US3288195A

US3288195A - Fail-safe control apparatus

Info

Publication number: US3288195A
Authority: US
Publication date: 1966-11-29
Anticipated expiration: 1983-11-29

Description

1966 E. c. THOMSON FAIL-SAFE CONTROL APPARATUS Filed Sept. 4, 1964 United States Patent 3,288,195 FAIL-SAFE CONTROL APPARATUS Elihu C. Thomson, Wellesley, Mass., assiguor to Electronies Corporation of America, Cambridge, Mass., a corporation of Massachusetts Filed Sept. 4, 1964, Ser. No. 394,472 17 Claims. (Cl. 158-28) The present invention relates to improved control apparatus and more particularly to condition responsive systems, such as those useful in supervising fuel burning systems, and to means for insuring reliable operation of the sensory and signal modifying portions of such systems. In condition responsive systems of the type employed for the supervision of flame established in a combustion chamber, it is desirable that the supervising system react very quickly to the presence or absence of flame so that the fuel valve may be closed quickly and prevent an excessive amount of unburned fuel from accumulating in the combustion chamber in the absence of flame. Flame sensing systems which have the desirable rapid response to the presence or absence of flame are well known, but such systems are susceptible to component malfunction and may cause the flame detecting system to falsely indicate the presence of flame. Should such a malfunction occur in a system supervising flame in a combustion chamber, an unsafe condition might arise as the system, in the event of flame failure, would continue to react as if flame was present and permit the continued introduction of raw fuel into the furnace chamber. The accumulated raw fuel could be ignited explosively, either by the hot refractory or upon an attempt to reignite the burner, for example, with disastrous results.

Industry standards specify that approved combustion control systems must operate with a maximum time delay of four seconds between flame failure and shutdown of the fuel flow to the supervised combustion chamber. Component checking arrangements which check the operability of the system by simulating flame failure therefore must complete their cycle through flame relay dropout and flame relay pickup within that time.

Accordingly, it is an object of this invention to provide an improved condition sensing system incorporating component checking arrangements whereby the operation of the condition sensing system is regularly checked to insure that the system is not falsely indicating the presence of the condition to be sensed.

A more general object of the invention is to provide a novel and improved control circuit of the fail-safe type which responds to two signals that alternate in time.

Another object of the invention is to provide a novel and improved fail-safe control system particularly useful with flame sensors.

Another object of the invention is to provide novel and improved control apparatus for use with condition responsive systems which incorporate means to periodically simulate the absence of the condition being sensed and means to check the continued operation of the condition absence simulator.

Another object of the invention is to provide novel and improved load control means in condition respon sive systems.

A further object of the invention is to provide a novel comprehensive condition responsive system in which load energization is responsive to both the condition sensing circuitry and to the checking circuitry and provides improved self-checking operation.

Still another object of the invention is to provide a novel and improved combustion supervision system of the self-checking type.

In accordance with the invention there is provided a control circuit arrangementfor energizing a load in- "ice cluding a power source for the load and coupling circuitry for coupling power from the power source to the load while performing an isolating function so that the load is not directly energized from the power source. This coupling circuitry includes two energy storage devices and an input control having two states. The input control is adapted to operate in response to two signals which alternate in time. Those signals may be independent of one another or may represent the presence and absence of a condition, for example. The input control in a first state provides a first energy transfer loop between the power source and one storage device and a second energy transfer loop between the one storage device and the load and a fourth energy transfer loop between the source and the other storage device. The two states of the input control are exclusive of one another so that in each state two different energy transfer loops are establishedone including the source and the other, the load. The load thus is energized from two energy storage devices and responds to each device directly and independently of the other device.

In the preferred embodiments of the invention, the load device is energized from a direct current source and is shunted by two asymmetrical devices having alternate high and low impedance conditions as a function of the polarity of electrical signals applied to them. These asymmetrical devices are connected in series and poled to permit current flow through them from the source. Connected between each source terminal and theload (and a corresponding asymmetrical device), however,-is an energy storage capacitor which blocks energization of the load directly from the source. A charging loop for each capacitor is controlled by an input control means having two alternate states. The input control means in a first state provides a low impedance path to complete a. charging circuit for one capacitor and presents a high impedance (open circuit) path in the charging circuit for the second capacitor. The control means, in each state, simultaneously completes an energizing loop through the load that includes the capacitor then not connected to the source. Through alternation of the input control means, the load is kept energized. In the preferred embodiment the input control is responsive to flame in a combustion chamber, and periodic flame failure simulation causes the input control to alternate. The circuit parameters and the cycle of the input control means are selected so that the duration of the discharge cycle of each capacitor is greater than the duration of that portion of the cycle of the input control means other than the portion required for fully charging the other capacitor.

