US3463600A

US3463600A - Control apparatus with redundant features

Info

Publication number: US3463600A
Authority: US
Inventors: Roger E Axmark
Original assignee: Honeywell Inc
Current assignee: Honeywell Inc
Priority date: 1967-03-15
Filing date: 1967-03-15
Publication date: 1969-08-26
Anticipated expiration: 1986-08-26
Also published as: GB1185972A; DE1673960A1

Description

g- 26, 1969 I R. E AXMARK 3,463,600

CONTROL APPARATUS WITH REDUNDANT FEATURES Filed March 15, 1967 1' AI Bl Q J';L

GEIGER TUBES 2| (INDIVIDUALLY AC RESPONSIVE T0 T0 LINE BURNER FLAME) BURNER l4 b RELAY E A A I I31 20 I9 AC I8 GEIGER TUBES MALFUNCTION 2| (INDIVIDUALLY OUTPUT I! RESPONSIVE 22 24 TO FLAME) 5 355 f MALFUNCTION fififi ulfi'i l8 OUTPUT 2| RESPONSIVE 9 5 TO FLAME) I4 0- 3 INVIZN'IOR.

ROGER E. AXMARK 2% MD {QM ATTORNEY United States Patent O M 3,463,600 CONTROL APPARATUS WITH REDUNDANT FEATURES Roger E. Axmark, Fridley, Minn., assignor to Honeywell Inc., Minneapolis, Minn., a corporation of Delaware Filed Mar. 15, 1967, Ser. No. 623,436 Int. Cl. F23n 5/24 US. Cl. 431-16 9 Claims ABSTRACT OF THE DISCLOSURE A burner control apparatus having two flame sensors in a bridge circuit. Each sensor is individually responsive to flame. The sensors jointly control, through adjacent legs of the bridge, the operation of a burner system. An electrical relay connected across the bridge is sensitive to electrical unbalance therein due to any discrepancy between the outputs of the two sensors and also controls the operation of the burner system.

BACKGROUND OF THE INVENTION This invention pertains to a control apparatus for closed loop systems wherein an output condition of the system is detected to control the operation of the system. The control apparatus is based on a redundant approach since the condition detecting means of the apparatus includes two condition sensors for sensing the output condition of the system. The control apparatus possesses fail-safe features that shut down the system in a safe condition in the event of failure by one of the condition sensors or its related parts.

Although this invention may be utilized with any system in which an output condition is to be detected for the purpose of controlling the system, it will be specifically described, for the sake of convenience, in connection with a burner system in which the condition to be detected is flame. Various characteristics of a flame, such as thermal or radiant energy, may be sensed by a flame sensor according to this invention. However, it has been found desirable in most burner systems to sense flame optically by means of radiation detectors such as Geiger tubes or other photosensitive devices. Geiger tubes that are responsive to the ultraviolet radiation in a flame are established in the art as preferred flame sensors. Such tubes consist of an anode and a cathode disposed in an ionizable gas. Upon being subjected to radiation to which the tube is sensitive, the gas ionizes causing a discharge current to flow between the electrodes which makes the tube conductive. This invention will be specifically described using such flame sensors.

In any type of a sensor designed to provide an output upon sensing a condition, the inherent risk exists that the sensor may fail in one of two basic ways. First, failure may occur if the sensor does not produce the desired output when the condition is actually present. Second, failure may occur if the sensor produces an output indicative of the presence of the condition when the condition is actually nonexistent. In the case of flame radiation sensors, particularly Geiger tubes, the first type of failure occurs when the sensor does not become conductive in the presence of flame radiation. The sensor indicates a no-flame condition when flame is actually present. The second type of failure occurs when the sensor is conductive even in the absence of flame rediation. The sensor indicates a flame condition when flame is not present. The first failure may result in the shutdown of the system by the control apparatus at an inconvenient time during the cycle of operation. On the other hand, the second failure may result in a dangerous condition since the control apparatus will fail 3,463,600 Patented Aug. 26, 1969 to shut down the system and prevent the supply of fuel to the burner when it cannot be properly ignited.

It has been determined that the second type of failure is the most likely to occur in Geiger tubes. Therefore, when Geiger tubes are used, the burner control apparatus should be particularly designed to guard against such failures.

