EP1462724B1 - Apparatus for temperature control or limitation of a heat generator - Google Patents

Abstract

An automatic heating control unit has a safety module which compares the temperature fed to a regulator from a sensor with a maximum allowable safe temperature (TSTB) stored in the safety module. If the safe temperature is reached or exceeded, the safety module generates a switch-off signal which causes the system to be switched off by the automatic heating control unit. An independent claim is included for a method of checking the temperature regulation or limiting function of a heat generating system.

Description

The invention relates to a device for temperature control / limitation for a heat generating plant and a method for checking the function, in particular the temperature control / limiting function for a heat generating plant.

The safety requirements with regard to temperature control and limitation devices are defined, for example, in the German standard DIN 3440. For the description of the invention, the terminology used in this standard is used, but without the standard being treated in detail here. According to the definition of the standard in point 2.2, a safety temperature monitor (STW) is an automatic reset device after the response, when the sensor temperature has dropped below the set limit by the amount of the switching differential, in addition to the requirements of extended safety according to point 3.12 of the standard DIN 3440. In contrast to the safety temperature monitor, interlocking occurs on a safety temperature limiter (STB) after the response. In this case, a provision by hand or with a tool is usually only possible if the sensor temperature has dropped by the amount of the switching difference below the limit.

Preferably, the STB or STW mentioned above are used to monitor the boiler temperature of a boiler. The boiler temperature is detected by at least one temperature sensor, which can be arranged, for example, on the boiler control panel of the boiler together with the temperature controller. The temperature controller compares the detected temperature of the boiler with a predetermined setpoint and influences the actual value of the temperature in the sense of an adjustment to its setpoint. If, for example, the temperature limit monitored by the temperature limiter or monitor is reached or an error occurs, eg sensor break, sensor short circuit, component failure or power failure, the system should be switched off. The shutdown of the system triggered by the response of the STB or STW generally causes an interruption of the power supply.

For this purpose, usually the control circuit or load circuit of an automatic burner is interrupted, which then locks off the fuel supply. In general, the automatic burner controls the starting sequence of the burner with bleeding, ignition and flame monitoring. In the case of irregularities, such as a flame failure, locks the automatic burner, i. he interrupts the fuel supply. The automatic burner control must comply with special safety regulations. By way of example, reference is made to the standard DIN EN 298 for this purpose.

From the German Utility Model DE 297 24 551 U1 For example, a control arrangement for a burner is known in which the temperature sensor used to detect the water temperature in the boiler is used for both the temperature control and for the safety temperature limiter. As a result, a separate temperature sensor for the safety temperature limiter, as is the case with the conventional control arrangements, can be dispensed with.

In this connection already already in the European Patent EP 0 614 047 B1 proposed to combine the temperature monitor, the temperature controller and the burner control to an electronic device. The fact that the function of the temperature monitor is integrated, eliminating the need for a separate thermostat.

The integration of the burner control, temperature controller and temperature monitor here represents a cost-effective solution, since the equipment cost can be reduced due to the integration.

The prerequisite for this, however, is that the combination of the burner with automatic burner control and the boiler control panel with temperature controller and temperature monitor is known. For floor-standing boilers, however, this is an exception, since components from third-party manufacturers are also used for the combination of boiler / burner. For these components, a standardized interface (with 4- / 7-pin Wieland connector) is used for data exchange according to the prior art. These are intended for the 230 volt supply and control circuits. However, these only allow very limited communication between the components.

The use of the standardized interface (Wieland connector) also has the disadvantage that when, for example, a 230 volt signal transmitted from the automatic burner to the boiler control panel, which is to be further processed by the controller, must be additionally converted into a corresponding extra low voltage signal, since the controller generally operated with safety extra-low voltage.

From the EP 0 751 350 A2 It is known to connect various units in a boiler control device by means of a data bus to exchange corresponding data between the units of the system. This improves the capacity of data transmission. However, the safety temperature limiter, temperature controller and burner control units are designed separately. In this case, components such as relays or microprocessors, which perform the same or similar tasks, are used for the automatic burner control and for the safety temperature limiter.

