GB2209075A - Relay contact checking - Google Patents

Abstract

A relay contact check circuit e.g. for burner control comprises a resistor configuration R5, R6, R7 operable as a foltage divider network and arranged to be selectively connectable dependent on the positions of the relay contacts RL2/1, RL2/2, RL3, RL4, RL5, RL6 to be checked, and voltage sensing means for detecting at least one voltage level derived from the network indicative of operation status. The voltage supplied to R7 is normally 120v, but will rise to 240v or fall to 0v if any of the contacts are in an incorrect state. The output of R7 is compared in a window comparator formed by IC5b and IC5c with upper and lower limits set by resistors R17, R19. The status of the output of the window comparator is thus a check on the relay contacts. <IMAGE>

Description

A RELAY CONTACT CHECK CIRCUIT The invention relates to a relay contact check circuit.

According to the invention there is provided a relay contact check circuit including a resistor configuration operable as a voltage divider network and arranged to be selectively connectible in dependence on the positions of the relay contacts to be checked and voltage sensing means for detecting at least one voltage level derived therefrom indicative of operational status.

The invention will now be described by way of example with reference to the accompanying drawings in which: Figure 1 shows a simplified block diagram ot one embodiment of the invention, Figure 2 shows the EPROM with addressing and data lines in more detail, Figures 3A - 3H show one arrangement for the figure 1 and 2 configurations; and Figure 4 shows a chart of EPROM addresses accessed and data stored therein for a typical burner operational sequence.

An embodiment of the system of the invention is shown in Figure 1, in simplified schematic form. In a typical as burner system there will be a requirement at start-up to ture the system, to ignite the pilot, ignite the main gas burner ana rn the system.

Monitoring of the thermostat operation, air pressure and safety checks will also be required. The arrangement shown is capable of performing these operations. A number of inputs can be received by input interfaces 10. The thermostat switching can be input for monitoring as can the air pressure switch, and if desired an external interlock circuit (if one has been provided).

A lockout reset input can also be provided via interface 11.

These inputs will, when present, typically be at mains voltage so that interfaces 10 provide mains isolation but allow their status to be transferred as a low d.c. voltage to the address bus 14. A check on the burner flame is also provided by detector 12 which will convert the status to a suitable level for bus 14. The address 14 is used to access data pre-stored within a memory device 18, in this example an erasable programmable read-only memory (EPROM). Addresses within the address area determined by the status of the various inputs can be incremented sequentially by the addresses provided on bus 15 which have been generated by oscillator 16 and address counter 17. This causes a sequence of instructions to be provided from the data outputs of EPROM 18.

These instructions control, inter alia, the system outputs including ignition, pilot, and main burner relays, which form part of the output interface 23. Buffers within the interface will receive the data from bus 20 to drive the relays.

In addition to a basic operation and detector sequence, a variety of other safety checks are performed. ..e cneck counter 13 provides a count which is compared wit ne output of the address counter 17 and checked by the parity check block 22 and if an error is detected indicative of malfunction, the lockout relay 25 is actuated. Typically relay 25 will be a bistable device, resettable as shown by the lockout reset from input 11.

In practice mechanical abuse may cause such a relay to fall out of one of these states. For safety the state into which the relay could fall is chosen as the lockout state. On lockout actuation, the fan, pilot, ignition and main burner relay contacts within output block 23 are removed from the main supply by the switched lockout relay contacts. In addition an external lockout output power signal is available for use remote from the control system, e.g. actually at the burner or for alarm actuation. Power for this operation is available from supply 24.

This supply can be made available for use with the thermostat and other remote items to allow suitable system inputs to be generated.

As described below, the fan load relay is associated with a circuit which checks the continuity of the lockout relay (set) coil as a fail-safe so as to cause deactivation of the load relay should this lockout coil become open-circuit.

A relay contact interface circuit 27 is provided to allow the status of various relay contacts to be checked, so as to discover when, through wear, any have become welded together, which is not an uncommon problem with powerful relays. The relay check circuit 28 determines whether any error is present. A frequency check circuit 29 monitors the system oscillator output 16 with an internally generated frequency and if an error is detected, then a change in status occurs and this is output to the address bus 14, so that the EPROM address area is changed and suitable instructions stored therein are implemented to curtail operation.

The relay check output from block 28 can modify the operation of frequency check circuit 29 so as to produce error detection conditions, as described below. Further failure conditions may also be determined. For example, the parity check circuit 22 may itself be subjected to test signals to determine that no circuit component has become in operative during use, which may otherwise allow a parity error to go undetected. A display 19 is provided to indicate the status of the various system outputs and inputs, some of the display inputs will come from the address bus 14 and some from the data bus 20. Where nine indicators are provided, as shown, these could display the status of thermostat, air, flame, interlock, fan, ignition, pilot, main valve and lockout.

