US3143161A

US3143161A - Self-checking condition responsive system

Info

Publication number: US3143161A
Application number: US275953A
Authority: US
Inventors: Donald L Graves; Giuffrida Philip
Original assignee: Electronics Corp of America
Current assignee: Electronics Corp of America
Priority date: 1963-04-26
Filing date: 1963-04-26
Publication date: 1964-08-04
Anticipated expiration: 1981-08-04

Description

1964 0.1.. GRAVES ETAL 3,143,161

SELF-CHECKING CONDITION RESPONSIVE SYSTEM Filed April 26, 1963 v y 8-2 T 4o-| 2 FIG.2

United States Patent 3,143,161 SELF-CHECKING CONDITION RESPONSIVE SYSTEM and Philip Giufirida, North 9 Claims. (Cl. 15828) This invention relates to control apparatus and more particularly to condition responsive apparatus such as those useful in supervising fuel burning systems, and to means for insuring reliable operation of the sensory and signal modifying portions of such apparatus.

.In condition responsive systems, as for example those used for supervision of combustion established in a furnace chamber, it is desirable that the system react very quickly to the presence or absence of a flame so that excessive amounts of unburned fuel will not accumulate in the chamber in the absence of flame. Electronic flame sensing systems have the desirable rapid reaction to presence or absence. of flame, but such systems are susceptible to malfunctions such as, for example, a continuously avalanching sensor of the gas-discharge type which falsely indicates flame presence or a runaway transistor .which continuously passes substantial current to a flame responsive device in the absence of the flame signal normally required to initiate and sustain such current flow. Should such a failure occur, it would be an unsafe type as the sensingsystem would, in the event of flame failure, continue to react as if flame were present and would therefore permit continued fuel introduction. In such a case the chamber can accumulate an excessive charge of fuel or fuel vapor which might be .ignited explosively by the hot refractory or upon an attempt to reignite the burner. If the sensing system through. component failure erroneously indicates the absence of flame, however, fuel introduction will be terminated and the failure is of asafe type.

In order to check the integrity of such condition responsive systems, it has been proposed to employ a condition absence simulator which operates repetitively at intervals shorter than the deactuation time of the load control device. Failure of the condition responsive device to react properly to the simulated condition absence results in deactivation of the controlled loads. A major disadvantage of the system is the limited life of those mechanical portions thereof which, because of the rapid repetition rate, amass a large number of operations within a relatively short period of time.

Another proposal has been to utilize a timing motor to periodically initiate a condition absence simulation, with the interval between such simulations being appreciably longer than the response time of theload control device. Whereas the less frequent operation of the checking apparatus contributes to its longer life expectancy, there is no assurance against malfunctions of the checking apparatus itself, and when such occur there is no continuing check on the integrity of the condition responsive system.

Accordingly, it is an object of this invention to' provide novel and improved control apparatus for checking condition responsive systems.

Another object of the invention is to provide novel and improved control apparatus for use with condition responsive systems which incorporate means to periodically simulate the absence of the condition being sensed and means to check the continued operation of the condition absence simulator. 7

Another object of this invention is to provide a selfchecking condition responsive system in which the checking events are provided at intervals substantially longer than the predetermined delay provided in the system between loss of the sensed condition and operation of load devices in response to such loss.

Another object of the invention is to provide a simplified checking system for a condition responsive system in which the checking components alternate between a first position and a second position and return to the first position only once during each checking cycle, which cycle is substantially longer than the system delay pro vided between the loss of sensed condition and operation of load devices in response to such loss.

In accordance with the invention there is provided a condition responsive system which in the preferred embodiment is a combustion supervision system. That system includes a radiation sensor which is disposed to supervise a particular area of interest in the combustion chamber and operates a condition indicating device in the form of a flame relay. The flame relay in turn operates a load control device in the form of a second relay that controls the flow of fuel to the combustion chamber for example. The system also employs a condition absence simulating means which is operative to place the flame relay in a state indicating the absence of flame if the circuitry is operating properly. This simulator is cyclically operated under the control of two timing devices having operating cycles of equal duration and is energized when both timing devices are in the same state. In that state each timing device renders itself inoperative through a self-operated control contact and de-energizes the load control device. That device has a delayed drop out and maintains the load device energized for a short time. An auxiliary timing device operating circuit is completed when the flame relay is in non-flame condition and the load device is still energized, a condition that is created by the simulator when the system components are operating properly. Through this timing device control the operability of the system is checked at regular intervals with the load device being de-energized promptly should the circuitry operate improperly or on flame failure.