EP 0 326 245 A2 discloses a "fuel burner control system" which has at least one "temperature responsive analog sensor" whose signal is processed by an A / D converter from a microcomputer. The microcomputer is part of the "fuel burner program module means", which are connected via a data bus with a "fuel burner". The "fuel burner program module means" have "sensor monitoring means" on the condition of the sensors connected to the "fuel burner program module means" with regard to functional errors, such. B. Sensor break, sensor short circuit, etc. monitor. If an error occurs, the heat generation system is shut down by the "fuel burner program module means".

The invention is therefore based on the object, in particular to propose a device for use in a heating system, which allows a reliable and accurate temperature control / limitation while avoiding the disadvantages of the prior art with little equipment expense, without safety aspects are neglected.

Furthermore, the object of the invention is to propose a method which enables reliable and accurate checking of the function, in particular of a temperature control / limiting function, in particular for a heating system.

The above object is solved by the features of the independent device claim and the independent method claim. Advantageous embodiments of the invention are the subject of the dependent claims.

The device according to the invention or the method according to the invention can be used for all safety-relevant functions in connection with the monitoring of thermal processes, ensure that the system is put into a safe state in the event of a fault or an error. The device according to the invention is characterized in that the safety temperature limiter or temperature monitor (STB, STW) is distributed in terms of functionality on the automatic burner control and controller. The components of the STB or STW, which are subject to the requirements of extended safety, are preferably provided in the automatic burner control. The components which are not subject to the special requirements of enhanced safety are preferably provided in the controller. For example, the temperature comparison of the sensed actual temperature of the boiler with the maximum allowable safety temperature T _STB at the STB or STW triggers the firing machine assigned. The sensor for detecting the actual boiler temperature is preferably assigned to the controller. In this case, the detected actual temperature is transmitted by the controller to the burner control unit via a communication interface. The communication interface can be implemented, for example, as a data bus (electrical / optical fiber optic cable) or as a radio link. The automatic burner control system monitors the boiler temperature and, when the set safety temperature T _{STB is} exceeded, switches off the fuel valves of the burner, for example, whereby the fuel supply is interrupted.

By distributing the functionality of the STB or STW according to the invention to the controller and automatic burner control unit, the hitherto conventional mechanical STB / STW can be dispensed with as an independent appliance which detects, evaluates, monitors and, if necessary, interrupts the boiler temperature. By merging the safety-relevant functions of the STB or STW in the automatic burner, the components required for the safety shutdown, and preferably also for the locking, need to be provided only once. As a result, the expenditure on equipment can be significantly reduced. The integration of the safety-relevant functions of the STB or STW in the automatic burner control has the advantage that the already existing safety structures of the automatic burner control can be used synergistically in an optimal manner.
Of course, a complete integration of STB or STW in the burner control is possible.

However, this would have the disadvantage that in this case the connection of the temperature sensor would have to be done on the burner control, whereby the standardized automatic burner would be charged with additional connections for the temperature sensor.

A further advantage of the invention is that the measured value detection by the measuring sensor and the further processing of the measured values in the controller and the transmission of the measured values from the controller to the automatic burner control unit can be tested or checked by the automatic burner control unit via a communication interface according to the invention. Preferably, a corresponding test request signal is transmitted to a sensor / test value switching module for checking the temperature control / - limit function of the automatic burner control, which can be switched between the sensor resistance and a corresponding reference resistor.

Preferably, the transmission of the sensor / test values takes place with a time offset from one another. The requirements for the interference immunity of the communication must be observed. Preferably, a data bus is used which enables a CRC check to detect data transmission errors. By using the data telegrams according to the invention, no special safety measures are required. For example, a data bus satisfying the safety aspects can be used for data transmission, as described for example in the document EP 0751 350 A2 is described.

