JPH02298819A - Inspecting device of redundancy of sensor output - Google Patents

Abstract

PURPOSE:To enable safe and accurate control of a fuel burner by converting an analog signal of a sensor into a digital signal, by comparing a digital value with an effective range stored beforehand, and by issuing an alarm signal when the value is outside an allowable range. CONSTITUTION:An analog signal of a sensor 17 such as a pressure sensor or a temperature sensor is converted into a digital signal by an A/D converter 54, while an analog signal of a flame sensor 18 is converted likewise into a digital signal by an A/D converter 55, and these two signals are inputted to a micro-(mu)-computer 51 from a terminal 57. The mu-computer 51 has a sensor monitoring means 53 incorporated and upper and lower limit values at the time of normal operation of a boiler are stored therein. Digital values of the aforesaid signals are compared with an effective range limited by said values, and when they exceed an allowable range, this is indicated in an indication module 15, a fuel burner 12 being stopped and an alarm being issued.

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Industrial Application] The present invention relates to a fuel burner control device, and particularly to a device for inspecting the output of a sensor provided in a fuel burner device. BACKGROUND OF THE INVENTION Fuel nozzle controllers, commonly referred to as combustion safety controllers, have been used for many years to control non-residential burners. These devices have traditionally been operated by mechanical switches or relays.Mechanical switches and relays have "on", "off" control, or
Since the sensors used in such burner control devices perform the functions of "connecting" and "disconnecting", a switching type is adopted according to the operating characteristics of the burner control device, and the sensor can open or disconnect the circuit depending on pressure, temperature, flame, etc. Or it operates to close. This type of sensor structure has two major deficiencies. First, the data sensed by the sensor cannot be supplied. One example of this is that it is limited to only providing data at the time of switching, that is, information on the limit state. Secondly, the operation of the sensor is ignored by users and maintenance personnel. Maintenance personnel open or close sensor circuits to perform repairs, potentially inducing a serious hazardous condition. Additionally, due to the sensor's ability to connect or disconnect the circuit, it is possible that someone who does not understand the risks may intentionally or inadvertently operate the burner control system in an unsafe condition. rSummary of the Present Invention 1 In recent years, combustion safety devices and combustion burner control systems based on microcomputers have been manufactured and sold. Such devices have intelligence and are capable of more sophisticated operations compared to traditional electromechanical devices. For this reason, the widespread use of electromechanical and mechanical sensors and limit switches has been inherited by computer-controlled combustion safety systems. Since computer-controlled combustion safety systems can respond to a range of sensed signals, it has been proposed to move the sensors to analogue types. An example of an analog sensor is a variable resistor. Variable voltage or current output devices that respond to pressure, temperature, flame intensity, etc. A microprocessor or computer controlled intelligent system can convert the resulting analog signal to a digital signal of the same range. The resulting digital signal can be compared to a preselected signal coverage range. Using digital signals provides three advantages over analog signals. The first advantage is that analog data can be read out continuously by using a microcomputer-controlled device with an analog-to-digital (A/D) converter and a suitable display. The display is an alphanumeric display capable of displaying the full range of various analog sensed signals within the combustion safety system or fuel burner control system. The second advantage, and the most important in terms of safety, is that tolerances can be set in advance. The microcomputer-controlled system includes memory and monitoring equipment so that tolerance ranges can be stored and the detected signal can be verified to be within those ranges. Since the fuel burner control device safely stops the fuel burner in response to a detection signal outside the permissible range, it is possible to suppress the occurrence of short circuits or opens in the analog sensor. Additionally, service personnel are prohibited from intentionally short-circuiting or opening sensors during fault diagnosis, and are also prohibited from forcibly activating any sensor to perform test operations on equipment to be repaired. Can be prohibited. A third advantage is that the analog/digital conversion can be tested over a wider range of input values than the sensor range limits, and the above-mentioned tests can be performed without disturbing boiler operation. It is the power of computers. These additional inputs also include intermediate values of the preselected range of the transducer. Furthermore, A/
By using two D-converters, each can be tested against the other and redundancy in this self-testing process can be measured. Because fuel burner control devices have a predecessor for safe burner operation, special care must be taken in ensuring the accuracy of electronic analog sensor devices that replace traditional electromechanical sensors and limit switches. This special attention includes both hardware and software. Accordingly, the present invention finds use in control systems that generate control signals to control the operation of physical devices such as fuel burners. The operating status of the physical device is obtained by outputs from multiple sensors. Each sensor senses a preselected physical quantity of a physical device and generates an analog voltage signal having an intensity representative of the sensed physical quantity.