The two timing devices are automatically resynchronized every checking cycle as each timing device deenergizes itself at the end of each checking cycle, and both timing devices must be de-energized before the simulator can be energized to cause de-energization of the flame relay. When that occurs, in a period less than the drop out delay time of the load controlling device, the auxiliary circuits are completed to initiate another checking cycle. As the two auxiliary circuits are operated simultaneously both timing devices are started in synchronism to commence another checking cycle.

The invention provides a self-checking arrangement for a condition sensing system which finds particular use in systems employed for the supervision of combustion in which a flame failure must be sensed and action taken in response to it within a very short time while the operability of the entire sensing system must be continually supervised. Other objects, features and advantages of the invention will be seen as the following description of a preferred embodiment thereof progresses, in conjunction with the drawing, in which:

FIG. 1 is a schematic diagram of a simplified condition sensing system including self-checking circuitry constructed in accordance with the invention and particularly adapted for use in combustion control systems; and

FIG. 2 is a timing diagram indicating the sequence of operation of the circuitry components shown in FIG. 1.

With reference to the drawing, the system includes a condition source 10 which is indicated generally as an element connected across

supply lines

12, 14. This condition source in the preferred embodiment is the flame from a burner element in a furnace chamber and is controlled through auxiliary circuitry including an ignition transformer and a fuel valve, for example. The showing of these details are omitted as they are conventional in na-' ture. Disposed in supervision relation to the condition source is a condition sensor 16 which may be an infra red radiation sensor or an ultraviolet radiation sensor. This condition sensor conventionally includes condition modifying circuitry in the nature of an amplifier or other device and for the purpose of simplicity such circuitry is not shown although such circuitry conventionally is employed.

The condition sensor operates a condition indicating device which is shown as flame relay 18. Connected across the relay coil 18 is a capacitor 20 which provides a time delay suificient to hold in the relay contacts through a complete cycle of the power supply voltage. Energy is supplied to the

lines

12 and 14 from a 120 volt 60 cycle source which is connected at terminals 24, 26. When the condition sensor 16 senses the desired condition from source 10, the relay 18 is energized and operates a load controlling device 28 which has a capacitor 30 connected across it to provide a drop out time delay in the order of three seconds. This load device in turn controls loads such as main fuel valves which are generally indicated at 32.

To check the proper continued operation of the condition responsive system, there is provided a condition ab.- sence simulating means in the form of a shutter 34 which may be interposed between the condition source and the condition sensor 16 to block radiation. Other simulator devices which are arranged to place the condition indicating device 18 in its first or deenergized state may also be employed. In the disclosed embodiment the shutter 34 is operated by solenoid 36 which also is connected across the

lines

12, 14.

Two

timing devices

40, 42 which may be capacitive charge storage devices, timing motors or other timing devices having predetermined and substantially identical timing cycles are also connected across the

supply lines

12, 14. Each timing device has connected in series with itself its own normally open contacts 40-1, 42-1 respectively which complete an energizing circuit. Connected in parallel circuit with each set of normally open timer contacts 40-1, 42-1 is an auxiliary circuit including a normally closed contact of the flame relay 18-1, 18-2, and a normally open contact of the load controlling device, 28-1, 28-2. The simulator operator coil 36 has connected in series with it normally closed timer contacts 40-2 and 42-2, so that both timers must be in the same state before the simulator can be operated.

The load control relay 28- is connected in series circuit with timer contacts 48-3 and flame relays contacts 18-3 (which are paralleled with a momentarily operated initiating device in the form of a push button 44 having normally open contacts) and a circuit including contacts 18-1, 28-1 and 42-1. Also connected in series with the coil 28 of the load control relay is a diode 46 and a resistor 48. The load control relay has normally open contacts 28-3 connected in series with the load device 32.

With the power supply connected to terminals 24 and 26, both timing devices will be in timed out, de-energized position as they are in series with their own contacts. To initiate operation of the circuitry, push button 44 is momentarily depressed, thus completing a parallel circuit across the open contacts 18-3 and 40-3 to energize the load controlling relay 28. Even though the push button circuit is immediately reopened, capacitor 30 will hold relay 28 in for three seconds. When contacts 28-1 and 28-2 close the timing device auxiliary circuits are completed and the

timing devices

40 and 42 both start their timing cycles. Simulator coil 36 is energized until contacts 40-2 and 42-2 open. (Timing device contacts 40-1, 40-3 and 42-1 close at the same time contacts 40-2 and 42-2 open, as indicated in FIG. 2.) Upon de-energization of the simulator, if the condition (flame) is present,

sensor 16 will energize the flame relay 18. When the flame relay is energized normally open contact 18-3 closes, recompleting the energization circuit for load control relay 28, and the normally closed contacts 18-1, 18-2 open, interrupting the auxiliary circuits. Should flame not be detected, however, either through circuit malfunction or flame absence within the combustion chamber, relay 18 will not pick up and .close contacts 18-3 so that the load control relay 28 will drop out after three seconds, reopening contacts 28-3 and de-energizing the load device 32.