As seen from the above description, a major component is the memory 18.

Any programmable memory of sufficient data capacity can be used for this device, e.g. ROM or PROM although an EPROM has the advantage that it could be re-programmed to perform different sequential operations.

The configuration of the EPROM is shown in Jue . It has been found that a 4096 x 8 bit EPROM (e.g. Texas te 532) provides sufficient memory requirements. Access to the memory locations is provided by 12 address lines AO - All. Thus any one of the storage addresses is accessible in dependence on the 12 bit word from buses 14 and 15. Each of the 4096 accessible addresses will allow its data content to be output as an 8 bit word from data outputs DO - D7 onto bus 20.

In effect the status of the inputs on lines A7 - All define the areas of the EPROM accessed. The counter generated binary addresses AO - A6 will sequentially increment the addresses within the memory areas defined by the inputs on the other addres lines. The 7 counter lines will allow a total of 128 address steps to be incremented. Interlock high on ne A7 will alone cause the addresses to start from location 128; A8 (relay/frequency check) from location 256; A9 (flame) from location 512; A10 (APS) from location 1024; All (Stat) from location 2048. Hence a closed thermostat on its own will access address 2048, but if a flame is present the address will be 2560 (i.e. 2048 + 512). If the air pressure switch was also input as closed then the address would increase to 3584. APS and stat alone would define address 3072. These combinations defining an address would then be incremented in single address steps up to a total of 127 additional locations. In practice one or more of the inputs on A7 - All may change status during a sequence so that the counter generated address need not be a zero when this occurs and so a higher address is accessed. As will be seen from the description below, when the external stat, APS, and interlock are closed then this causes a binary '1' which accesses the address line defined thereby. This also occurs with a detected flame. The relay/frequency check is normally '0' and changes to '1' when an error in relays or frequency occurs. In other words lower EPROM addresses are accessed during normal running.

Thereafter addresses jump by 256 locations, when A8 changes status on error detection. The prestored 8 bit words within the EPROM will effectively control system operation. Hence the least significant bit DO will control ignition when logically high.

Similarly with D1 for pilot and D2 for main gas valve. D3 is used as a check in the parity check circuit.

D4 acts as a counter reset to return the system counter to zero, when this bit is logically high. D5 is used to actuate the 'load' relay for the fan (in practice via parity check and lockout set coil as described below).

D6 provides a 'hold' signal to maintain that point in the cycle which prevents further incrementing of the address counter so freezing sequencing of the system.

D7 is a check bit used in the parity checking circuit.

A more detailed explanation is now provided with respect of Figures 3A - 3H which relate to a specific embodiment of the Figure 1 and 2 configuration.

The burner system inputs and outputs are --..m generally in Figure 3a. Mains input to the control system is ia sockets 30 32. The live rail 33 typically receives a 240v 50Hz input via fuse F1 with neutral on line 34 and earth on line 35. A socket 36 allows the mains voltage to be available for use with a variety of remote sensors. As shown schematically, sockets 37 40 will receive the rail voltage when the respective remote input is switched into a closed position. Thus when the air pressure switch is closed, the mains voltage at input socket 37 will cause the current limited by resistor R1 to be rectified by diode bridge BR1. Capacitor C1 suppresses transients. The resultant d.c. will power the light-emitting diode forming part of ICla acting as input interface 10 of figure 1.A similar situation is achieved when the mains voltage is received at -he socket 38 for the interlock with R2, BR2, C2 and IClbsbeing used. The lockout reset input to socket 39 will make use of R3, BR3, IClc and C3.

This was represented as interface 11 in figure 1. The thermostat, when closed will cause the live rail voltage to be applied to socket 40, causing ICld diode to be illuminated via R4, BR4 and C4. ICla-d is typically a 4 input standard optoisolator, the light coupled outputs being shown in Figures 3B and 3F described later.

A flame detector input is provided at sockets 42 and 43. The input will typically be provided from the rectified output of an ultra-violet (uv) cell used as the flame sensor (e.g. Sylvania P578 + diode) or by the rectification effect of a flame. The input passes to a sensor detection circuit described later with relation to Figure 3G. The system outputs are provided at sockets 45 - 49, and can be considered as part of the circuits within the blocks 25 and 23 or Figure 1.

Neutral and earth are available at socket 31 and 32 respectively.

The lockout output at socket 45 is activated when lockout relay contact RLl/l is in the opposite position to that shown in Figure 3A. The fan output at socket 46 is activated when load relay contacts RL2/1 and 2 are in the opposite position to that shown, but with Rtl/l as shown, so as to provide a series connection from rail 33. Pilot output from socket 47 operates when pilot relay contact RL3 is the position opposite to that shown, forming a series connection with RL2/1 and RLl/1. The ignition output at socket 48 operates when ignition relay contact RL4 is in the position opposite to that shown to provide a series connection with RL2/1 and RLl/l.The main valve output at socket 49 will operate when flame relay contact RL5 and main relay contact RL6 are both in positions opposite to that illustrated to provide a series connection with RL4, RL2/1 and RLl/l. Thus for example, the main valve can only be energised if a flame is present.