In an embodiment, a sensor output redundancy testing device is provided that tests a component for operation according to design requirements and generates a warning signal for operation outside of design requirements. , the sensor output redundancy checking device comprises: (a) at least first and second multiple analog voltage input channels having predetermined unique first and second channel addresses; receiving a sensor signal and a channel selection signal on which a channel address is encoded at a channel selection terminal; first and second analog-to-digital converters providing intensity-coded digital output signals; (b) applying a voltage having a predetermined exact value to the first and second voltages;
(e) storing in advance a digital value of the voltage supplied by the first reference voltage source and receiving the outputs of the first and second converters;
providing a channel selection signal encoded with a predetermined first input channel address to each transducer during a first predetermined time; storing an output from each transducer during the first predetermined time; testing whether the output of the first or second converter matches a pre-stored value of the voltage of the first reference voltage source supplied to the converter; microcomputer means for generating a warning signal if the voltage supplied by the source does not match a predetermined value. In a second embodiment of the invention, a plurality of sensors sense a preselected physical quantity associated with a physical device and provide an analog voltage signal representative of the sensed physical quantity to control the operation of the physical device. A sensor output redundancy testing device is provided that is included in a control device that generates a control signal for control based on the analog signal. The second embodiment is a sensor output redundancy testing device that tests components for operation according to design requirements and generates a warning signal for operation that deviates from design requirements. (a) at least one analog-to-digital converter having an analog voltage input channel for receiving a signal from the sensor and providing a digital output signal encoding the strength of the analog signal present on the input channel; ) receiving an output from the converter, first and second values respectively specifying predetermined upper and lower limits to be set for the first output of the converter and other outputs of the converter; Digital values of upper and lower limits depending on the operating state of the device are stored in advance and are narrower than the range of the upper and lower limits set by the device, and the output of the converter is determined by the upper and lower limit values depending on the operating state of the device. range and the first and second
is within a range determined by the value of microcomputer means for generating certain control signals. [Example 1] Figure 1 is an example of a heating plant, and the heating plant indicated by IO is a boiler 11. It consists of a fuel burner 12 and a fuel burner control system, designated generally at 13. The fuel burner control device 13 is comprised of a fuel burner program module 14 and a keyboard/display module 15. The keyboard/display module 15 is connected to the fuel burner program module via a communication path 16. A communication path I6 also connects the heating plant 10 to other unrelated equipment. The fuel burner control device I3 controls the fuel burner 1
Analog sensor 17 and flame detector 18 working together with 2
Completed by adding . During operation, the fuel burner 12 generates sufficient heat for the boiler 11 to supply hot water or steam to the heating load 2 via conduit 20.
1 (which does not form part of this invention). Heating load 21 conventionally returns water or condensed steam to boiler 11 via conduit 22. Fuel burner program module 14 will be described below in connection with FIG. For now, it will suffice to state that the fuel burner program module 14 includes a microcomputer, a memory, an A/D converter, sensor monitoring means, and by a combination of these means. The fuel burner program module 14 is enabled to receive signals from the analog sensor 17 and the flame detector 18. These signals are converted from analog format to digital format by an A/D converter. The digital information thus obtained is used in the microcomputer and sensor monitoring means to provide two functions that could not be obtained with conventional devices. Figure 2.3.4 shows three types of analog sensors.
The figure shows a pressure-responsive analog sensor 25. The housing 26 connects the pressure response tube 27 to the diaphragm 39.
It is installed in a sealed housing 28. Further, a solid-state or strain meter type sensor 31 whose resistance value changes depending on the movement of the diaphragm 30 is attached to the diaphragm 30 . The solid state sensor 31 has a pair of conductors 32,33 through which the sensor 31 is connected to the appropriate terminals of the fuel burner program module 14 (
(not shown). Further, the sensor 31 is connected to the conductor 29
It is supplied with a constant voltage and outputs a variable voltage signal. The pressure-responsive tube 27 is exposed to the pressure in the boiler Il or similar conditions and is used to measure the pressure of the fuel or steam. Pressure is transmitted to the diaphragm 30, and the diaphragm 30 is configured to bend due to the change in pressure. This movement of the diaphragm 30 changes the resistance value of the sensor 31, which in turn changes the output voltage on the conductor 32.33.
4 can be supplied with an analog signal. FIG. 3 is an example of a temperature-responsive analog sensor. Housing 35 is provided with threaded attachment means. The tube 37 is inserted into the boiler 11 in a liquid-tight manner. A temperature-responsive resistor 40 having a pair of leads 1l 141.42 protruding from the housing 35 is built into the tube 37. The temperature change inside the boiler is caused by temperature responsive resistance 4.
