NL1016345C2 - Electronic safety system for monitoring equipment such as hot water boilers or heavy motors, comprises safety and control parts with separate interlinked electric connections - Google Patents

Abstract

Separate electric connections regulated by microcontrollers (1, 13) are provided between the equipment and the safety part and control part of the safety system. These separate connections communicate with each other regarding the status of the equipment being monitored and the control function can only be operated once the safety function has been tested and found to be in order. The equipment is switched off if there is a threat of an unsafe situation arising, e.g. too high a temperature, pressure or voltage, or in the event of a fault in the safety system.

Description

- 1-

Electronic system for guaranteeing the safety of electronically controlled devices.

The invention relates to a concept of an electronic control system consisting of an electronic control part and an electronic safety part with which it is guaranteed that in the event of an error the device is switched off before a dangerous situation, such as for instance a too high temperature, voltage or pressure can occur. originate.

The current state of the art is that many devices still use a single or multi-phase mechanical / hydraulic safety switch which interrupts the voltage supply to the controller when a maximum set value in the process to be controlled is exceeded. In the case of controlling a temperature, the appliance or appliance must be fitted with an over-temperature protection in accordance with the applicable standards and guidelines, which, if the temperature control fails, switches off the appliance when a specified maximum temperature is reached.

The temperature measurement is often done on the basis of the cubic expansion coefficient of a liquid in a reservoir which is connected via a capillary tube to a second space with liquid.

This second space is bounded on one side by a membrane which, at a certain displacement caused by the too high temperature, opens one or more switches, as a result of which the power supply is interrupted. The device can then only be put back into operation by a qualified person. In addition, there are electronically protected controls for, among other things, electric flow heaters, where the electronics of the control part, when the latter functions properly, apply a release signal in the form of a cyclically changing voltage. passes on the safety part. (For example, patent publication DE 44 16 789 A1 from 11/16/1995.)

The following drawbacks are present with regard to the above-mentioned devices according to the current state of the art: 1. In today's devices and devices, the safety switch mentioned must also be mounted in the device in addition to the often highly advanced electronic control. These safety switches are relatively large and very difficult or not easy to assemble.

2. The specified mechanical / hydraulic safety switches are never tested for proper operation during the life of a device.

30 3. During the final assembly of a device, the reservoir (temperature sensor) of the mechanical / hydraulic safety switch must be placed in the position to be measured. It must be ensured that the said capillary tube is properly mounted. Squeezing / kinking the capillary tube can lead to the safety switch not functioning.

4. The temperature sensor including the capillary cannot be separated from the actual safety switch.

As a result, it is not possible to have the temperature sensor and the safety switch follow different logistic routes during the production process.

1016345 -2- 5. The aforementioned electronically protected electronic controls do not meet the requirements for, among other things, certain household appliances where a safety function that operates independently of the control function is required.

The invention provides a solution to the aforementioned drawbacks by making use of two microcontrollers controlled sub-circuits. One of the sub-circuits actually takes over the function of traditional over-temperature protection, among other things. Because the said sub-circuit can communicate via a galvanic isolation with the other microcontroller-controlled sub-circuit that provides the control function, an electronic system is realized which, in addition to the control function, also guarantees safety. All electronic components required for the implementation of the safety function can now be mounted on the same circuit board as the one on which the components for the control function are placed. Because the safety function has been realized electronically, its operation can also be tested frequently. The sensors used are connected to the printed circuit board via electrical wiring, if necessary pluggable.

The principles are explained and applications explained with reference to the figures.

Figure 1 shows the block diagram of an electronic circuit which will explain the principle of and the operation of the safety system.

Figure 2 shows a possible electronic circuit diagram with which the releasing of the safety part relays must be ensured in the event of the microcontroller failing.

20

In order to be able to meet the safety standards that are set for household appliances such as domestic water heaters, the control part and the safety part, the latter having the function of switching off the mains voltage in the case of exceeding a maximum acceptable temperature, independently of each other Operate. This means that each function must have its own temperature sensor.

In the concept of this invention, two independently controlled switches, usually relays, are connected in series for each phase of the mains voltage.

