  • a second test is also carried out at constant time intervals when the burner is switched on.
  • the control unit 10 "blocks" the AND gate 46 via the line 44 and thus simulates the failure of a flame detection signal.
  • the output signal of the AND gate 46 goes out, which leads to an input signal at the AND gate 50 via the negation. Since the solenoid valves 16, 18 are energized, the OR gate 54 also supplies a signal to the AND gate 50, which creates a signal on line 52.
  • the energization of the safety circuit 32 is in turn recognized by the control unit 10 via the line 43.
  • the effective flame detection signal on line 48 is tapped through line 45 and passed directly to control unit 10.
  • the device 56 which is constructed in the form of an undervoltage detector, monitors the supply voltage of the control unit 10 in such a way that when a certain threshold value is undershot, an output signal is sent to the control unit 10, thereby converting it into a defined state.
  • This output signal is advantageously connected to the output signal of the AND gate 36 via an OR gate 58.
  • the same input on the control unit 10 can be used as is also available to the watchdog circuit 28, 34, 36, 40.
  • a connection between the safety circuit 32 and the undervoltage detector 56 makes it possible to keep the control unit 10 in a defined state via the undervoltage detector 56 when the switch 55 is triggered.
  • the comparator 64 compares a reference voltage 66 with a partial voltage across the voltage divider 70, 71, which is derived from the current / voltage supply 62. As long as this partial voltage is greater than the reference voltage 66, there is no signal at the output 72. If the supply voltage 62 drops, the partial voltage drops above 71 and generates an output signal.
  • the influence of the safety circuit 32 on the undervoltage detector 56 can take place by a connection via a diode 68 between the center tap of the voltage divider 70, 71 and the line 20.
  • switch 55 When switch 55 is closed, the second (higher) supply voltage of the current / voltage supply 24 has no influence on the comparator 64 because of the diode 68.
  • the diode 68 is operated in the forward direction, as a result of which the voltage at the voltage divider 70, 71 drops and causes an output signal at output 72.
  • the circuitry implementation of the exemplary embodiments is possible in different ways.
  • the control unit is preferably implemented as a microcomputer. A discrete structure can also be provided in simpler devices.
  • the logical elements can be implemented as discrete modules, for example with AND and OR operations.
  • An integrated solution that includes all functions is particularly suitable.
  • implementation in relay technology can also be favorable.

Description

Stand der TechnikState of the art

Die Erfindung bezieht sich auf eine Schaltung und ein Vefahren nach der Gattung des Oberbegriffs im nach folgenden Anspruch 1 bzw. 17. Aus der DE-OS 39 23 773 sind ein Verfahren und eine Vorrichtung zum Überwachen eines brennstoffbeheizten Gerätes bekannt, bei denen sicherheitsrelevante Eingangssignale gleichzeitig in zwei Mikrocomputersysteme eingegeben, unabhängig voneinander in jedem Mikrocomputer verwertet und anschließend die daraus entstandenen Ausgangssignale verglichen werden. Die Übereinstimmung der Ausgangssignale stellt ein überprüfbares Kriterium für das fehlerfreie Funktionieren der Steurung dar. Außerdem verfügt jedes Mikrocomputersystem unabhängig über die Möglichkeit, mit Hilfe einer Sicherheitsabschaltung alle Endstufen und Stellglieder stromlos zu schalten.The invention relates to a circuit and a method according to the preamble of the preamble in claim 1 and 17, respectively. From DE-OS 39 23 773, a method and a device for monitoring a fuel-heated device are known, in which safety-relevant input signals simultaneously entered into two microcomputer systems, used independently in each microcomputer and then the resulting output signals are compared. The conformity of the output signals represents a verifiable criterion for the faultless functioning of the control. In addition, each microcomputer system has the option of disconnecting all output stages and actuators with the help of a safety shutdown.

Dieses System, bei dem zwei unabhängig voneinander arbeitende Mikrocomputer miteinander koordiniert werden müssen, ist sowohl in der Hardware als auch der Software aufwendig. Ferner haftet dieser Art der Schaltung der Nachteil an, daß bei auftretenden Fehlern in den Sensoren oder Stellglieder keine direkte Abschaltmöglichkeit der Gesamtanlage besteht, ohne daß ein Mikrocomputer dies veranlaßt.This system, in which two independently working microcomputers have to be coordinated with one another, is complex in terms of both hardware and software. Furthermore, this type of circuit has the disadvantage that, in the event of errors in the sensors or actuators, there is no direct possibility of switching off the entire system without a microcomputer causing this.

Vorteile der ErfindungAdvantages of the invention

Die erfindungsgemäße Schaltungsanordung mit den kennzeichnenden Merkmalen des unabhängen Anspruchs 1 hat den Vorteil, daß bei auftretenden Fehlern in den sicherheitsrelevanten Schaltungsteilen direkt auf die Sicherheitsschaltung eingewirkt wird, die das Gerät unmittelbar abschaltet. Die Schaltungsanordnung ermöglicht außerdem eine Überprüfung dieser Schaltungsteile auf Fehlerzustände, ohne daß ein zweiter Mikrocomputer eingesetzt werden müßte. Hierzu werden einfache logische Elemente, wie z. B. UND-, ODER-, NAND-Glieder usw. eingesetzt. Diese Elemente haben den Vorteil, daß sie gegenüber einem Mikrocomputer einfacher aufgebaut, billiger und sicher beherrschbar sind.The circuit arrangement according to the invention with the characterizing features of independent claim 1 has the advantage that in the event of errors in the safety-relevant circuit parts, the safety circuit, which switches the device off immediately, is acted upon. The circuit arrangement also makes it possible to check these circuit parts for error states without having to use a second microcomputer. For this, simple logical elements, such as. B. AND, OR, NAND elements, etc. used. These elements have the advantage that, compared to a microcomputer, they are simpler, cheaper and can be safely controlled.

Durch die in den abhängigen Ansprüchen aufgeführten Merkmale sind vorteilhafte Verbesserungen der Schaltungsanordnung gemäß dem unabhängigen Anspruchs 1 möglich.Advantageous improvements of the circuit arrangement according to independent claim 1 are possible due to the features listed in the dependent claims.

