EP1402216A1

EP1402216A1 - Safety device for an industrial boiler comprising relays mounted on a printed circuit board

Info

Publication number: EP1402216A1
Application number: EP02738266A
Authority: EP
Inventors: Charles Jacobberger
Original assignee: Alstom Schweiz AG
Current assignee: Stein Energie Chaudieres Industrielles
Priority date: 2001-06-20
Filing date: 2002-05-17
Publication date: 2004-03-31
Anticipated expiration: 2022-05-17
Also published as: CN1518655A; FR2826433B1; CA2451033A1; DE60218310D1; US20040214119A1; CN1278072C; US7385316B2; EP1402216B1; CA2451033C; ATE354767T1; WO2003001116A1; FR2826433A1; DE60218310T2

Abstract

A safety device for an industrial boiler (CHA) including relays (REn) which are connected to form an electromechanical safety chain (CH 1 ). Each relay (REn) is mounted on a printed circuit board (CIA, CIB, CIC, CIP). As a result of the arrangement, the relays can be mounted in a compact box that may be sealed so that it is impossible for an operator to access a relay in order to block it.

Description

Safety device for industrial boilers comprising relays mounted on a printed circuit board

The invention relates to a safety device for an industrial boiler comprising electromechanical relays connected to form an electromechanical safety chain.

The invention applies in particular to industrial boilers comprising for example a gas burner for producing steam or superheated water. Such boilers are provided with a safety device which is interposed between one or more sensors and one or more actuators mounted on the boiler to trigger via the actuators a shutdown of the boiler when at least one sensor detects a malfunction of the boiler. This fault may be excessive pressure, too low water level or a problem in the burner flame.

More particularly, such a safety device is able to open a supply circuit for the actuators on detection of a fault by a sensor. The actuators, which may for example be solenoid valves, are designed to initiate a shutdown of the boiler as soon as they are no longer supplied with current by the supply circuit. Each sensor supplies an alternating electric current at 230 Volts to the safety device in the event of normal operation of the boiler and does not supply this current in the event of a fault being detected. Such an arrangement forms a so-called "positive" safety in which a break in the electrical supply triggers the shutdown of the boiler.

In this safety device, each sensor corresponds to a relay which is kept energized when it is supplied by the current supplied by the corresponding sensor and the relay contacts corresponding to the different sensors are for example connected in series to form a chain of electromechanical safety in the form of wired logic. The electrical circuit corresponding to this electromechanical safety chain is closed in the event of normal operation of the boiler and is open in the event of an anomaly in the latter. It is known in such a safety device to add to the electromechanical safety chain a so-called IT safety chain operating in parallel and redundantly to the electromechanical safety chain when the automation and regulation of the boiler become complex and require the use of an industrial programmable controller. The IT security chain is generally consisting of a data processing circuit such as a microprocessor which receives as input the electrical signals produced by the sensors and converted into computer signals at 5 volts and which feeds through a transistor controlling a relay the electrical supply circuit of the actuators . The output of the data processing circuit is for example wired in series in the electromechanical safety chain which constitutes the main safety chain.

Standards require that the proper functioning of safety sensors with their associated relays be checked periodically. This requirement entails the implementation of important provisions which are generally ensured, a part in cable relay for everything that deals directly with security and the other part by a microprocessor system for everything concerning procedures and their follow-up. . When two redundant safety chains are put in place, the second safety chain (IT) is generally processed in the microprocessor system, but the latter must be independent and distinct from any boiler control and automation device. Consequently, the measures to be taken at present and implemented are increasingly important and complicated with relays, specific cases, wiring, microprocessor systems communicating with each other only by wired electrical contacts. In addition, there are risks that an operator accidentally intervenes in the wired logic of the electromechanical safety chain during the verification of the proper functioning of the safety sensors until blocking a relay in the closed position which is very detrimental for the safe operation of the boiler.

On the other hand, the standard NF D36504 more specifically specifies (ch 4.2) that the evaluation of the operational safety of an IT security chain must be carried out by a specific test procedure, by injecting directly on the equipping errors in order to simulate an internal fault: a failure of all the memory bits taken one by one is simulated. Such a test is particularly long to execute, considerably increases the tests which precede the first commissioning of such a boiler and increases its cost accordingly.

The object of the invention is to remedy these drawbacks. To this end, the subject of the invention is a safety device for an industrial boiler comprising electromechanical relays connected to form an electromechanical safety chain, characterized in that the relays are mounted on a support in the form of a printed circuit board. With this arrangement, the electrical connections between the relays are formed by the tracks of the printed circuit so that it is no longer possible for an operator to modify the operating logic of the electromechanical safety chain. Preferably, these relays are directly soldered to a printed circuit board and the connection to the input / output boards is carried out by means of removable terminal blocks fitted with a coding device. These printed circuit boards can be mounted in a compact case, possibly sealed so that it is impossible for an operating operator to access the entire electromechanical safety chain.

