EP0837283A1

EP0837283A1 - An automatic control system with double safety protection for intermittently-operated gas burners

Info

Publication number: EP0837283A1
Application number: EP96830531A
Authority: EP
Inventors: Gianpiero Turrin; Stefano Fandella; Ettore Rossi; Danilo Briarava
Original assignee: Sit La Precisa SpA
Current assignee: Sit La Precisa SpA
Priority date: 1996-10-16
Filing date: 1996-10-16
Publication date: 1998-04-22
Anticipated expiration: 2016-10-16
Also published as: EP0837283B1

Abstract

In an automatic control system with double intrinsic safety protection for gas burners, a first, safety solenoid valve (1) and a second, regulation solenoid valve (2) in cascade control the supply of gas to a burner (16), detector means (51) recognize whether the voltage generated by a thermocouple (7) heated by a pilot light (19) supplied by means of the safety valve (1) is above or below a predetermined threshold value sufficient to keep the first solenoid valve (1) open, and control means (3, 50, 52, 53, 73) generate control signals (EV1, EV2) for opening the first and second solenoid valves mutually exclusively of one another, the opening of the second solenoid valve being dependent on the recognition of a thermocouple voltage above the predetermined value.

Description

The present invention relates to an automatic control system with double intrinsic safety protection for intermittently-operating gas burners, for example, of the type used in gas boilers for domestic heating and, in particular, in a system for automatically igniting a pilot light for a burner under the control of an external signal, for automatically re-igniting the pilot light should it go out accidentally, and for closing both a safety valve and a regulation valve in the event of failure to re-ignite.

In known safety devices such as, for example, that described in the document WO93/12378, the presence of a flame is detected by a thermocouple the electromotive force of which supplies a solenoid-valve winding keeping the valve in the open position.

A reduction of the e.m.f. of the thermocouple, which is indicative of the flame going out, is detected by suitable sensors and causes the activation of a control circuit which, before closing the safety valve, operates an ignition-spark generator for a predetermined period of time.

If the flame does not re-ignite within the predetermined period of time, in the absence of a thermocouple e.m.f., the solenoid-valve closes.

Subsequent ignition requires a manual operation.

The system described has only one degree of safety in the sense that if the flame goes out, it is solely the absence of a thermocouple e.m.f. which ensures closure of the valve.

This system has the serious disadvantage that the supply of gas is intrinsically controlled by the thermocouple voltage, in the absence of which the safety valve should close.

If, for any reason, the valve should stick in the open position, which situation cannot be excluded although the likelihood of this event is extremely low, the only remedy available is therefore an attempt at re-ignition which, if unsuccessful, may have extremely dangerous consequences.

The same disadvantage is present in the system described in the documents EP-0109155 and EP-0439417, in which the safety valve also performs a regulation function and, as well as being opened for the ignition of the burner, can also be closed intermittently by the controlled opening of the thermocouple circuit or by the generation of a current pulse to neutralize the magnetisation current generated by the thermocouple.

Moreover, no alarm signal is provided to indicate a condition in which the flame has gone out unintentionally.

A further disadvantage is that the burner is automatically ignited or re-ignited by the opening of the safety and regulation valve for a predetermined period of time, of the order of 60s, so that if the operation is not successful the volume of gas which flows from the burner throughout this time is not negligible and constitutes a risk factor.

The present invention overcomes these serious disadvantages and provides an automatic control system with double intrinsic safety, or redundancy protection, for intermittently-operating or even continuously-operating gas burners, with a minimal leakage of gas even in the event of a failure to ignite or re-ignite, in which two valves are provided in cascade, of which one has exclusively a safety function and the other has a regulation function.

The opening of the regulation valve is dependent on the actual presence of a pilot light supplied by means of the safety valve, as detected by a voltage of a thermocouple heated by the pilot light being above a preset threshold value.

If a pilot light supplied by the safety valve goes out and any attempt to reignite it is unsuccessful, both valves are closed and an alarm signal is simultaneously supplied.

This ensures that the gas supply is stopped, even if one of the two valves fails to close in the absence of a light, possibly with the exception of the small gas flow necessary to supply a pilot light if the safety valve fails to close.

Double intrinsic safety protection is thus provided, in the sense that even if the safety valve fails to operate automatically, as a result of the lack of a pilot light (first protection), the regulation valve (second protection) is in any case closed.

Conversely, in the absence of a light, the failure of the regulation valve to operate for any reason is remedied by the operation of the safety valve; as is known from probability theory, the probability of a simultaneous failure to operate of both valves is the product of the probabilities of the two individual events and is thus much lower than the probability of a single valve failing to operate, and is practically zero.