SUMMARY OF THE INVENTION The invention is embodied in a control apparatus having a condition detecting means which includes two condition sensors adapted to be individually responsive to the condition produced by the system and to provide separate outputs. An output responsive means is arranged to respond to the outputs of the two sensors by assuming a first state indicative of the absence of outputs from both of the sensors, a second state indicative of the presence of outputs from both of the sensors or a third state indicative of an output from only one of the sensors. First and second control means are also included in the control apparatus. The first control means is responsive to the output responsive means when in the first or second states. The second control means is responsive to the output responsive means when in the third state. A switching means operated by the first and second control means controls the operation of the system in accordance with the responses of the first and second control means.

Operating as a burner control apparatus and in the event of the first type of failure by one of the sensors, the control apparatus will shut down the burner system immediately in a safe condition. On the other hand, in the event of the more likely second type of failure by one of the sensors, the control apparatus will delay shutdown until the end of that portion of the cycle of operation wherein the system is required to provide a flame and the flame is normally extinguished. At that point in the cycle, the control apparatus will shut down the burner system in a safe condition.

BRIEF DESCRIPTION OF THE DRAWING FIGURE 1 is a circuit schematic of a preferred embodiment of the invention using standard electrical components.

FIGURE 2 is another circuit schematic of a second preferred embodiment of the invention using solid state components.

FIGURE 3 is another circuit schematic of a third preferred embodiment of the invention representing a simplified version of the circuit in FIGURE 2.

DESCRIPTION OF THE PREFERRED EMBODIMENTS FIGURE 1 of the drawing shows a control apparatus for controlling the operation of a burner system (not shown). In this embodiment, the condition to be detected is the flame output of the burner system which is sensed optically by means of two Geiger tubes. All relays and associated switches are shown in the de-energized condition.

The apparatus includes three relays, designated as A, B and C. Relay A is provided with a normally open switch A1. Relay B is provided with a normally open switch B1. Relay C is provided with a normally closed switch C1 and a normally open switch C2. Switches A1, B1 and C1 are connected into series circuit means, generally designated as 10. The switches, when closed, are cooperatively arranged to energize a burner system through terminals 11 and 12.

Switch C2 is included in circuit means 13 which also includes a malfunction output means 14. Circuit means 13 is adapted to provide a malfunction indication when switch C2 is closed. Circuit means 10 and 13 are adapted 3 to be connected to an AC source by means of

terminals

15 and 16.

Circuit means, generally designated as 17, is adapted to be supplied with DC electrical energy by means of diode 18, capacitor 19 and current limiting resistor 20, which form a rectifying network. In this embodiment, circuit means 17 includes a condition detecting means in the form of a bridge circuit. The bridge circuit is indicated by a, b, c and d. Terminals a-b represent the first leg of the bridge, a-d the second leg of the bridge, b-c the third leg of the bridge and c-d the fourth leg of the bridge. A first Geiger tube 21 is included in the first leg of the bridge. A second Geiger tube 22 is included in the second leg of the bridge. The Geiger tubes are arranged in an environment such that they are individually responsive to burner flame from the burner system. For example, the sensors may be optically shielded from each other but arranged to sense the burner flame.

The bridge also includes output responsive means connected into the other legs of the bridge. The output responsive means preferably takes the form of first and second electrical responsive means connected respectively to the third and fourth legs of the bridge. In this embodiment, the first electrical responsive means is the electrical winding of relay A, which is connected into the third leg of the bridge. The second electrical responsive means is the electrical Winding of relay B, which is connected into the third leg of the bridge. The second electrical responsive means is the electrical winding of relay B, which is connected into the fourth leg of the bridge.

The output responsive means, comprising the third and fourth legs of the bridge and the windings of relay A and relay B, is capable of assuming any one of three distinct states. It will assume a first state when neither of the Geiger tubes is producing an output, that is, when neither of the Gieger tubes is conductive. It will assume a second state when both of the Geiger tubes are conductive. It will assume a third state when only one of the Geiger tubes is conductive.

The armatures of relays A and B jointly form a first control means responsive to the output responsive means when it is in either the first or the second states.

Relay C is a second control means responsive to the output responsive means when it is in the third state. In operation, relay C reacts to electrical unbalance in the bridge since it is connected between the third and fourth legs.