If the automatic burner after a lockout encounters a locked state, can with the inventive safety function for unlocking, for example, max. 5 unlocks within a certain time allowed, the lock can be canceled by a transmitted over the data bus unlock command again. The unlocking command can be generated by a non-safety-oriented device, eg by means of a portable device by the operator. In order to increase the security of the data communication, the firing automat can additionally provide filtering for the received data. This can be prevented, for example, that the burner, for example, unintentionally turned on / off.

Since the controller according to the invention in accordance with the aforementioned standard does not need to be designed security relevant, no special safety measures for the controller are necessary. However, the verification of the sensor, the controller and the communication interface according to the invention is carried out by the automatic burner control. It is recommended that a galvanic isolation that meets the requirements for safety extra-low voltage, as the controller is usually operated with safety extra-low voltage in contrast to the burner control. In this case, the galvanic separation in the form of optocouplers can be provided in the controller or automatic burner control.

Furthermore, the invention also has the advantage that further process signals between automatic firing and controller, such as the type of fuel, etc. can be replaced via the communication interface. Further advantages of the invention will become apparent from the following description.

Figure 1 shows schematically the inventive arrangement with electronic safety temperature limiter in conjunction with controller and automatic burner control.

FIG. 2 shows in a functional block diagram the preferred implementation of the invention, for example based on the temperature control / limiting function.

Figure 1 shows the interaction of automatic burner control (FA) and controller with a distributed on controller and FA safety temperature limiter (STB). Of course, instead of the electronic STB, the function of a safety temperature monitor (STW) can be implemented accordingly. The sensor Tk is used for example to detect the temperature of a boiler, not shown here, and is connected to the controller. The analog / digital converter of the controller converts the analog measured value into a digital value, for example into a temperature value T. This is transmitted from the controller to the burner control. The automatic burner control comprises a safety module. The safety module or STB module monitors, for example, the sensed boiler temperature T and switches off the burner, not shown here, when the reference value stored in the STB module (safety temperature T _STB ) is exceeded.

The safety temperature or trip temperature T _STB can be set, for example, during commissioning of the system by an installer via a not shown here operating device. The safety _temperature T _STB is transmitted to the burner control and stored, for example in the STB module safety-relevant. The safety temperature T _STB is preferably transmitted in the same format as the boiler actual temperature T to the automatic burner control.

To check the correct function of the measured value acquisition, the controller and the communication interface, the STB module according to the invention carries out a corresponding test. For example, the sensor and the path from the sensor connection terminal including further processing in the controller, eg analog / digital conversion and also the transmission of the converted measured value are checked by the automatic burner control. In addition, it is checked whether the measured value T is within the permissible range defined by T _STB .

When communicating between the controller and automatic burner control system, the corresponding requirements for the immunity to interference of the data transmission must be observed so that the basic safety is guaranteed and there are no unnecessary fault shutdowns. If the sensor fails or there is a fault in the controller or if the communication is interrupted, a safety switch-off takes place through the automatic burner control until the fault or fault has been rectified. The various models for handling the errors or faults are discussed below.

FIG. 2 shows a preferred exemplary embodiment of the implementation of the method for checking a temperature control / limiter function, wherein the safety-relevant functions are performed by the automatic burner control.

The controller 20 and the automatic burner 40 are connected to each other via a communication interface (30) as shown here.

For example, a data bus (electrical / optical) or even a wireless radio link can be used as the communication interface between controller and automatic burner control. A sensor value / test value switching module 10 is preferably activated by the automatic burner control by a test request signal.

The temperature sensing resistors 11 and 12 are used e.g. for detecting the actual temperature of a boiler, not shown here. The reference resistors 13 and 14 are connected in parallel thereto via the switches 15 and 16. This makes it possible to switch between the sensor resistors 11 and 12 and the reference resistors 13 and 14, thereby obtaining the sensor values or reference / test values. Of course, the elements 11 to 16 associated with the sensor value / test value switching module 10 can be present partially or completely in the controller 20 in accordance with the functionality.