The characteristics of the invention as set out in the appended claims, and the advantages resulting therefrom will become clearer from the following description of a preferred embodiment of the invention and from the appended drawings, in which:

Figure 1 is a schematic block diagram of an automatic control system with double intrinsic safety protection formed in accordance with the present invention,

Figure 2 is a first state diagram which describes the various states of a control unit used in the system of Figure 1 for operating the system in a mode of operation with an intermittent pilot-light,

Figure 3 is a second state diagram which describes the various states of a control unit used in the system of Figure 1 for operating the system in a mode of operation with a permanent pilot-light,

Figure 4 is an electrical circuit diagram of a preferred embodiment of the control unit of Figure 2,

Figure 5 is an electrical circuit diagram of a preferred embodiment of the control unit of Figure 3,

Figure 6 is a state diagram of a control unit which can discriminate between accidental extinguishing of the pilot light and situations of combustion-air depletion,

Figure 7 is an electrical circuit diagram of a control unit operating according to the state diagram of Figure 6.

With reference to Figure 1, an automatic control system according to the present invention comprises, essentially, a first, safety solenoid valve 1 in series with a regulation solenoid valve 2, a control unit 3 supplied by a supply P.S. 4, a spark-generating device 6, a thermocouple 7 and acoustic or visual alarm indicator means 29.

The safety solenoid valve 1 comprises a plug 8 which closes a gas-flow path from an inlet 9 to an outlet 10.

The plug 8 which is fixed to the armature 11 of an electromagnet 12, is biased towards the closure position by a spring 13.

The electromagnet 12 has a first winding 14 supplied by the voltage developed by the thermocouple 7 and at least one second winding 15 supplied by a signal EV1 generated by the control unit 3.

The regulation solenoid valve 2 which operates intermittently with ON-OFF regulation comprises a plug 20 which closes a gas-flow path from the output 10 of the valve 1, which constitutes the input of the valve 2, to an outlet 151 connected to a gas burner 16.

A pipe 17 connected to the inlet/outlet 10 and terminating in a nozzle 18 opening near the burner 16 supplies a pilot light 19 which, when ignited by the spark-generator 6, heats the thermocouple 7.

The plug 20, which is fixed to the armature 21 of an electromagnet 22 is biased towards the closure position by a spring 23.

The electromagnet 22 has a winding 24 supplied by a signal EV2 generated by the control unit 3.

As well as being connected to the terminals of the winding 14, the thermocouple 7 terminals are connected to an input of the control unit 3.

Naturally, instead of acting on the gas flow directly, the regulation valve may be of the combined type with a solenoid valve and valve with a diaphragm actuator, the activation of the former producing a differential pressure on the diaphragm which causes the latter to open.

The control unit 3 is supplied by the supply 4 when it is connected to the electrical mains by a manual switch 25.

The manual switch 25 may also consist of a thermostatic switch for supplying the automatic control system only when there is a demand for the burner to operate.

Alternatively, a thermostatic regulation switch 26 is provided in addition to the general manual switch, in the line of the signal EV2 output by the control unit.

The control unit 3 comprises, essentially, electrical circuits which operate as a logic system with finite states, a thermocouple-voltage amplifier 5, a comparator 28 which receives, as an input, the voltage output by the amplifier 5 and compares it with a reference voltage in order to generate a binary logic signal, of which the levels, on (or true) and off (or false), indicate, respectively, that the thermocouple voltage is above or below a predetermined value, for example 5mV and, preferably (but not necessarily), a timing circuit 27.

When the thermocouple 7 is not heated by the pilot light, the thermocouple voltage is practically zero and when it is heated, the voltage rises to a level of the order of 10-15mV (without a load).

The threshold value of 5mV is advantageously selected as the voltage value above which the magnetomotive force developed by the winding 14 is sure to be sufficient to oppose the action of the spring 13 and the armature 11, if closed, is held by the electromagnet 12.

For an understanding of the invention, rather than a detailed description of the circuits which form the control unit 3, for which very many structural solutions may be adopted, it is better to consider the state diagrams of Figures 2 and 3, which represent, respectively, the various states that the control unit 3 can assume in dependence on the signals received as inputs (the supply voltage and the thermocouple voltage), and the control signals generated in the various states.

Two modes of operation are described:

1) A mode of operation with an intermittent pilot light, that is, with intermittent ignition and extinguishing of the pilot light according to the need to operate the burner, determined by a thermostatic switch or an equivalent device.

2) A mode of operation with a permanent pilot light, that is, with the pilot light ignited when the system is activated and kept ignited irrespective of the operation of the burner.

The first operative mode is represented by the state diagram of Figure 2.