Resistors R5 - R7 are of high resistance so currents are too small to actuate devices via this route. The positions and actuation of the various relay coils associated with the contacts are described later.

The voltage dependent resistors VD1 - VD4 act as anti-surge devices.

Resistors R5 - R7 form the relay contact interface 27 of Figure 1 for the relay contact safety check circuit to detect welded or open contacts and are described in more detail with regard to Figure 3C, which receives the output of resistor R7.

The live rail 33 and neutral and earth 34, 35 pass to Figure 3B and are used via isolation transformer TR1 to provide a source of low voltage a.c. which is rectified by diode bridge BR5 and smoothed by capacitors C5, C6. Precise regulation is provided by a standard 3 terminal voltage regulator IC2 to provide a 5v output on rail 62 to power various circuit components including the EPROM and other IC's. The smoothed but unregulated rails 60 and 61 provide a 12v output for relays and other components. An additional lockout relay contact RL1/2 will switch the output normally provided on rail 61 to drive a LED (LD9) shown in Figure 3D, indicative of a lockout condition. To assist in 5v regulation, capacitors C7, C8 are provided between rails 62 and common rail 63. The phototransistor forms part of the optocoupler.

IClc of Figure 3A is driven via bridge BR3 and connects to the 5v rail via resistor R8 and capacitor C9. When a lockout reset input is present as described in Figure 3A, the transistor will conduct causing the input of inverter IC3a to go low and its output to go high. This inverter (e.g. 40106) has inbuilt hysteresis so it also acts as a risetime improver or noise eliminator. The high output is inverted by driver IC4a to provide a logically low output. This output, see Figure 3c causes the 'reset' coil (a) of the lockout relay RL1 to be actuated. This relay has two coils and operates as a bistable device, the 'set' coil RLl(b) being shown on Figure 3E. Contact RL1/2 associated with the reset coil is shown in the non 'lockout' or reset mode in Figure 3B.As the lockout 'reset' may be a push-button on the boiler, or any other gas burning plant which is momentarily operated manually, the 'reset' input will not be maintained, but due to the bistable nature of the relay, this is not a problem as the relay holds this state. The temporarily low output of IC4a during 'reset' will also be available via voltage divider resistors R9, R10 and capacitors C10, Cli and resistor Rll to one input of a comparator IC5a (e.g.

LM 339). A stable reference voltage from resistor network R12 Rl5 provides voltage comparison and causes the comparator to provide a reset output (5v) via diode D4 whenever the lockout is reset. This reset output is used to reset several devices described below including the counter IC12 of Figure 3H and the display driver IC6 of Figure 3D. To prevent unreliable operation due to main supply problems, IC5a will also initiate a reset if the 12v rail 60 begins to fall lowering the voltage across relay RLla. This fall from the rail 60 will be more pronounced than a fall on the 5v regulated rail 62 from which all the integrated circuit chips are powered in normal manner. Thus this part of the circuit performs several functions. It detects for low supply voltage or a lockout reset signal, resetting the counter and display.Continual powering of the lockout reset (an error condition) will hold the circuit reset, so no operations can proceed.

The relay contact check referred to as block 28 in Figure 1 is effected by comparators IC5b,c. A reference voltage is provided for each comparator by resistors R17 - R19. The input to be compared passes via a circuit comprised of diodes D1 - D3, capacitor C12 and resistor R16.

The resistors R5, R6 and R7 (of Figure 3A) together with R16 form voltage dividers which reduce the mains voltage to a few volts.

Earth rail 35 acts as circuit return connected to common rail 63 (see Figure 3B). Diode D2 rectifies this a.c. signal and capacitor C12 smooths it. This voltage is then compared with the upper and lower limit set by R17 - 19 using the comparators IC5b,c (e.g. LM 339).