0 and the resistance value changes. This change is provided to the program module 14 as an analog sensor signal. FIG. 4 shows a conventional ultraviolet flame detector 44. As shown in FIG. Flame detector 44 is connected to flame amplification means 47 by a pair of conductors 45,46. Flame amplification means 47 generates at output 50 a variable voltage signal responsive to the intensity of the flame sensed by flame detector 44. Also, the output 50 has a fuel burner 12
An analog output signal responsive to the flame within is also generated. FIG. 5 is a detailed diagram of the fuel burner program module 14. This fuel burner program module 14 uses a microcomputer 51 having a memory 52 and sensor monitoring means 53. The sensor monitoring means 53 stores preselected effective ranges of signals sent from different types of analog sensors. The information stored varies depending on the application, such as predetermined ranges of resistance values of pressure sensors, temperature sensors, and predetermined ranges of current of flame amplification means. Based on this information, the fuel burner control module 14 controls the fuel burner 12 by controlling the analog sensors 17 and 18.
be able to respond appropriately to requests for driving. FIG. 5 is a diagram showing the pair of A/D converters 54, 55 in more detail. The A/D converter 54 includes a sensor 17, such as a pressure sensor or a temperature sensor as shown in FIGS.
connected to. On the other hand, the A/D converter 55 is connected to the flame amplifying means 47.
The control device of this embodiment, which is connected to the flame sensor 18 and the flame sensor 18, uses two A/D converters for safety. The range required to control the output signal of sensor 17 is typically different from the output value range of flame detector 18, ie the sensing range. Two A/D converters 54,55 are used to easily handle this difference within the fuel burner module 14. The A/D converter 54 is connected to the microcomputer 51 through a terminal 56, and the A/D converter 55 is connected to the microcomputer through a terminal 57. Furthermore, the microcomputer 51 is connected to the keyboard/display module 15 via a path 16 and to the fuel burner 12 by a path or connection means 60. Keyboard/display module 15 typically includes both a keyboard for entering information into the device and an alphanumeric display, such as a liquid crystal display, for visually monitoring input and output data. Thus, the keyboard/display module 15 can continuously display analog signals from the sensors 17.18 and a reading range of the overall status of the device, such as information on the annunciator, malfunctions, shut-offs, etc. FIG. 6 shows a flowchart of the novel safety feature according to the invention. A standby routine 61 is provided to continuously check the status of the sensor according to the strength of the detected signal. What is continuously checked here are the upper and lower limits during normal operation of the boiler and the limits of the normal range of the sensor. It is determined in step 62 whether the analog value obtained in the standby routine 61 is greater than the minimum value of a preselected range. Here, if the analog signal is smaller than the minimum value (No), it indicates that the system is malfunctioning and safely stops (step 64). If step 62 indicates that the analog value is greater than the minimum value, the process proceeds to step 66 to determine whether the analog value is less than the maximum allowable value. If the analog value is greater than the maximum value (No), step 6
Proceed to step 4 to stop the system. Conversely, if it is smaller than the maximum value (YES), the process returns to the standby routine 61 and this loop is repeated. The sensor monitoring means 53 of FIG. 5 continuously executes a standby routine that checks the status strength of the sensors, thereby confirming that there are no open or shorted sensors (the system is operational). Certain limits are preset on the operating range of the device depending on the conditions required for the operation. The microcomputer 51 supplies any kind of status information to the keyboard/display module 15, and during normal operation status information. Malfunctions. It is clear that malfunction information or annunciator information can be obtained when the system is stopped.Each component in FIG. 7 shows the device in FIG. 5 in more detail. The functions of the entire device are managed according to the programs shown in the flowcharts shown in Figures 8A, B, and C. The microcomputer 51 has several output channels, including channel selection data paths 7]a, 71b, control paths 60a, aob, and a warning data line 16. Furthermore, the microcomputer 5I also has an input channel through which the data converted by the A/D converter (data line 56) is connected.
．． 57). The accepted data is usually stored in the random access memory (RAM) of the microcomputer 5I.
is memorized. Furthermore, the microcomputer 51 is also equipped with a channel selection register 51a, the function of which will be described later. RAM of microcomputer 51
There are many address locations, each of which can function as a register. The microcomputer 51 further includes a device for the operator to supply operating parameters directly to the external data path 16, either from the keyboard shown in FIG. 5 or by connecting a read-only memory (ROM) storing desired values. We are prepared. Therefore, the output value of sensor 17.18 is @I and the second
A data line 56 is connected as digital data to the microcomputer 51 by means of an A/D converter 54,55.