Die Abgabe eines Signals der Sicherschaltung an die Steuereinheit, das z. B. den Betriebszustand der Sicherheitschaltung anzeigt, ermöglicht, daß von der Steuereinheit aktiv die Brennstoffzufuhr geschlossen werden kann. Dadurch wird erreicht, daß bei einem Ausfall entweder der Sicherheitsschaltung oder des Abschaltweges der Sicherheitsschaltung ein Abschalten bewirkt wird. Zusätzlich kann eine Fehlermeldung nach außen abgegeben werden.The delivery of a signal of the safety circuit to the control unit, the z. B. indicates the operating state of the safety circuit, enables that the fuel supply can be actively closed by the control unit. This ensures that in the event of a failure of either the safety circuit or the shutdown path of the safety circuit, shutdown is effected. In addition, an error message can be given to the outside.

Wenn das von der Sicherheitsschaltung an die Steuereinheit abgegebene Signal gegenüber dem Abschaltsignal der Sicherheitsschaltung an das Ventil verzögert abgegeben wird, ist es möglich, verschiedene auf die Steuerschaltung wirkende Wege, die im Bedarfsfall eine Abschaltung bewirken, durch gezielte Falschinformation zu überprüfen. Hierzu wird mit definiert ausgegebenen Signalen ein Fehler simuliert, das von der Sicherheitsschaltung als Reaktion darauf abgegebene Signal an die Steuereinheit detektiert und innerhalb der Aus der EP-A 308 831 ist eine Schaltungsanordnung zum Betreiben eines brennstoffbeheizten Gerätes bekannt, die eine Steuereinheit sowie eine Flammenüberwachungseinrichtung enthält. Die Steuereinheit, die das brennstoffbeheizte Gerät steuert, ist als Mikrocomputer realisiert, der in Abhängigkeit vom Betriebsprogramm ein Steuersignal an eine Schaltstufe abgibt, die ein in einer Gasleitung angeordnetes Magnetventil öffnet oder sperrt. Bei einem vom Mikrocomputer festgestellten abnormalen Betriebszustand kann das Steuersignal an die Schaltstufe abgegeben werden, welches das Magnetventil sperrt. Unabhängig vom Mikrocomputer ist die Flammenüberwachungseinrichtung, die gegebenenfalls ein Signal bereitstellt, das bei einem Flammenausfall unmittelbar zum Abschalten des Magnetventils verwendet wird. Ein Einspeisen des Ausgangssignals der Flammenüberwachungseinrichtung in den Mikrocomputer oder in eine andere Schaltungsanordnung ist nicht vorgesehen.If the signal emitted by the safety circuit to the control unit is emitted with a delay compared to the switch-off signal of the safety circuit to the valve, it is possible to check various paths acting on the control circuit, which cause a switch-off if necessary, by means of targeted false information. For this purpose, an error is simulated with defined signals that are detected by the safety circuit in response to the signal to the control unit and within the From EP-A 308 831 a circuit arrangement for operating a fuel-heated device is known, which contains a control unit and a flame monitoring device. The control unit which controls the fuel-heated device is implemented as a microcomputer which, depending on the operating program, emits a control signal to a switching stage which opens or blocks a solenoid valve arranged in a gas line. In the event of an abnormal operating state determined by the microcomputer, the control signal can be emitted to the switching stage which blocks the solenoid valve. The flame monitoring device is independent of the microcomputer and, if necessary, provides a signal which is used immediately in the event of a flame failure to switch off the solenoid valve. Feeding the output signal of the flame monitoring device into the microcomputer or into another circuit arrangement is not provided.

Der Erfindung liegt die Aufgabe zugrunde, eine Schaltungsanordnung und ein Verfahren zum Überwachen eines brennstoffbeheizten Geräts anzugeben, die mit einfachen schaltungstechnischen Mitteln eine hohe Betriebssicherheit ermöglichen.The invention has for its object to provide a circuit arrangement and a method for monitoring a fuel-heated device, which enable high operational reliability with simple circuitry means.

Die Aufgabe wird durch die in den unabhängigen Ansprüchen 1 und 17 angegebenen Merkmale jeweils gelöst.The object is achieved in each case by the features specified in independent claims 1 and 17.

Verzögerungszeit der ursprüngliche Betriebszustand wiederhergestellt. Ein ungewolltes Abschalten wird auf diese Weise vermieden.Delay time of the original operating state restored. In this way, unwanted shutdown is avoided.

Das Verbinden der Ausgänge der Ventilüberprüfvorrichtung und der Vorrichtung zur Überprüfung der Flammenüberwachungseinrichtung mittels eines verknüpfenden Elements, dessen Ausgang auf die Sicherheitsabschaltung wirkt, ermöglicht, daß sich jeder Ansteuerweg eines oder mehrerer Ventile überprüfen läßt. Wenn außerdem die Steuereinheit in der Lage ist, das Flammendetektionssignal während des Betriebs kurzfristig auszublenden, läßt sich auch dieser Weg auf mögliche Fehler überprüfen.The connection of the outputs of the valve checking device and the device for checking the flame monitoring device by means of a linking element, the output of which acts on the safety shutdown, makes it possible to check each actuation path of one or more valves. If, moreover, the control unit is able to briefly hide the flame detection signal during operation, this route can also be checked for possible errors.

Ist die Steuereinheit über eine die Steuereinheit überwachende Vorrichtung mit der Sicherheitsschaltung verbunden und ist von der Leitung zwischen dieser Vorrichtung und der Sicherheitsschaltung eine Leitung abgezweigt, die über ein UND-Glied zur Steuereinheit führt, kann erreicht werden, daß diese Vorrichtung Betriebsfehler der Steuereinheit erkennt. Ferner kann, wenn verhindert wird, daß diese Vorrichtung auf die Steuereinheit einwirkt, durch gezielte Fehlinformation sowohl diese Vorrichtung, als auch der Weg von der Steuereinheit über diese Vorrichtung zur Sicherheitsschaltung einer Fehlerüberprüfung unterzogen werden.If the control unit is connected to the safety circuit via a device monitoring the control unit and a line is branched from the line between this device and the safety circuit and leads to the control unit via an AND gate, this device can detect operational errors in the control unit. Furthermore, if this device is prevented from acting on the control unit, both this device and the route from the control unit via this device to the safety circuit can be subjected to an error check through deliberate misinformation.

