EP1407191B1 - Safety device for boiler comprising a time delay protected by an electronic circuit - Google Patents

Abstract

A safety device for an industrial boiler (CHA) including electromechanical relays (RE<SUB>n</SUB>, RS), which are connected in series in order to form an electromechanical safety chain (CH 1 ), and at least one shunt relay (RT<SUB>n</SUB>) which is normally open and mounted in parallel to one of the electromechanical relays (RE<SUB>N</SUB>). The shunt relay is controlled by an automaton (AP 1 ) so that it is closed during a time delay. The shunt relay (RT<SUB>n</SUB>) is provided with a contact that is connected to an electronic circuit (CE<SUB>n</SUB>) and said electronic circuit (CE<SUB>n</SUB>) opens an electromechanical relay (RS) which is mounted in series in the safety chain when the shunt relay (RT<SUB>n</SUB>) is closed for longer than the time delay. Given the arrangement, in the event of an automaton failure, the time delay is ensured by the electronic circuit so that a satisfactory level of safety is guaranteed in relation to the installation.

Description

The invention relates to a safety device for an industrial boiler comprising electromechanical relays connected in series to form an electromechanical safety chain, and at least one normally open shunt relay connected in parallel with one of said electromechanical relays. shunt being controlled by a PLC to be closed during a delay time.

A safety device for an industrial boiler comprising electromechanical relays is known from DE-A-3,704,062.

The invention applies in particular to industrial boilers comprising for example a gas burner for producing steam or superheated water. Such boilers are provided with a safety device of the type indicated above which is interposed between one or more sensors and one or more actuators mounted on the boiler. This device is especially designed to trigger via the actuators a boiler shutdown when at least one sensor detects a malfunction of the boiler. This defect can be excessive pressure, too low a water level or a problem in the burner flame. Each sensor is for example a pressure switch which supplies an alternating electric current under 230 Volts to keep a corresponding electromechanical relay connected in series in the safety chain of the device closed. This safety chain is an electrical circuit comprising several electromechanical relays connected in series to form an electrical circuit which is closed in normal operation, and which is open on detection of a fault by a sensor. Actuators that can be for example solenoid valves are designed to trigger a shutdown of the boiler as soon as they are no longer supplied with power. Thus, the safety device comprises for each sensor a relay which is kept closed by the corresponding supply current, and it provides power to the actuators if the safety chain is closed. In the event of a malfunction, one of the sensors stops supplying its current to open the safety chain, which causes the power supply of the actuators to stop to shut down the boiler.

Some of the sensors are subjected to daily tests to check that in the event of a fault in the boiler, the sensor tested will open the corresponding relay. These tests are carried out during operation, and the corresponding relay must open, but without stopping the boiler. A shunt relay that is normally open is therefore connected in parallel with the relay corresponding to the sensor tested. This shunt relay is closed by a PLC for a predefined delay time, so that the safety chain remains closed during the opening of the sensor relay generated by the test. The test of a pressure switch consists, for example, of temporarily closing an isolation valve of a box comprising the pressure switch and of increasing the pressure in this box to check that the corresponding relay in the safety chain opens on increase of the pressure in the box. When closing the isolation valve, the shunt relay is closed by the PLC for the delay time. The increase in pressure causes the sensor relay to open, but the safety chain remains closed due to the closing of the shunt relay. The isolation valve is then opened to complete the test by restoring normal pressure in the chamber. Returning to normal pressure in the sensor environment therefore causes the sensor relay to close. Then, the timer is disarmed through the PLC which controls the opening of the shunt relay, which corresponds to a return to the initial state preceding the test.

The problem with these timers is that they are managed only by the controller. Therefore, a malfunction of the controller can cause a closed hold of a shunt relay in the safety chain beyond the delay time. In such a case, the corresponding sensor is inhibited since if it detects a fault, the opening of its relay will not cause an opening of the safety chain, given that its shunt relay is closed. Such a malfunction is therefore not detected by the safety device, which constitutes a major risk for the operational safety of the installation.

The object of the invention is to overcome these disadvantages.