With reference to Figure 2 in combination with Figure 1, from an inactive state 30 (IDLE-OFF), in which the unit 3 is preferably, but not necessarily, not supplied electrically, the control unit 3 changes to a state 31 (PILOT IGNIT) in which the pilot light is ignited when a heat demand signal TH-ON is applied to the unit.

This signal advantageously consists of the supply voltage which is applied to the unit 3 (by the supply 4) by the closure of the switch 25 (Figure 1).

In the state 31, the control unit 3 activates an internal timing circuit (START-TIM) and turns on (EV1-ON) the signal EV1 for energizing the solenoid valve 1 (Figure 1), which is opened, as well as a signal SPARK-ON for energizing the ignition spark-generator 6 (Figure 1).

The signal EV2 for energizing the regulation solenoid valve 2, however, is turned off (EV2-OFF).

As a result of the signals which are turned on, the nozzle 18 is supplied with gas and the pilot light 19 is ignited, heating the thermocouple 7.

When the thermocouple voltage V exceeds the predetermined threshold level (5mV) which is sufficient to ensure that the solenoid valve 1 is kept open, the condition V>5mV recognized by the unit 3 causes it to change from the state 31 to a state 32 (BURNER COMM), with a delay which is normally of the order of a few seconds (5-15 sec).

In this state, the control unit 3 turns off the signal for energizing the solenoid valve 1 (EV1-OFF) and the spark-generator 6 (SPARK-OFF) and turns on the signal for energizing the regulation valve (EV2-ON).

It also resets the internal timing circuit 27 (RES-TIM).

The burner is thus lit.

In normal working conditions, the control unit 3 changes from the state 32 (BURNER COMM) to the state 30 (IDLE-OFF) when the thermostatic supply switch 25 is opened (TH-OFF).

During the transition from the state 32 to the state 30, a voltage pulse SWITCH-OFF is generated and applied to the thermocouple circuit and neutralizes the thermocouple voltage, closing the solenoid valve 1 and extinguishing the pilot light.

In the state 30, all of the signals output by the control unit 3 are turned off; both of the

solenoid valves

1 and 2 are therefore closed.

Any failure of one of the open valves to close does not constitute a dangerous situation since gas is prevented from flowing to the burner, if not to the pilot-light nozzle, by the operation of the other valve.

If, during the operation of the burner (state 32) the thermocouple voltage V falls below the predetermined threshold level (5mV) for any reason, the control unit 3 returns to the state 31 in order to re-ignite the pilot light.

Clearly, this change of state may also be dependent on a rate of decrease of the thermocouple voltage greater than a predetermined value S, that is, on the condition -ΔV/ΔT>S, as described, for example, in the document WO 9312378 already cited, instead of on a threshold voltage.

The two criteria may also be combined, the change of state taking place upon the occurrence of at least one of the two events.

Whatever the outcome of the operation, it takes place in complete safety since the supply of gas to the burner is stopped by the closure of the solenoid valve 2.

If the ignition or re-ignition operation carried out by the control unit 3 in the state 31 is not successful and the control unit 3 does not change to the state 32, at the end of the time interval defined by the timing circuit 27, (TIME-END), the control unit changes from the state 31 to an alarm state 33 (ALARM).

In this state, the control signals for energizing the two

solenoid valves

1 and 2 are both turned off (EV1-OFF, EV2-OFF) and a signal ALARM-ON for activating the optical and/or acoustic alarm-state indicator is turned on.

The lock-out and alarm state may be volatile or permanent.

In the first case, the alarm state is maintained until the demand for ignition of the burner (that is, the supply voltage in the embodiment described) is turned off.

The system thus changes from the state 33 to the state 30 completely automatically without any manual intervention when the condition TH-OFF occurs.

In the second case, the transition from the alarm state to the state 30 is dependent on an electrical or electro-mechanical operation (MAN-RES) to reset a lock-out device, carried out by the user and represented by the broken transition line 34.

In the state diagram of Figure 2, another variant is possible; if it is considered that the condition of a voltage drop in the thermocouple as a result of, for example, the pilot light going out is an event to be indicated to the user, instead of an automatic attempt to re-ignite pilot light with a change from the state 32 to the state 31 along the transition line 35, it is possible to change from the state 32 to the alarm state 33 along the transition line 36.

Clearly, from the state 31, if the supply voltage is interrupted or the ignition-demand signal (TH-OFF) drops, the system returns to the state 30.

The operation of the control unit 3 in the case of the permanent-pilot mode of operation will now be considered with reference to Figure 3, in combination with Figure 1.

In this case, the control unit 3 changes from an inactive state 37 (IDLE-OFF) without a supply to an active state 38 (PILOT IGNIT) for the ignition of the pilot light upon the closure (ON signal) of the supply switch 25 (Figure 1).