Durch Integration einer die an der Steuereinheit anliegende Spannung überprüfenden Vorrichtung in die Schaltungsanordnung kann bei fehlerhafter Spannungsversorgung die Steuereinheit in einen definierten Zustand überführt werden. Wenn außerdem die Sicherheitsschaltung auf diese Vorrichtung wirkt, ist es möglich, mit dem Auslösen des Sicherheitsschalters diese Vorrichtung so zu beeinflussen, daß diese die Steuereinheit in dem definierten Zustand hält.By integrating a device checking the voltage applied to the control unit into the circuit arrangement, the control unit can be brought into a defined state if the voltage supply is faulty. If, in addition, the safety circuit acts on this device, it is possible, by triggering the safety switch, to influence this device in such a way that it keeps the control unit in the defined state.

Zeichnungdrawing

Ein Ausführungsbeispiel der Erfindung ist in der Zeichnung vereinfacht dargestellt und in der nachfolgenden Beschreibung näher erläutert. In Figur 1 sind die einzelnen Schaltungsbaugruppen schematisch dargestellt. Figur 2 zeigt die Einbindung einer die an der Steuereinheit anliegenden Spannung überprüfenden Vorrichtung in einen Teil der Schaltung gemäß Figur 1 und Figur 3 ein Ausführungsbeispiel dieser Vorrichtung. In Figur 4 ist ein Ausführungsbeispiel der Sicherheitsschaltung dargestellt.An embodiment of the invention is shown in simplified form in the drawing and explained in more detail in the following description. In Figure 1, the individual circuit assemblies are shown schematically. FIG. 2 shows the integration of a device checking the voltage applied to the control unit into part of the circuit according to FIG. 1 and FIG. 3 shows an exemplary embodiment of this device. An exemplary embodiment of the safety circuit is shown in FIG.

Beschreibung eines AusführungsbeispielsDescription of an embodiment

In Figur 1 ist eine Steuereinheit 10 gezeigt, die über Leitungen 12, 14 mit Magnetventilen 16, 18 verbunden ist und die ihrerseits über Leitungen 20, 21 an eine Strom-/Spannungsversorgung 24 angeschlossen sind. Die Magnetventile 16, 18 wirken auf eine Gasversorgungsleitung 22, die zu einem Brenner 23 führt und sind zueinander in Reihe geschaltet.1 shows a control unit 10 which is connected to solenoid valves 16, 18 via lines 12, 14 and which in turn is connected to a current / voltage supply 24 via lines 20, 21. The solenoid valves 16, 18 act on a gas supply line 22 which leads to a burner 23 and are connected in series with one another.

Von der Steuereinheit 10 geht ferner eine Leitung 26 zu einer die Steuereinheit 10 überprüfenden Vorrichtung 28, im folgenden Watchdog genannt, dessen Ausgang über eine Leitung 30 mit einer Sicherheitsschaltung 32 verbunden ist. Watchdogs sind allgemein bekannt und überprüfen periodische Ereignisse innerhalb eines vorgegebenen Zeitfensters, z. B. die Periodizität von Triggerimpulsen.A line 26 also goes from the control unit 10 to a device 28 which checks the control unit 10, hereinafter referred to as the watchdog, the output of which is connected to a safety circuit 32 via a line 30. Watchdogs are well known and check periodic events within a given time window, e.g. B. the periodicity of trigger pulses.

Von der Leitung 30 zweigt eine Leitung 34 ab, die zu einem ersten Eingang eines UND-Gliedes 36 führt. Der zweite Eingang ist über eine Leitung 38 mit der Steuereinheit 10 verbunden und der Ausgang über eine Leitung 40 an die Steuereinheit 10 zurückgeführt. Weiterhin ist die Steuereinheit 10 über Leitungen 42, 43 mit der Sicherheitsschaltung 32 verbunden. Über zwei Leitungen 44, 45 ist eine Prüfvorrichtung 46 für die Flammenüberwachungseinrichtung 47 ebenfalls mit der Steuerung 10 verbunden. Im Ausführungsbeispiel ist die Prüfvorrichtung 46 durch ein einfaches UND-Glied realisiert. Vorstellbar sind aber auch komplizierter aufgebaute Strukturen, die eine größere Anzahl von Daten verarbeiten. An die Leitung 45 ist eine Leitung 48 angeschlossen, die von der Flammenüberwachungseinrichtung 47 herführt. Der Ausgang des UND-Gliedes 46 ist negiert auf einen Eingang eines weiteren UND-Gliedes 50 geführt, dessen Ausgang über eine Leitung 52 an die Sicherheitsschaltung 32 angeschlossen ist. Der zweite Eingang dieses UND-Glieds 50 ist mit dem Ausgang einer Ventilüberprüfvorrichtung 54 in Form eines ODER-Glieds und dessen Eingänge mit den Magnetventilen 16 und 18 verbunden.A line 34 branches off from line 30 and leads to a first input of an AND gate 36. The second input is connected to the control unit 10 via a line 38 and the output is returned to the control unit 10 via a line 40. Furthermore, the control unit 10 is connected to the safety circuit 32 via lines 42, 43. One is via two lines 44, 45 Test device 46 for the flame monitoring device 47 is also connected to the controller 10. In the exemplary embodiment, the test device 46 is implemented by a simple AND gate. However, structures with a more complex structure that process a larger amount of data are also conceivable. A line 48, which leads from the flame monitoring device 47, is connected to the line 45. The output of the AND gate 46 is negated to an input of a further AND gate 50, the output of which is connected to the safety circuit 32 via a line 52. The second input of this AND gate 50 is connected to the output of a valve checking device 54 in the form of an OR gate and its inputs to the solenoid valves 16 and 18.