To this end, the subject of the invention is a safety device for an industrial boiler comprising electromechanical relays connected in series to form an electromechanical safety chain, and at least one normally open shunt relay mounted in parallel with one of said electromechanical relays, said shunt relay being controlled by an automaton to be closed during a delay time, characterized in that said shunt relay has a contact connected to an electronic circuit, and in that said electronic circuit controls an opening of an electromechanical relay connected in series in the safety chain in case of closure of said shunt relay for a duration greater than said duration of delay ..

Such a construction makes that the delay is managed by the electronic circuit and the PLC to ensure a satisfactory degree of safety of the installation.

According to a particular embodiment of the invention in which the safety device comprises electromechanical relays connected in series to form a power supply circuit of an actuator of the boiler, one of said relays being controlled by an automaton for being open for a delay time on receipt of a delay start command, the electronic circuit drives another electromechanical relay also connected in series in said supply circuit to open said other electromechanical relay during said delay time on receipt of said timed launch order. With this arrangement, a minimum delay time such as a minimum pre-scan time before commissioning can also be secured.

According to a preferred embodiment of the invention said relay which is controlled by the electronic circuit is closed if it is electrically powered by the electronic circuit and otherwise open. With this arrangement, in the event of a fault in the electronic circuit, the delay time tends to zero so as to instantly open the security chain in such a case. This arrangement further increases the operational security of the timing management.

According to a preferred embodiment of the invention, the relays and the electronic circuit are mounted on a support in the form of a printed circuit board. With this arrangement, the safety device can be mounted in a compact assembly enclosed by an optionally sealed housing to prevent an operator from changing its configuration.

According to another particular embodiment of the invention the electronic circuit comprises a programmable circuit of "PAL" type. With this arrangement, the electronic circuit can be realized at a lower cost.

• La figure 1 est une représentation très schématique de l'invention ;
• La figure 2 est une représentation très schématique d'un premier mode de réalisation de l'invention ;
• La figure 3 est une représentation très schématique d'un circuit électronique du dispositif selon l'invention ;
• La figure 4 est une représentation très schématique d'un second mode de réalisation de l'invention.

The invention will now be described in more detail and with reference to the accompanying drawings which illustrate one embodiment thereof by way of example.

• Figure 1 is a very schematic representation of the invention;
• Figure 2 is a very schematic representation of a first embodiment of the invention;
• FIG. 3 is a very schematic representation of an electronic circuit of the device according to the invention;
• Figure 4 is a very schematic representation of a second embodiment of the invention.

As shown in FIG. 1, a safety device according to the invention is connected to at least one sensor PT _n and at least one actuator EV _m which are generally mounted in the industrial boiler CHA. The sensor PT _n which is here a pressure switch sends an electric current I _n to the safety device DS which is here mounted in an electrical cabinet AE. On receipt of this current I _n , the safety device in turn returns a second electric current J _m towards the actuator EV _m which is here a solenoid valve, to maintain this actuator in a normal operating position. If the current I _n is not received, the safety device DS controls an opening relay of the power supply circuit of the actuator EV _m to cancel the current J _m , and thus trigger the shutdown of the boiler . The electric currents I _n and J _m are generally alternating currents of high power at 230 volts.

Figure 2 shows very schematically the architecture of the DS security device. This comprises several electromechanical relays RE _n connected in series to form a safety chain CH1. Each relay RE _n is kept closed by a corresponding supply current I _n which is supplied by a corresponding sensor PT _n . CH1 safety chain is thus an electrical circuit which is closed during normal operation, and which is opened as soon as a PT _n sensors detects a fault. For sensors to be periodically tested, a shunt relay RT _n that is normally open is connected in parallel with the RE _n sensor relay. This shunt relay is controlled by an PLC controller to be closed for a delay time from the beginning of the test. This delay time is for example 30 seconds maximum. When an operator test a PT _n pressure switch by closing an isolation valve VI _n of the corresponding insulation chamber Cl _n and by increasing the pressure in this chamber, the test delay is activated. Generally, the isolation valve VI _n is equipped with an electrical contactor connected to the PLC controller for controlling the closure of the shunt relay RT _n as soon as the valve VI _n is closed. This shunt relay is then opened on the order of the PLC as soon as the delay time has elapsed. In the event of a malfunction of the controller or the shunt relay, the shunt relay RT _n can therefore remain closed for a duration longer than the delay time. In such a case, the corresponding sensor is inhibited since if it detects a fault, the opening of its relay will not cause an opening of the safety chain, given that its shunt relay is closed. Such a malfunction is therefore not detected by the safety device, which constitutes a major risk for the operational safety of the installation.