By the double execution of the temperature sensors, e.g. NTC sensors, for example, the correct mounting of the temperature sensors or a short circuit or a sensor break can be detected by comparing the temperature sensor resistances or the sensor values. This redundant design of the temperature sensor is thus a sensible safety measure. An age-related drift of the sensor values can also be determined by a comparison with the corresponding reference resistances or reference values. Instead of two separate individual sensors, of course, a double sensor or even a temperature sensor can be provided. In this case, then only one reference resistor needs to be provided. It must be ensured that a reliable and secure sensor placement and function of the probe is guaranteed. Of course, this also applies to the reference sensor or reference resistor.

If the reference switchover does not work correctly or a short circuit or interruption occurs with a reference resistor, this can be detected by the reference / test values. The sensor / test values T1 'and T2' or T _{test 1 '} and T _{test 2'} are supplied, for example, from a multiplexer 21 to an analog-to-digital converter 22. The test values can also be used to detect errors during multiplexing or during analog-to-digital conversion. The converted temperature values T1 'and T2' as well as the converted test values T _{test 1 '} and T _{test 2'} are in hexadecimal form, for example, and are supplied to a shift register 23. The sensor and test values temporarily stored in the register 23 are then preferably supplied to a linearization module 24 which has, for example, software for linearizing the characteristic curve.

In this case, the sensor / test values present in register 23, for example in hexadecimal form, can be converted into a form suitable for the evaluation, eg integer values. The sensor / test values T1, T2, T _Test1 and T _Test2 obtained by the linearization are z. B. a shift register 25 is supplied. The shift registers in this case preferably have a ring structure. The discarding of the last value in the buffering of the sensor / test values in the shift registers ensures that the order of the sensor / test values in the corresponding memory cells of the shift register changes.

Preferably, a test request signal e.g. for example, transmit a test drive sequence, asynchronously, every 10 seconds from a test request unit (42) of the burner control unit to the sensor value / test value changeover module (10). Of course, the test request unit 42 can also be included in the security module 41. Thereafter, the sensor resistance switches to the reference resistors. From the firing automaton then received within a defined time interval response signal for checking the function with regard to errors or disturbances in the system is evaluated accordingly. For example, the asynchronicity between sensor values and test values can also be evaluated by the automatic burner control.

The answer to the test request can additionally be identified by a special attribute. As a result, the evaluation of the response by the automatic burner control can be facilitated. For example, an actual time can be used as an attribute for characterizing the response to the test request. Alternatively, a random value generated by the controller, which is checked by the burner control, could be used.

Preferably, the transmission of the sensor / test values takes place, for example, according to a protocol, for example in the form of a data telegram. For example, a corresponding transmission buffer 26 can be provided for this purpose. In the transmission buffer, for example, one of the four data messages P ₁ to P _{4 is provided} for transmission to the automatic burner control. The telegrams P ₁ and P ₂ are each preferably transmitted periodically, for example every 5 seconds by the controller automatically to the burner control.

The telegram P1 includes, for example, the sensor values T1, T2 and the test value T _Test1.
The telegram P ₂ includes, for example, the test value T _Test2 and the sensor values T1 and the sensor value T2. The telegrams P ₃ , P ₄ may each be transmitted as an answer to the test request, preferably asynchronously to the telegrams P ₁ or P ₂ . The telegram P ₃ includes, for example, the two test values T _Test1, T _Test2 and the sensor value T1. The telegram P ₄ includes, for example, the sensor value T2 and the two test values T _Test1, T _Test2 .

The firing automat (40) or the security module (41) can then use the received data telegrams P ₁ , P ₂ , P ₃ or P _{4 to} carry out the verification of the temperature control / limiting function. The different test functions are described below. The automatic firing system initially tests the correct sequence of the messages P ₁ to P _4. For example, a restart of the burner is prevented if the correct test sequence is not determined.

The following describes the test functions shown in the function block diagram. Of course, a different order than that shown here can be used for the test functions.