Before a load (for example, a heating element of a boiler) is controlled, it is first checked whether the switches are in order. With this concept, the microcontroller of the safety function is the "master" of the electronic system. This means that the safety section can pass binding instructions to the control section. The control part has its own microcontroller and temperature sensor for the actual control function.

The concept is explained with reference to Figure 1. In principle, the concept consists of three functional parts, which are structured as follows: 1. the safety part consisting of the electrical supply (19), microcontroller (1), temperature sensor (17), supply circuit for the safety relay (2), relay or relay group (3), the networks for testing voltages (4/5) and (6/7), switch (8) and a resistor (9) 1016349 -3- 2. the control part consisting of the electrical supply (20) , microcontroller (13), temperature sensor (18) and the relay or relay group (14) 3. the control unit (16).

Furthermore, the device to be controlled comprises the heating element or the heating elements (15).

For the sake of clarity, the function of each of the blocks in Figure 1 is further explained below. 1. Microcontroller of the safety part.

2. Circuit where the presence of two dynamic input signals is necessary to supply a relay or relay group with voltage. As soon as the said signals assume a static state, all relays (3) that are periodically tested for proper functioning are switched off.

3. A relay or relay group that can only be switched if it has been tested in advance that switching will take place without load. Only in the extreme case (if a switch from relay group (14) cannot be switched off) will it be switched off under load.

4. High voltage resistors (number dependent on the number of voltages on the terminals (101).

5. A capacitor which, together with a high-voltage resistor (4), forms a network for detecting the presence of a voltage on terminal (101) on an input of a microcontroller (1).

6. Resistance as said resistor (4), to prove that a contact from relay group (3) has been opened. The number of resistors is equal to the number of available voltages on the terminals (101).

7. A capacitor such as said capacitor (5), which together with high voltage resistor (6) forms a network to prove the absence of a voltage behind a contact from relay group (3) on an input of a microcontroller (1).

8. Electronic switch to determine whether the contacts of the switching group (14) are open, so that the contacts of the relay group (3) can switch on without load. This electronic switch supplies as many high-voltage resistors (9) as the number of available voltages on terminal (101).

9. High voltage resistance (s), equal to the number of voltages used, to test whether the contacts of the switching group (14) are open.

10. Mains connection (101). With three-phase power control, the components 3,4,5,6,7 and 9 are triple present. The Neutral is connected to the lower terminal (103). Only LI is connected here for supplying the electronics themselves. The voltage L1 is one of the voltages that is also connected to the shown terminal 101.

11. Optocoupler for data transfer from the safety part to the control part.

12. Optocoupler for data transfer from the control part to the safety part.

13. Microcontroller of the control part.

35 14. Switch or switch group for switching the loads on and off (in this example heating elements).

1016349 -4- 15. One to several loads (A number of three with a three-phase connection.) 16. Device control unit.

17. Sensor of the safety part (in this example a temperature sensor).

18. Sensor of the control part (in this example a temperature sensor).

5 19. Electrical supply of the safety part.

20. Electrical supply of the control part.

21. Connection terminal for the safety earth.

The optocouplers (11) and (12) allow the said safety part and the control part to communicate with each other, while a very good galvanic separation between said parts has been realized. This electrical separation allows the keypad (16) and possibly other connections to external electronics to be connected to the control section, since the safety ground (21) is the zero potential of the control section.

The relay contacts (3) and (14) are normally open when the system is not connected to the mains. When voltages are present on the terminals (10) (101, 102 and 103), both microcontrollers (1) and (13) start up. During the said start-up phase it is prevented that the relays (3) in the safety part or the relays (14) in the control part are energized. Because both microcontrollers are not operational at the same time, it is permitted that the communication between the two microcontrollers is established somewhat delayed. For example, a second is acceptable in most applications. Immediately from start-up, the microcontroller (1) measures the temperature as often as possible with the aid of the sensor (17). The maximum acceptable temperature is stored in a non-volatile memory, in or connected to a microcontroller (1).

The said non-volatile memory can for example be an E2Prom or even a non-writable Prom or Rom. Measurements are also made as often as possible over the RC networks (4) / (5) and (6) / (7) 25 respectively before and after the switching contacts of relay group (3). With the help of the RC networks (4) / (5), it is checked which mains voltages of L1, L2 and / or L3 are present. The specified mains voltages and Neutral (Neutral voltage of the mains) are connected to the terminals (101) and (103) respectively. In order for the electronics to function, at least Neutral and L1 are present, which are connected to terminals (102) and (103) respectively.