In this state, as in the case of the intermittent-pilot mode, the control unit 3 turns on the signal EV1-ON for energizing the safety valve 1 and the signal SPARK-ON for energizing the spark-generator, whereas the signal EV2-OFF for opening the regulation valve 2 is turned off.

After the ignition of the pilot light, which is detected by a the thermocouple voltage V above the threshold voltage, the control unit changes to the burner-operating state 39 (BURNER COMM) in which the signals for energizing the solenoid valve 1 and the spark-generator 6 are turned off (EV1-OFF, SPARK-OFF), whereas the signal for energizing the solenoid valve 2 is turned on (EV2-ON).

The transfer of this signal to the solenoid valve 2 and the consequent opening thereof is dependent on the intermittent closure of the thermostatic switch 26 (Figure 1) which, for clarity, is also shown in the state diagram of Figure 3 as a condition for the transfer of the signal EV2-ON output by the block 39.

The control unit 3 leaves the state 39 in order to change to the IDLE-OFF state 37 upon the removal (OFF) of the supply voltage, as a result of the opening of the switch 25 (Figure 1).

In this mode, a current pulse (SWITCH-OFF) is also generated upon the transition from the state 39 to the state 37, neutralizing the thermocouple current and ensuring closure of the solenoid valve 1.

If, for any reason, the thermocouple voltage V decreases below a predetermined threshold value (5mV) (as when the pilot light goes out) or with a rate of change -ΔV/ΔT greater than a predetermined value S, the control unit is put in an alarm state 40 (ALARM) in which the signals for energizing the

solenoid valves

1 and 2 are both turned off (EV1-OFF, EV2-OFF), whereas an alarm signal ALARM-ON is turned on and activates an optical and/or acoustic alarm indicator.

As in the previous case, the alarm state 40 may be a permanent lock-out which the system leaves (transition line 41) by a manual resetting operation in the presence of the supply voltage (MAN.RST & ON) or a volatile lock-out which the system leaves (transition line 42, alternative to line 41) upon the removal (OFF) of the supply voltage.

As in the previous case, a timing circuit may also be provided and activated when the control unit 3 is in the state 38 in order to bring about the change from the state 38 to the state 40 (transition line 44, signal TIME-END) if a thermocouple voltage above a predetermined value is not detected within a predetermined period of time determined by the timing circuit.

As in the previous case, instead of the change from the state 39 to the state 40 if the thermocouple voltage falls below a threshold value, it is possible to provide for a change from the state 39 to the state 38 (transition line 43).

The permanent-pilot mode of operation thus differs substantially from the intermittent-pilot mode of operation solely in that the pilot light is lit permanently throughout the time for which the automatic control system is supplied, irrespective of an actual demand for ignition of the burner imposed intermittently by a thermostatic switch (switch 26 of Figure 1).

This mode of operation, which requires a permanent electrical supply to the system and a continuous supply of gas to the pilot-light nozzle and hence a continuous although low consumption of electrical energy and gas which, in the previous case, is strictly limited to the stages in which the pilot flame is ignited and the burner is supplied, is particularly advantageous for automatic control systems for so-called "combined" or water-heating automatic boilers in which it is necessary to have an almost instantaneous supply of hot water upon demand by the user.

In fact, the supply takes place without delay since it does not even have to be preceded, upon each demand, by a short pilot-flame ignition stage of the order of 10-15 sec.

Naturally, in this case, as well as providing for an ON-OFF-type regulation under the control of a thermostatic switch 26 (Figure 1), the regulation solenoid valve 2 also has to ensure a continuous opening regulation which is achieved, for example, by means of a differential diaphragm actuator acting on the obturator 20 in an OR logic arrangement with the electromagnet 22 in dependence on the required flow-rate of hot water.

In addition to the various modes of operation and variants, it will thus be noted that the automatic control system provides for the use of two valves (safety and regulation) in cascade which, except for the holding ensured by the thermocouple voltage if it is greater than a predetermined threshold value, are opened mutually exclusively, and that the absence of flame is detected positively, where appropriate after an ignition attempt, in order to close both solenoid valves and to adopt an alarm and lock-out state (volatile or permanent).

Double intrinsic safety is thus ensured, as already explained since, in the event of the pilot light going out, the supply of gas is stopped not only as a result of the automatic operation of the safety valve but also by the supplementary closure action imparted to the regulation valve.

Figure 4 shows schematically and by way of an example of the various possible embodiments, a preferred embodiment of a control unit 3 for the automatic control system of the present invention in the case of the intermittent-pilot mode of operation.