The first test function involves checking the two temperature values T1 and T2, which are compared for this purpose with the trip temperature of the safety temperature _limiter T _STB . When T _STB is reached or exceeded, a fault message is generated and the burner is switched off by the automatic burner control. In this case, there is also a lock, if at the same time there is a switch-on command from the controller to the burner control.

In the second test function, the sensor values T1 and T2 are each compared with a maximum permissible temperature difference T _diff . If this temperature difference is permanently exceeded, for example, the burner control unit locks the burner and generates a corresponding error message. In the case of a short-term or one-time exceeding of the temperature difference, only one safety shutdown can take place. If, however, the exceeding of the permissible temperature difference occurs again within a certain time or even several times, then the automatic burner control unit locks the burner.

The third test function includes a comparison of the example of the reference resistors derived reference values T and T _{Ref1 Ref2} with the test values T _Test1 and T _Test2.
If, for example, the result of the comparison does not correspond to an expected value, then the burner control unit switches off the burner and an error message is generated. In the absence of an answer to the test request, for example, a failure of the reference resistor or the controller or a communication failure may be present. In this case, for example, after a time delay, the locking of the burner by the automatic burner control.

The fourth function includes, for example, an overtemperature counter to determine whether the safety temperature T _STB is exceeded later when the burner is switched off due to a Nachwärmeffektes. If this is the case, a corresponding counter is incremented. If the counter reading Z _{Off has} reached, for example, a predetermined value Z _STB , then a lock occurs.

If the burner control unit or the STB module locks the burner after a fault lockout, it can be unlocked by means of an unlocking command. The unlocking command can also be generated by a non-safety-oriented operator panel. In this case, the error-free data transmission of the Entriegelungsbefehles must be ensured via the data bus. This can be done, for example, a CRC error check. In addition, no further special security measures regarding the data transmission of the Entriegelungsbefehles must be provided.

The following describes the unlocking function. If there is a fault in the automatic burner control with interlocking, which was issued as a fault message from the automatic burner control unit to the data bus and displayed on the HMI device, the operator can, for example, select an unlocking menu on the HMI device. The unlock command is then given to the data bus by the operator via the HMI device. Then then the unlocking takes place. In order to avoid incorrect operation, the unlocking function is preferably carried out in the handshake method. For example, that can Control unit which has triggered the unlocking command wait a certain time, if the unlocking has been carried out successfully.
If the information remains that the unlocking was successful, for example, it is only after a time delay, another attempt to unlock unlocked.

With regard to the unlocking, e.g. three unlocking classes are distinguished. The first class concerns e.g. internal faults of the burner control unit, which can only be reset after unlocking the lock. In case the unlocking is disabled, e.g. only via a power-on-off switch or via a special unlocking button, e.g. be unlocked by a release button of the boiler control panel by means of a separate data line blocking. The blocking as well as the unlocking can be indicated by an appropriate display to the operator.

The second class concerns e.g. Error in the heating system where the STB function has triggered. In this case, the locking can be executed by the operator by means of an unlocking command sent via the data bus, e.g. reset only once.

The third class concerns other application errors that can be reset, for example, via an HMI device. Preferably, a safety function is used for this purpose, e.g. a maximum of 5 unlockings within a defined time allowed. The safety function is only effective when unlocked via the data bus.

Claims (16)