From Figure 3A it is seen that all mains current for driving the outputs passes first through the lockout relay contacts RL1, then through the load (fan) contacts RL2. The lockout contacts will be in the position shown in Figure 3A unless lockout occurs; and if this happens all other outputs are disconnected. As regards RL2, the fan will operate when the contacts move to the opposite position to that shown in the Figure, and relay contacts RL3 and RL4 will also receive power when RL2 contacts move to this position (i.e. with the fan operating). The pilot will be powered up when contacts RL3 are in the position opposite to that illustrated, as will ignition when RL4 is in the opposite position to that shown.The main gas valve will be actuated when contacts RL6 (main relay) and contacts RL5 (flame relay) are in the positions to those shown as will RL4 as shown (i.e. ignition off). Because of the presence of resistor R5, the main valve will not operate when the contacts are in the position shown, as the available current will be too small. If resistors R5 and R6 are each 2.2 MI < in value, the current provided to the main gas valve will be only 55 A. R6 and R5 acting as a potential divider will provide about half the supply voltage (120v for 240v supply) when the control is in the shutdown state. When the pilot gas valve is connected (i.e. relay contact RL3 is in the opposite position to that shown), then there is a short circuit route for this current and hence the voltage provided to R7 falls to O.Similarily if relay contacts RL5 or RL6 alone are in the incorrect state then this voltage will rise to 240v. If relay contacts RL2/2, RL3 or RL4 are in the wrong state, then resistor R5 is bypassed and the output voltage falls to zero. Finally, if relay contact RL2/1 is closed the resistor R6 is bypassed and the output voltage will again rise to 240v.

If the voltage supplied to resistor R7 is thus around 120v all of the relay contacts. are in the correct state for the shutdown situation as shown in Figure 3A. If the voltage is around 240v then a fault has occurred in relay contact RL2/1, RL5 or RL6, and if the voltage is near zero then either relay contact RL3, RL4 or RL2/2 is at fault. This system therefore provides an efficient way of detecting relay faults by monitoring their status using resistor combinations in the shutdown situation so that erroneously open circuit contacts or welded (closed) contacts are detected. The voltage at the R5/R6 junction is reduced by R7 (IOM) ) and R16 (390KS2) to a few volts, rectified by diode D2 and smoothed by capacitor C12.The reference voltages set by R17 - 19 are typically 1.5v and 2.5v. With the control at shutdown, the relay check circuit should give approximately 2v and the output from the window comparator should be 'low', if the contacts are correctly positioned, and 'high' if a relay contact is an incorrect state. The relay check circuit is not itself fail-safe, and therefore needs to be checked on start up. One way to perform this check is as follows. On commencing the start up sequence, the output from the comparators is checked for a high state. Having completed this check, one style of fault is simulated and is achieved by powering the pilot output relay RL3.

Since the load relay is not powered and the first stage of the check will have proven this to be the case, the pilot relay can be operated without fear of energising the pilot output. This will have the effect of reducing the voltage on resistor R7 to zero causing the output from the comparators to go 'low'. A short delay may be required whilst C12 discharges, and then the new state of the comparators can be checked.

The pilot relay RL3 is then de-energised, and after a short delay the comparators are against checked to confirm that RL3 has indeed opened. The final stage of the checks is to power relay RL2 commencing the purge) hence simulating the second style of fault and then testing for a high voltage on R7 and a corresponding flow output from the comparators. This correctly completed sequence allows start up proper to commence. Any incorrect check will cause the comparator output via the frequency check circuit to give the incorrect A8 status so accessing a different area of the EPROM which will contain data which when output will cause lockout to be effected.

As just stated a fault condition of the relay contacts will cause the voltage applied to the comparators to result in a change of state at the comparators. This 'high' state tied via pull up resistor R20 to the rail 62 passes as an error signal to transistor Q2 of the frequency check circuit (see Figure 3G) which can be considered as block 29 of Figure 1. This transistor affects the operation of IC10 which is also part of the frequency check circuit. This integrated circuit is a phase locked loop (PLL) device (e.g. NE 567) which will track an external frequency signal with reference to an internally generated frequency. The control for this internal frequency is provided by preset resistor VR1, resistor R46 and capacitor C25 which sets the PLL centre frequency (e.g. 2KHz).

The external frequency (see also Figure 3H) is provided by the system oscillator ICll (e.g. type 4060) which can be considered as block 16 of Figure 1. This signal is received via capacitor C30. The PLL filter inputs are connected to C26 and C27. The PLL output is provided as address line A8. This is tied to rail 62 via resistor R47, and will be logically L r. the frequency is tracked as accurate (i.e. within 5%). ~~ sw ~DOp falls out of lock this means that the input frequency cr tre PLL has become incorrect or when testing the relay contacts, the comparators have detected an error causing Q2 to conduct and C24 to be included in the centre frequency setting of the PLL so causing an error signal as defined by a logically high signal on A8. So at start up, the relay contacts, the PLL and the oscillator are all checked in one test. The system.oscillator frequency is highly stable as set by the network including the crystal CR1, resistors R48, 49 and capacitors C28, C29, CR1 may be a standard 32.768KHz device.

The IC11 device includes an internal 14 stage binary ripple counter so that the basic oscillator set by the network can be obtained in binary divided frequencies from the various outputs.