According to the invention, the shunt relay RT _n which is controlled by the PLC PLC has its time delay secured by an electronic circuit CE _n such that the EC circuit _n drives an electromechanical relay RS connected in series in the CH1 chain for open CH1 if relay RE _n remains closed for longer than the delay time. This electronic circuit has an input E connected to a contact of the shunt relay RT _n such that as soon as it detects a closing of the relay RT _n , it triggers a delay, and if at the end of this delay the relay RT _n is still closed, it controls the opening of the RS relay. Thus, the electronic circuit CE _n is able to trigger a shutdown of the boiler independently of the PLC, and on detection of an overrun of the delay time. According to the invention, the timer which is controlled by the PLC is therefore also secured by the electronic circuit CE _n to form a heterogeneous hardware redundancy in the management of the timer.

This embodiment is given as an example for securing a timer corresponding to a sensor test, but it can also be applied to securing other similar timers. For example, during the start-up sequence, the flame detection sensor is subjected to a similar delay for which it must detect the presence of a burner flame no later than five seconds after the start of feeding. burner gas, otherwise a safety of the boiler or its starting device must be triggered.

The circuit CE _m can be realized in different ways, for example by using capacitors and resistors driven by a logic integrated circuit to count the delay time on the basis of the charging time of a capacitor.

An exemplary embodiment of the electronic circuit CE _n is shown very schematically in FIG. 3. It comprises a logic integrated circuit CIL having an input E connected to a contact of the shunt relay RT _n and an output S to control an opening of the relay RS in the case where the input E is energized for a duration greater than the time delay. This logic integrated circuit is powered by a DC voltage of 12 volts, and it is connected to a resistor R and capacitors C1 and C2 to drive capacitor C1 charges to manage the delay time. On receipt of an E timing start command, the logic integrated circuit triggers a charge of the capacitor C1. The logic integrated circuit also has an input connected to a point V located between the resistor R and the capacitor C1, so that during the charging of the capacitor C1, this input changes state when the delay time has elapsed. Thus, in the case where the timer has elapsed while the shunt relay RT _n is still closed, the logic integrated circuit controls the opening of the relay RS through its output S.

The logic integrated circuit CIL will advantageously be realized for example with a "PAL" type circuit. These "PAL" circuits operate under 12 Volts and allow to realize at least cost logical operators between input channels and output channels. They are permanently configured by electrical breakdown.

More particularly, the relay RS is a relay that is closed if it is powered by the output S, and otherwise open, such that a malfunction of the circuit. CE triggers an opening of the RS relay. Thus, in the event of a fault in the electronic circuit, the delay time tends to zero so as to instantly open the security chain in such a case. This arrangement further increases the operational security of the timing management.

In another variant of the invention, the various electronic circuits and the various relays are grouped together in a housing enclosing supports in the form of printed circuit boards on which they are mounted by welding. Such a housing comprises one or more printed circuits on which are mounted the relays forming the electromechanical chain, so that these relays are not interconnected by a hardwired logic, but by conductive tracks printed circuits. These different circuits can thus form a compact assembly enclosed by an optionally sealed housing to prevent an operator from changing the configuration thereof. Advantageously, several circuits are pinned in connectors of a card called backplane board and also equipped with connectors providing the electrical connection with the sensors and with the actuators.