Die Sicherheitsschaltung 32 ist mechanisch mit einem Schalter 55 verbunden, der es ermöglicht, die Leitung 20 zu unterbrechen.The safety circuit 32 is mechanically connected to a switch 55, which makes it possible to interrupt the line 20.

In Figur 2 ist dargestellt, wie eine die an der Steuereinheit 10 anliegende Spannung überprüfende Vorrichtung 56 in die Schaltungsanordnung gemäß Figur 1 (nur zum Teil dargestellt) eingebaut ist. Dazu ist die Leitung 40 vom UND-Glied 36 auf einen ersten Eingang eines ODER-Gliedes 58 geführt, dessen Ausgang mit der Steuereinheit 10 verbunden ist. Am zweiten Eingang ist der Ausgang 72 der Vorrichtung 56 angeschlossen. Weiterhin führt von der Sicherheitsschaltung 32 eine Leitung 60 zur Vorrichtung 56, für die ferner eine Strom-/Spannungsversorgung 62 vorgesehen ist.FIG. 2 shows how a device 56, which checks the voltage applied to the control unit 10, is installed in the circuit arrangement according to FIG. 1 (only shown in part). For this purpose, the line 40 is led from the AND gate 36 to a first input of an OR gate 58, the output of which is connected to the control unit 10. The output 72 of the device 56 is connected to the second input. Furthermore, a line 60 leads from the safety circuit 32 to the device 56, for which a current / voltage supply 62 is also provided.

Ein Ausführungsbeispiel der Vorrichtung 56 als Unterspannungsdetektor ist in Figur 3 dargestellt, dessen Kernstück ein Komparator 64 bildet, der mit seinem positiven Eingang mit einer Referenzspannungquelle 66 und mit seinem negativen Eingang über eine Leitung 67, eine Diode 68 und eine Leitung 60 mit der Leitung 20 verbunden ist. Die Leitung 67 ist ferner an dem Mittelabgriff eines Spannungsteilers 70, 71 und dieser an der Stromversorgung 62 angeschlossen. Der Ausgang 72 des Komparators führt auf das ODER-Glied 58.An embodiment of the device 56 as an undervoltage detector is shown in FIG. 3, the core of which is formed by a comparator 64, which has a positive input with a reference voltage source 66 and a negative input via a line 67, a diode 68 and a line 60 with the line 20 connected is. The line 67 is also connected to the center tap of a voltage divider 70, 71 and this to the power supply 62. The output 72 of the comparator leads to the OR gate 58.

Ein Ausführungsbeispiel der Sicherheitsschaltung 32 als Bimetallansteuerung ist in Figur 4 dargestellt. Ausgehend von der Strom-/Spannungsversorgung 24, führt die Leitung 20 über den Schalter 55 zu einer Spule 77, deren Ausgang über eine Leitung 74 mit dem Kollektor eines Transistors 76 verbunden ist. Der Emitter des Transistors 76 ist an Masse angeschlossen. Parallel zur Kollektor-Emitter-Strecke liegt ein Spannungsteiler 78, 79, an dessen Mittelabgriff die Leitung 43 abzweigt. Die Leitungen 30, 42, 52 führen über Dioden 80 parallel zusammen an die Basis des Transistors 76.An embodiment of the safety circuit 32 as a bimetal control is shown in Figure 4. Starting from the current / voltage supply 24, the line 20 leads via the switch 55 to a coil 77, the output of which is connected via a line 74 to the collector of a transistor 76. The emitter of transistor 76 is connected to ground. Parallel to the collector-emitter path is a voltage divider 78, 79, at the center tap of which line 43 branches off. Lines 30, 42, 52 lead in parallel via diodes 80 to the base of transistor 76.

Funktionsweise:Functionality:

Im Ruhezustand sind die Magnetventile 16, 18 geschlossen und es ist keine Flamme vorhanden. Tritt eine Wärmeforderung auf, so öffnet die Steuereinheit 10 zunächst eines der Magnetventile 16, 18. Dies führt über das ODER-Glied 54 und das UND-Glied 50 zu einer Bestromung der Sicherheitsschaltung 32. Über die Leitung 43 wird diese Bestromung der Steuereinheit 10 angezeigt. Erfolgt keine Bestromung, muß dieser Ansteuerweg defekt sein, die Steuereinheit schließt das Ventil wieder und bestromt ihrerseits über die Leitung 42 die Sicherheitsschaltung 32.In the idle state, the solenoid valves 16, 18 are closed and there is no flame. If a heat request occurs, the control unit 10 first opens one of the solenoid valves 16, 18. This leads to the safety circuit 32 being energized via the OR gate 54 and the AND gate 50. This energization of the control unit 10 is indicated via line 43 . If there is no current supply, this control path must be defective, the control unit closes the valve again and supplies current to the safety circuit 32 via line 42.

Bei korrekter Funktion öffnet die Steuereinheit 10 das zweite der Ventile 16, 18 und löst die Zündung aus. Liefert die Flammenüberwachung 47 nach erfolgter Zündung über die Leitung 48 ein gültiges Signal, führt dies über das UND-Glied 46 auf den negierten Eingang des UND-Glieds 50. Dadurch wird ein Ausgangssignal an 50 verhindert, die Bestromung der Sicherheitsschaltung 32 beendet und der Heizbetrieb liegt vor. Erscheint innerhalb einer Sicherheitszeit von ca. 10 sec kein Flammensignal, schließt die Steuereinheit 10 die Magnetventile 16, 18 und hält die Bestromung der Sicherheitsschaltung 32 aufrecht, bis der Schalter 55 auslöst. Zwischen Bestromung der Bimetallansteuerung 32 und dem Auslösen des Schalters 55 vergeht üblicherweise eine Zeit von ca. 25 sec.When functioning correctly, the control unit 10 opens the second of the valves 16, 18 and triggers the ignition. If the flame monitor 47 delivers a valid signal after the ignition via line 48, this leads via the AND gate 46 to the negated input of the AND gate 50. This prevents an output signal at 50, the energization of the safety circuit 32 is terminated and the heating is operating. If no flame signal appears within a safety time of approximately 10 seconds, the control unit 10 closes the solenoid valves 16, 18 and maintains the current supply to the safety circuit 32 until the switch 55 trips. A time of approximately 25 seconds usually elapses between the energization of the bimetal control 32 and the triggering of the switch 55.