Thus the clock pulses from the output Q10 are a 210 division of the basic frequency. The basic oscillator frequency (32.768KHz) results in an output from Q10 to 32Hz which after further division provides the basic EPROM timing. The input to the PLL is from output Q4 which is a 24 division of the basic frequency (i.e. 2.048KHz). The Q6 output provides a 512 Hz signal to be input to IC14d. The Q7 output (256Hz) is used as a strobe for the display. These functions are discussed in more detail later Whereas the A8 address for the EPROM is provided by the output of IC10 in Figure 3G, the address A9 is provided by the output of IC3e of Figure 3G, which together with its associated circuit components form the detector block 12 of vi~u-= ~.As already shown on Figure 3A, sockets 42 and 43 provide ne rectified input from a standard ultra-violet flame sensor at the burner or for a flame rectification probe. Resistor R41 and capacitor C21 apply a current limited mains supply to the flame sensor, the capacitor blocking d.c. The rectified U.V. cell output or the flame rectification current causes a d.c. current to flow. The only path for this d.c. is from the path provided by resistors R43, R44 and R45. A current of very small magnitude (typically 1 A) will produce a small voltage across R45 (typically 2.7v), which is detected by inverter IC3e causing this to produce a logically high output. Capacitors C22 and C23 filter out a.c. ripple and diodes D10 and D11 prevent transient voltages from damaging IC3e.

D10 also prevents the voltage on resistor R45 and capacitor C23 from going too negative so that in excess of 2 A the response of the detector remains constant. The neon prevents very high ignition voltages which may breakdown to the flame rectification probe from damaging the circuit. The device IC3e has inbuilt hysteresis to provide a positive switching action with noise elimination. While the logically high output from IC3e is indicative of flame presence, the inverter IC4f makes this output a logically low output so causing a current to flow from rail 61 so as to actuate the flame relay RL5, its switching contacts already being described with regard to Figure 3A.

The remaining inputs for address lines A7, A10, All for system control via the EPROM, as already discussed with regard to Figures 1 and 2, are shown in Figure 3F. These inputs can be considered as part of block 10 of Figure 1. Devices ICla, b and d are the photoreceiver portions of the optoisolators driven via bridges BR1, BR2 and BR4 already described in Figure 3A, viz APS, interlock and thermostat. The conducting phototransistor ICld will pulldown the voltage at the input to inverter IC3b produced by resistor R38 and capacitor C18 when the remote thermostat switch is closed, thus producing a logically high output at address line All. Device IC3b (e.g. 40106) has inbuilt hysteris to aid switching. Phototransistor ICla with resistor R39 and capacitor C19 will cause inverter IC3c to produce a logically high output at address line A10 when the remote air pressure switch is closed.

Phototransistor IClb with resistor R4q and capacitor C20 will cause inverter IC3d to produce a logically high output at address line A7 when the remote interlock switch is closed. For normal system operation the remote interlock switch will not be closed, so a logically low signal will be the norm on line A7. These address lines together with lines A8 and A9 just discussed are part of the address bus 14 shown in Figure 2. The data output lines DO - D2 on EPROM data bus 20 are also shown in Figure 3F.

The driver buffers IC4c, d and e are connected to the 12v rail 61 to allow power for driving relays RL4, RL3 and RL6 associated with ignition, pilot and main operation as described above with relation to Figure 3A with regard to contact Dperation. These relays can be considered as part of block ^- igure 1.

Referring now to Figure 3H, the DO - D2 data outputs used to control the above relays are shown coming from EPROM 18. The data line D3 on bus 20 is provided as a check bit as is output D7 and this is described in more detail below when considering the parity check circuit. Data output D4 is a reset bit which resets the check counter IC15 (e.g. type 4040) via resistor R50 and capacitor C31. It is to be noted that counters IC11 and IC15 can also be reset by the actuation of the lockout reset circuit, described above with relation to Figure 3C.

D5 is the data bit controlling the load (fan) relay after passage through a check circuit described later. As far as Figure 3H is concerned it can be seen that the signal for operating the load relay available on D5 is passed to NAND gate IC14d (e.g. 4093).

The other NAND input is from the Q6 output of oscillator ICll, so that the NAND output will be a relatively high frequency signal compared to the clock Q10 from the oscillator. This higher frequency is typically 512Hz. In practice when the D5 output is low, this high frequency signal cannot pass to the output of NAND IC14d. If D5 is high, indicative of load relay actuation, then the NAND output will be at the same frequency but inverted due to the continuous presence of the D5 output. The NAND output is also provided as one input to the parity check device IC16 (e.g.

4531), and can be considered as part of the block 22 of Figure 1.