Other objects, features and advantages of the inven tion will be seen as the following description of preferred embodiments thereof progresses, in conjunction with the drawing, in which:

FIG. 1 is a diagram of a combusition control system incorporating apparatus constructed in accordance with the invention;

FIG. 2 is a schematic diagram of a second embodiment of circuitry constructed in accordance with the invention; and v FIG. 3 is still another embodiment of checking circuitry constructed in accordance with the invention.

With reference to FIG. 1 there is shown a combustion chamber 10 having a main fuel line 12 and nozzle 14 eX-' tending thereinto. The flow of fuel through line 12 is controlled by solenoid operated valve 16, and fuel flowing into the combustion chamber is ignited to produce flame 18.

The flame in the combustion chamber is sensed by suitable sensing circuitry including a sensor 20 which may be an infrared or ultraviolet radiation sensor, a flame rod or other flame sensing device well known in the art. (A

pilot flame may be initially established or manual start button 35, in parallel with contacts 34, may temporarily energize fuel valve 16.) The output signal from the sensor 20 may be applied through suitable signal modifying and/ or amplifying circuitry 22 to operate flame relay 24. That flame relay controls a movable contact member 26 for motion between a first fixed contact 28 and a second fixed contact 30, contact 28 being the normally closed contact and contact 30 being the normally open contact. When the sensor 20 senses the flame and the circuitry is operating properly, the flame relay 24 is energized to move member 26, and open the circuit to the normally closed contact 28, while closing the circuit to the normally open contact 30. (Relay 24, of course, may be actuated conversely, that is, de-energized in the response to flame and energized upon flame failure.)

The flame relay controls a load device diagrammatically indicated as a load relay 32 which operates a set of contacts 34 that are connected in circuit to control the solenoid operated fuel valve 16 such that, if the flame 18 in the combustion chamber is extinguished after it has been established therein, the load relay 32 will be de-energized and open contacts 34 to close the valve 16 and prevent the flow of raw fuel into the combustion chamber.

The circuitry connected between the flame relay 24 and the load relay 32 constitutes a fail-safe rectifier circuit and operates as a self-checking system in conjunction with a cycling device which is illustrated as a shutter 36 driven in rotation by motor 38. The shutter has a sector of predetermined angular length which is interposed periodically between the sensor 20 and the flame 18 to block the sensors view of the flame and thus simulate a flame failure condition. Other devices capable of causing the circuitry to respond periodically as if a flame absence existed may also be employed. The cycle of openation of the simulator device is of predetermined duration so that this checking operation occurs at regular intervals.

The checking circuitry includes a source 40 of direct current energy connected to terminals 41, 42 of polarity as indicated. The positive terminal 41 is connected to contact 28 and to one terminal of capacitor 44, and the negative terminal 42 is connected to contact 30 and one terminal of capacitor 46. Connected to the other terminal of capacitor 44 is an asymmetrical device in the form of diode 48 and one terminal of the load relay 32. Connected to the other terminal of capacitor 46 is a second asymmetrical device in the form of diode 50 and the other terminal of load relay 32. The two

diodes

48, 50 are connected in series and their junction 52 is connected directly to the movable contact element 26 of flame relay 24.

The circuitry is shown in position resulting when flame relay 24 is de-energized. In this condition a capacitor charging path is provided from terminal 41 through contact 28 and diode 50 to charge capacitor 46 to the full supply voltage with polarity as indicated. Capacitor 44 is fully discharged, and therefore there is no potential across the solenoid coil of load relay 32 and, therefore, no current flow through that relay.

When the sensor 20 secs flame, relay 24 is energized to move member 26 from engagement with contact 28 to engagement with contact 30. This operation opens the charging path for capacitor 46 and completes a charging path for capacitor 44 from terminal 41 through capacitor 44, diode 48, and contact 30 to terminal 42. This is a low impedance path and capacitor 44 is rapidly charged to the full potential connected across terminals 41, 42. At the same time a discharge path for capacitor 46 is completed, which discharge path includes the load relay 32. That discharge path is from the positive terminal of capacitor 46 through load relay 32, diode 48 and contact 30, the potential across diode 50 due to charge on capacitor 46 being such that it is not conductive. The resulting current flow energizes the relay 32 and closes contacts 34 to energize the main fuel supply valve 16. The parameters of the circuit are adjusted so that the discharge time of capacitor 46 through this path is of longer duration than the radiation transmitting portion of the cycle of shutter 36.