When flame is not present in the burner system,

Geiger tubes

21 and 22 will not be conductive. Relays A and B will be de-energized and switches A1 and B1 will be open. The supply of electrical energy to the burner system is cut off and the supply of fuel to the burner system will be prohibited in accordance with principles standard in the art.

When flame is present, both

Geiger tubes

21 and 22 will beconductive if functioning normally. Relays A and B will be energized and switches A1 and B1 will be closed. Normally closed switch C1 will also be closed since relay C will be de-energized. Therefore, electrical energy will be supplied to the burner system allowing it to remain in operation.

When flame is present and one Geiger tube, such as Geiger tube 21, is properly conductive while the other Geiger tube, such as Geiger tube 22, is not conductive due to failure, one relay, such as relay A, will be energized while the other relay, such as relay B, will be de-energized. Therefore, one of the normally open switches, such as switch B1, will be open. Relay C will be energized due to the electrical unbalance in the bridge and switch C1 will also be open. As a consequence, the control apparatus will shut down the burner system in a safe condition. In addition, relay C will also close normally open switch C2 to provide a malfunction output indication in the malfunction output means 14.

When flame is present and one Geiger tube, such as Geiger tube 21 is properly conductive, while the other Geiger tube, such as Geiger tube 22 is improperly conductive due to its failure, shutdown will not occur since both relays A and B will be energized. Since there will be no electrical unbalance in the bridge, relay C will be de-energized. Therefore, switches A1, B1 and C1 will be closed. In this event,'the supply of electrical energy to the burner system will be continued until that part of the burner system operation cycle wherein the flame is normally extinguished. At that part of the cycle, the control apparatus will detect the failure of the improperly conductive tube since Geiger tube 21 will be normally nonconductive in the absence of flame whereas Geiger tube 22, which has failed into a constantly conductive condition, will continue to be conductive. Relay B will be maintained in an energized condition causing electrical unbalance in the bridge. This condition causes relay C to be energized, opening switch C1 and discontinuing the supply of electrical energy to the burner system. Switch C2 will close and a malfunction indication will be provided by malfunction output means 14.

Since the second type of failure, wherein the sensor is improperly constantly conductive, is the most likely to occur with Geiger tubes, it is obvious that the above arrangement provides for the detection of the most likely type of failure to occur and as a consequence thereof will shut down the burner system in a safe condition at a convenient time during its cycles of operation. That is, the system will be shut down when the flame has been normally extinguished.

Referring now to FIGURE 2 of the drawing, a control apparatus is show that makes use of solid state components. The circuit of FIGURE 2 is effectively the same as that of FIGURE 1. Therefore, similar numbers have been utilized to identify similar components.

Series circuit means 10' includes normally closed switch C1, normally open switch C2 and first and second controlled rectifier means such as silicon controlled

rectifiers

23 and 24.

Controlled rectifiers

23 and 24 are respectively operably connected by means of their gates to the second and third legs of the bridge circuit means indicated by a, b, c and d. Normally closed switch C1 and controlled

rectifiers

23 and 24 are adapted, when the switch is closed and the controlled rectifiers are both activated, to energize the burner system through terminals 11 and 12.

The output responsive means comprises a first electrical responsive means, such as resistor 25, in the third leg of the bridge, and a second electrical responsive means, such as resistor 26, in the fourth leg. When

Geiger tubes

21 and 22 are conductive, a potential is developed across

resistors

25 and 26 which activates controlled

rectifiers

23 and 24 to allow the flow of electrical energy through circuit means 10'.