As shown, other inputs to the counter parity check circuit are provided by the system counter IC12 outputs Al - A6 on address bus 15 and the outputs Q1 to Q6 of check counter IC15 (e.g. 4040) equivalent to block 13 of Figure 1. This binary ripple counter IC15 is clocked by the output of the parity check circuit of Figure 3E described later.The parity check device IC16 produces an output which may be either high or low depending on the parity of the combination of the inputs (i.e. whether there are an even or odd number of inputs logically high or low) so could check for example if the control sequence started erroneously part way through its normal operations sequence due to the failure of an output from IC12 or any sequencing fault occuring during operation. The output fo the counter parity check is used in the Figure 3E check circuit.

The D6 data output from the EPROM is used as a 'hold' signal, when logically high, for the counter It12. This is achieved by passing it to the ICl4c (e.g. 4093) which is a NAND gate. This causes the address counter to be held at the given address so the counter does not increment, nor does the operating sequence, whilst a 'hold' is present. This does not prevent a change in the A7 to All inputs being applied to the EPROM. The IC12 counter (e.g. 4040) is also a binary ripple counter, the outputs being taken from the Q6 - Q12 outputs. The internal frequency dividers reduce the 32Hz input from ICl4c to a basic 0.5Hz rate to the EPROM. Thus the counter output will remain 'high' for one second and low for one second before incrementing.The Q4 output (2Hz) is available for use with the display to.indicate a fault condition under the control of the lockout circuit, described in more detail below.

The EPROM data output D7 is used as a check bit ln the parity check circuit now described with reference to Figure 3E and this circuit can be considered as corresponding to a further part of block 22 of figure 1. This circuit includes a series of EXCLUSIVE - OR devices IC7a - d, IC8a - d and IC9a - d. The counter address output AO for parity checking from bus 15 passes to one input of gate IC9a (Al - A6 as described above were received by check circuit IC16 in Figure 3H). All data bits DO D7 from bus 20 are received by the gate inputs as shown in Figure 3E. Also the 512 Hz signal to actuate the load relay derived from EPROM line D5 and the NAND IC14d is received at the other input to IC7a. The step check output from parity IC16 of Figure 3H is received as one input to IC8d.Under normal operational conditions, the data inputs changing at normal system clock rates will allow a check counter clock at half the speed of that at counter IC12 to be available from the output of IC8c at its junction with capacitor C15 (e.g. 470pF) this capacitor preventing errors, due to the settling time after change of status on any EPROM output, from clocking counter IC15. One of the inputs to gate IC9b is taken from the junction of resistors R36 and capacitor C16, ultimately controlled by the output of gate IC9a. The EX - OR devices will provide a logically high signal when either input but not both are high, so under any other combination of conditions their output will be logically low.The parity check circuit is designed to check the overall parity of the EPROM data outputs, the address counter outputs, the check counter outputs and the check circuit integrity. In normal operation the check counter outputs and address counter outputs are identical so there will be parity. The output of the parity check device IC16 reflects this parity. In practice, due to the high frequency input (512Hz) this device output will provide an output changing state at the same time as the output from NAND IC14d of Figure 3H. If the counters IC12 and IC15 agree then the step check output.ICl6 will be in phase with the output from IC14d. This output from IC16 is used as a step check in the EX - OR circuit of Figure 3E.Although address parity is odd, the EPROM will have to be programmed such that the data outputs (including the check bits) of the 8 bit word in those areas of the EPROM not associated with system lockout will always have a combination of logically high outputs that are of an odd parity (i.e. 1,3,5 or 7 bits). The parity check circuit would then detect an odd parity. The load relay input to IC7a and the step check input to IC8d act as a relatively high frequency test signal to test the circuit, whenever the load relay is energised.

The signals will normally be identical in status and frequency.

However, due to the presence of R36 and C16 a slight delay is introduced to the step check input. Typically a delay of 50 Sec is introduced so that during this short period at millisecond intervals (the period of the high frequency signal) an overall even parity is introduced.

IC9c output will therefore be logically high 3 fle lockout relay set coil RLlb will not be actuated via inverting buffer/driver IC4b. Each time the load relay clock changes state this check is made. It is to be noted that the output data lines DO to D3 are preprogrammed so that their combined priority always follow the status of address line AO to maintain correct overall parity.

If the address parity of the counters is wrong due to their being out of step then the step check input will have been inverted.

If there is a fault in the EPROM data then parity will be incorrect on the data inputs. The route of the two signals at IC7a and IC8d will test each gate and thus exercise each part of the circuit. If there is a fault in any of the EX - OR gates then data will be corrupted and parity will be incorrect causing the IC9c output to be low, under any of these circumstances (i.e.

counter, EPROM or check circuit error). When IC9c goes low then the lockout coil RLl(b) is energised. This relay coil can be considered part of block 25 of Figure 1. A signal from the output of IC9d is available under lockout conditions to be used by the system display as described below. Although the 50 Sec pulses are too short to actuate the lockout set relay RLl(b) under normal operating conditions, as the mean current is very small, nevertheless this small current will be available if the load relay input to IC7a is present in the correct status (determined by EPROM output D5 bia IC14d of Figure 3H). This small current is received by detector Q1 (see Figure 3F).The detector is a high gain transistor (e.g. darlington TIP127) which produces larger current pulses to the diode pump circuit comprising resistor R37, capacitor C17 and diode D9. While the input pulses are received the transistor pulses are sufficiently large to charge the diode pump circuit so that load (fan) relay RL2 is energised and remains so. This arrangement acts as a safety check for the continuity of lockout set relay coil RLl(b).