A conventional supply 4 activated by the closure of the thermostatic switch 25 outputs an alternating voltage V^∼ used for energizing the solenoid valves and the spark-generator 6, which is also conventional, a first, unregulated direct voltage V1 of the order of 20V, and a second, regulated direct voltage V2 of the order of 15V.

The control unit comprises essentially the following functional blocks:

a block 50 for releasing the safety solenoid valve,
a block 51 for monitoring the thermocouple voltage,
a block 52 for piloting the solenoid valves and the spark-generator, and
a timing and alarm block 53.

The release block 50 comprises a diode 54, a resistor 55 and a capacitor 56 connected in series between the voltage V1 and the positive thermocouple terminal 7.

The node between the resistor 55 and the capacitor 56 is connected to earth by a limiting resistor 59 and a first, normally-closed, switch contact 57 of a relay 58 of the piloting block 52.

The monitoring block 51 comprises essentially a first operational amplifier 60 supplied with the voltage V2 and receiving the thermocouple voltage as an input (through suitable resistors), and a comparator 61, also supplied by the voltage V2, with its non-inverting input connected to the output of the amplifier 60 and its inverting input connected to a reference voltage VR (obtained, for example, from V2 by a resistive divider).

Input capacitances and feedback circuits, not shown, define the gain and frequency-response of the amplifier and comparator, in known manner.

At the output of the comparator 61 there is a positive electrical signal if the thermocouple voltage is above 5mV, and a zero electrical signal if the thermocouple voltage is below 5mV.

The optional modifications necessary to take account, additionally or solely, of any decreases of more than a predetermined value in the thermocouple voltage can easily be inferred from the document WO9312378 cited.

They will also be considered in greater detail below.

The piloting block 52 comprises essentially a transistor 62 with its collector connected to the voltage V1 by means of a load constituted by the winding of the relay 58 with two toggling

switch contacts

57, 63, its emitter connected to earth, and its base driven, in known manner, by the signal output by the comparator 61.

A freewheeling diode 64 with reverse polarity is connected between the voltage V1 and the collector of the transistor 62.

The timing and alarm block 53 comprises essentially an RC network formed by a resistor 65 and a capacitor 66 in series between the voltage V2 and earth, a comparator 67 which is supplied by the voltage V2 and receives as inputs the charge voltage of the capacitor 66 and a reference voltage VRR obtained, for example, from V2 by a resistive divider, and a transistor 68 connected like the transistor 62 in order to drive the winding of an alarm relay 69 in parallel with which an LED 70 or equivalent alarm indicator is connected.

The normally-closed contact 71 of the relay 69 is opened with a delay determined by the time constant of the RC network 65, 66 after the supply of voltage to the circuit.

The alternating voltage V^∼ is transferred by means of the normally-closed contact 71 to the switch contacts 63 as a signal EV1 or EV2 for the mutually exclusive supply of the two solenoid valves 1 and 2 (Figure 1).

As long as the thermocouple voltage is below 5mV, the de-energized relay 58 supplies the solenoid valve 1, which is opened, and the spark-generator.

As soon as the thermocouple voltage exceeds 5mV, the relay 58 is energized and the supply is switched to the solenoid valve 2 by means of the switch contacts 63.

Moreover, the switching of the contacts 57 of the relay 58 causes the capacitor 66 to be discharged, consequently resetting the timing block and allowing charging of the capacitor 56, the function of which will be explained below.

If, however, the thermocouple voltage does not exceed 5mV, when the charge voltage of the capacitor 66 exceeds the reference voltage VRR, the comparator 67 makes the transistor 68 conductive and the relay 69 is supplied and opens the contact 71, removing the supply from both of the

solenoid valves

1 and 2 and indicating the alarm condition.

The relay 69 may be of various types; if a simple relay with an electromagnet is used, the lock-out and alarm condition is volatile and, if the supply is removed from the control circuit, for example, by the opening of the switch 25, the de-energizing of the relay causes the control circuit to return to the rest condition (block 30 of Figure 2).

If, on the other hand, the relay 69 has a manual lock-out with a manual release, the lock-out condition is maintained even if the supply is removed and, in order to return to the rest condition, a manual operation is necessary to release the mechanical lock-out.

The release may also be electro-mechanical and brought about by a push-button which closes an electrical release circuit. In this case, as will be described further below, the release is dependent on the presence of a voltage and the system changes from the lock-out state 30 to the pilot-light ignition state 31 (Figure 2).

Finally, in normal operative conditions, when the control circuit is in the state 32 and the relay 58 is energized, the removal of the supply voltage causes the relay 58 to return to the rest condition and the solenoid valve 2, which is no longer supplied, to close.

The contact 57 of the relay 58 switches and connects the positively-charged plate of the capacitor 56 to earth.