．． 57. In a highly dangerous field such as the control of the burner device 12, it is very important that parameter values representing the operating state of the burner are supplied to the microcomputer 51 with high precision and reliability. Therefore, A/D converters 54,55 are highly reliable devices and it is important that these malfunctions or drifts are detected as quickly as possible. For this reason, it is highly desirable to have a certain degree of redundancy and self-diagnosis function. The accuracy of the A/D converters 54 and 55 is determined based on the reference voltage vREF on the path 73, and this value must be accurately known and controlled in order to perform highly accurate A/D conversion. In the following discussion, it is assumed that the maximum output (all binary ones) from transducer 54 or 55 corresponds to 5 volts of the sensor or test voltage. A/D converters 54,55 have multiple inputs. Accordingly, the first A/D converter 54 includes a multiplexer 54a having input channels of addresses 1-4 and IA as shown. Channel selection path 71a receives an address value from microcomputer 51, which selects a desired one of the aforementioned channels and provides an analog voltage value to be converted to digital data. A/D converter 5
4 converts the analog signal obtained from the channel of the address transmitted by the channel selection path 71a into a digital signal and supplies it to the microcomputer 51 via the data path 56. There may be an inherent delay in A/D converter 54 from when the channel address is output on channel selection path 71a until the digital value of the voltage of the selected channel is first obtained. For this,
The A/D converter 54 is provided with a device that outputs a signal indicating the presence of a digital value to the microcomputer 51 when a digital signal is first obtained, so that the microcomputer 5I performs other processing during conversion. Okay, no further consideration of timing would be necessary. In addition to the predetermined precise voltage supplied to the A/D converter 54 via data path 74a, voltage signals representative of various operating parameters are sent from sensor 17 to A/D converter 54 via data paths 72a. is supplied. Each sensor output is at address 2.3 of the A/D converter 54.
．． 4, etc. The second A/D converter 55 is completely the same in function and operation as the first A/D converter 54, and according to the channel address on the channel selection path 7Ib supplied from the microcomputer 51, addresses 1... 2110
．． The input signal multiplexer 55b selects a channel from among the input channels having . A/D
The converter 55 connects the signals from the various sensors 18 to the signal path group 7.
2b via channels 1.2. , is input. To achieve one object of the invention, each A/D converter 54,55 is supplied with a predetermined, precise test voltage on its respective channel 1 on electrical traces 75a, 75b. In this case, voltage v1 from a first accurate voltage source 76 is preferably received by a voltage divider network, where accurate test voltages v3, v4 are generated and supplied to electric lines 75a, 75b. The voltage divider network feeding channel l of the first A/D converter 54 via
．． It consists of a pair of resistive elements 77a, 78a with relatively accurate values to generate 765 volts. Similarly, the exact voltage V4 = 2.500 volts means that the exact resistive element 7
7b, 78b. Voltage v4 is supplied to channel 1 of second A/D converter 55 via electric line 75b. In this embodiment, to ensure redundancy and proper processing, a second voltage source 70 is used to determine the second accurate voltage V2=
1.235 volts to channel IA of A/D converter 54
is supplied to. By using the second accurate voltage source 70, the A/D converter 54 can control the A/D converter 54 itself;
It can have a function of determining whether the operation of the voltage dividing network consisting of the first voltage source 76 and the resistance elements 77a and 78a is appropriate. It is also possible to test whether the conversion process is appropriate by inputting two accurate voltages v2 and v3 to the A/D converter 54. The A/D converter may not function accurately at certain bit positions in the output. For example, a malfunction that frequently occurs in which one of the upper bits cannot take either binary value. may occur. If one expects the upper five bits of the output signal on data path 56 of A/D converter 54 to be reasonably error-free and accurate when digitizing the voltage applied to multiplexer 54a, then these upper bits should be It is important to test that can take on values of both 0 and 1. This possibility allows you to select the voltage value for each bit and to select the correct voltage V2.