If this coil became open circuit and incapable of actuating, then the small input current pulses would cease and de-energise the load relay so acting as a fail-safe device. In other words the lockout relay coil is checked and the load relay is normally energised by the same signal, even though this is a series of very short duration pulses. As a further safeguard, R37 ( watt, 100 ) will normally dissipate about 25mW when the load relay RL2 is actuated. During lockout, this increases to over 2 watts, during a brief period. However, if this lockout relay fails to operate , R37 will continuously dissipate this high power and eventually fail providing a fail-safe breakdown. When a lockout is instigated during normal operating conditions, such as if the flame detector indicates flame failure at address line A9, then a lockout portion of the EPROM is accessed.The data stored at that address will have been chosen to have even parity (e.g. all zeros). This will cause all outputs to be de-energised. In addition even parity will cause the parity check circuit of Figure 3E to initiate lockout by energising relay RL1(b). Under either condition lockout contacts RL1/1 of Figure 3A will switch off power available to the fan, pilot, ignition and main relays.

Contact RL1/2 of Figure 3B will switch the 12v supply from line 16 to the lockout LED, LD9 of Figure 3D. The drive of lockout relay RLlb is not continuous but is normai-.' nn with short 'off' pulses at each transition of the test signal, but this is not detected by the transmitter and hence will not charge the diode pump circuit so the load relay de-energises even if the lockout coil failed to actuate so as to provide a back up safe shutdown route.

The display configuration of Figure 3D can be considered as corresponding to block 19 of Figure 1. As just mentioned, at lockout, the diode LD9 is illuminated, which is current limited via resistor R32. The remaining display diodes LD1 - LD8 are driven by display driver device IC6 (e.g. UCN4801A) via associated limiting resistors R24 - R31. These diodes conduct when a logically high input is provided from respective address lines All - A9, A7 from bus 14 and respective data lines D5, DO D2 from bus 20. Input control is also provided by resistor R33 and capacitor C14 associated with one input of NAND gate IC14a and capacitor C13 and resistor R34 associated with its other input. This NAND is series connected with a further NAND IC14b (e.g. both Schmitt type 4093) its other input going to the positive rail 62.Two diodes D5, D6 are respectively connected to divider resistors R21, R22 and R23 and the output of NAND IC14b. The diode anodes are connected to the strobe input of the display driver. A further pair of diodes D7, D8 are connected together with resistor R35 enabling input of the display driver.

The cathode of D7 is connected to LD9 the L/O diode and the cathode of D8 receives the flash' input from address counter IC12 of Figure 3H. Display reset is provided to the 'clear' input of the driver which is provided by the output of IC5a of Figure 3c, operable when external L/O reset is actuated. The input to R33 of IC14A is provided by the lockout signal from EX OR IC9d of Figure 3E.

The input to C13 of IC14a is provided by the Q7 oscillator output of IC11 of Figure 3H acting as a display strobe.

The strobe causes the various input states of the thermostat (All), APS (A10), flame (A9) and interlock (A7) and those of the fan load (DE5), ignition (DO), pilot (D1) and main valve (D2) to be latched and displayed by the driver. This strobe updates the display once every millisecond. On receipt of a lockout signal the strobe signal is prevented by the NAND gates from updating the driver and the display retains the status it held immediately prior to lockout. However the lockout diode LD9 is illuminated via the lockout relay whilst the remaining diodes LD1 - LD8 previously illuminated will flash at the rate set by the income frequency to diode D8 from the system oscillator ICil. This display flashing will continue till reset is achieved by the external lockout reset.

It is clear from the system described in Figure 3 that a sophisticated control and safety checking configuration has been provided. As already described with regard to Figure 2 and Figure 3, the sequence of events produced at the EPROM output will be determined by the EPROM inputs and After factors to produce a comprehensive operating system.

To illustrate an example of an entire operational sequence, a typical EPROM addressing and data output sequence will now be given with reference to Figure 4.