After assembling a device, for example a hot water boiler powered by electrical energy, the control sensor (18) of the control part can be calibrated.

Said control sensor (18) can, in addition to a temperature sensor, also be an integral sensor with which the heat content of a boiler can also be determined. During the final test in the factory, the microcontroller (13) can be brought into a state whereby a certain correction factor is written in a non-volatile memory of or at the microcontroller (13).

This mentioned correction factor is in fact the value that the microcontroller (13) of the control part needs to be able to measure the temperature or heat content within a certain tolerance. The calibration of sensor (18) is possible because the accurate sensor (17) of the The safety part and the sensor (18) of the control part have the same temperature after the assembly of the whole, within a certain maximum deviation. Microcontroller (1) of the safety part communicates the measured value of sensor (17) via optocoupler (11) to microcontroller (13) of the control part. After this calibration, the control part is able to accurately control the temperature to a certain desired value set on the control part. Even in the event that an error is made during production during this calibration, the microcontroller (1) will ensure that when the temperature is too high, the relay groups (14) and (3) are deactivated. The software of the safety part and the control part can in practice ensure that at a certain moment in the event of a predetermined too large deviation between the measured temperatures, the system is switched off. If it is necessary to exchange it after the mentioned control unit fails, the installer can put the control unit placed in the unit in a state whereby the sensor of the control part is calibrated.

It is also possible that, if desired, the control sensor is periodically automatically calibrated during operation.

The requirements imposed on relays that must switch off an electrical load in an emergency are very high. A condition is, for example, that a relay must be able to switch off 250000 times under operating conditions. In order to greatly reduce the requirements for these relays, it is included in the concept of this invention that the relays of the relay group (3) which in the event of an emergency must switch off the power supply to the loads always always switch off during normal operation when the switches of the control part (14) have interrupted the power supply. With this concept, the mentioned safety part relays are never switched on or off under load under normal operating conditions.

In the event that the control part wants to supply one or more energy consumers (in the example heating elements) with energy, a request is made via optocoupler (12) to the safety part to switch on the voltages at the inputs of the control part. The control part will only activate the required switches when the message has arrived via optocoupler (11) that the requested request has been executed by the safety part. However, before this message is sent by the security part 30, the security part must perform a number of checks.

It is first checked whether the independently controlled contacts of the relay group (3) and relay group (14), which are connected in series, are in the open state.

1016345 -6-

This check is carried out as follows: • it is tested with the networks (4) / (5) whether voltages are present at the terminals (101) (voltages are measured at the relevant inputs of the microcontroller (1)), • with the networks (6) / (7) it is checked whether the contacts of relay group (3) are all open 5 (no voltages are then measured at the relevant inputs of the microcontroller (1)), • switch 8 is activated and again checked with the networks (6) / (7) whether the contacts of relay group (14) are open. If a contact of relay group (14) is not opened, as may occur in the event of an error situation, no voltage is measured at the corresponding input of the microcontroller (1). This is caused by the low-ohmic load (15) and the high-ohmic resistance (9).

If an error is found during the aforementioned test progress, the safety part is immediately locked in a locked state. In that case, a data location is described in the non-volatile memory of microcontroller (1) that makes it impossible to activate relay group 3. The microcontroller (13) of the control part is also informed of the error via optocoupler (11). The control part then also describes a data location in the non-volatile memory of the own microcontroller (13). As a result, the control part will also no longer be able to activate relays from the switching group (14). Microcontroller (13) can continue to communicate with the keypad (16) in the latter state. As a result, the user of the device can be informed of the error that has occurred. Even if the voltage drops and the voltage returns, the control system will no longer be able to return to the operational state. Only after activating a non-accessible reset key, the control system will attempt to become operational again.

Because the safety part and the control part communicate with each other continuously, it is very easy to inform the other part about an existing error. Even in the event that one of the 25 processors stops, this is recognized by the stagnation of communication. The executing software of the still-working microcontroller or microcontrollers (there may also be an error in the communication channel over the optocouplers (11) and (12)) then ensures that the contacts are opened.

