Abstract:
An event detector and associated methods of protecting systems provide convenient and economical safety features. In a described embodiment, an ignition sequence detector for a boiler system has a microprocessor which is programmed so that an ignition control module of the boiler system is deprived of primary power when an improper sequence of events occurs. The ignition sequence detector includes multiple event detectors interconnected to the microprocessor, and is configured so that it is usable in high RFI environments.

Description:
This is a division, of application Ser. No. 08/982,858, filed Dec. 2, 1997, such prior application being incorporated by reference herein in its entirety. 
    
    
     BACKGROUND OF THE INVENTION 
     The present invention relates generally to systems in which it would be desirable to detect events or sequences of events and, in an embodiment described herein, more particularly provides a boiler system ignition sequence detector. 
     In many electromechanical systems, or simply electrical or mechanical systems, an event or sequence of events should occur in the normal course of operation. However, if the event or sequence of events do not occur as desired, remedial or emergency operations may need to be performed to restore the system to normal operation. Thus, a detector which is able to indicate when an event or sequence of events does not occur as desired would be very useful in these circumstances. 
     In the case of a boiler system, a desired sequence of events may be as follows: fuel is supplied to the boiler system, electrical power is supplied to the boiler system, a pilot valve is opened, a flame is ignited at a pilot burner, a thermostat indicates a need for heat, a main valve is opened, a flame is ignited at a main burner, the thermostat indicates that additional heat is not needed, the main valve is closed, etc. Several of these events are typically controlled by an ignition control module of the boiler system. For example, the ignition control module may control when the pilot valve opens, ignition of the pilot flame, opening of the main valve, etc. 
     Hazardous conditions may result if an improper sequence of events occurs in a boiler system. For example, if the main valve is opened before the pilot valve is opened, fuel may accumulate within the boiler system and lead to uncontrolled burning or explosion. As another example, if the main valve is opened before the thermostat indicates a need for heat, the boiler may become overheated. 
     In the past, simple relays have been used to ensure that a proper sequence of events has occurred in a boiler system. In this manner, for example, power could not be supplied to a main solenoid valve unless power had been previously supplied to a pilot solenoid valve and the thermostat had previously indicated a need for additional heat. Unfortunately, such types of relay networks are easily fooled and may fail to react if a sequence of events, although improper, does not occur exactly as prescribed. Additionally, such event detectors usually were constructed with relatively large and expensive mechanical latching relays. Due to the high radio frequency transmissions produced by ignition of the pilot flame, construction of a generally solid state event detector was thought to be unfeasible. 
     From the foregoing, it can be seen that it would be quite desirable to provide an event detector for electrical, mechanical, electromechanical or electronic systems which is capable of accurately detecting the occurrence of an event or sequence of events in the system, and which is suitable for use in high RFI level environments. When used in a boiler system, it would be desirable for the event detector to further be able to shut down the boiler system if an improper event or sequence of events occurs, and for the event detector to maintain the boiler system in this state until it is manually reset. It is accordingly an object of the present invention to provide such an event detector and associated methods of protecting systems. 
     SUMMARY OF THE INVENTION 
     In carrying out the principles of the present invention, in accordance with an embodiment thereof, a latching event detector is provided which uses solid state technology, utilization of which does not require a network of mechanical relays, but which is usable in high RFI environments. Methods of protecting systems are also provided. 
     In broad terms, a latching event detector is provided which includes at least one event detector, each of which is interconnected to a corresponding element of a system, so that each detector is capable of indicating when an event has occurred for its corresponding element. The output of each event detector is interconnected to a microprocessor. The microprocessor is programmed and interconnected to the system, such that the system is disabled when an improper event or sequence of events occurs. The system can be subsequently enabled by manually resetting the latching event detector while primary power is applied thereto. 
     In the disclosed and described embodiment, the event detectors are interconnected to a pilot valve, a main valve and a thermostat of a boiler system. When an improper sequence of events occurs, an ignition control module of the boiler system is disabled by removing primary power therefrom, thereby removing power from the pilot and main valves. Primary power may be restored to the ignition control module by depressing a reset switch of the latching event detector while power is supplied thereto. 