Where the condition is sensed within the predetermined time interval as established by the drop out time of load control relay 28, the circuit continues to indicate the presence of the condition as long as that condition exists. Should there subsequently be a failure of the condition or a failure of the sensing circuitry, so that flame relay 18 is de-energized for a period longer than the drop out time of the load control device 28, the system will shut down automatically with the de-energization of the load. (It will be noted that the

timers

40 and 42 complete their cycles irrespective of flame failure or other condition absence and at the end of their cycles contacts 40-1 and 42-1 will open to de-energize the timing devices.)

Assuming that the system continues to indicate the presence of flame throughout the checking cycle, both

timers

40 and 42 complete their cycles and open contacts 40-1 and 42-1 to deenergize the timers and remove power from load control device 28 via the opening of contacts 42-1 and 40-3. That device as indicated above will hold the load control contacts 28-3 closed for three seconds in the preferred embodiment. When both timers have completed their cycles, the series connected contacts 40-2 and 42-2 are closed, and the simulator actuator 36 is operated to interpose the shutter 34 between the condition source 10 and sensor 16 to cause the flame relay 18 to drop out. If the flame relay 18 does not drop out promptly, the time delay drop out of the load control relay 28 is exceeded'and that relay drops out tie-energizing the load. If the flame relay does drop out promptly, however, as

it does in proper operation, contacts 18-1 and 18-2 close' before contacts 28-1 and 28-2 open to complete the auxiliary timing device energizing circuits for the

timers

40 and 42. Those devices, when energized, close contacts 40-1, 40-3 and 42-1, initiating another timing cycle. With the reinitiation of a timing cycle, contacts 40-2 and 42-2 are opened, de-energizing the shutter solenoid 36 and removing the simulated condition absence so that flame relay 18 is again picked up and completes the energizing circuit to the load control device 28.

As indicated above, should the flame relay 18 drop out due to failure of the flame sensor or signal modifying circuitry, for example, the load control relay 28 will drop out in a predetermined period, de-energizing the load 32. Similarly if the radiation fails, the load will be de energized after the same time interval. If the simulator mechanism should fail to operate, such as the shutter solenoid 36 failing or the shutter 34 sticking in the open position, the flame relay 18 will not drop out at the end of the checking cycle interval, the timing cycle will not be reinitiated by the auxiliary circuits, and the load control device 28 then will drop out after the predetermined interval, again de-energizing the load 32. The cycle timers check each other in a simple manner. It will be noted that the load control device is de-energized when either timer reaches the end of its cycle. If one of the

timers

40, 42 should stick or get out of synchronism by more than the drop out time of that device, the load 32 will be de-energized. 'Thus the system is self-checking so that failure of radiation or of the condition sensing circuitry will shut down the controlled load. The checking cycle time is substantially longer than the system delay permitted between absence of the sensed condition such as flame failure and load de-energization, but the circuitry does check the continued operability of the entire condition sensing system at regular intervals and promptlyv shuts down the load upon detection of a malfunction in the system.

While a preferred embodiment of the invention has been shown and described, various modifications thereof will occur to those skilled in the art, and therefore it is not intended that the invention be limited to the disclosed embodiment or to details thereof and departures may be made therefrom within the spirit and scope of the invention as defined in the claims.

We claim: 1. A combustion supervision system comprising a flame sensor,

means including a flame indicating device controlled by said sensor to indicate the presence or absence of flame in a combustion chamber under supervision,

means including a load control device controlled by said flame indicating device as a function of the presence or absence of flame in said combustion chamber,

simulating means for placing said flame indicating device in a flame failure indicating state independently of the presence or absence of flame in said combustion chamber,

two timing devices each having a timing cycle of the same duration, each timing device including means to render itself inoperative at the end of each timing cycle,

timing cycle initiating means operative when said flame indicating device is in said flame failure indicating state and said load control device is in a state corresponding to the presence of flame in said combustion chamber, 7

and means responsive to the end of the timing cycles of both devices to operate said simulating means to place said flame indicating device in said flame failure indicating state.