V, can be tested by taking a value such that all significant bits of the digital value of v2 are preferably the complement of the corresponding bits of the digital conversion of v3. That is. Voltage V, is selected such that a predetermined number of consecutive upper bits are different from the value of the corresponding upper bit of voltage v2. These A/D converters typically have a predetermined full-scale binary digital output in which all bits are binary rlJ. Therefore, corresponding to this predetermined full-scale voltage level input, there will be a series of binary numbers rN on output path 56. In this state, the sum of v2 and V is the sum of the A/D converter 54
can be selected to be approximately equal to a predetermined voltage level corresponding to the full-scale output of . Assuming that the full scale output of the A/D converter 54 is 5.000 volts, this is equal to the sum of the voltages v2, ■, in this embodiment described above, and rlJ is continuous in the upper bits of this full scale. When applied to the A/D converter 54, by making the sum of voltages v2 and v3 equal to the full-scale output value of the A/D converter 54, the binary digital value of the upper bit of voltage v3 is automatically This is the complement of the binary digital value of the corresponding upper bit of the voltage V2 from the voltage source V2. In the embodiment shown in FIG. 7, the first A/D converter 54 is configured to perform an analog/digital conversion different from that of the second A/D converter 55. Specifically, first A/D converter 54 is, for example, an integrator-based circuitry, and the output on data path 56 is generated by internal circuitry that includes the integrator. Second A/D converter 55, on the other hand, has internal circuitry that employs a continuous approximation process to generate a digital output on data path 57. The purpose of this is to add further redundancy to the device so that if one A/D converter is damaged by a supply voltage spike, the other A/D converters in the configuration are not affected. be. Or, if one A/D converter malfunctions, the output is different from that of the other A/D converters. By incorporating such a structure into the device of this embodiment, malfunction of either or both of the A/D converters 54 and 55 can be easily detected, reducing the possibility that both of them will fail at the same time. This method increases the operational safety of the burner device 12. The operation of the apparatus shown in FIG. 7 is controlled by a program stored in the microcomputer 51. The flowchart of this program is shown in Section 8A. The software of FIGS. 8A, 8B and 80 shown in FIGS. 8B and 80 can be understood to represent the actual physical structure forming part of the ROM of microcomputer 51. By combining this physical structure with the internal structure of the microcomputer,
The device can be caused to perform operations as shown in the flowchart in Figure C. The microcomputer 51 has each A/D converter 54.5.
A digital signal encoding an analog value of the voltage applied to the selected channel of 5 is received from data path 56.57. The programs of FIGS. 8A, 8B, and 80 are based on input channels 1 and LA of multiplexers 54a and 55a.
, 2. . Operation begins with a series of instructions in step 86, which begins by pre-storing specific parameter values for burner device 12 and sensors 17, 18 in a test range value table in the memory of microcomputer 51. The upper and lower limit values obtained during normal operation of the sensor 17.18 are supplied to the microcomputer 51 from an external data source and are stored in the internal memory as the 0 normal value and the drift of the sensor output due to any reason or of the operating parameters of the burner device. A tolerance percentage indicating drift can also be obtained for each of the sensors 17,18. Also,
There are system operating state dependent values that are applicable when the burner system 12 is active, ie in operation. In step 86 (element 86), these various values are input to the first and second A/Ds.
associated with each of channels 2.3, etc. of transducers 54.55. Means is also provided for associating sensor output parameters with individual channel numbers, with each sensor being attached to an associated channel via data paths 72a, 72b. Therefore, the sensor output parameters are stored in the test range value table and can be retrieved with reference to the channel number and associated transducer. A step or software element 100 is provided for entering into the test range value table a value representing the percentage error of the sensor 17.18 that is permissible under normal operating conditions of the burner device 12. The error percentage of each sensor is multiplied by the steady-state value, the multiplication result is added to the steady-state value to obtain the percentage error upper limit, and the multiplication result is further subtracted from the steady-state value to obtain the percentage error lower limit. In this case, the 1 multiplication value is also stored in the test range value table so that it can be searched from the A/D converter associated with the channel number. Of course, there are various ways to set the limit value other than multiplying the error percentage limit value by the steady value, but in this example, when changing these limit values according to the installation conditions, and after the installation request This method is the most flexible when changing and changing the test. In fact, any method of setting narrow range limits depending on these operating conditions is possible. In the following explanation, this limit value will be simply referred to as a percentage limit. Connection B89 marks the start of a general program loop which performs an operational test of the A/D converter 54.55 and a limit test of the digital conversion values of the outputs of the various sensors 17.18 (data paths 72a, 72b). Operational testing of the A/D converter begins at step 80. Step 80 is the channel selection path 71a, 7 in FIG.
Set the channel address l to microcomputer 5 to 1b.
In response to the output of the channel address, representing that 1 is output, the multiplexers 54a, 55a transfer the voltage present on the channel with address I to the A/D converter 54.55.
is supplied to the internal A/D conversion circuit. A/D converter 54.
55 converts the analog voltage on the input channel of the respective address 1 into a digital value after a respective conversion period and connects the data path 56 to the microcomputer 51.
