GB2169733A - Safety systems for thermostatted fluid mixer valves - Google Patents

Abstract

An electronically controlled mixer thermostat including a safety system having means for monitoring critical parameters of the control system with respect to the maintenance of predetermined safety limits and means for instituting one or more safety actions when a monitored parameter exceeds a safety limit. <IMAGE>

Description

SPECIFICATION Mixer thermostat This invention relates to an electronically controlled mixer thermostat, such as may be used in domestic sanitary installations or industrial manufacturing processes.

An electronically controlled mixer thermostat has a temperature sensor-hereafter referred to as the "sensor' '-which is exposed to the mixed water flow, generating an electrical signal corresponding to the mixed water temperature, which signal is then fed to an electronic circuit hereafter referred to as the "controller". An electronic or electromechanical adjustable element operated by the user-hereafter referred to as the "temperature selector"-- generates another electrical signal corresponding to the desired temperature which is then also fed to - the controller. The controller, after comparison of the above signals, generates an electrical output signal according to a certain expressly chosen functional relationship (e.g.

P, PI or PID) which is fed to an electromechanical drive element-hereafter referred to as the "motor". The motor causes a mechanical change in position, corresponding to the controller-generated signal, which is transferred directly or via any desired gearing arrangement to a mixer valve which alters the ratio between the incoming hot and incoming cold water flow, thus controlling the temperature of the mixed water outflow. Such electronic mixer thermostats on their own are (already) known and have been described for instance in German patents DE-PS 24 10 316, DE-OS 30 20 040 and DE-OS 30 30 167.

The area of application of the invention however also encompasses those electronically controlled mixer thermostats where the group of components designated as the "mixer valve" consists of two or more constructionally separate valve units, or where the group of elements designated as the "motor" consists of two or more constructionally separate electromechanical drive elements as described for instance in German patents DE-PS 23 23 841, DE-PS 28 36 698 and DE OS 30 30 716. The invention applies furthermore to such mixer thermostats where the group of elements referred to as the "controller" has been realised not by means of a simple electronic circuit but wholly or partly by a suitably programmed computer where said computer could consist, for example, of a microprocessor circuit. Such a system has been described for instance in German patent DE-OS 29 25 234.

All the systems described hitherto have in common that although they fulfill the task of maintaining the temperature of the mixed water constant to a greater or lesser degree, they take no steps to prevent the deleterious effects which can arise through technical malfunctions in the relatively complex total system. It is thus entirely in the realm of the possible that in an apparatus of the type described, which is employed as a shower thermostat, a breakdown of the sensor during showering has the consequence that the person taking the shower is suddenly exposed to hot water at the temperature of the hot supply, thus suffering serious burns before he has the chance to protect himself. In the same way, mixer thermostats employed in an industrial manufacturing process could cause considerable material damage through occurrence of a similar fault.

Other elements of the apparatus in the systems known hitherto can also bring about malfunctions with dangerous consequences. If for instance a mixer valve which was last used to draw hot water is not used for some considerable time and became stuck in the hot position by calcinous deposits or other foreign bodies, it would yield hot water at a later point even if the user had chosen a lower temperature.

It is an object of this invention therefore to provide an electronic mixer thermostat in which an automatic safety system prevents the deleterious consequences of a technical failure by as wide ranging a supervision of all critical elements of the apparatus as possible and producing a suitable reaction on detection of the state of malfunction.

According to the present invention there is provided an electronically controlled mixer thermostat including a safety system having means for monitoring critical parameters of the control system with respect to the maintenance of predetermined safety limits and means for instituting one or more safety actions when a monitored parameter exceeds a safety limit.

In a preferred embodiment of the invention the mixer thermostat further includes a second safety system having means for monitoring input values of external user operated control elements and means for instituting additional safety actions when said input values are indicative of improper operation of the control elements.

Embodiments of the invention will now be described with reference to the accompanying drawings, in which: Fig. 1 illustrates schematically the manner in which a safety system monitors the mixed water temperature in relation to the set temperature, and Fig. 2 is a block diagram illustrating safety systems in a mixer thermostat.

Fig. 1 is a diagram showing schematically the mode of operation of a safety system where the measured value TM of the mixed water temperature (true temperature signal) is plotted as a function of Ts,the set temperature. The double diagonal line marks the optimum control condition TM = Ts.

The shaded regions Al, A2, B1, B2 and Cl, C2 represent forbidden zones. Any pair of values (TM,Ts) falling into one of these zones leads to the triggering of a safety action. By contrast any pair of values (TM,Ts) which does not lie on the ideal line but also does not fall into a forbidden zone is tolerated.