The first control means, responsive to the output responsive means, comprises

transistors

27 and 28. Transistor 27 is operatively connected by means of its input circuit to the fourth leg of the bridge. The output circuit of transistor 27 is connected to the third leg of the bridge in such a manner that when the transistor is activated, it shunts current from Geiger tube 21 to prevent the activation of controlled rectifier 23. In the fourth leg of the bridge is receiving current when the third leg is not, transistor 28 will be activated to shunt current flow away from controlled rectifier 24 preventing its activation and discontinuing the supply of electrical energy to the burner system. Likewise, transistor 28 is operably connected by means of its input circuit to the third leg of the bridge while the output circuit thereof is connected to the fourth leg in such a manner as to shunt current away from controlled rectifier 24, when transistor 28 is activated, to prevent activation of controlled rectifier 24. Therefore, if the third leg of the bridge is receiving current from Geiger tube 21 when the fourth leg is not receiving current from Geiger tube 22, transistor 27 will be activated by means of its input circuit to shunt controlled rectifier 23 and open circuit means .In operation, when no flame is present in the burner system,

Geiger tubes

21 and 22 will not be conductive. Potentials will not be developed across

resistors

25 and 26 and controlled

rectifiers

23 and 24 will be inactive as will be

transistors

27 and 28. The control apparatus will not supply electrical energy to the burner system.

When flame is present and both

Geiger tubes

21 and 22 are properly conductive, potentials will be developed across

resistors

25 and 26 to activate controlled

rectifiers

23 and 24.

Transistors

27 and 28 will be inactive and circuit means 10' will supply electrical energy to the burner system to maintain it in operation.

When flame is present and one of the Geiger tubes, such as Geiger tube 21 is properly conductive while the other Geiger tube, such as Geiger tube 22 is not conductive, controlled rectifier 24 will be inactive and controlled rectifier 23 will be prevented from being activated since transistor 27 will be activated. Relay C will detect a discrepancy between the conductive conditions of the Geiger tubes by detecting unbalance in the bridge. Thus, switch C1 will be opened and switch C2 will be closed to provide a malfunction output from malfunction output means :14. The same result will be obtained if Geiger tube 22 is properly conductive and Geiger tube 21 is not conductive since transistor 28 will be activated and controlled rectifier 24 will be inactive.

When flame is present and one of the Geiger tubes, such as Geiger tube 21 is properly conductive, whereas the other Geiger tube, such as Geiger tube 22 is improperly conductive due to its failure, both controlled

rectifiers

23 and 24 will be activated to supply electrical energy to the burner system until that part of the operation cycle of the burner system wherein the flame is normally extinguished. At that part of the cycle, Geiger tube 21 will cease being conductive whereas Geiger tube 22 will continue to be conductive. Transistor 28 will be activated and controlled rectifier 24 will be prevented from being activated. As a result, circuit means 10' is opened and the flame condition cannot be re-established in the burner system. Relay C will detect the discrepancy between the two Geiger tubes by detecting unbalance in the bridge to open switch C1 and close switch C2. The same results will be obtained if Geiger tube 21 improperly fails to be conductive and Geiger tube 22 is properly conductive, since transistor 27 will be activated to shunt controlled rectifier 23 and controlled rectifier 24 will be normally inactive.

Referring now to FIGURE 3, a third embodiment of a control apparatus is shown. This embodiment is effectively the same as that of FIGURE 2 but is somewhat simplified. Since many portions of the circuit of FIGURE 3 are again similar to portions of the circuit-disclosed in FIGURES 1 and 2, similar components are similarly numbered.

The apparatus of FIGURE 3 includes a bridge circuit indicated by terminals a, b, c and d. A relay, designated as relay C, is connected across the bridge to detect a discrep ancy between the conductive conditions of

Geiger tubes

21 and 22 by detecting electrical unbalance in the bridge. Relay C is provided with normally closed switch C1 and normally open switch C2. Switch C1 is included in circuit means 10" as is a controlled rectifier, such as silicon controlled rectifier 29. Switch 01 and controlled rectifier 29 Switch C1 and controlled rectifier 29 are adapted to energize the burner system by means of terminals 11 and 12. Controlled rectifier 29 is operably connected to the fourth leg of the bridge by means of its gate and will consequently be activated when Geiger tube 22 is conductive and the proper resultant potential is developed across resistor 30. When controlled rectifier 29 is activated and the bridge is electrically balanced with switch C1 in its normally closed position, circuit means 10" will supply electrical energy to the burner system.