     A method of protecting boiler systems is also provided, which method includes the steps of reading the recorded state of a relay and determining whether a fault has occurred by reading the outputs of one or more event detectors. If a fault is detected, the relay is unlatched and the unlatched state is recorded in an EEPROM. Upon subsequent power-up, if an unlatched state is recorded in the EEPROM, the relay may be latched only if a reset switch is closed. 
    
    
     These and other features, advantages, benefits and objects of the present invention will become apparent to one of ordinary skill in the art upon careful consideration of the detailed description of a representative embodiment of the invention hereinbelow and the accompanying drawings. 
     BRIEF DESCRIPTION OF THE DRAWINGS 
     FIG. 1 is a schematic representation of a boiler system embodying principles of the present invention; 
     FIG. 2 is a circuit diagram of a latching event detector embodying principles of the present invention, the latching event detector being incorporated as an ignition sequence detector in the boiler system of FIG. 1; and 
     FIG. 3 is a flow chart of a method of protecting boiler systems, the method embodying principles of the present invention. 
    
    
     DETAILED DESCRIPTION 
     Representatively and schematically illustrated in FIG. 1 is a boiler system  10  which embodies principles of the present invention. The boiler system  10  is of the gas-fired type which is well known to those ordinarily skill in the art, in that it includes a boiler  12 , a burner system  14  in close proximity to the boiler for providing heat to the boiler, and a thermostat  16  for regulating the temperature of the boiler. However, the burner system  14  described herein includes features not heretofore found in conventional burner assemblies. 
     The burner system  14  includes a conventional pilot valve  18  for regulating the supply of gas to a boiler pilot (not shown). The burner system  14  also includes a conventional main valve  20  for regulating the supply of gas to a main burner (not shown). In operation, the pilot valve  18  is typically open, thereby supplying gas to the boiler pilot continuously. 
     The main valve  20  is typically opened only when the thermostat  16  indicates that heat needs to be provided to the boiler  12 . When the main valve  20  is opened, a relatively large quantity of fuel (as compared to that supplied to the boiler pilot) is supplied to the main burner, and this fuel is ignited by a flame of the boiler pilot. Thus, it will be readily appreciated that it would be very hazardous for the main valve  20  to be opened while the pilot valve  18  is closed, or while the pilot valve is open and a flame has not been ignited at the boiler pilot. For example, either of these situations could lead to accumulation of a large quantity of fuel within the burner system  14 , which fuel might be inadvertently ignited and produce an uncontrolled explosion or other combustion of the fuel. 
     In the burner system  14 , opening and closing of the pilot and main valves  18 ,  20 , and ignition of a flame at the boiler pilot is controlled using a conventional ignition module  22 . The ignition module  22  is interconnected to the pilot valve  18 , main valve  20 , and to the thermostat  16 . Power is supplied to the ignition module  22  via a power line  24  supplying, for example,  24  VAC. 
     In conventional operation, when power is initially supplied to the ignition module  22  by the power line  24 , such as when the boiler system  10  is turned on, the ignition module opens the pilot valve  18  and supplies a spark at the boiler pilot to ignite a flame at the boiler pilot. Thereafter, when the thermostat  16  indicates that heat needs to be supplied to the boiler  12 , the ignition module  22  opens the main valve  20 . 
     In an important aspect of the present invention, the burner system  14  further includes an ignition sequence detector  26 , in order to protect the boiler system  10  from an improper ignition sequence. The ignition sequence detector  26  is interconnected to the power line  24 , the thermostat  16 , and to the pilot valve  18  at their interconnections to the ignition module  22 . In this manner, the ignition sequence detector  26  is capable of monitoring whether a proper sequence has occurred, or whether a hazardous situation may be presented. 
     If a fault in the ignition sequence is detected by the ignition sequence detector  26 , the ignition sequence detector will prevent power from being supplied to the ignition module  22  by the power line  24 . In addition, the ignition sequence detector  26  will remain latched in this state, even if power is removed from the power line  24  and then restored. When latched to prevent power from being supplied to the ignition module  22 , the ignition sequence detector  26  will subsequently permit power to be supplied to the ignition module only if it is manually reset while power is present on the power line  24 , for example, by depressing a switch  28  connected to the ignition sequence detector. 