The capacitor 56 thus applies to the thermocouple circuit a negative voltage pulse which opposes the thermocouple voltage and neutralizes the current which holds the solenoid valve 1 open, so that it closes.

The embodiment of the control unit for the permanent-pilot mode of operation shown in Figure 5 may not differ greatly from the previous embodiment.

In Figure 5 the supply functional block 4, the release functional block 50, and the thermocouple-voltage monitoring functional block 51 are identical to those of Figure 4 and are therefore not shown in detail.

The solenoid-valve piloting block is also the same as that of Figure 4, differing therefrom solely in that, when the contact 57, which is normally closed to earth, is opened, it supplies a supply voltage to an alarm block 73.

The alarm block 73, which replaces the timing block 53 of Figure 4, comprises a lock-out and alarm relay 75 of the mechanical lock-out type with two contacts 80, 81 (of which one 81, which is normally closed, has the same function as the contact 71 in the block 53, at least with regard to the activation of the release block 50), a first excitation winding 76 connected between earth and the collector of a PNP-type transistor 77 and a second resetting winding 79.

The emitter of the transistor 77 is supplied, by means of a delay network formed by a capacitor 72 and a resistor 74, by a voltage supplied, for example but not necessarily, by the block 50 when the contact 57 in the block 52 is open.

Otherwise, it is connected to earth by means of the resistor 74 and the closed contact 57.

The base of the transistor 77 is polarized, through a resistor 78, by the output voltage of the comparator 61 of the block 51 which makes the transistor 77 conductive if the thermocouple voltage is below 5mV and, of course, if the contact 57 is open and the transistor 77 is supplied.

An LED 82 or equivalent indicator, connected in series between the voltage V1 and earth to a current-limiting resistor and to the normally-open contact 80, supplies an alarm signal when the relay 75 is put in the alarm state.

The second winding 79 of the relay 75, which is energized by the voltage V1 when a push-button switch 83 is closed, provides a reset control signal for the lock-out and alarm device.

Clearly, the circuits of Figures 4 and 5 represent only preferred examples of the many possible embodiments and many variations may be applied.

Amongst these, the possibility of a change from the burner-operating state to the re-ignition or alarm state if the rate of decrease of the thermocouple voltage is greater than a certain value has already been mentioned.

In particular, the control system described can also be used in gas-burning equipment having a pilot light and protection against depletion of supporters of combustion, known by the acronym ODS (for oxygen depletion system), in which the design of the pilot-light nozzle and its spatial relationship with the thermocouple are such that the pilot light heats the thermocouple only when there is an adequate supply of supporters of combustion; otherwise, in the presence of a stale atmosphere, and hence with a smaller supply of supporters of combustion, the rate of propagation of the flame is reduced and the pilot flame generated moves away from the thermocouple and cannot heat it sufficiently.

If the control system described is used in combination with an ODS device, it is advantageous, for reasons of safety, to avoid any attempt to reignite the pilot light in the event of its going out, which may be due to combustion-air depletion.

With reference to Figure 2, it is therefore advisable to change from the burner-operating state to the alarm state 33, following the transition path 36 instead of to the pilot-light ignition state 31, following the transition path 35.

Moreover, it is also advisable for the alarm and lock-out condition 33 to be permanent and for a manual operation to be required to reset it.

In the permanent-pilot mode of operation represented by the state diagram of Figure 3, it is thus advantageous to exclude the variant represented by the transition path 43 from the burner operating state 39 to the pilot-light ignition or re-ignition state 38.

It is also possible to provide a more sophisticated control system which can discriminate between accidental extinguishing of the flame and the intervention of the ODS device.

Accidental extinguishing of the pilot light in fact results in a relatively rapid decrease in the thermocouple voltage which can be detected even before the threshold voltage value is reached, whereas depletion of supporters of combustion in an enclosed environment and the consequent movement of the pilot flame away from the thermocouple are much slower and more gradual phenomena which bring about a slower and more gradual decrease in the thermocouple voltage.

Accidental extinguishing of the pilot flame can therefore be identified by means of a circuit for detecting a negative derivative of the thermocouple voltage and depletion of supporters of combustion by comparison of the thermocouple voltage with a predetermined threshold voltage.

It is in fact only when the thermocouple voltage is below a predetermined threshold value that the safety valve closes, extinguishing the pilot light, if it is lit, and causing a further subsequent rapid drop in the thermocouple voltage.

It is therefore possible to cause the state of the control system to develop differently according to whether one or other of the two events occurs first, in the first case attempting to re-ignite the flame and, in the other case, bringing about a permanent lock-out of the system.