According to a particular embodiment of the safety device according to the invention, current converters associated respectively with relays of the electromechanical safety chain are provided for converting an electrical signal input from a relay into an electronic signal, the electronic signals supplied by the converters being processed in a logic integrated circuit constituting with the converters an electronic safety chain redundant to the electromechanical safety chain. Such an electronic security chain satisfies the conditions of standard NF D36504 in the sense that it is possible to assess the operating safety of the electronic system, by simply stating its design, and is easier to validate by tests than an IT security chain. The logic integrated circuit is preferably a programmable circuit of the "PAL" type.

According to yet another particular embodiment of the security device according to the invention, a relay and the current converter associated with the relay are mounted on the same printed circuit board so as to obtain a compact arrangement of the security device. According to yet another particular embodiment of the safety device according to the invention, each current converter is an optocoupler so as to isolate from the electrical point of view the two electromechanical and electronic safety chains. In this way, an electrical fault in the electromechanical safety chain does not affect the operation of the electronic safety chain. According to yet another particular embodiment of the security device according to the invention, the electronic signals are converted into computer signals by means of microcontrollers to be sent to a computer security chain redundant to the electronic security chain which allows to strengthen the degree of security of the security device without increasing its complexity of implementation since this computer security chain constituting a third security chain, is not subject to the test procedures according to standard NF D36504 described above. The invention will now be described in more detail, and with reference to the accompanying drawings which illustrate an embodiment by way of non-limiting example.

Figure 1 is a very schematic representation of the invention;

Figure 2 is a very schematic representation of a printed circuit of the security device according to the invention;

Figure 3 is a very schematic representation of the arrangement of printed circuits of the device according to the invention.

As shown in FIG. 1, the device according to the invention is connected to at least one sensor PT _n and to at least one actuator EV _m which are generally mounted in the industrial boiler CHA. The PT _n sensor which is here a pressure switch sends an electric current l _n to a safety device DS which is here mounted in an electrical cabinet AE. If this current l _{n is received} , the safety device in turn sends a second electric current Jm towards the actuator EV _m which is here a solenoid valve, to maintain this actuator in a normal operating position. If the current l _n is not received, the safety device DS commands an opening relay (not shown) of the electrical supply circuit of the actuator EV to cancel the current J _m , and thus trigger the stop of the boiler. The electric currents l _n and J _m are generally high alternating currents at 230 Volts. According to the invention, the safety device DS comprises a box containing printed circuit boards hereinafter called printed circuits which form an electromechanical safety chain CH1. This box comprises one or more printed circuits on which are mounted the relays forming the first safety chain CH1, so that these relays are not interconnected by wired logic, but by conductive tracks of the printed circuits. These different circuits can thus form a compact unit enclosed in a possibly sealed housing to prevent an operator from modifying the configuration. This type of boiler generally comprises a plurality of sensors associated with a plurality of actuators, and the housing can contain, for example, several printed circuits CI _A , CI _B , Clc to manage the various sensors of the boiler, as shown in FIG. 3 Advantageously, these circuits are pinned into connectors of a card called backplane card (not shown) which is also equipped with connectors ensuring the electrical connection with the sensors and with the actuators.

In Figure 2 has been shown the printed circuit CI _B but the circuits CIA, CI _B , Clc are similar to the circuit CIB. As shown in this figure, each printed circuit CI _Al CI _B , Clc comprises a relay RE _n which is kept closed if it receives a current l _n from the corresponding sensor PT _n to form the conventional electromechanical safety chain CH1. More particularly, the circuits CI _A , CI _B , Clc have their outputs combined in a main circuit CIP visible in FIG. 3 which includes the connections forming the first safety chain CH1. This main circuit is also mounted on the backplane board. For example, it sets up the various relays RE _n of each printed circuit CI _A , CI _B , Clc in series, and controls an opening relay for the electrical supply circuit of the actuator or of the actuators of the boiler, from that one of the RE _n relays is open. As a variant, the security device could include a second security chain CH2 redundant to the first, this second chain being electronic. This electronic chain is also capable of opening the electric supply circuit of the actuator EVm to cut off its electric supply in the event of non reception of an electric current In. The advantage of electronic management for this second chain is that validation tests are simpler than in the context of computerized management. This CH2 electronic chain can be mounted in a separate box, and connected to the backplane board by specific connectors. However, it can advantageously be integrated into the printed circuits which define the electromechanical chain, as explained below. In this variant, the current In supplied by a sensor PT _n is converted in the printed circuit on which the corresponding relay RE _n is mounted by a corresponding converter OC _n into an electronic signal. This electronic signal is a direct current at 12 Volts intended to be received by a logic integrated circuit CIL to form the second safety chain CH2. The logic integrated circuit CIL can be mounted on the main printed circuit CIP of the security device DS, this main circuit itself being connected to the backplane card. Thus, the main printed circuit CIP receives the electronic signals produced by each printed circuit CIA, CI _B , Clc to control an opening relay of the electrical supply circuit of the actuator EV _m on the order of the logic integrated circuit CIL.