1. Apparatus for temperature regulation/limitation for a heat generating installation, which has at least one measurement sensor (T_k) which is connected to a regulator (20) which is connected via a communication interface (30) to an automatic heating system (40), characterized in that the automatic heating system (40) has a safety module (41) which compares the temperature which is detected by the measurement sensor, is passed on to the regulator and is transmitted from the regulator via the communication interface to the automatic heating system with a maximum permissible safe temperature (T_STB) which is stored in the safety module (41), and in that the safety module (41) generates a switch-off signal on reaching or exceeding the safe temperature, which switch-off signal causes the installation to be switched off by the automatic heating system.
2. Apparatus according to claim 1, characterized in that a further measurement sensor (T_k) is provided, and is connected to the regulator (20).
3. Apparatus according to claim 1 or 2, characterized in that a sensor value/test value switching module (10) is provided, which has at least one switch (15, 16) which connects a reference resistance (13, 14) in parallel with the measurement sensor resistance (11, 12), and in that the switching between the temperature sensor resistance (11, 12) and the reference resistance (13, 14) is controlled by the automatic heating system (40).
4. Apparatus according to claim 3, characterized in that a test requirement unit (42) for the automatic heating system transmits a test requirement signal to the sensor value/test value switching module (10), as a result of which at least one test value (T_Test1, T_Test2), which is derived from the reference resistance, is transmitted via the communication interface to the automatic heating system (40).
5. Apparatus according to claim 4, characterized in that the sensor/test value derived from the measurement sensor/reference resistance (11, 12, 13, 14) is processed further by the regulator (20) before it is transmitted via the communication interface (30) to the automatic heating system (40).
6. Apparatus according to claim 5, characterized in that a multiplexer (21), an analog/digital converter (22), at least one shift register (23, 25) and a linearization module (24) are provided for further processing of the sensor/test value.
7. Apparatus according to one of the preceding claims, characterized in that the communication interface (30) for connection of the regulator (20) to the automatic heating system (40) is in the form of a data bus or a radio link.
8. Method for checking the operation in particular of the temperature regulation/limitation function for a heat generating installation, which has at least one measurement sensor (T_k), a regulator (20), a communication interface (30) and an automatic heating system (40) with the measurement values (T1, T2) which are derived from at least one measurement sensor being passed on to the regulator for further processing and being transmitted via the communication interface to the automatic heating system, characterized in that the automatic heating system compares the received measurement values (T1, T2) with a maximum permissible safe temperature (T_STB) and in that a switch-off signal is generated on reaching or exceeding the safe temperature (T_STB).
9. Method according to claim 8, characterized in that a test requirement signal is generated for functional checking of the measurement value recording and/or for further processing of the measurement values and/or for transmission of the measurement values from the automatic heating system, and in that the response to the test requirement is received by the automatic heating system within a defined time period and is then evaluated by the automatic heating system.
10. Method according to claim 9, characterized in that the response to the test requirement is provided with a specific attribute.
11. Method according to one of claims 9 or 10, characterized in that the response to the test requirement signal comprises test values (T_Test1, T_Test2) which are compared with reference values (T_Ref1, T_Ref2).
12. Method according to claim 11, characterized in that, if the comparison between the reference and the test values does not correspond to an expected value, a fault message is generated, or in that lack of the response to the test requirement indicates a failure of the measurement sensor resistance/reference resistance or of the regulator, or indicates a communication fault, and in this case the automatic heating system locks the burner after a time delay.
13. Method according to one of claims 8 to 12, characterized in that the measurement values (T1, T2) are compared with a maximum permissible temperature difference T_diff, and in that, once this temperature difference has been exceeded, a safety switch-off is carried out by the automatic heating system, and in that, if the permissible temperature difference is once again exceeded within a specific time, the automatic heating system locks the burner.
14. Method according to one of claims 8 to 13, characterized in that a check is carried out to determine whether the safe temperature (T_STB) is exceeded as a result of a subsequent heating effect after the burner has been switched off, and in that, if this is the case, the count (Z_off) of a counter is incremented, and in that the automatic heating system locks the burner when the current count (Z_off) reaches a predetermined maximum permissible limit value (Z_STB).
15. Method according to one of claims 8 to 14, characterized in that a safety function is used for unlocking, which allows a maximum number of unlocking operations within a defined time period, with this function being effective only for unlocking via the communication interface.
16. Method according to one of claims 8 to 15, characterized in that the sensor and test values are transmitted as a data message periodically and automatically from the regulator to the automatic heating system, or are transmitted asynchronously to the automatic heating system as a response to a requirement from the automatic heating system, with this then being checked by the automatic heating system in both cases.

Images