Within that discharge time, therefore, the shutter 36 is caused to be interposed between flame 18 and sensor 20 and causes the flame relay 24 to bede-energized, opening the circuit at contact 30 and closing the circuit at contact 28. During the transition interval between

contacts

30 and 28, the two capacitors are connected in series across the source through load 32. Capacitor 44, however, is charged to full supply voltage and capacitor 46 is partially charged to a potential of additive polarity so that the total capacitor voltage exceeds the supply voltage, and current flow continues through relay 32 in the direction to maintain the relay contacts 34 closed. It is desirable that the transit time of the member 26 between

contacts

28 and 30 be as small as possible, as both capacitors during this transient are discharging simultaneously. However, the circuit design can accommodate transit times that are necessary for desired circuit operation.

With the

contacts

28 and 26 in engagement, a discharge path for capacitor 44 is completed from the positive terminal of capacitor 44 through contact 28, diode 50 and the load relay 32 to the negative terminal of capacitor 44. This path maintains the load relay 32 energized. At the same time the charging path for capacitor 46 is again completed from terminal 41 through contact 28, diode 50 and capacitor 46 to terminal 42. Thus, capacitor 46 is recharged to supply potential, and during this interval the relay 32 is held energized by capacitor 44.

The circuitry continues to alternate in response to the flame relay, as controlled by shutter 36, to alternately charge

capacitors

44 and 46, each capacitor having a charging path independent of the load relay 32 and a discharge path through the load relay independent of the source 40, each path including contacts of the flame relay. Should the flame 18 become extinguished or sensor circuitry fail, for any reason, to indicate flame during the open shutter period, the relay 24 will be de-energized and the load relay 32 will drop out in the time constant of the discharge circuit for capacitor 44 (a typical value being three seconds). When relay 32 drops out, contacts 34 open and de-energize valve 16 to terminate the flow of fuel into the combustion chamber 10.

Should any other component of the circuitry fail, the load relay 32 will similarly be de-energized within a predetermined time to open contacts 34, shutting down the supervising system in safe condition. For example, should a circuit component fail so that the relay 24 remains in energized position, the charge on capacitor 46 will not be replenished and the load relay will be de-ener gized within a predetermined time. (It will be noted that the time constant parameters of the discharge circuits of

capacitors

44 and 46 need not be equal. The use of a longer time constant in the discharge circuit of capacitor 46 than of capacitor 44 enables the checking cycle time to be increased.) Similarly should the circuit fail so that the contact member 26 of flame relay is not in engagement with either

contacts

28 or 30, both the capacitors will be discharging at the same time, and as soon as the total sum of their charges is equal to the supply potential, the relay will be de-energized, shutting down the system in safe condition.

Similarly, should either

capacitor

44 or 46 become defective, either in short-circuit condition, open-circuit condition, or increased leakage, the relay 32 will be deenergized. In the case of their increased leakage, the discharge time of the capacitor discharge circuit is decreased, and when it becomes less than the cycle time of the simulator shutter 36, the system will be shut down in safe condition. Likewise, if the capacitor shorts, the short will be placed directly across the line through the diode when the capacitor is directly connected and a fuse or other protective component will blow. If either

diode

48 or 50 becomes open-circuited, the capacitor to which it is connected will have no charging path; while if a diode shorts, it will shunt the current through the load relay 32 and that relay will drop out. Diode leakage will have an effect similar to capacitor leakage.

, A modified embodiment is shown in FIG. 2 in which similar components are provided: flame relay 24 having fixed

contacts

28, 30 and movable element 26', capacitors 44' and 46, diodes 48' and 50. The load relay 32', however, is divided into two sections 60, 62, and a center tap 64 between the two sections is connected to the junction 52 between the two diodes 48' and 50. The load relay 32' may be energized by current through either section 60 or 62, as these two sections constitute separate electrical loads but the magnetic flux generated by either section is common to both coils.

With the flame relay in de-energized condition, a

capacitor discharge path for capacitor 44' is provided through contact 28', junctions 52' and 64, coil section 60 and resistor 66. With the flame relay 24' in energized condition, the discharge path of capacitor 46' is completed through relay coil section 62, junctions 64 and 52' and relay contact As these two discharge circuits are independent, resistance may be introduced in one of the circuits (as at 66) to provide greater control over the discharge time of one of the capacitor discharge circuits. It will be noted that the capacitors are charged in the same manner as the embodiment shown in FIG. 1, and the load relay and resistor 66 are not conv the transient charging current of capacitor 44" plus the continuous current drawn through resistor 78.