     Referring additionally now to FIG. 2, a circuit diagram of a latching event detector  30  embodying principles of the present invention is representatively illustrated. The latching event detector  30  is described herein as it may be used for the ignition sequence detector  26  of the boiler system  10  described above. However, it is to be clearly understood that the latching event detector  30  may be used in other systems, and other types of systems, without departing from the principles of the present invention. 
     The latching event detector  30  includes a power supply circuit  32 , a programmable microprocessor U 1 , three event detector circuits  34 ,  36 ,  38 , a relay K 1 , interconnected relay driver circuits  40 ,  42 , a reset switch SW 1 , a single shot circuit  46 , a clock circuit  48 , and a watchdog circuit  50 . The power supply circuit  32  receives primary power from the power line  24  at terminals  1  and  3  of a connector P 1 . The clock circuit  48  provides the basic system clock at pins  15 ,  16  of the microprocessor U 1 . 
     The event detector circuit  34  is connected to terminal  3  of a connector P 3 , which is connected to a line  52  connected between the ignition module  22  and the pilot valve  18 . Voltage present on terminal  3  of connector P 3  provides an indication that the pilot valve  18  is open, and the output of the event detector circuit  34  (at pin  6  of U 3 ) will be low. When voltage is not present on terminal  3  of connector P 3 , the pilot valve  18  is closed, and the output of the event detector circuit  34  will be high. The output of the event detector circuit  34  is connected to pin  8  of the microprocessor U 1 , and to the base of transistor Q 2  of the relay driver  40 . 
     The event detector circuit  36  is connected to terminal  6  of the connector P 3 , which is connected to a line  56  for supplying power to the ignition module  22 . Voltage present on terminal  6  of the connector P 3  provides an indication that primary power is available for supply to the ignition module  22 , and the output of the event detector circuit  36  (at pin  2  of U 3 ) will be low. When voltage is not present on terminal  6  of connector P 3 , primary power has been lost, and the output of the event detector circuit  36  will be high. The output of the event detector circuit  36  is connected to pin  6  of the microprocessor U 1 , and to the base of transistor Q 2  of the relay driver  40 . 
     The event detector circuit  38  is connected to terminal  7  of the connector P 3 , which is connected to a line  54  connected between the thermostat  16  and the ignition module  22 . Voltage present on terminal  7  of the connector P 3  provides an indication that a switch of the thermostat is closed, and the output of the event detector circuit  38  (at pin  4  of U 3 ) will be low. When voltage is not present on terminal  7  of connector P 3 , the thermostat switch is open, and the output of the event detector circuit  38  will be high. The output of the event detector circuit  38  is connected to pin  7  of the microprocessor U 1 , and to the base of transistor Q 2  of the relay driver  40 . 
     Note that an output of each of the event detectors  34 ,  36 ,  38  is connected to the relay driver  40 . If any one of the event detectors  34 ,  36 ,  38  indicates a fault, transistor Q 2  will conduct, thereby disconnecting ground from the power supplied (between VCC and ground) to the relay K 1 . When the relay K 1  is no longer powered (i.e., “unlatched”), the 24 VAC power source on terminal  6  of a connector P 4  (connected to K 1  pin  9 ) is no longer electrically connected to terminal  6  of the connector P 3  (connected to K 1  pin  13 ), which is connected to the line  56  for supplying power to the ignition module  22 . Thus, when any one of the event detectors  34 ,  36 ,  38  indicates a fault, the burner assembly  14  is disabled by unlatching the relay K 1 , and the pilot and main valves  18 ,  20  will be closed, thereby preventing a potentially hazardous accumulation of fuel. Pins  4  &amp;  6  of K 1  are connected to terminals  1  &amp;  2  of a connector P 5 , which may optionally be used as an external indicator of the state of K 1 , such as by connecting the terminals to the contacts of an external relay (not shown). 