The two horizontal lines TK and Tw mark the externally determined temperature of the hot and cold supplies respectively and thus delimit the prevailing control interval R. In operation TK and Tw can be subject to considerable variation thus leading to narrowing or widening of the interval R.

The points EK and Ew mark the two end stops of the mixer valve. If the control system functions correctly then each set temperature value Ts ATK causes the mixer valve to be driven to the cold end stop EK at which the cold water inlet is fully open and the hot water inlet completely closed. The mixed temperature is then given by TK. The opposite is true for set temperature values Ts aTw and the end stop Ew.

Various critical parameters of the control system are monitored with respect to the maintenance of predetermined safety limits.

Exceeding any of the safety limits causes the immediate or delayed triggering of a safety action, depending on the nature of the malfunction. The safety system is so designed that it is capable of recognising certain malfunctions typical of mixer thermostats where a specific safety action is not required, thus avoiding false alarms or self blocking of the installation.

The safety actions consist of: (a) Generation of malfunction signal which can be used to trigger, for instance, an alarm device, (b) Actuation of a shut-off valve in the mixed water outflow.

Item (b) is not included in installation where shutting off the water supply can be more disadvantageous than exceeding a temperature limit. In such cases the user must devise a sensible utilisation of the alarm signal.

Individual monitor features and associated safety actions can be as follows: (1) Monitoring of the set-temperature signal Ts by means of line S1 (Fig. 2) for falling short of the minimum value a7 or exceeding the maximum value a2. Sattsty action follows at once if the set-temperature signal falls into forbidden zones Al or A2. Purpose: Identification of malfunction in the settemperature device (in particular open or short circuiting). The forbidden zone Al (Fig. 1) has as its upper bound on the set-temperature axis the t5sjFli- mum value al which is chosen to be slightly less than the lowest permissible set-temperature value.Similarly A2 has as its lower bound the maximum value a2 which is a lit'Je greater than the highest permissible set-tem- perature value.

(2) Monitoring of the sensor signal TM (measured temperature) by means of line S2 for falling short of the minimum value bl or exceeding the maximum value b2. Safety action follows at once if the sensor signal falls into the forbidden zones B1 or B2. Purpose: Identification of malfunction of the temperature sensor (in particular open or short circuiting). The forbidden zones B1 and B2 are defined on the mix temperature axis in a manner analogous to Al and A2.

(3) Monitoring of the temperature error signal AT=TMTs by means of line S3 for falling short of a negative minimum value Al and exceeding a positive maximum value A2. Safety action follows after a delay if AT falls into the forbidden zones C1 or C2. Purpose: Identification of malfunction of the control system and the control loop (e.g. motor failure, blockage of mixer valve) as well as occurrence of external malfunctions which cannot be corrected sufficiently promptly by the controller.

The time constant r is dynamically so adjusted that the temperature error-time integral l=iO ATd does not exceed a critical value 1K (typical value for IK=10 C sec.). The time delay ensures that if the control system works correctly, external disturbances do not trigger a response of the safety system if the control system is capable of dealing with them before the critical value 1K is reached. The forbidden zone C1 has as an upper bound on the mix temperature axis, the value cl =Ts+Al where To is the present select temperature and is bounded on the low side by zone B1.Conversely zone C2 has a lower bound, the value c2=Ts+52 and is bounded on the upper side by the forbidden zone B2.

Monitoring of water temperatures can be readily accomplished using, for example, thermocouples.

(4) Monitoring of valve position with respect to maintenance of the control range R using lines S6 and S7. This is accomplished for example by means of two end switches ESK and ESW which identify the cold and hot end positions EK and Ew of the valve respectively.

On reaching EK the forbidden zone C2 is cancelled. Excess temperatures up to zone B2 will thus be tolerated. Correspondingly zone C1 is cancelled on reaching Ew. Excess low temperatures down to zone B1 will thus be tolerated.

This does not constitute a safety risk since in the end positions EK and Ew, the hot and cold water supplies respectively are shut off. Purpose: (a) Recognition of situations where owing to external conditions the correctly working control system is not able to supply the set mix temperature without the need for activation of a safety action; (b) Avoidance of self blocking of the ther mostat system especially during start up.