Figure 6 shows, as a state diagram, the operation of a preferred embodiment of the control unit 3 which operates according to these concepts in a system such as that of Figure 1.

From an inactive state 90 (IDLE-OFF) in which the unit 3 is preferably but not necessarily, not supplied electrically, the system changes to a state 91 (PILOT IGNIT) for the ignition of the pilot light when a heat demand signal TH-ON is applied to the unit.

In the state 91, the control unit 3 activates an internal timing circuit (START-TIM), and turns on (EV1-ON) the signal EV1 for energizing the solenoid valve 1 (Figure 1) which is opened, as well as a signal SPARK-ON for energizing the ignition spark-generator 6 (Figure 1).

The signal EV2 for energizing the regulation solenoid valve 2, on the other hand, is turned off (EV2-OFF).

As result of the signals which are turned on, the nozzle 18 is supplied with gas and the pilot flame 19 is ignited, heating the thermocouple 7.

When the thermocouple voltage V exceeds the predetermined threshold level (5mV) which is sufficient to ensure that the solenoid valve 1 is kept open, the condition V>5mV recognized by the unit 3 causes it to change from the state 91 to a state 92 (BURNER COMM), with a delay which is normally of the order of a few seconds (5-15 sec.).

It also resets the internal timing circuit 27 (RES-TIM).

The burner is thus lit.

In normal working conditions, the control unit 3 changes from the state 92 (BURNER COMM) to the state 90 (IDLE-OFF) when the thermostatic supply switch 25 is opened (TH-OFF).

During the transition from the state 92 to the state 90, a voltage pulse SWITCH-OFF is generated and applied to the thermocouple circuit and neutralizes the thermocouple voltage, closing the solenoid valve 1 and extinguishing the pilot light.

In the state 90, all of the signals output by the control unit 3 are turned off; both of the

solenoid valves

1 and 2 are therefore closed.

Any failure of one of the open valves to close does not constitute a dangerous condition because gas is prevented from flowing to the burner, if not to the pilot-light nozzle, by the operation of the other valve.

If, during the operation of the burner (state 92), the thermocouple voltage V undergoes an abrupt decrease (-ΔV/ΔT>S), probably due to accidental extinguishing of the light, the control unit 3 returns to the state 91 in order to reignite the pilot light.

If, however, still during the operation of the burner, the thermocouple voltage decreases slowly to a level below or equal to a predetermined threshold voltage (V<5mV) the control unit is put in an alarm and permanent lock-out state (ALARM 1) which it leaves to change to the state 90 only by a manual resetting operation (MAN-RST).

In this case, the change in the thermocouple voltage is probably due to depletion of supporters of combustion.

In this state, the control signals for energizing the two

solenoid valves

1 and 2 are both turned off (EV1-OFF, EV2-OFF) and a signal ALARM1-ON for activating an optical and/or acoustic indicator of the alarm state is turned on.

If the ignition or re-ignition operation carried out by the control unit 3 in the state 91 is not successful and the control unit 3 does not change to the state 92, at the end of the time interval defined by the timing circuit 27 (TIME-END), the control unit changes from the state 91 to an alarm state 94 (ALARM 2).

In this state, the control signals for energizing the two

solenoid valves

1 and 2 are both turned off (EV1-OFF, EV2-OFF) whereas a signal ALARM2-ON for activating an optical and/or acoustic alarm-state indicator is turned on.

The lock-out and alarm state may be volatile or permanent.

The system thus changes from the state 94 to the state 90 completely automatically without any manual intervention when the condition TH-OFF occurs.

In the second case, the alarm state 94 is functionally equivalent and corresponds to the state 93.

Figure 7 shows, by way of example, a practical embodiment of a control unit which operates according to the states of Figure 6.

The control unit is constituted essentially by the same functional blocks as those described with reference to Figures 4 and 5 and only the very small variations are shown and described in detail. The functional blocks and elements equivalent to those of Figures 4 and 5 are identified by the same reference numerals.

The block 51 for monitoring the thermocouple voltage differs from that of Figures 4 and 5 solely in that, in addition to the comparator 61, there is a second comparator 95 the inverting input of which is connected to the output of the amplifier 60.

The non-inverting input, on the other hand, is connected to the output of the amplifier 60 by means of a resistor 96. It is also connected to earth by means of a resistor 97 and a capacitor 98 in parallel with one another.

Clearly, the output of the comparator 95 is normally at an electrical level 0 and is brought to a positive electrical level (V2) only by a relatively rapid decrease in the voltage output by the amplifier 60.