．． 57, and these digital values are stored in the RAM of the microcomputer 51. Step 81 represents an operation in which the microcomputer 51 calls up the digital value of the accurate test voltage v3 previously stored in the ROM and compares it with the digital value of the voltage V3 on the data path 56. In this comparison, the two digital values are They are not completely equal. This is due to variations in the voltage value v3 due to variations in individual A/D converters, temperature changes, power status, noise, variations in circuit component values, and the effects of differences between devices. , the digital values obtained from the A/D converter 54 may contain slight errors. The error is about 1.6%, and the measurement is acceptable. If the digital value on the data path 56 is within this allowable error range with respect to the pre-stored voltage value V, then proceed to step 83.
When the output from the A/D converter 54 (data path 56) is outside the tolerance range for the exact voltage value V3, control proceeds to step 82 via connection A88 to stop the burner device and notify the operator. Send appropriate alerts. This step 82 is
7 represents the burner stop signal on data path 60a and the alarm signal on data path 16 of the apparatus shown in FIG. When control proceeds to step 83, a test similar to that performed in step 81 is performed, comparing voltage v4 on data path 57 to a prestored precision test voltage V4. If the signal on data path 57 is within the permissible range of the internally stored digital value of voltage v4, control proceeds to step 84; if, on the contrary, it is outside the permissible range, control proceeds to step 82 via connection A88. Go ahead and stop the burner. These two tests can check the proper operation of the A/D converter 54, 55 and indicate whether the accurate voltage w, 76 and the voltage divider connected thereto are working properly. Furthermore, a drift occurring in the voltage vREF supplied from the electric line 73 to the A/D converter 54.55 can also be detected. If the above-mentioned two tests pass, the microcomputer 51 executes the instruction in step 84. In step 84, the address IA is set to the channel selection path 7.
1a and the second accurate voltage W, voltage V2 from 70
(data path 74) is derived for conversion to a digital value by A/D converter 54. Address IA is actually a numerical value, but this symbol is used to simplify the description. After the time required for conversion, the digital value of voltage v2 is output by A/D converter 54 to data path 56 and stored in microcomputer 51. ! ! The process then proceeds via connection C90 to step 85 of FIG. 8b, where the value on data path 56 is tested against a prestored precision test voltage v2. If the value is outside the predetermined range around the pre-stored test voltage value v2, the process returns to step 82 via connection A88. If the test shows that the value is acceptable as the output of the A/D converter 54, the process proceeds from step 85 to step 91. Step 91 represents an instruction for the microcomputer to preset the index of the loop testing the appropriate absolute maximum range of the output of the individual sensors 17,18 and the limits depending on the operating state of the device. As already explained, step 86 represents the operation of presetting various parameters in the memory of the microcomputer 51, and the input channels (2, 3100,) of the multiplexers 54a and 55a are
The digital value of the output of the sensor 17.18 connected to is tested. There are two types of these test range parameters. The first type is the absolute value of the upper and lower limits of each sensor 17, 18, which are therefore the limit values of the device. A second type of parameter is the permissible error percentage of each sensor 17, 18, a limit value that depends on the operating state of the device. Thus, address 2.3.4.1.
There are four different marginal values for each sensor 17,18 connected to the channel of the multiplexer 54a, 55a with . Any or all of these limit values may be inserted by an engineer during system construction, or already prepared values may be used, or any or all of these values may be inserted at the factory during production. It is also possible to put it away. These values allow testing the output of each sensor 17, 18 in a two-step process. The first step tests whether the sensor output is within the absolute limits of the sensor. The absolute upper and lower limits represent the maximum possible range of the sensor 17.18, and many sensors 17.18
and the steady-state values and errors set for the parameters of the device 12 that sense the operating conditions may vary depending on the installation situation.For example, if the device 12 is a fuel burner, the acceptable fuel flow rate may vary depending on the installation situation. varies depending on the capacity of the burner. Therefore, the steady-state value of fuel flow rate is determined when combustion occurs, and the zero flow rate is determined when combustion is not occurring. In this way, the steady-state value that depends on the operating state of the device varies depending on the installation conditions, so when the error percentage is applied to the steady-state value, it forms a range whose absolute width varies depending on the strength of the steady-state value. Therefore, in this test stage, the operation of step 100, i.e., as already explained, the product of the upper and lower error percentages and the steady-state value is determined for each sensor, and a test range value table is created according to the channel address number for later use. By storing the information in the memory, it is possible to carry out the test process without interruption. By simply inputting the channel number in the table in step 91, the test range value of each sensor can be retrieved when necessary. As mentioned above, the channel selection address register 51a
is provided, and the channel number transmitted to the channel selection path 71a is stored here. This is useful in obtaining the address of the multiplexer 54a, 55a which supplies the analog voltage to be converted into a digital value from the sensor 17.18. To reduce the required instructions, this function is performed in only one software loop, increments the selected channel number in register 51a, and
Receives the associated sensor output on data path 56.57. In step 91, the index variable of this loop is set in advance by storing "2" in the channel selection register 51a.