     As used herein, the term “latched” is used to indicate that power is supplied to the relay K 1  by the latching event detector  30  circuits, transistor Q 3  is conducting, and thereby connecting K 1  pins  9  and  13  (as well as pins  4  and  8 ) and supplying power to the ignition module  22 . The term “unlatched” is used to indicate that power is not supplied to the relay K 1  by the latching event detector  30  circuits, transistor Q 3  is not conducting, and power is not supplied to the ignition module  22 . 
     The outputs of the event detectors  34 ,  36 ,  38  are also connected to terminals  6 ,  7  and  8  of the microprocessor U 1 . The microprocessor U 1  is programmed, using conventional methods well known to those of ordinary skill in the art, to detect when certain sequences of events occur, and to produce certain outputs when corresponding detected sequences do occur. For example, if the ignition module  22  is powered (24 VAC is present at terminal  6  of connector P 3 ), and the thermostat  16  switch is closed (24 VAC is present at terminal  7  of connector P 3 ), but the pilot valve  18  goes from on to off (24 VAC is present, and then removed from terminal  3  of connector P 3 ), the microprocessor U 1  program will cause its pin  5  to go from high to low, thereby unlatching the relay K 1  and disabling the burner system  14 . This is due to the fact that the microprocessor U 1  pin  5  is connected to the base of transistor Q 3  of the relay driver  42 . Note that the microprocessor U 1  program can also cause its terminal  9  to go high, thereby causing transistor Q 4  to conduct, to thereby unlatch the relay K 1 . 
     Terminals  3  &amp;  4  of the connector P 2  may be connected to an external LED (not shown) for providing an external indication that a fault has occurred. For this purpose, the microprocessor U 1  program causes its pin  3  to go high when a fault has been detected, thereby causing transistor Q 1  to conduct. An internal indication is provided by an LED D 2 . The external indication is optional, and the internal indication may still be provided, even if no external indication is desired, by directly connecting terminal  3  to terminal  4  of the connector P 2 . 
     The microprocessor U 1  is connected to a conventional EEPROM U 2 , which records when the relay K 1  has been latched and unlatched. The microprocessor U 1  is, thus, able to “remember” the state of the relay K 1 . In the event that power supplied to the latching event detector  30  is interrupted, the microprocessor U 1  will have the state of the relay K 1  in its memory when the power is restored. 
     In order to reset the relay K 1  from its unlatched to its latched state, the switch SW 1  is momentarily depressed while primary power is being supplied to the latching event detector  30  on line  24 . Closing of the switch SW 1  causes the single shot circuit  46  to output a pulse to the microprocessor U 1  at its pin  2 . The EEPROM U 2  is made to record a latched state of the relay K 1  when the pulse is received by the microprocessor U 1 . The microprocessor U 1  program makes pin  3  go high if the EEPROM U 2  has a latched state of the relay K 1  recorded on initial power-up, that is, when primary power is initially supplied on line  24 . 
     The watchdog circuit  50  outputs a low frequency signal to pin  1  of the microprocessor U 1 . Pin  1  is the reset pin of the microprocessor U 1 . 
     The microprocessor U 1  is programmed to produce a 1 KHz clock signal on its pin  9 , which pulses the base of a transistor Q 5 , causing it to discharge a capacitor C 13  and hold the output on pin  12  of U 3  high. This clock signal is coupled through a capacitor C 6  to a network  58 . The network  58  produces a negative voltage from the clock signal, which is connected to the base of a transistor Q 4 . The negative voltage holds the transistor Q 4  off, thereby allowing the signal on pin  5  of the microprocessor U 1  to drive the base of the transistor Q 3  of the relay driver  42 . 
     If the microprocessor U 1  fails, or its program otherwise fails to execute properly, the 1 KHz clock signal will no longer be present on its pin  9 . Lack of the clock signal on pin  9  will cause Q 4  to conduct (the junction of R 16  and C 7  no longer being held low), thereby preventing the transistor Q 3  from conducting, and unlatching the relay K 1 . Thus, the network  58  provides “fail safe” operation of the microprocessor U 1 , i.e., if the microprocessor fails, the relay K 1  is unlatched. 