Unabhängig von einer Wärmeforderung erfolgt ein Test des Watchdogs 28 in konstanten Zeitintervallen (ca. 40 sec beim Ausführungsbeispiel) durch gesteuerte Falschtriggerung. Die Tests erfolgen alternierend mit zu kleiner und zu großer Periodendauer der Triggerimpulse. Dazu "sperrt" die Steuereinheit 10 das UND-Glied 36 und verhindert so, daß der Watchdog 28 während der Überprüfung über die Leitungen 34, 40 die Steuereinheit in einen definierten Zustand überführt. Die Steuereinheit 10 ist dadurch in der Lage über die Leitung 43 zu prüfen, ob der Watchdog 28 eine Bestromung der Sicherheitsschaltung 32 bewirkt. Die Testdauer ist kürzer als die Ansprechzeit des Schalters 55, so daß dieser bei einem korrekt verlaufenden Test nicht schaltet. Nach dem Test wird das UND-Glied 36 wieder "freigegeben".Regardless of a heat requirement, the watchdog 28 is tested at constant time intervals (approx. 40 sec in the exemplary embodiment) by controlled false triggering. The tests are carried out alternately with the trigger pulse period being too short and too long. For this purpose, the control unit 10 "blocks" the AND gate 36 and thus prevents the watchdog 28 from bringing the control unit into a defined state during the check via the lines 34, 40. The control unit 10 is thus able to check via the line 43 whether the watchdog 28 is energizing the safety circuit 32. The test duration is shorter than the response time of the switch 55, so that it does not switch when the test is running correctly. After the test, the AND gate 36 is "released" again.

Da der Watchdog 28 die Sicherheitsschaltung 32 bereits während des Tests bestromt, erfolgt durch das gesperrte UND-Glied 36 keine Beeinträchtigung der Sicherheit, auch wenn im Testbetrieb ein Fehler in der Steuereinheit 10 auftreten sollte. In diesem Fall dauert die Falschtriggerung über die Zeit des Testes an, und der Watchdog hält die Bestromung der Sicherheitsschaltung 32 aufrecht, bis der Schalter 55 auslöst. Außerdem können Selbsttests der Steuereinheit 10 derart vorgesehen sein, daß sich die Steuereinheit 10 bei auftretenden Fehlern selbst in einen definierten Zustand überführt und eine Bestromung der Sicherheitschaltung 32 über die Leitung 42 bewirkt.Since the watchdog 28 is already energizing the safety circuit 32 during the test, the blocked AND gate 36 does not impair safety, even if an error should occur in the control unit 10 during test operation. In this case, the false triggering continues for the time of the test and the watchdog maintains the current on the safety circuit 32 until the switch 55 trips. In addition, self-tests of the control unit 10 can be provided in such a way that the control unit 10 transfers itself to a defined state when errors occur and causes the safety circuit 32 to be energized via the line 42.

Ein erster Test auf Fehlerfreiheit der Bestromung der Sicherheitsschaltung 32 durch eine Signaleinwirkung über die Leitung 52 wurde bereits beim Start der Feuerungsanlage vollzogen. Ein zweiter Test erfolgt bei eingeschaltenem Brenner ebenfalls in konstanten Zeitintervallen. Dazu "sperrt" die Steuereinheit 10 über die Leitung 44 das UND-Glied 46 und simuliert so das Ausfallen eines Flammendetektionssignals. Es erlischt das Ausgangssignal des UND-Glieds 46, was über die Negation zu einem Eingangssignal am UND-Glied 50 führt. Da die Magnetventile 16, 18 bestromt sind, liefert das ODER-Glied 54 ebenfalls ein Signal zum UND-Glied 50, wodurch ein Signal auf der Leitung 52 entsteht. Die Bestromung der Sicherheitsschaltung 32 wird von der Steuereinheit 10 wiederum über die Leitung 43 erkannt. Um die Sicherheit während dieses Testes zu gewährleisten, wird das effektive Flammendetektionssignal auf der Leitung 48 durch eine Leitung 45 abgegriffen und direkt zur Steuereinheit 10 geleitet.A first test to ensure that the safety circuit 32 was free from faults by means of a signal via line 52 was already carried out when the furnace was started. A second test is also carried out at constant time intervals when the burner is switched on. For this purpose, the control unit 10 "blocks" the AND gate 46 via the line 44 and thus simulates the failure of a flame detection signal. The output signal of the AND gate 46 goes out, which leads to an input signal at the AND gate 50 via the negation. Since the solenoid valves 16, 18 are energized, the OR gate 54 also supplies a signal to the AND gate 50, which creates a signal on line 52. The energization of the safety circuit 32 is in turn recognized by the control unit 10 via the line 43. In order to ensure the safety during this test, the effective flame detection signal on line 48 is tapped through line 45 and passed directly to control unit 10.

Die in Form eines Unterspannungsdetektors aufgebaute Vorrichtung 56 überwacht die Versorgungsspannung der Steuereinheit 10 in der Weise, daß beim Unterschreiten eines gewissen Schwellwertes ein Ausgangssignal an die Steuereinheit 10 abgegeben wird, und diese dadurch in einen definierten Zustand überführt. In vorteilhafter Weise wird dieses Ausgangssignal mit dem Ausgangssignal des UND-Glieds 36 über ein ODER-Glied 58 verbunden. Dadurch läßt sich derselbe Eingang an der Steuereinheit 10 nutzen, wie er auch der Watchdog-Schaltung 28, 34, 36, 40 zur Verfügung steht. Durch eine Verbindung zwischen Sicherheitsschaltung 32 und Unterspannungsdetektor 56 läßt sich erreichen, daß bei ausgelöstem Schalter 55 die Steuereinheit 10 über den Unterspannungsdetektor 56 in einem definierten Zustand gehalten wird.The device 56, which is constructed in the form of an undervoltage detector, monitors the supply voltage of the control unit 10 in such a way that when a certain threshold value is undershot, an output signal is sent to the control unit 10, thereby converting it into a defined state. This output signal is advantageously connected to the output signal of the AND gate 36 via an OR gate 58. As a result, the same input on the control unit 10 can be used as is also available to the watchdog circuit 28, 34, 36, 40. A connection between the safety circuit 32 and the undervoltage detector 56 makes it possible to keep the control unit 10 in a defined state via the undervoltage detector 56 when the switch 55 is triggered.