In the event that both microcontrollers should fail simultaneously and end up in a static state, block (2) causes the supply to relay group (3) to be interrupted. The circuit of block (2) of Figure 1 can look like this. (Other options including a transformer are possible to interrupt the power supply to relay group (3) if the microcontroller (1) enters a static state. See figure 2 for this.

As long as the two signed outputs of the microcontroller produce two counter-phase signals with a duly cycle of approximately 50 percent at a sufficiently high frequency, the signed relay RY1 is supplied.

1016349 -7-

The diode bridge (B1) is controlled in reverse phase via the two capacitors (C1) and (C2). When the microcontroller ceases and therefore the two outputs assume a static state, the power supply to the relay coil is interrupted. If a microprocessor output is logically zero, the points 1 and 3 of the capacitors (C1) and (C2), respectively, can reach virtually zero volts. to stand. In that case, control of the relay coil is immediately interrupted. However, in the event that one or both outputs have a logic one potential or a potential at which one or both transistors (T1) or (T3) can become conductive, the points 1 and 3 of the capacitors (C1) and (C2) will a potential of almost +12 volts. In this case, one or both of the aforementioned capacitors are charged by the current flowing through the relay (RY1). Within one second, the aforementioned capacitors are charged to such an extent that the resulting voltage across the relay drops below the holding voltage, causing the relay to fall off. Measures have been taken in the software to prevent the program from continuing to generate the two counter-phase signals in the event of a faulty program or software error.

Every time after the relay contacts of the relay group (3) and the contacts of the switching group (14), as described above, have been satisfactorily tested, the microcontroller (1) will control both inputs of block (2) with a logic one voltage. This action is controlled or the capacitors (C1) and (C2) have no increased leakage current or a short circuit. In the event that said error is present with one or both of said capacitors, the relays of relay group (3) are activated. With the aid of the RC networks (6) / (7), as previously explained, it is checked whether all contacts of relay group (3) are in the open state within one second. By properly dimensioning component values, it is possible, if desired, to prevent the relays from coming on briefly. After it has been determined that the said capacitors are not wrong, the two said outputs are driven in reverse phase. In the said embodiment of block (2) by the diagram according to Figure 2, a frequency of 3 KHz would be sufficient to feed a relay group. The correct rise of the relays in relay group (3) is again tested by the RC networks (6) / (7).

As soon as the safety part has the operating voltages for the control part available, the control part is informed of this via optocoupler (11). The microcontroller (13) of the control part then knows that the required switches in switch group (14) may be used for control purposes.

After the control part has reached the final value to be controlled (in the case of an electric boiler that is the desired temperature of the water), all contacts of the switching group (14) will have to go to the open state. The control part reports this to the safety part via optocoupler (12). This ensures that the contacts of relay group (3) will never switch off under normal circumstances.

1016345 -8-

After opening the contacts of relay group (3) with the RC networks (6) / (7), the safety part checks whether relay group (3) has actually been able to open all contacts. If this test is successful, the microcontroller (1) will activate the switch (8). Via the resistors (9) and the RC networks (6) / (7), it will be checked whether the contacts of the switching group (14) are actually open.

5

If an error in the total system is signaled at any time, a command to deactivate switch group (14) is first sent to the control part before relay group (3) will be switched off. As a result, the contacts of relay group (3) will normally never switch off when loaded.

The two sensors of the safety part (17) and of the control part (18) are constantly tested for good performance. A short circuit or isolation is detected directly by the analog to digital converters in or near the microcontrollers (1) and (13). Due to the constant communication between the control part and the safety part, a comparison of the two measured values is carried out, especially when approaching the desired end temperature (or quantity other than temperature). As mentioned, too great a deviation can lead to system shutdown. In contrast to guaranteeing safety according to the current state of the art, switching off the system in the event of an error in the control part according to this new concept will often already take place if the desired temperature is exceeded to a degree to be determined. hydraulic / mechanical safety switch only respond when an absolute maximum temperature is exceeded.