Self blocking during start up could easily occur in a mixer thermostat with a safety system according to (1) to (3) above if it did not incorporate an additional override feature like (4). Let, for instance, TK=10 C, Tw=600C and T,=40"C. Let, there be water in the supply pipe line between the hot water source and the mixer tap which has cooled to T'W=20 C.

On start up, the mixer valve will immediately move to the end position Ew. However, the mix temperature will, for some considerable period, lie some 20"C below the set value and thereby fall into zone C1. If this zone were now not cancelled, then the safety action would close the magnetic valve in the outflow thus preventing the arrival of fresh quantities of warmer water from the supply line so that on renewed switch-on of the installation the safety action would inevitably be retriggered.

(5) Monitoring of supply voltages for sensor and settemperature device by means of lines 54 and S5 to prevent exceeding given limiting values. Safety action takes place immediately if one of these voltages falls short of or exceeds the given limiting values. Purpose: Elimination of error signals from sensor or settemperature device to controller or safety system as a result of excessive variation in the supply voltages. The supply voltage of the controller and the motor requires no special monitoring as any error occurring here will be detected by the monitoring system of item (3) above. During total supply breakdown the system fails safe owing to shut-off by the magnetic valve.

(6) In the case of a digital realisation of the control and/or safety system: Self monitoring of the micro-computer. Purpose: Recognition of hardware failures or program errors in the microcomputer which could affect safety monitoring as described under (1) to (5) above.

After completion of each cycle, the program in the microcomputer sends an 'OK' status message to an external monitor circuit preferably implemented in the form of a hardware timer. If the 'OK' status message is not periodically repeated after a predetermined time interval, then the monitoring circuit generates a signal which triggers the safety action.

(7) If the mixer valve position is continually monitored via a position sensor: (a) Recognition of the end positions EK and Kw according to (4) above by comparison of the position signal with corresponding predetermined limiting values. The end switches ESK and ESW can then be omitted.

(b) Monitoring of the position signal for exceeding certain predetermined limiting values which lie outside the limiting values defined by EK and Ew in 7(a) above and which will not be reached with certainty if the system functions correctly. Purpose: Recognition of position sensor failure (in particular open or short circuiting) which would lead to the erroneous message to the safety system "EK reached" or "Ew reached". Exceeding these limiting values immediately triggers the safety action.

The foregoing safety features are implemented by the safety system I in Fig. 2 and take no account of any improper operation of the mixer thermostat by the user. A second safety system II monitors user operated controls and institutes appropriate safety actions when the controls are improperly operated.

Generally the user, e.g. in a domestic shower installation, has control only over an "on/off" switch and a "temperature set" control element. With the inclusion of a microcomputer in an electronic control there exists the possibility of incorporating many other safety features. Generally the input values of the external control elements are continually monitored for maintenance of certain safety conditions. If the relevant condition is not satisfied a substitute function which guarantees safety replaces the function chosen by the user.

Individual safety features and associated actions can be as follows: (8) Define starting temperature ("reset-temperature") Required function: Switching on of installation to supply water without prior temperature selection. Substitute safety function: Switching on of installation to supply water with input of a non-dangerous set-temperature (reset temperature). In the sanitary (non-industrial) situation the reset temperature could, for instance, be set at 35"C. The user can afterwards choose any other desired temperature by operating the set-temperature control(s).

Purpose: (a) Installations which retain the last set temperature value (e.g. temperature selection via potentiometer): Prevention of the danger which is caused by the previous user leaving the installation with a dangerous settemperature and the next user switching on the installation without having first noted the value of the set temperature.

(b) Installation not retaining the last set temperature value (temperature selection by electronic ramping): Avoidance of an undefined initial state.

(9) Prevention of unintended choice of dangerous temperatures (child lock) Required function: Set temperature Ts > critical temperature Tc,,,. Substitute safety function: Set temperature as chosen only if another control element (e.g. Key switch, hidden push button etc.), is actuated at same time as set temperature control element. Otherwise T0=T In a nonindustrial situation Tc, could for instance be 38 C. Purpose: Protecting small children or thoughtless users against inadvertent choice of dangerous temperatures.

(10) Indication of condition "Temperature Unattainable" Required function: Ts < TK or Ts > Tw Substitute safety function: Ts as required but in addition indication "temperature unattainable" as soon as the mixer valve reaches one of the end positions EK, Ew. Purpose: Informing user about the situation (resulting from conditions in the supply line) that the set temperature cannot be supplied at the moment but could possibly be available at a later time when the supply line has become stable. Thereby: (a) avoiding the dangerous situation that because the desired temperature is not obtained and the controller function is not understood an even higher/lower temperature is selected.