a, is the minimum address of the input channel of 55a. At the beginning of this loop, the contents of the channel selection register 51a are transferred from the output channel of the microcomputer 51 to the A/D converter 54, 55 via data paths 71a, 71b.
will be forwarded to. Depending on this input address, each multiplexer 54a,
55a converts the voltage generated by sensor 17.18 connected to channel 2 of A/D converter 54.55 from analog to digital. After the time required for conversion,
Digital values equivalent to the voltages generated by these sensors are sent to the microcomputer 51 via data paths 56 and 57.
is supplied to The digital data on data paths 56,57 are further stored in appropriate cells of RAM within microcomputer 51 by the function shown in step 93.
The instruction represented by step 94 is then executed to retrieve the sensor's absolute upper and lower limits stored in the test range value table using the contents of channel selection address register 51a as an index. The digital value of the sensor output is tested to see if it is within the absolute upper and lower limits of the sensor retrieved from the test range value table. If it is not within the upper and lower limits, the process proceeds to step 101 to indicate a malfunction of the sensor, jump to step 82 via connection A88, stop the burner, and issue a warning to the operator. Conversely, if the digital value on the data path 56 is within the range of the upper and lower limits set for the sensor 17, then the process proceeds to step 95. In step 95, the multiplexer 55
Take the absolute upper and lower limits for the sensor 18 connected to input channel 2 of a and test the digital value representing the analog voltage of this sensor. If the digital value of the output of the sensor 18 is within the absolute upper and lower limits, the process is performed at the connection part D10.
2 to the flowchart of FIG. 8C. If the range is out of range, proceed to step 101 as in step 94.
If the second A/D converter 55 passes the test according to step 95, proceed to step 96, as shown in step 96.
A further test is performed on the digital value of the output of sensor 17. The multiplication value of the error percentage and steady-state value obtained for the sensors 17.18 in step 100 and stored in the test range value table is calculated using the contents of the channel selection register 51a as an index for each sensor 17.18. It is taken out for j8. Step 96 tests whether the value on data path 56 is within percentage limits of the steady state value. If the value is outside the limited range, then step 106 is executed. If this limit range is narrow, it is possible that operating conditions outside this range will not indicate a malfunction of the burner device 12.For example, if no combustion is taking place in the burner device, the fuel flow rate may be zero. (If the pilot were held, there would be a very low flow rate) and no percentage limit applies to the output of the sensor sensing this flow rate. Normally, these limit values do not apply during the first pass through this loop after start-up, since the operating conditions are only established at this time; The possibility of application can be determined by the signals on data paths 60a, 60b. If it is not possible to apply the percentage limit test, proceed to step 103. On the other hand, if a percentage limit test is applicable, step 10
6 to step 105 to appropriately indicate possible malfunctions such as sensor drift or malfunction progression of the burner device 12. Then from connection A88 to step 82
to stop the burner and generate an alarm signal to the operator. If the test represented by step 96 is passed, proceed to the next step 97, in which the percentage upper and lower limits of the steady-state value of the sensor connected to the multiplexer input channel with the number stored in the channel selection register 51a are determined. The test is identical to the test performed in block 96 except that the output of the second A/D converter 55 on data path 57 is tested against (stored in the test range value table). If the value is not within the limit value range in this test, the test in step 106 is performed. If the test result in step 97 is good (YES)
, it can be assumed that the sensors 17 , 18 accurately measure and supply various parameters for the operation of the burner device 12 . Therefore, data path 56.
Based on the output values from the sensors 17 and 18 transmitted to the microcomputer 57, the operation of the burner device 12 is continued and changed in accordance with the instructions constituting the internal burner control algorithm of step 103 stored in the memory of the microcomputer 51. be able to. At this time, depending on the operating state of the burner device 12, it is possible to perform or cancel the determination of the percentage within the upper limit for each sensor. This merely reflects the situation that different limit values may be applied depending on the operating conditions of the sensor and burner system at the time the percentage limit test of step 96.97 is performed. It should be noted that changes in operation of the burner system cannot begin until a set of sensor values has been converted to digital values and tested; this limitation is well known in the art and is beyond the scope of the present invention. When the sensor signal processing is properly performed, a primary step 106 is finally executed to determine if this sensor test loop needs to be repeated one more time. The contents of the channel selection register 51a are the multiplexers 54a and 55a.
is not the highest channel number (e.g. 7), control jumps from connection E88 to step 93 of FIG. 8B;
1 is added to the value of the channel selection register 51a, and the process proceeds to step 93 in FIG. 8B via the connection E92. The sensor 17. which is connected to the channel number 3 input channel of the multiplexers 54a and 55a.