Funktionsweise der Vorrichtung 56 in der Form eines UnterspannungsdetektorsOperation of device 56 in the form of an undervoltage detector

Der Komparator 64 vergleicht eine Referenzspannung 66 mit einer Teilspannung über dem Spannungsteiler 70, 71, die von der Strom-/Spannungsversorgung 62 abgeleitet ist. Solange diese Teilspannung größer ist als die Referenzspannung 66, liegt am Ausgang 72 kein Signal an. Sinkt die Versorgungsspannung 62, so sinkt die Teilspannung über 71 und erzeugt ein Ausgangssignal. Der Einfluß der Sicherheitsschaltung 32 auf den Unterspannungsdetektor 56 kann durch eine Verbindung über eine Diode 68 zwischen dem Mittelabgriff des Spannungsteilers 70, 71 und der Leitung 20 erfolgen. Bei geschlossenem Schalter 55 hat die zweite (höhere) Versorgungsspannung der Strom-/Spannungsversorgung 24 wegen der Diode 68 keinen Einfluß auf den Komparator 64. Bei geöffnetem Schalter 55 ist die Diode 68 in Durchlaßrichtung betrieben, wodurch die Spannung am Spannungsteiler 70, 71 sinkt und ein Ausgangssignal am Ausgang 72 bewirkt.The comparator 64 compares a reference voltage 66 with a partial voltage across the voltage divider 70, 71, which is derived from the current / voltage supply 62. As long as this partial voltage is greater than the reference voltage 66, there is no signal at the output 72. If the supply voltage 62 drops, the partial voltage drops above 71 and generates an output signal. The influence of the safety circuit 32 on the undervoltage detector 56 can take place by a connection via a diode 68 between the center tap of the voltage divider 70, 71 and the line 20. When switch 55 is closed, the second (higher) supply voltage of the current / voltage supply 24 has no influence on the comparator 64 because of the diode 68. When the switch 55 is open, the diode 68 is operated in the forward direction, as a result of which the voltage at the voltage divider 70, 71 drops and causes an output signal at output 72.

Funktionsweise der Sicherheitsschaltung 32 in der Form einer BimetallansteuerungOperation of the safety circuit 32 in the form of a bimetal control

Solange an den Ansteuerwegen 30, 42, 52 (Figur 4) eine Spannung nahe 0 Volt anliegt, fließt durch die Wicklung 77 nur ein sehr kleiner Strom, der keine auslösende Wirkung besitzt. Durch Anlegen einer höheren Spannung an eine der Leitungen 30, 42, 52 schaltet der Transistor 76 und erhöht damit den Stromfluß durch die Wicklung 77. Der Schalter 55 öffnet nach einer, der Erwärmung entsprechenden Verzögerungszeit. Mit dem Schalten des Transistors erniedrigt sich die Spannung über der Kollektor-Emitter-Strecke und damit die Spannung zwischen der Leitung 43 und der Masse.As long as a voltage close to 0 volts is present on the control paths 30, 42, 52 (FIG. 4), only a very small current flows through the winding 77 and has no triggering effect. By applying a higher voltage to one of the lines 30, 42, 52, the transistor 76 switches and thus increases the current flow through the winding 77. The switch 55 opens after a delay time corresponding to the heating. With the switching of the transistor, the voltage across the collector-emitter path lowers and thus the voltage between line 43 and ground.

Die schaltungstechnische Realisierung der Ausführungsbeispiele ist auf unterschiedliche Weise möglich. Die Steuereinheit ist vorzugsweise als Mikrocomputer realisiert. In einfacheren Geräten ist auch ein diskreter Aufbau vorsehbar.The circuitry implementation of the exemplary embodiments is possible in different ways. The control unit is preferably implemented as a microcomputer. A discrete structure can also be provided in simpler devices.

Die logischen Elemente sind als diskrete Bausteine, beispielsweise mit UND- und ODER-Verknüpfungen, realisierbar. Besonders geeignet ist eine integrierte Lösung, die sämtliche Funktionen einschließt. Für einfache Geräte kann auch eine Realisierung in Relaistechnik günstig sein.The logical elements can be implemented as discrete modules, for example with AND and OR operations. An integrated solution that includes all functions is particularly suitable. For simple devices, implementation in relay technology can also be favorable.

Claims (23)