When the transistor 70 is switched to its ofl condition, the charging path for capacitor 44" will be opened, but capacitor 46" will be charged through the path from terminal 41", resistor 78, diode 50", to terminal 42". In this circuit the discharge path of capacitor 44" includes the resistor 78, and therefore the value of resistance 78 must be much smaller than the resistance value of load relay 32". Also, the voltage drop in resistor 78 will reduce the voltage to which capacitor 46" can be charged. However, the necessary circuit parameters can be taken into account in the design of this circuitry. Transistor 70 may obviously be replaced by a single pole, single throw switch or relay. Also, either transistor 70 or resistor 78, or both, may be replaced by light dependent resistors which are operated by periodic illumination.

While several embodiments of the invention have been shown and described, still additional constructions of the invention will be obvious to those skilled in the art, and therefore it is not intended that the invention be limited to the disclosed embodiments or to details thereof, and departures may be made therefrom within the spirit and scope of the invention as defined in the claims.

What is claimed is:

1. A fail-safe circuit comprising a load,

a power source for energizing said load,

coupling circuitry for coupling power from said source to said load including two energy storage devices, first circuit means to provide a first energy transfer loop between said source and one energy storage device independent of said load and a second energy transfer loop between the second energy storage device and said load independent of said source,

second circuit means to provide a third energy transfer loop between said source and said second energy storage device independent of said load and a fourth energy transfer loop between said one energy storage device and said load independent of said source,

and means to alternately complete said first and second circuit means for transferring energy from said source through said energy storage devices to said load.

2. A fail-safe circuit comprising a load,

power supply means for energizing said load,

coupling circuitry connected between said power supply means and said load including two energy storage devices,

two asymmetrically conductive devices, and

input control means having two states,

said input control means when in a first state providing an energy coupling path for the first energy storage device from said source through a first asymmetrically conductive device and an energy coupling path for the second energy storage device through said load,

and when in a second state providing a coupling path for the second energy storage device from said source through the second asymmetrically conductive device and an energy coupling path for the first energy storage device through said load, and

means to alternate said input control means between said two states in a cycle of predetermined duration.

3. A fail-safe circuit comprising an energy source,

a load,

two energy storage devices,

two asymmetrically conductive devices connected in series with one another and in parallel with said load,

means connecting each said asymmetrically conductive device in circuit to provide a first energy transfer loop between said source and one energy storage device independent of said load and a second energy transfer loop between the other energy storage device and said load independently of said source,

and input control means connected in said loops for controlling the transfer of energy through said loops between said source and said load.

4. A fail-safe circuit comprising a load,

direct current power supply means for energizing said load,

coupling circuitry connected between said power supply means and said load including two capacitors,

two asymmetrically conductive devices, and

input control means having two states,

said input control means when in a first state providing a charging path for the first capacitor from said source through a first asymmetrically conductive device and a discharge path for the second capacitor through said load,

and when in a second state providing a charging path for the second capacitor from said source through the second asymmetrically conductive device and a discharge path for the first capacitor through said load, and

5. A fail-safe circuit comprising a load having two 5 terminals,

direct current power supply means having two terminals for energizing said load,

coupling circuitry connected between said power supply and said load including two capacitors,

means connecting one capacitor between the terminal of said supply and one terminal of said load and the other capacitor between the second terminal of said supply and the second terminal of said load,

first circuit means to connect said one terminal of said supply to said second terminal of said load,

second circuit means to connect said second terminal of said supply to said one terminal of said load,

and means to alternatively complete said first and second circuit means for transferring energy from said source through said capacitors to energize said load.

6. A fail-safe circuit comprising a load having two terminals,

two asymmetrically conductive devices,

means connecting said asymmetrically conductive devices across said load and in series with one another so that a junction is defined between them,

means connecting one capacitor between one terminal of said supply and one terminal of said load and the other capacitor between the second terminal of said supply and the second terminal of said load,

circuit means to connect said junction betwen said two asymmetrically conductive devices to the two terminals of said supply, and

means to periodically reverse the flow of energy through said circuit means for transferring energy from said supply through said capacitors to energize said load.

7. The circuit as claimed in claim 6 wherein said energy flow reversing means includes a relay having a normally open contact element connected to one of said supply terminals and a normally closed contact element connected to the other of said supply terminals.

8. The circuit as claimed in claim 6 wherein said load is an electromagnetic device having two electrical sections and a common magnetic section and further including a resistance element connected in series circuit between one of said electrical sections and one of said capacitors.