The starting of such a boiler is subject to a sequence also implementing timers. For example, the ignition of the burner must be performed after a pre-purge operation of the combustion chamber to evacuate any residual gas before commissioning the burner. Opening of the burner gas supply solenoid valve must be prohibited until the pre-purge sequence is complete. Such a start sequence is provided by a controller that controls the pre-purge sequence to control the closing of a relay of the power supply circuit of the gas supply solenoid valve at the end of the pre-purge sequence. The closing of this relay is only commanded after the expiration of the minimum delay time corresponding to the pre-scan. The controller may be a microprocessor programmable controller, or a "black box" comprising for example a servomotor for controlling the sequence.

In a similar way to the security of the security chain, the device according to the invention may have the timings of its start sequence also secured by one or more electronic circuits. For the management of the pre-purge delay, the PLC PLC which is represented in FIG. 4, then manages a delay which is this time a minimum duration which must elapse before it commands the closing of a relay RE _m of an AC electromechanical chain. The AC chain which is secured here is a power supply circuit of an actuator EV _m which is for example the gas supply solenoid valve of the burner.

According to the invention, the order of launching of the prepurge timer T that is received is sent in parallel to the PLC controller and an electronic circuit CE _m. On receipt of a delay start command, the electronic circuit CE _m controls the opening of another electromechanical relay RS for the minimum duration. Consequently, in the event of a malfunction of the automaton causing an early closure of the relay RE _m , the actuator EV _m is not energized since the AC supply circuit is kept open by the relay RS which is controlled by the circuit electronic CE _m . The RS relay is here a start authorization relay.

More generally, the startup sequence includes timers that are minimum durations and maximum times during which relays must be operated. Securing all of such a start sequence thus includes several electronic circuits to manage these two types of timing, parallel to the controller.

The electronic circuit CE _m managing this pre-purge delay which is a minimum duration may for example be a circuit of the type of that shown in Figure 3, but driven by a logic different from that which has been presented above. This circuit holds the start enable relay RS open on receipt of a timer command and commands a closing of this relay after the delay time has elapsed.

More particularly, the relay RS is a relay that is closed if it is powered by the output S, and otherwise open, so that a malfunction of the circuit CE triggers an opening of the relay RS. Thus, in the event of a fault in the electronic circuit, the delay time tends to infinity so as to prevent the burner from starting in such a case. This arrangement further increases the operational security of the timing management.

As can be seen, the security device according to the invention gives rise to an improved degree of security in the management of security delays by forming a heterogeneous redundancy for the management of these delays.

Claims (5)

1. Safety device for an industrial boiler (CHA) comprising electromechanical relays (RE_n, RS) connected in series to form an electromechanical safety chain (CH1) and at least one normally open shunt relay (RT_n) that is connected in parallel with one of said electromechanical relays (RE_n) and is controlled by an automatic controller (API) so that it is closed for a time delay duration, said shunt relay (RT_n) having a contact connected to an electronic circuit (CE_n) and said electronic circuit (CE_n) controlling opening of an electromechanical relay (RS) connected in series in the safety chain in the event of closure of said shunt relay (RT_n) for a duration exceeding said time delay duration.
2. Safety device for an industrial boiler (CHA) comprising electromechanical relays (RE_m, RS) connected in series to form an electrical power supply circuit (CA) of an actuator (EV_m) of the boiler and one of said relays (RE_m) being controlled by an automatic controller so that it is open for a time delay duration on receiving a time delay start instruction, an electronic circuit (CE_m) controlling another electromechanical relay (RS) that is also connected in series in said power supply circuit (CA) to open said other electromechanical relay (RS) for said time delay duration immediately on receiving said time delay start instruction.
3. The device according to claim 1, wherein said relay (RS) that is controlled by the electronic circuit (CE_n) is closed when it is supplied with electrical power by the electronic circuit and is otherwise open.
4. The safety device according to claim 1, 2 or 3, wherein said relays (RE_n, RE_m, RS) and said electronic circuit (CE_n, CE_m) are mounted on a support in the form of a printed circuit board.
5. The safety device according to claim 1, 2, 3 or 4, wherein said electronic circuit (CE_n, CE_m) comprises a PAL-type circuit.

Images