18, various limit value search and sensor output value commands are executed. This pattern continues until the contents of the channel address register 51a are equal to the hexadecimal value of the channel number in the multiplexers 54a, 55a, at which point the process proceeds to step 99 and other necessary steps for controlling the 1-ner device 12 are performed. Processing function is microcomputer 51
have it done. After all these instructions have been executed, the process proceeds to step 80 of FIG. 8A via connection B89. In this way, the microcomputer 51 receives digital conversion values of the analog output values from the various sensors 17, 18 and obtains output values that reflect with a very high degree of accuracy the levels of the various operating parameters of the burner arrangement ft12. I can do it. Note that the order and operation of the various tests described above are arbitrary. However, functions that need to be performed in order for subsequent functions to perform properly must be performed in the specified order. For example, the A/D converter 54
．． Testing for the accuracy of 55 must be performed before the sensors 17, 18 are tested within limits, thereby eliminating any sources of detected inaccuracy and ensuring that the operator allows repairs and adjustments to be made more easily and quickly. Generally, the order of such important software elements (steps) can be easily deduced from the above description. Although one embodiment of the present invention has been specifically described above,
It will be apparent to those skilled in the art that various modifications may be made, and the invention is intended to be limited only by the scope of the claims.

[Brief explanation of the drawing]

Figure 1 is a block diagram of the fuel burner control device installed in the boiler, Figures 2, 3 and 4 are diagrams showing examples of analog sensors, respectively, Figure 5 is a block diagram of the burner control device, and Figure 6 is FIG. 7 is a detailed diagram of the burner control device of FIG. 5, and FIGS. 8A, 8B, and 80 are flow charts of the safety test software. 12. Burner device 17.18. ,,sensor 51,,,microcomputer 54.55. , A/D converters 54a, 55a, , multiplexer 70, , second voltage source 76, , first voltage source Patent applicant Yamatake Honeywell Co., Ltd. Agent Patent attorney Yoshiharu MatsushitaFig. 5

Claims (1)

[Claims] 1. Sensing a preselected physical quantity associated with a physical device by a plurality of sensors, providing an analog voltage signal representing the sensed physical quantity, and controlling the operation of the physical device using the analog signal. A sensor output redundancy check device included in a control device for generating control signals for controlling based on a sensor output, the device comprising: (a) at least first and second channels having predetermined unique first and second channel addresses; It has two multiple analog voltage input channels, the second channel receives the analog sensor signal and the channel selection terminal receives a channel selection signal encoded with a channel address, and the channel address is determined in response to the channel selection signal. first and second analog//
a digital converter; (b) a first reference voltage source providing a voltage having a predetermined precise value to the first and second converters; and (c) a first reference voltage source provided by the digital converter. pre-storing a digital value of voltage, receiving the outputs of the first and second converters, and providing a channel selection signal encoded with a predetermined first input channel address to each converter during a first predetermined time period; and storing the output from each converter during the first predetermined time period, and matching the output of each converter with a pre-stored value of the voltage of the first reference voltage source supplied to the converter. microcomputer means for testing whether the output of said first or second converter and a predetermined value of the voltage supplied by said first reference voltage source do not match and generating a warning signal; A redundancy testing device for sensor output, characterized in that it tests a component for operation according to design requirements and generates a warning signal for operation that deviates from design requirements. 2. sensing a preselected physical quantity associated with a physical device by a plurality of sensors, supplying an analog voltage signal representing the sensed physical quantity, and controlling the operation of the physical device based on the analog signal; What is claimed is: 1. A sensor output redundancy test device for a control device generating a control signal, the device comprising: (a) an analog voltage input channel for receiving a signal from the sensor; at least one analog-to-digital converter providing a converted digital output signal; (b) receiving an output from said converter and setting predetermined upper and lower limits for a first output of said converter Digital values of upper and lower limit values that are narrower than the range of the upper and lower limit values set for the respective specified first and second values and other outputs of the converter and that are dependent on the operating state of the device are stored in advance. , a range in which the output of the converter is determined by upper and lower limits depending on the operating state of the device, and the first and second
is within a range determined by the value of microcomputer means for generating certain control signals, testing the component for operation in accordance with design requirements, and generating a warning signal for operation outside of design requirements; Redundancy check device.