The block 52 for piloting the solenoid valves differs from that of Figures 4 and 5 in that, as well as being controlled by the transistor 62 which closes one terminal of the winding to earth when it is made conductive by the comparator 61, the excitation winding of the relay 58 is also controlled by a PNP transistor 99 of which the emitter is connected to the voltage V2 (by suitable measures also to the voltage V1) and the collector is connected to the other terminal of the winding.

The base of the transistor 99 is connected to the output of the comparator 95 by means of a resistor, so that the transistor 99, which is normally conductive, is cut off when the output of the comparator 95 is brought to a positive electrical level, that is, in the presence of a relatively rapid drop in the thermocouple voltage.

Clearly, the relay 58 is energized when the thermocouple voltage is greater than a predetermined threshold value and is de-energized, not only if the thermocouple voltage falls below the threshold value, but also if it drops rapidly.

The control unit comprises both a timing and alarm block 53 identical to that of Figure 4 and an alarm block 73 identical to that of Figure 5.

The supply of the voltage V^∼ to the solenoid valves is controlled jointly by the two

blocks

53 and 73, by the connection in series of the relay contact 71 in the block 53, of the relay contact 81 in the block 73, and of the diverter switch contact 63 of the relay 58 in the block 52.

As in the embodiment of Figure 4, the energizing of the relay 58 brings about resetting of the timing circuit in the block 53 by the switching of the contact 57.

As in the embodiment of Figure 5, when the signal output by the comparator 61 falls to the level 0, provided that the relay 58 is energized (burner-operating state 92) it activates the alarm block 73.

If it is not necessary to have two different lock-out conditions (volatile and permanent) in dependence on different events, the two alarm blocks 53 and 73 may be replaced by a single alarm and timing block, with a single intervention and permanent lock-out relay activated both by the operation of the timing circuit and by the falling of the thermocouple voltage below the threshold level.

Claims

An automatic control system with double intrinsic safety protection for gas burners, comprising:

a first, safety solenoid valve (1) with at least a first and a second excitation winding (14, 15),

a second, regulation solenoid valve (2) in cascade with the first valve (1) and having a third winding (24),

means (17, 18), connected to a gas pipe (10) between the first and second valves (1, 2), for supplying a pilot light (19),

pilot-light ignition means (6), and

a thermocouple (7), heated by the pilot light and connected to the first winding (14) in order to keep the first solenoid valve (1) open,
characterized in that it comprises:

detector means (51) for recognizing whether the voltage generated by the thermocouple (7) is above or below a predetermined threshold value, and

control means (3, 50, 52, 53, 73) having a pilot-light ignition state (31, 38), a burner-operating state (32, 39) and an alarm state (33, 40),

in the ignition state, the control means turning on a first control signal (EV1) for opening the first solenoid valve (1) and activating the ignition means (6) with the exclusion of a second control signal (EV2) for opening the second solenoid valve (2),

in the burner-operating state, the control means turning on the second control signal (EV2) with the exclusion of the first signal,

in the alarm state, the first and second signals being turned off together,

the control means changing from the ignition state to the burner-operating state when the voltage generated by the thermocouple and detected by the detector means exceeds the predetermined threshold value, and

the control means changing to the alarm state upon the occurrence of one of the following events:

the voltage generated by the thermocouple and detected by the detector means falling below the predetermined threshold value with the control means in the burner-operating state,

the voltage generated by the thermocouple and detected by the detector means not exceeding the predetermined threshold value within a predetermined time interval with the control means in the ignition state.
A control system according to Claim 1, in which the detector means (51) comprise means (95, 96, 97, 98) for recognizing a decrease of the thermocouple voltage with a rate of decrease greater than a predetermined value, and in which the control means change from the burner-operating state to the ignition state if, in the operating state, the thermocouple voltage decreases with a rate of decrease greater than the predetermined value.
A control system according to Claim 2, in which the event which causes the control means to change to the alarm state is the falling of the voltage generated by the thermocouple below the predetermined threshold value.
A control system according to Claim 1 or Claim 2, in which the control means change to the alarm state from the ignition state if the voltage generated by the thermocouple and detected by the detector means does not exceed the predetermined threshold value within a predetermined time interval, and change from the burner-operating state to the ignition state if, in the burner-operating state, the voltage generated by the thermocouple and detected by the detector means decreases below the predetermined threshold value.
A control system according to the preceding claims, in which the control means comprise a first switch (71) which is normally closed and is open in the alarm state and a second, diverter switch (63) in series with the first switch and having one or other of two states, for the ignition state or for the burner-operating state of the control means, respectively.
A control system according to the preceding claims, in which the control means assume an inactive state (30, 37) in the absence of an electrical supply and comprise means (50) for generating an electrical pulse for closing the first electromagnetic valve (1) when the control means change from the burner-operating state to the inactive state as a result of an interruption in the electrical supply.