     When power is first supplied on Line  24 , the relay K 1  is unlatched and no power is supplied to terminal  6  of the connector P 3 . Thus, no power is supplied to the ignition module  22  on line  56 . There are no signals input to the event detectors  34 ,  36 ,  38 , so their outputs are all high. The transistor Q 2  of the relay driver  40  is turned on, pulling the anode of diode D 11  low and disconnecting resistor R 14  from the base of transistor Q 3  of the relay driver  42 . At this point, only the signal on pin  5  of the microprocessor U 1  can turn the relay K 1  on, and pin  5  will go high only when the microprocessor&#39;s program causes it to go high based on the data recorded in the EEPROM U 2 . If the microprocessor U 1  fails to operate properly, for example, if it fails to execute its program, the outputs of the event detectors  34 ,  36 ,  38  will still hold transistor Q 3  off. Thus, on initial power-up, pin  5  is high if a latched state of the relay K 1  is recorded in the EEPROM U 2 , and pin  5  is low if an unlatched state of the relay K 1  is recorded in the EEPROM. 
     A circuit  60 , including diodes D 16 , D 17 , resistors R 20 , R 21  and capacitor C 11  produces a 60 Hz clock signal. This clock signal is input to the microprocessor U 1  at its pin  4 . Reading of the event detector circuit outputs at pins  6 ,  7 ,  8  is controlled by the clock signal, as is the switching of the signal on pin  5 . In this manner, the detector  30  is “debounced” and false triggering due to noise is prevented. Such noise may be produced by a large quantity of RFI generated by a high voltage arc at the boiler pilot as the ignition module  22  attempts to ignite a flame. The wiring interconnecting the ignition module  22  and the latching event detector  30  carries this RFI to the latching event detector. Without the 60 Hz clock signal produced by the circuit  60 , the relay K 1  would chatter due to the noise disturbing the proper functioning of the microprocessor U 1 . 
     Thus, in a normal operating state of the boiler system  10 , all three event detectors  34 ,  36 ,  38  produce low outputs, which are input at pins  8 ,  6 ,  7 , respectively of the microprocessor U 1 . Transistor Q 2 , therefore, is nonconducting and the relay K 1  may be latched on by current flow through resistor R 14 . 
     If any one of the inputs to the event detectors  34 ,  36 ,  38  is turned off, that is, if primary power is disconnected from the ignition module  22 , the pilot valve  18  is closed, or the thermostat  16  switch opens, the base of Q 2  is powered and the junction of R 14  and D 11  is pulled low. At this point, the microprocessor U 1  program produces appropriate output, based on which of the inputs on its pins  6 ,  7 ,  8  are high and which are low, and the order in which they changed. For example, if the thermostat  16  switch cycles from closed to open, while the ignition module  22  remains powered and the pilot valve  18  remains open, Q 2  will conduct, but the output on pin  5  of U 1  will remain high and the relay K 1  will remain latched. 
     If, however, the microprocessor U 1  program detects a “fault”, i.e., an improper event or sequence of events at its inputs  6 ,  7 ,  8 , the program will cause the output on pin  5  of U 1  to go low, thereby unlatching the relay K 1 . Additionally, the program will write an “unlatched” state of the relay K 1  to the EEPROM U 2 . 
     The following is an example of an improper sequence of events, which may be detected as a fault by the microprocessor U 1  program. With the boiler system  10  in its normal operating state, K 1  is latched and power is supplied to the ignition module  22  at terminal  6  of connector P 3 . With the thermostat  16  switch closed, power is supplied to terminal  7  of connector P 3  and to the thermostat input of the ignition module  22  on line  54 . The ignition module  22  supplies power to the pilot valve  18  on line  52 , which is also connected to terminal  3  of connector P 3 . If the ignition module  22  fails to sense a flame at the pilot burner, it turns off the power to the pilot valve  18 . When the microprocessor U 1  senses this sequence of events, the program causes the output on its pin  5  to go low, thereby unlatching the relay K 1 . The program also writes this unlatched state in the EEPROM U 2 . 