  1. Circuit for monitoring a fuel-heated apparatus, having a control unit (10) to which at least one input signal which is relevant to safety is fed and which switches at least one valve (16, 18) which can be actuated electrically and which is arranged in the fuel supply (22) to a burner (23), having a flame monitoring device (47) and having a safety circuit (32) to which the control unit (10) transmits, at least as a function of the input signal which is relevant to safety, at least one signal which causes the valve (16, 18) to switch off, characterized in that a redundant monitoring circuit (28, 36, 46, 50, 54) is provided which contains simple, logic elements to which at least one input signal which is relevant to safety is also fed and which transmits, at least as a function of this input signal which is relevant to safety, at least one further signal directly to the safety circuit (32), which further signal causes the valve (16, 18) to switch off.
  2. Circuit according to Claim 1, characterized in that the safety circuit (32) transmits to the control unit (10) a signal which indicates that the safety circuit is energized.
  3. Circuit arrangement according to Claim 2, characterized in that the safety circuit (32) transmits the switch-off signal to the valve (16, 18) with a delay with respect to the signal transmitted to the control unit (10).
  4. Circuit according to one of Claims 1 to 3, characterized in that the monitoring circuit (28, 36, 46, 50, 54) contains a valve checking device (54) which can be connected to the safety circuit (32).
  5. Circuit according to one of Claims 1 to 4, characterized in that the monitoring circuit (28, 36, 46, 50, 54) contains a testing device (46) for the flame monitoring device, which testing device (46) can be connected to the safety circuit (32).
  6. Circuit according to Claim 5, characterized in that a linking element (50), in particular an AND element, is provided whose inputs are connected to the outputs of the valve checking device (54) and of the testing device (46) and whose output is connected to the safety circuit (32).
  7. Circuit according to one of the preceding claims, characterized in that the safety circuit (32) is connected to a switch (55) which can interrupt the supply of power to the valve (16, 18).
  8. Circuit according to Claim 7, characterized in that the safety circuit (32) contains a bimetal switch (77, 55) which responds with a time delay.
  9. Circuit according to one of the preceding claims, characterized in that the monitoring circuit (28, 36, 46, 50, 54) contains a device (28) which monitors the control unit (40) for periodically occurring signals and which transmits a further signal to the safety circuit (32), which further signal causes the valve (16, 18) to switch off, and in that, between the device (28) and the safety circuit (32), a line (34), which leads to the control unit (10) via a logic element (36), in particular an AND element, branches off from the line (30) conducting the said signal.
  10. Circuit according to Claim 9, characterized in that the control unit (10) is connected with a further line (38) to a second input of the logic element (36).
  11. Circuit arrangement according to one of the preceding claims, characterized in that the monitoring circuit (28, 36, 46, 50, 54) contains a device (56), in particular an undervoltage detector, which checks the voltage present at the control unit (10).
  12. Circuit according to Claim 10 or 11, characterized in that the output of the logic element (36) is connected to a first input of a further logic element (58), in particular of an OR element whose second input is connected to an output (72) of the device (56) and whose output is connected to the control unit (10).
  13. Circuit according to Claim 12, characterized in that the device (56) is connected to the safety circuit (32).
  14. Circuit according to Claim 12 or 13, characterized in that the device (56) contains a comparison element (64), in particular a comparator, to whose positive input a reference voltage (66) is connected, whose negative input is connected via a voltage divider (70, 71) and a diode (68) to the supply line (20) for the valve (16, 18) and whose output constitutes the output (72) of the device (56).
  15. Circuit according to one of Claims 7 to 14, characterized in that an active element (77) is provided which is connected via a switch (55) to the supply voltage (24) and itself acts on this switch (55), in that lines (20, 22) lead from this connection to the valve (16, 18), and in that the active element (77) is also connected to a transistor (76) to whose base various lines (30, 42, 52) which are relevant to switching off are connected.
  16. Circuit according to Claim 15, characterized in that a voltage divider (78, 79) whose centre tap is connected to the control unit (10) is provided parallel to the transistor (76).
  17. Method for monitoring a fuel-heated apparatus, in which a control unit (10) is provided to which at least one input signal which is relevant to safety is fed and which switches at least one valve (16, 18) which can be actuated electrically and which is arranged in the fuel supply (22) to a burner (23), in which method a flame monitoring device (47) is provided and in which method a safety circuit (32) is provided, to which safety circuit (32) the control unit transmits, at least as a function of the input signal which is relevant to safety, at least one signal which causes the valve (16, 18) to switch off, characterized in that a redundant monitoring circuit (28, 36, 46, 50, 54) is provided which contains simple, logic elements, in that the monitoring circuit (28, 36, 46, 50, 54) transmits at least one further signal directly to the safety circuit (32), which further signal causes the valve (16, 18) to switch off, and in that the monitoring circuit (28, 36, 46, 50, 54) is actuated via at least one path which can be checked for protection against errors.
  18. Method according to Claim 17 for operating a circuit according to one of Claims 9 or 10, characterized in that the safety circuit (32) is actuated directly via the control unit (10) or indirectly via targeted incorrect information to a device (28) which monitors the control unit (10).
  19. Method according to Claim 18, characterized in that the device (28) monitors the period duration of the pulses which are output by the control unit (10) in a defined way, said device (28) activating the safety circuit (32) when errors occur and converting the control unit (10) into a defined state.
  20. Method according to one of Claims 18 or 19, characterized in that the device (28) is tested in that defective pulses are output to the device (28) by the control unit (10) in a targeted manner, in that the control unit (10) is prevented from converting into a defined state, and in that the actuation of the safety circuit (32) by the control unit (10) via the device (28) is detected within the response time of the switch (55).
  21. Method according to one of Claims 17 to 20, characterized in that the safety circuit (32) is actuated as soon as a valve (16, 18) is actuated and there is no flame detection signal present.
  22. Method according to Claim 21, characterized in that, when the valve (16, 18) is actuated and a flame detection signal is present, the flame detection signal is gated out by the control unit (10) and the actuation of the safety circuit (32) by the control unit (10) via the valve (16, 18) is detected within the response time of the switch (55), as a result of which the actuation path of the safety circuit (32) is tested.
  23. Method according to one of Claims 17 to 20 for operating a circuit according to one of Claims 11 to 13, characterized in that the supply voltage is monitored via an undervoltage detector (56) and the latter converts the control unit (10) into a defined state when the supply voltage drops below a prescribed value.
EP92103323A 1991-04-12 1992-02-27 Circuit and method for monitoring a fuel-heated apparatus Expired - Lifetime EP0508081B1 (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
DE4111947 1991-04-12
DE4111947A DE4111947A1 (en) 1991-04-12 1991-04-12 CIRCUIT ARRANGEMENT AND METHOD FOR MONITORING A FUEL-HEATED DEVICE

Publications (3)

Publication Number Publication Date
EP0508081A2 EP0508081A2 (en) 1992-10-14
EP0508081A3 EP0508081A3 (en) 1993-02-03
EP0508081B1 true EP0508081B1 (en) 1996-09-25

Family

ID=6429439

Family Applications (1)

Application Number Title Priority Date Filing Date
EP92103323A Expired - Lifetime EP0508081B1 (en) 1991-04-12 1992-02-27 Circuit and method for monitoring a fuel-heated apparatus