At powering up of the system or following lockout - reset, and for the moment assuming the thermostat was open (i.e. burner not required) then the inputs A7 (interlock); A9 (flame), A10 (APS) and All (stat) will all be low to the EPROM inputs so the first address (zero) in the EPROM will be addresses due to the signal on line AO, following reset of counter IC12. The 8 bit word prestored in this location in shown in (a) of Figure 4 and this is output to the data bus DO - D7. D7 is the only active bit and maintains odd parity. After one second the counter IC12 advances, and D4 becomes active and this causes the counter IC12 to be reset, so no further addresses are accessed. This reset will therefore occur at one second intervals, each time the counter is clocked. Odd parity on the data lines ensures that lockout is not instigated.

When the thermostat is closed (as would be the normal start up condition) then the All input will cause the EPROM address to jump to that shown in (b). Thus the stored data has only D7 high, to give odd parity. If the relay contacts were in the correct start-up state then A8 would also be high causing the EPROM address to be 256 locations higher at (c) (i.e. 2304).

After counter IC12 changes state the next ~z~.C' address (i.e.

2305) will be accessed. This does not contain a reset instruction (i.e. D4 is low) and hence the counter IC12 is allowed to continue. After a further 1 second the next EPROM address (2306) is accessed, providing the relays are in the correct state and A8 is high. If a relay contact had been welded closed for example then A8 would have been low causing the EPROM address to have been 256 locations lower (i.e. 2050) at which address all 'lows' are stored for DO to D7. Such even parity will cause lockout to occur.

Assuming the correct addressing at (c) is achieved then the next address stepped after one second has D1 active so that the pilot relay is now actuated to check that its contacts close (2307).

Closure of contacts will cause A8 to go low (an error is simulated) so the address will jump tq 2051 as at (d). This location also has D1 high, maintaining the pilot relay energised, and D7 high preventing lockout. After a further one second counter IC12 advances again so that EPROM adress 2052 is accessed. If A8 had remained high because the fault had not been detected the EPROM address 2308 would be used. This again has DO to D7 stored all low, even parity causing lockout.

Assuming the correct addressing at (d) is achieved then the next address stepped after one second will be at 2053, which has D1 low so that the pilot relay is de-energised. Opening of the RL3 contacts should cause A8 to go high (the normal shut down state) so that address will jump to 2309. This location also has D1 low, and D7 high preventing lockout. When counter IC12 steps on again EPROM address 2310 is accessed, unless a fault has occured.

A fault would maintain A8 low, causing EPROM address 2054 to be used. This has DO to D7 stored all low, causing lockout.

The final stage of the start-up check sequence occurs when counter IC12 steps on again accessing EPROM address 2311, with D5 high, which operates the load (fan) relay to simulate a further relay fault. The A8 line should now go low causing EPROM address 2055 to be accessed which also has D5 high. When counter IC12 moves on one count then 2056 will be addressed if A8 is still in the correct 'low' state. If AS is high then 2312 will be addressed and lockout will occur.

Since the fan is energised the air pressure switch should now change state causing the address to increase by 1024 to 3080.

After a few second the counter IC12 will have incremented this to 3083. If air now fails to be proven the EPROM address will revert back to 2059 where D4 is high causing a reset and hence a shutdown. The steps from 3080 to 3083 allow sufficient time for the air pressure switch to change state. This status is maintained for the next 32 steps of IC12, ensuring a 32 second purge. When the address reaches 3116 DO and D1 both become high causing a jump to (f) 3628 (3116 & 512) wiich has identical data.

After 2 seconds 3630 is reached, where DO is low causing the ignition and output to be de-energised if flame is not present, A9 will be low and 3118 will be addressed causing lockout.

After a further 6 seconds address 3636 will be reached, the last step before energising the main at 3637 by making D2 high. Again should the flame fail, A9 will go low, 3125 will be addressed and lockout will occur. Step 3638 maintains D2 high for a second second, until at 3639 D1 goes low extinguishing the pilot.

Finally, one second later, 3640 is addressed with D6 high causing the system clock to hold.

If flame should dissappear A9 will go low and EPROM address (3640 - 512) 3128 will be accessed causing lockout.

If air should fail A10 will go low and EPROM address (3640 1024) 2616 will be accessed causing a reset and hence a shutdown.

If the thermostat opens, All will go low and EPROM address (3640 - 2048) 1592 will be accessed again causing a reset and hence shutdown.

Claims (4)

1. A relay contact check circuit including a resistor configuration operable as a voltage divider network and arranged to be selectively connectable dependent on the positions of the relay contacts to be checked, and voltage sensing means for detecting at least one voltage level derived from the network indicative of operation status.

2. A circuit as claimed in claim, wherein at least one of the resistors is arranged to be shorted on actuation of certain of the relay contacts to provide a further voltage change, and a second voltage sensing means is provided to detect this voltage.

3. A circuit as claimed in claim 2, wherein the voltage sensing means includes a window comparator for producing an error state when the detected voltages are outside aspredetermined range.

4. A relay contact check circuit substantially as hereinbefore described with reference to the accompanying drawings.