The second leg of the bridge contains resistor 31 and a connection to the input circuit of transistor 32. Transistor 32 is connected between the second and third legs of the bridge by its input and output circuits so as to shunt controlled rectifier 29 when transistor 32 is activated. Due to the arrangement of transistor 32 between the legs of the bridge, it can be activated to shunt controlled rectifier 29 only when Geiger tube 22 is conductive and Geiger tube 21 is not conductive. If both

Geiger tubes

21 and 22 are conductive transistor 32 will be inactive and controlled rectifier 29 will be active. If both Geiger tubes are not conductive, transistor 32 and controlled rectifier 29 will be inactive. If Geiger tube 21 is not conductive and Geiger tube 22 is conductive, transistor 32 will be active and controlled rectifier 29 will be inactive. Switch C1 will be open due to the energization of relay C.

When flame is not present in the burner system,

Geiger tubes

21 and 22 will not be conductive. Transistor 32 and controlled rectifier 29 will be inactive and circuit means 10" will be open to prevent the supply of electrical energy to the burner system.

When flame is present and both

Geoger tubes

21 and 22 are properly conductive, transistor 32 will be inactive and controlled rectifier means 29 will be active to close circuit means 10". Electrical energy will then be supplied to the burner system.

When flame is present and Geiger tube 21 is conductive whereas Geiger tube 22 is not conductive due to its failure, transistor 32 and controlled rectifier 29 will be inactive and circuit means 10*" will be open. Switch C1 will be open due to the energization of relay C. The supply of electrical energy to the burner system will be prevented. Switch C2 will be closed to produce a malfunction indication.

When flame is present and Geiger tube 21 is properly conductive whereas Geiger tube 22 is improperly conductive due to its failure, the control apparatus will allow the burner system to continue operation until the flame is normally extinguished at which time the electrical unbalance in the bridge will be sensed by relay C. Switch C1 will be open to shut down the burner system. Switch C2 will be closed to provide a malfunction indication.

If flame is present and Geiger tube 22 is properly conductive whereas Geiger tube 21 is improperly conductive due to failure, the control apparatus will allow the burner system to continue operating until its flame is normally extinguished at which time the electrical unbalance will be sensed by relay C. Switch C1 will be open to shut down the burner system. Switch C2 will be closed to provide a malfunction indication.

Three specific electrical embodiments of this invention, particularly adapted to control the operation of a burner system, have been described. In these embodiments, the condition detecting means includes an electrical bridge circuit having first and second flame sensors mounted in first and second adjacent legs of the bridge. An output responsive means consisting of first and second electrical responsive means is connected to the third and fourth adjacent legs of the bridge. The electrical responsive means are respectively responsive to the first and second flame sensors. Electrical means are operably connected to the electrical responsive means in the third and fourth legs of the bridge to provide a first control means. An electrically operated relay is connected across the bridge, either within the first and second legs or between the third and fourth legs, to provide a second control means. A plurality of switch means, respectively responsive to the first and second control means, are serially connected into an electrical circuit to control the supply of electrical energy to the burner system.

The embodiment of the invention in which an exclusive property or right is claimed are defined as follows.

I claim:

1. Control apparatus for controlling the operation of a system wherein a condition exists as a result of energization of the system, comprising:

condition detecting means including first and second condition sensing means adapted to be individually responsive to the condition and to produce outputs as a result thereof,

output responsive means responsive to said first and second sensing means and having a first state indicative of the absence of outputs from both of said sensing means, a second state indicative of the presence of outputs from both of said Sensing means, and a third state indicative of an output from only one of said sensing means,

first switching means responsive to said output responsive means having a first state indicative of the absence of outputs from both of said sensing means, and having a second state indicative of the presence of outputs from both of said sensing means,

second switching means responsive to said output responsive means having a first state indicative of the presence or absence of outputs from both of said sensing means, and having a second state indicative of an output from only one of said sensing means, and

circuit means controlled by said first and second switching means and adapted to energize the system only when said second switching means is in said first state.

2. The control apparatus of claim 1 including:

malfunction output means energized by said second switching means only when in said second state for producing a malfunction output.

3. The control apparatus of claim 1 wherein:

said first and second condition sensing means are adapted to produce electrical outputs in response to the presence of the condition,

and said output responsive means is electrically connected to said condition sensing means and electrically responsive to the outputs thereof.