     When power is initially applied at terminals  1  &amp;  3  of connector P 1 , transistor is nonconducting and, therefore, transistor Q 3  is nonconducting and relay K 1  is unlatched. No power is supplied to any of the event detector  34 ,  36 ,  38  inputs, so transistor Q 2  conducts and resistor R 14  is effectively disconnected from the base of transistor Q 3 . The microprocessor U 1  reads the EEPROM U 2  and determines whether pin  5  of U 1  should be high or low (based on whether the relay K 1  was latched or unlatched at power-down as recorded in the EEPROM; the actual state of relay K 1  is irrelevant). The microprocessor U 1  also produces the 1 KHz clock signal on its pin  9 , thereby making transistor Q 4  nonconducting. Thus, if U 1  pin  5  is high, relay K 1  turns on and power is supplied to connector P 3  terminal  6 , powering the ignition module  22  and making the output of event detector  36  low. When the ignition module  22  supplies power to the pilot valve  18 , the output of event detector  34  goes low. When the thermostat  16  switch closes, the output of event detector  38  goes low. With all three of the event detectors  34 ,  36 ,  38  having low outputs, Q 2  is nonconducting and resistor R 14  is effectively connected to the base of transistor Q 3 . As long as all three outputs of the event detectors  34 ,  36 ,  38  are low (as is the case in the normal operating state of the boiler system  10 ), Q 2  remains nonconducting and the base of transistor Q 3  remains powered, even though normal operation of the microprocessor U 1  may be momentarily interrupted, for example, by RFI generated when the ignition module  22  generates an ignition spark at the pilot burner. 
     Referring additionally now to FIG. 3, a method  61  of protecting the boiler system  10  is schematically illustrated. In step  62 , power is initially supplied to the latching event detector  30  and the microprocessor U 1  is initialized (i.e., a programmed reset or initialization program is executed). The latched or unlatched state of the relay K 1  is then read from the EEPROM U 2 . If a latched state of the relay K 1  is recorded, U 1  pin  5  is caused to go high in step  66 , and the method  61  proceeds to step  76 . 
     If an unlatched state of the relay K 1  is recorded in U 2 , U 1  pin  5  is made to go low, and the method  61  will proceed no further unless the reset switch SW 1  is closed. Thus, if the EEPROM U 2  records an unlatched state of the relay K 1 , merely turning the power off and then back on will not result in the relay K 1  being latched. In step  70  the reset switch SW 1  is closed, causing U 1  pin  5  to go high in step  72 , and causing the EEPROM U 2  to record a latched state of the relay K 1  in step  74 . The method  61  then proceeds to step  76 . 
     In step  76  the outputs of the event detectors  34 ,  36 ,  38  are read at U 1  pins  6 ,  7 ,  8 . If a fault is detected, U 1  pin  5  is made to go low in step  78  and an unlatched state of the relay K 1  is recorded in the EEPROM U 2  in step  80 . If no fault is detected in step  76 , U 1  pin  5  is maintained high in step  82  and the latched state of the relay K 1  is recorded or maintained in the EEPROM U 2  in step  84 . Periodically, the outputs of the event detectors  34 ,  36 ,  38  are again read, so that any subsequent fault will be detected and, in the event of a fault, the relay K 1  will be unlatched and the unlatched state recorded in the EEPROM U 2 . 
     In parallel with the fault detection routine, a clock signal is produced at U 1  pin  9  in step  86 . If the clock signal is not present on U 1  pin  9 , the fail-safe network  58  causes the relay K 1  to unlatch in step  88 . Subsequent power-downs and power-ups will not cause the relay K 1  to latch, as long as there remains no clock signal at U 1  pin  9 . 
     Of course, a person of ordinary skill in the art would find it obvious to make modifications, additions, deletions, substitutions, and other changes to the boiler system  10 , latching event detector  30 , and method  61 . Accordingly, the foregoing detailed description is to be clearly understood as being given by way of illustration and example only, the spirit and scope of the present invention being limited solely by the appended claims.