9. The circuit as claimed in claim 8 wherein said energy flow reversing means includes a control device having an output circuit and a control electrode for controlling current flow through said output circuit and means connecting the output circuit of said control device across said power supply.

10. A condition sensing system comprising a condition sensor adapted to produce an output as a function of a first sensed condition,

means to periodically modify said sensor output to simulate the sensing of a second condition,

a load adapted to provide an indication of the condition as sensed by said sensor,

a power source for energizing said load,

coupling circuitry for coupling power from said source to said load including two energy storage devices,

a first circuit means to provide a first energy transfer loop between said source and one energy storage device independent of said load and a second energy transfer loop between the second energy storage device and said load independent of said source,

and means to complete said first circuit means in response to a sensor output representative of said first sensed condition and to complete second circuit means in response to an output representative of said second sensed condition for transferring energy from said source through said energy storage devices to said load.

11. The system as claimed in claim 10 wherein each said energy storage device is a capacitor and each said capacitor is connected in series between one terminal of said power source and one terminal of said load.

12. The system as claimed in claim 11 wherein said circuit completing means includes a relay responsive to the output of said condition sensor and having a normally open contact element in one of said circuit means and a normally closed contact element in the other of said circuit means.

13. The system as claimed in claim 11 wherein said circuit completing means includes a control device having an output circuit and a control electrode for controlling current flow through said output circuit and means connecting the output circuit of said control device across said power source.

14. The system as claimed in claim 11 wherein said load is an electromagnetic device having two electrical sections and a common magnetic section and further including a resistance element connected in series circuit between one of said electrical sections and one of said energy storage devices.

15. A combustion supervision system for supervising flame in a combustion chamber comprising fuel control means,

a flame sensor,

signal modifying means coupled to said flame sensor to provide an output signal indicative of the presence of flame in the supervised combustion chamber,

means cooperating with said flame sensor and signal modifying circuitry to periodically simulate a flame absence,

a load having two terminals,

two asymmetrically conductive devices,

means connecting one energy storage device between one terminal of said supply and one terminal of said load and the other energy storage device between the second terminal of said supply and the second terminal of said load,

circuit means to connect said junction between said two asymmetrically conductive devices to the two terminals of said supply, means to periodically reverse the flow of energy through said circuit means for transferring energy from said supply through said capacitors to energize said load,

and means responsive to the energization of said load to operate said fuel control means for controlling the flow of fuel to said combustion chamber as a function of flame sensed by said sensor.

16. The system as claimed in claim 15 wherein said energy flow reversing means includes a relay responsive to the output of said flame sensor and having a normally open contact element connected to one of said supply terminals and a normally closed contact element connected to the other of said supply terminals.

17. The'system as claimed in claim 16 wherein said load is an electromagnetic device having two electrical sections and a common magnetic section and further including a resistance element connected in series circuit between one of said electrical sections and one of said capacitors.

References Cited by the Examiner UNITED STATES PATENTS 2,798,213 7/1957 Rowell.

2,824,265 2/1958 Seeger 317-151 2,825,012 2/1958 Consoliver et a1. l5828 3,146,822 9/1964 Ray l58-28 JAMES W. WESTHAVER, Primary Examiner.

Claims

1. A FAIL-SAFE CIRCUIT COMPRISING A LOAD, A POWER SOURCE FOR ENERGIZING SAID LOAD, COUPLING CIRCUITRY FOR COUPLING POWER FROM SAID SOURCE TO SAID LOAD INCLUDING TWO ENERGY STORAGE DEVICES, FIRST CIRCUIT MEANS TO PROVIDE A FIRST ENERGY TRANSFER LOOP BETWEEN SAID SOURCE AND ONE ENERGY STORAGE DEVICE INDEPENDENT OF SAID LOAD AND A SECOND ENERGY TRANSFER LOOP BETWEEN THE SECOND ENERGY STORAGE DEVICE AND SAID LOAD INDEPENDENT OF SAID SOURCE, SECOND CIRCUIT MEANS TO PROVIDE A THIRD ENERGY TRANSFER LOOP BETWEEN SAID SOURCE AND SAID SECOND ENERGY STORAGE DEVICE INDEPENDENT OF SAID LOAD AND A FOURTH ENERGY TRANSFER LOOP BETWEEN SAID ONE ENERGY STORAGE DEVICE AND SAID LOAD INDEPENDENT OF SAID SOURCE, AND MEANS TO ALTERNATELY COMPLETE SAID FIRST AND SECOND CIRUIT MEANS FOR TRANSFERRING ENERGY FROM SAID SOURCE THROUGH SAID ENERGY STORAGE DEVICES TO SAID LOAD.