20

In addition to running security and communication software, Microcontroller (1) can also perform tasks at a lower priority level for measuring and controlling Neutral-related voltages. As a result, for example, the microcontroller (13) of the control part can be informed via optocoupler (11) about the presence or absence of a voltage which indicates that the night current rate applies 1016349

Claims (14)

1. An electronic safety system for appliances for which a separate safety system is required by law, such as for example for hot water boilers and heavy engines, characterized in that separate electronic circuits are used for both the safety function (the safety part) and the control function (the control part) ), which separate circuits communicate with each other about the status of the device to be protected and in which the control function can only be activated after the protection function has been tested and found to be in order and in which the device switches off if an unsafe situation threatens, such as, for example, too high a risk. temperature, too high a pressure or too high a voltage, or when a malfunction occurs in the aforementioned electronic safety system. 10 An electronic safety system according to claim 1, characterized in that the safety part will only offer voltages for the supply of energy to the load to the control part if the control part has submitted a request to the safety part via said communication and after the automatic execution of tests has been shown that the relays or other switches of both the safety part and the control part are in the open state, so that it is guaranteed that when the said voltage is switched on by the safety part the switches of the safety part will switch unloaded turn into. 3. An electronic safety system according to one or more of the preceding claims, characterized in that the safety part will only switch off the voltages to the control part if the safety part is informed of the opened state of the switches by means of said communication with the control part of the control part, so that when the control part functions properly it is ensured that the switches of the safety part are switched unloaded when the said safety part is switched off. 25 An electronic safety system according to one or more of the preceding claims, characterized in that in the case of exceeding a preset value at which the device is to switch off, by means of said communication between the safety part and the control part an attempt is first made to have the control part switch off the connected load, after which the safety part will switch off the voltages to the control part with a small delay. 35 1016345 -10- An electronic safety system according to one or more of the preceding claims, characterized in that after switching off the safety part, it is tested whether the switches of the control part are indeed the first to have switched off the load and said switches thus in the desired opened condition. 5 An electronic safety system according to one or more of the preceding claims, characterized in that the safety part may be equipped with switches that normally have an electrical life that is too short for this purpose, but which can nevertheless be used because, except in the extreme undergo no switching load during use. An electronic safety system according to one or more of the preceding claims, characterized in that if the control part is unable to switch off a load due to an error, this function can be taken over by the safety part by using said communication, whereby the the quantity to be controlled, such as temperature or pressure, does not have to rise to the maximum set value stored in the memory of the safety part. 8. An electronic safety system according to one or more of the preceding claims, characterized in that after the detection of an error both the safety part and the control part are brought into a locked state, as a result of which the device cannot come into operation again autonomously after a mains voltage interruption . 9. An electronic safety system according to one or more of the preceding claims, characterized in that the sensors of both the safety part and the control part can be connected to the electronics via plug-in connections, whereby the sensors and the electronics can be connected up to the final assembly of the device. can follow different logistical routes. 10. An electronic safety system according to one or more of the preceding claims, characterized in that it is possible by means of said communication between safety part and control part to compare the measured values with each other and on the basis thereof automatically, for example during the production process, a carry out calibration or switch off the device if there are too large differences in measured values. 1016345 - 11 - An electronic safety system according to one or more of the preceding claims, characterized in that the relay or switching group of the safety part and optionally also the relay or switching group of the control part can be supplied by a circuit as shown, for example, as in Figure 2 or, for example, by a circuit that uses a transformer, as a result of which the supply current is quickly lost if the microcontroller (1) were to fail due to a static condition. 12. An electronic safety system according to one or more of the preceding claims, characterized in that the galvanic separation between the safety part and the control part and the data communication between the safety part and the control part by optocouplers as shown in figure 1 are also provided by means of a electronic circuit with transformers or capacitors with a sufficiently high breakdown voltage can be realized. 13. An electronic safety system according to one or more of the preceding claims, characterized in that, due to the said galvanic isolation between the safety part and the control part, the safety part acquires a reference potential which will lie at the 'neutral' of mains voltage and wherein the control part has a reference potential that is connected to the safety ground, whereby the connection of external devices, such as control consoles, to the control part can be made without the addition of additional optocouplers now that there is no risk of contact with the user. 20 An electronic safety system according to one or more of the preceding claims, characterized in that networks can be connected to the microcontroller of the safety part through which voltages in the order of 230 volts can be measured directly, which measurement activities are controlled by a part of the software that is handled at a lower priority in the processor of the security part. 1016345