Such a logic integrated circuit will advantageously be produced for example with a "PAL" type circuit. These "PAL" circuits operate at 12 Volts and allow logic operators to be made between input channels and output channels at a lower cost. They are permanently configured by electrical breakdown.

In Figure 2, there is shown a printed circuit CI _A , CI _B , Clc also called electronic card receiving the current l _n from a single sensor. However, the same card can receive the currents l _n supplied by several sensors, so as to manage all the sensors of a member of the boiler such as for example the burner. In such a configuration, the card includes a relay and an optocoupler for each sensor, the relays being placed in series on the card so as to provide a single output for the electromechanical safety chain CH1. The electronic signals from the different optocouplers are then brought together through a local logic integrated circuit which is also mounted on the card CI _A , CIB, CI _C. This circuit thus provides a single electronic output signal reflecting the state of the member concerned, intended for the electronic safety chain CH2.

As a variant, the security device according to the invention may also include a third security chain CH3 redundant to the other security chains CH1 and CH2, this third chain being computer-based. In this variant, each printed circuit C1 includes a microcontroller which converts the 12 Volt electronic signal into a computer signal clocked by a clock contained in the microcontroller. This computer signal is emitted at approximately 5 Volts. As with other security chains, the various computer signals are collected by the main printed circuit CIP. This CIP circuit is equipped with a microcontroller uniting the various computer signals, and which communicates with an MP microprocessor to form the third safety chain. More particularly, the microprocessor MP also communicates with the microcontroller MCP to trigger a shutdown of the boiler on the order of the computer program for managing the third chain. The microprocessor then opens the opening relay of the supply circuit of the actuator (s) EV _m through a transistor which is mounted on the main printed circuit. An additional advantage of the invention is that this security chain which is computer-based is a third chain, so that it is not subject to the test specifications of standard NF D36504 mentioned above.

In the case of a printed circuit C1 bringing together several sensors of the same member of the boiler, the microcontroller MC of this printed circuit can be a parallel-series converter. Such a converter receives the electronic signals at 12 Volts as input from each sensor and outputs a serial computer signal clocked at 5 Volts reflecting the state of each of the sensors managed by the circuit CI _A , CIB, Clc. In this way, the microcontroller MCP of the main printed circuit is able to communicate to the microprocessor MP computer data defining the precise state of each sensor of the boiler.

As can be seen, the security device according to the invention with heterogeneous redundancy gives rise to improved compactness and to an increased degree of security since an operating operator cannot modify its configuration. In addition, the implementation of a third computer security chain makes it possible to connect the boiler to an information system giving a precise indication of the state of each boiler sensor.

Claims

1 / Safety device for an industrial boiler (CHA) comprising electromechanical relays (RE _n ) connected to form an electromechanical safety chain (CH1), each relay (RE _n ) being mounted on a support in the form of a card printed circuit (CU, CI _B , Cl _c , CIP), characterized in that current converters (OC _n ) associated respectively with relays of the electromechanical safety chain (CH1) are provided to convert an electrical input signal from a relay to an electronic signal, the electronic signals supplied by the converters being processed in a logic integrated circuit (CIL) constituting with the converters an electronic safety chain (CH2) redundant to the electromechanical safety chain (CH1).

2 / Device according to claim 1, wherein a relay (RE _n ) and the current converter (OC _n ) associated with the relay are mounted on the same printed circuit board (CI _A , CIB, Clc).

3 / The safety device according to claim 1 or 2, wherein each current converter (OC _n ) is an opto-coupler.

4 / The security device according to one of claims 1 to 3, wherein said logic integrated circuit (CIL) is a programmable circuit of the "PAL" type.

5 / The security device according to one of claims 1 to 4, wherein the electrical signals are converted via microcontrollers (MC) to be sent to a computer security chain (CH3) redundant to the security chain electronic.