2. Control apparatus comprising a condition sensor adapted to produce an output signal indicative of the presence of a sensed condition,

means including a simulator for causing said sensor to indicate the absence of the sensed condition,

means including a load device controlled by said sensor,

means to delay the de-energization of said load device after said sensor indicates the absence of the sensed condition,

first and second timing devices having identical timing cycles,

means responsive to completion of the timing cycle of both timing devices to actuate said simulator,

and means responsive to an indication of absence of the sensed condition by said sensor within a predetermined time after actuation of said simulator to simultaneously reactivate both said timing devices to initiate their timing cycles.

3. The apparatus as claimed in claim 2 wherein said timing devices are timing motors each having a timing cycle substantially longer than the delay period of said delay means.

4. The apparatus as claimed in claim 2 wherein said simulator includes a shutter for interposition between said sensor and the condition source being sensed to block radiation from said sensor.

5. A condition responsive system comprising a condition sensor,

means including a condition indicating device controlled by said sensor,

said condition indicating device having first and second states,

means including a load control device controlled by said condition indicating device,

said load control device having first and second states corresponding to the first and second states of said condition indicating device,

condition absence simulating means for placing said condition indicating device in said first state independent of the presence or absence of the condition being sensed, first and second cyclically operable timing devices, means responsive to each device to control its cycle duration,

said device responsive means de-energizing each timing device and actuating said simulating means at the completion of the timing cycles of both devices,

and auxiliary circuit means for energizing each timing device when said condition indicating device is in said first state and said load control device is in said second state to initiate a timing cycle.

6. An electrical control system arranged to be energized on need for fuel burner operation and having means adapted to be connected to energize the fuel burner to establish a flame,

comprising a flame sensor adapted to be associated with said fuel burner to detect flame at the fuel burner,

means including a simulator for simulating the absense of flame,

sensor responsive means,

first and second timing devices having identical timing cycles,

means including a load device controlled by said sensor responsive means,

means responsive to the energization of said load device to actuate said first and second timing devices simultaneously,

means responsive to the completion of the timing cycles of both timing devices to actuate said simulator and to deactuate said timing devices,

and means responsive to an indication of absence of flame from said sensor responsive means While said load device is energized to reactuate both said timing devices at the same time.

7. The control system as claimed in claim 6 wherein each said timing device is electrically operable and controls an electric circuit switch, each said timing device controlled switch being connected in series with that timing device and each said timing device controlled switch being closed after the start of each timing cycle and opened at the end of each timing cycle,

and a circuit connected across each said timing device controlled switch including a normally open switch controlled by said load device and a normally closed switch controlled by said sensor responsive means.

8. The control system as claimed in claim 7 wherein said timing devices are timing motors each having a timing cycle substantially longer than the delay period of said delay means.

9. The control system as claimed in claim 8 wherein said simulator includes a shutter for interposition between said sensor and the source of flame being sensed to block radiation from said sensor.

References Cited in the file of this patent UNITED STATES PATENTS 2,084,880 Wotring June 22, 1937 2,763,853 Grant Sept. 18, 1956 2,814,740 Smith Nov. 26, 1957 2,865,444 Deziel Dec. 23, 1958 3,072,177 Fennell Jan. 8, 1963

Claims

6. AN ELECTRICAL CONTROL SYSTEM ARRANGED TO BE ENERGIZED ON NEED FOR FUEL BURNER OPERATION AND HAVING MEANS ADAPTED TO BE CONNECTED TO ENERGIZE THE FUEL BURNER TO ESTABLISH A FLAME, COMPRISING A FLAME SENSOR ADAPTED TO BE ASSOCIATED WITH SAID FUEL BURNER TO DETECT FLAME AT THE FUEL BURNER, MEANS INCLUDING A SIMULATOR FOR SIMULATING THE ABSENSE OF FLAME, SENSOR RESPONSIVE MEANS, FIRST AND SECOND TIMING DEVICES HAVING IDENTICAL TIMING CYCLES, MEANS INCLUDING A LOAD DEVICE CONTROLLED BY SAID SENSOR RESPONSIVE MEANS, MEANS RESPONSIVE TO THE ENERGIZATION OF SAID LOAD DEVICE TO ACTUATE SAID FIRST AND SECOND TIMING DEVICES SIMULTANEOUSLY, MEANS RESPONSIVE TO THE COMPLETION OF THE TIMING CYCLES OF BOTH TIMING DEVICES TO ACTUATE SAID SIMULATOR AND TO DEACTUATE SAID TIMING DEVICES, AND MEANS RESPONSIVE TO AN INDICATION OF ABSENCE OF FLAME FROM SAID SENSOR RESPONSIVE MEANS WHILE SAID LOAD DEVICE IS ENERGIZED TO REACTUATE BOTH SAID TIMING DEVICES AT THE SAME TIME.