4. The control apparatus of claim 1 wherein:

said condition detecting means comprises an electrical bridge circuit having electrical terminals (a), (b), and said first condition sensing means is electrically responsive to the condition and is connected between terminals (a) and (b) of said bridge circuit to form a first leg thereof, said second condition responsive means is electrically responsive to the condition and is connected between terminals (a) and (d) of said bridge circuit to form a second leg thereof adjacent said first leg, and said output responsive means comprises first electrical responsive means responsive to the output of said first condition sensing means and connected between terminals (b) and (c) of said bridge circuit to form a third leg thereof, and second electrical responsive means responsive to the output of said second condition sensing means and connected between terminals and (d) of said bridge circuit to form a fourth leg thereof adjacent said third leg.

5. The control apparatus of claim 4 wherein the system to be controlled is a burner installation, the condition is flame, and

said first and second condition sensing means are con structed and arranged to individually produce electrical outputs in response to the radiant energy produced by flame,

and wherein second switching means is an electrically operated relay having an actuator connected between adjacent pairs of said bridge legs for responding to electrical unbalance in said bridge circuit caused by a discrepancy between the outputs of said first and seocnd condition sensing means. 6. The control apparatus of claim 5 including: malfunction output means operably connected to be controlled by said electrically operated relay. 7. The control apparatus of claim 4 wherein: said first electrical responsive means includes a first electrically operated relay, said second electrical responsive means includes a second electrical operated relay, and including a third electrically operated relay having an actuator connected between terminals b and d of said bridge circuit for responding to a discrepancy between the outputs of said condition sensing means by detecting electrical unbalance in said bridge circuit, and wherein said first switching means includes series connected normally open switches of said first and second relays, said second switching means includes a normally closed switch of said third relay, and and said circuit means includes in a series circuit the normally open switches of said first and second relays and the normally closed switch of said third relay. 8. The control apparatus of claim 4 wherein: said second switching means includes an electrically operated relay having an actuator connected between adjacent pairs of said bridge legs for responding to a discrepancy between the outputs of said condition sensing means by detecting electrical unbalance in said bridge circuit, and having a normally open switch, said first switching means includes,

a first controlled rectifier means, circuit means operably connecting said first controlled rectifier means to said first electrical responsive means, a second controlled rectifier means, circuit means operably connecting said second controlled rectifier means to said second electrical responsive means, circuit means interconnecting said first and second controlled rectifier means in parallel, and said circuit means comprising a series circuit connecting said first and second controlled rectifier means to said switch for adapting said controlled rectifier means and said switch to control energization of the system, and including,

a first transistor having input and output circuits, a second transistor having input and output circuits, circuit means operably connecting said first transistor input circuit between said first and second electrical responsive means such that said first transistor is activated only when said first electrical responsive means is active and said second electrical responsive means is inactive, circuit means connecting said first transistor output circuit to said first controlled rectifier means such that said first rectifier means is shunted when said first transistor is activated, circuit means operably connecting said second transistor input circuit between said first and second electrical responsive means such that said second transistor is activated only when said second electrical responsive means is active and said first electrical responsive means is inactive, and circuit means connecting said second transistor output circuit to said second controlled rectifier means such that said sec- 0nd rectifier means is shunted when said second transistor is activated. 9. The control apparatus of claim 4 wherein: said second switching means includes an electrically operated relay having an actuator connected between adjacent pairs of said bridge legs for responding to a discrepancy between the outputs of said condition sensing means by detecting electrical unbalance in said bridge circuit, and having a normally open switch, said output responsive means includes,

a transistor having an input circuit and an output circuit, and circuit means operably connecting said input circuit between said first and second electrical responsive means such that said transistor is activated when said first electrical responsive means is inactive and said second electrical responsive means is active, said first switching means includes,

a controlled rectifier means, circuit means operably connecting said controlled rectifier means to said second electrical responsive means, and circuit means operably connecting said controlled rectifier means to said transistor output circuit such that said controlled rectifier means is shunted when said transistor is activated, and said circuit means comprising a series circuit con meeting said controlled rectifier means to said switch for adapting said controlled rectifier means and said switch to control energization of the system.

References Cited UNITED STATES PATENTS 2,775,291 12/ 1956 Wilson 431-24 3,160,197 12/1964 Deziel 431-24 3,286,761 11/1966 Engh 317-1'24 LEE T. HIX, Primary Examiner US. Cl. X.R.