Country Status (3)

Country Link
EP (1) EP0508081B1 (en)
DE (2) DE4111947A1 (en)
ES (1) ES2093126T3 (en)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE19616065A1 (en) * 1996-04-23 1997-11-06 Bosch Gmbh Robert Circuit arrangement for monitoring a fuel-heated device
ES2155404B1 (en) * 1999-07-23 2001-12-01 Fagor S Coop CONTROL CIRCUIT FOR GAS HOBS WITH SAFETY SYSTEM BEFORE DOUBLE FAILURE.
DE19956426C1 (en) * 1999-11-24 2001-05-03 Honeywell Bv Water temperature monitoring device e.g. for detecting maximum permissible water temperature for heat exchanger, provides cut-out of burner for heating water for safety protection of heat exchanger
EP1373800B1 (en) * 2001-03-26 2006-02-22 Sit la Precisa S.p.a. Control and safety device for valve means
DE102009036423C5 (en) * 2009-08-06 2023-03-02 Robert Bosch Gmbh Method and device for interrupting a fuel supply and use thereof

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP0308831A2 (en) * 1987-09-21 1989-03-29 Honeywell Inc. System for processing a flame sensor output signal

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4211526A (en) * 1978-11-06 1980-07-08 Honeywell Inc. Control system for redundant valves
US4518345A (en) * 1983-02-28 1985-05-21 Emerson Electric Co. Direct ignition gas burner control system
US4695246A (en) * 1984-08-30 1987-09-22 Lennox Industries, Inc. Ignition control system for a gas appliance
FR2600437B1 (en) * 1986-06-18 1993-12-31 Telemecanique Electrique METHOD AND DEVICE FOR REDUNDANT CONTROL OF A POWER MEMBER
US4832594A (en) * 1987-09-10 1989-05-23 Hamilton Standard Controls, Inc. Control system with timer redundancy
US4842510A (en) * 1987-09-10 1989-06-27 Hamilton Standard Controls, Inc. Integrated furnace control having ignition and pressure switch diagnostics

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP0308831A2 (en) * 1987-09-21 1989-03-29 Honeywell Inc. System for processing a flame sensor output signal

Also Published As

Publication number Publication date
ES2093126T3 (en) 1996-12-16
EP0508081A2 (en) 1992-10-14
DE59207215D1 (en) 1996-10-31
EP0508081A3 (en) 1993-02-03
DE4111947A1 (en) 1992-10-15

Similar Documents

Publication Publication Date Title
DE3731142C2 (en) Monitoring device in an electronic control unit
DE4101598A1 (en) Circuit for anti-lock controlled vehicle brake system
EP0681715A1 (en) Control and regulation of doors driven by an electromechanical motor
DE3508608C2 (en)
DE4441070C2 (en) Safety switch arrangement
DE2833761C3 (en) Circuit arrangement for monitoring the status of signal systems, in particular road traffic light signal systems
DE3924988C2 (en) Circuit arrangement for controlling the safety relay of an electronically controlled brake system of a motor vehicle
DE4242792C2 (en) Safety switch arrangement
CH650087A5 (en) RELAY CONTROL ARRANGEMENT.
DE19919504A1 (en) Engine controller, engine and method for controlling an engine
DE4037175A1 (en) ANTI-BLOCKING BRAKE SYSTEM WITH FAILURE CONTROL
EP0676055B1 (en) Circuit arrangement for monitoring a plurality of coils
EP0508081B1 (en) Circuit and method for monitoring a fuel-heated apparatus
EP0326694A1 (en) Safety system for an internal-combustion engine
EP1277095B1 (en) System and method for the monitoring of a measurement and control device
DE3101747C2 (en)
DE4202761C2 (en) Circuit for the control and monitoring of inductive loads, especially of solenoid valves in an anti-lock control system
DE3728561A1 (en) Method of testing a monitoring device for a microprocessor
EP1740815B1 (en) Electronic control device and method for controlling the operation of motor vehicle components
EP1679729B1 (en) Method for secure signal generation
DE10392916T5 (en) Self-test system
EP1397729B1 (en) Device for reliable signal generation
EP0596297B1 (en) Method and apparatus for checking the monitoring unit of a control system for an engine
EP2117094B1 (en) Monitoring switch and method for checking the switch
EP1933008A1 (en) Safety system for a machine and method for monitoring a safety system

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

AK Designated contracting states

Kind code of ref document: A2

Designated state(s): DE ES FR GB IT

PUAL Search report despatched

Free format text: ORIGINAL CODE: 0009013

AK Designated contracting states

Kind code of ref document: A3

Designated state(s): DE ES FR GB IT

17P Request for examination filed

Effective date: 19930708

17Q First examination report despatched

Effective date: 19950214

GRAG Despatch of communication of intention to grant

Free format text: ORIGINAL CODE: EPIDOS AGRA

GRAH Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOS IGRA

GRAH Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOS IGRA

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): DE ES FR GB IT

REF Corresponds to:

Ref document number: 59207215

Country of ref document: DE

Date of ref document: 19961031

ET Fr: translation filed
ITF It: translation for a ep patent filed

Owner name: STUDIO JAUMANN

REG Reference to a national code

Ref country code: ES

Ref legal event code: FG2A

Ref document number: 2093126

Country of ref document: ES

Kind code of ref document: T3

GBT Gb: translation of ep patent filed (gb section 77(6)(a)/1977)

Effective date: 19961205

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

26N No opposition filed
PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: ES

Payment date: 19990208

Year of fee payment: 8

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: FR

Payment date: 19990219

Year of fee payment: 8

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: GB

Payment date: 19990225

Year of fee payment: 8

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: DE

Payment date: 19990511

Year of fee payment: 8

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GB

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20000227

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: ES

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20000228

GBPC Gb: european patent ceased through non-payment of renewal fee

Effective date: 20000227

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: FR

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20001031

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: DE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20001201

REG Reference to a national code

Ref country code: FR

Ref legal event code: ST

REG Reference to a national code

Ref country code: ES

Ref legal event code: FD2A

Effective date: 20011010

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IT

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20050227