(b) avoiding an unpleasant surprise on the part of the user through the belated appearance of the selected temperature.

(11) Prevention of excessive temperature selection in the "temperature unattainable" condition Required function: Ts < TK or Ts > Tw Substitute safety function: Ts at first as required.

As soon as the valve reaches the end position EK, the ability to select lower temperatures is inhibited. As soon as the valve reaches the end position Ew, the ability to select higher temperature is inhibited. Purpose: Enhancement of the safety function of (lOa) above. This safety function is desirable above all for those mixer thermostats which have an indicator only for the actual mix temperature and where the set temperature cannot be directly checked.

Various modes of implementation are available for the present invention where choice has little or no effect on achieving the functions. Three preferred forms of implementation are: (1) Controller and safety systems realised by electronic analogue technology.

(2) Controller realised using electronic analogue circuits, safety systems realised by microcomputer technology.

(3) Controller and safety systems realised by microcomputer technology.

Figure 2 is a block diagram of an implementation of the invention according to (1) above.

The functional blocks "safety system I" and "safety system II" can be preferentially realised by operational amplifiers.

Claims (16)

1. An electronically controlled mixer thermostat including a safety system having means for monitoring critical parameters of the control system with respect to the Tlainte- nance of predetermined safety limits and means for instituting one or more safety actions when a monitored parameter exceeds a safety limit.

2. A thermostat according to claim 1 wherein the safety action means include means for generating an alarm signal.

3. A thermostat according to claim 2 wherein the safety action means includes means for shutting off the mixer outflow.

4. A thermostat according to claim 1, 2 or 3 wherein the monitoring means is arranged to monitor the set-temperature to identify a malfunction of the temperature setting device whereby the set temperature is either below a pre-set minimum or above a pre-set maximum temperature and a safety action is accordingly instituted.

5. A thermostat according to claim 1, 2 or 3 wherein the monitoring means is arranged to monitor the thermostat output temperature to identify a malfunction of the output temperature sensor device whereby the output temperature is either below a pre-set minimum or above a pre-set maximum temperature and a safety action is accordingly instituted.

6. A thermostat according to claim 1, 2 or 3 wherein the monitoring means is arranged to monitor a temperature error signal being representative of the difference between the set temperature and the output temperature to identify a malfunction of the thermostat control system whereby said error signal is outside predetermined limits and a safety action is accordingly instituted.

7. A thermostat according to claim 1, 2 or 3 wherein the monitoring means is arranged to monitor the position of a fluid mixing valve by means of valve position end switches whereby output temperatures outside pre-set limits are allowed without resulting in a safety action caused by monitoring of the set-temperature or the output temperature.

8. A thermostat according to claim 1, 2 or 3 wherein the monitoring means is arranged to monitor the supply voltages for temperature sensors whereby voltages outside pre-set limits are identified and a safety action is accordingly instituted.

9. A thermostat according to claim 1, 2 or 3 wherein the electronic control is implemented by means of a digital microcomputer which is programmed to implement a selfmonitoring routine at predetermined times to generate an 'OK' status message to be sent to an external monitor circuit having timing means whereby if an 'OK' status message is not received within a pre-set time after a previous 'OK' status message a safety action is accordingly constituted.

10. A thermostat according to claim 6 wherein the safety action means includes a delay to allow the control system to rectify the error signal for a predetermined time before a safety action is instituted.

11. An electronically controlled mixer thermostat according to claim 1 including further means for monitoring input values of user operated control functions and means for instituting substitute functions to replace functions chosen by the user when said input values do not satisfy predetermined safety conditions.

12. A thermostat according to claim 11 wherein the monitoring means monitors the set-temperature at switch-on" of the thermostat and if the temperature set exceeds a pre-set value initiates an override to bring the set-temperature value to a predetermined value.

13. A thermostat according to claim 12 including a further separate control element whereby the override can be cancelled.

14. A thermostat according to claim 11 wherein the monitoring means is arranged to monitor the set-temperature and the temperature of the hot and cold supplies whereby a "temperature unobtainable" alarm is initiated if the water supply conditions are such as to prevent the desired temperature from being reached.

15. A thermostat according to claim 14 wherein the safety action means is arranged to prevent any temperature setting outside a pre-set range from being selected when a "temperature unobtainable" alarm is initiated until predetermined hot and cold water supply conditions have been attained.

16. An electronically controlled mixer thermostat substantially as described with reference to the accompanying drawings.