Method for safety-oriented control

Abstract

A method for the safety-oriented control of at least one final control element of at least one electrically actuated gas valve, which is switched by means of two relays connected in series, wherein the final control element is activated only if the first relay and the second relay are tripped, wherein a flow of current over the first relay is monitored by a first monitoring device, a flow of current over the second relay is monitored by a second monitoring device, and a control device is programmed in such a way that the final control element is activated by tripping the two relays only if both the first monitoring device and the second monitoring device report to the control device that there is no flow of current before the activation.

1 . A method for the safety-oriented control of at least one final control element of at least one electrically actuated gas valve, which is switched by means of two relays connected in series, wherein the final control element is activated only if the first relay and the second relay are tripped,
 wherein
 a flow of current over the first relay is monitored by a first monitoring device, 
 a flow of current over the second relay is monitored by a second monitoring device, and 
 a control device is programmed in such a way that the final control element is activated by tripping the two relays only if both the first monitoring device and the second monitoring device report to the control device that there is no flow of current before the activation. 
   
     
     
         2 . The method according to  claim 1 , wherein, in the event of a fault in at least one of the two relays and/or in at least one of the two monitoring devices, the final control element is switched to a safe state blocked for further control. 
     
     
         3 . The method according to  claim 2 , wherein information relating to the relay and/or the monitoring device in which the fault occurs is stored by means of the control device, wherein the information is stored secure against power failure. 
     
     
         4 . The method according to  claim 3 , wherein the safe state is removed and a renewed control of the final control element is enabled by means of a reset of the control device. 
     
     
         5 . The method according to  claim 4 , wherein, after the control device has been reset, the relay in respect of which the information has been stored is always tripped first. 
     
     
         6 . The method according to  claim 1 , wherein the two relays for activating the final control element are closed by the control device in succession, with a delay of 10 ms to 500 ms. 
     
     
         7 . The method according to  claim 1 , wherein the two relays for deactivating the final control element are opened by the control device in succession, with a delay of 10 ms to 500 ms. 
     
     
         8 . The method according to  claim 1 , wherein a tripping under load is divided by the control device between the first and second relay in such a way that the first and the second relay have roughly the same number of tripping actions that are performed under load over the service life of the apparatus and in total. 
     
     
         9 . The method according to  claim 1 , wherein a fault in the form of a fused relay contact is identified by means of the control device in that, despite a switched off relay, a signal from the monitoring device corresponding to the switched off relay is detected. 
     
     
         10 . The method according to  claim 1 , wherein a fault in the form of a defective relay or a fault in the form of a defective monitoring device is identified by means of the control device in that, despite a switched on relay, a signal from the monitoring device corresponding to the switched on relay is not detected. 
     
     
         11 . The method according to  claim 1 , wherein a fault in the form of a fused relay contact in combination with a defective monitoring device is identified by means of the control device in that, in the event of a change in the switching state of the relay no change in the signal of the corresponding monitoring device is detected. 
     
     
         12 . The method according to  claim 1 , wherein either the first relay is operated in an external conductor of the final control element and the second relay is operated in a neutral conductor of the final control element, or that the first relay and the second relay are operated in an external conductor of the final control element, or that the first relay and the second relay are operated in a neutral conductor of the final control element. 
     
     
         13 . The method according to  claim 1 , wherein at least one monitoring device is operated by means of voltage feedback from an optocoupler contact. 
     
     
         14 . A system comprising:
 at least one final control element of an apparatus, wherein the final control element is designed as an electrically actuated gas valve,   a first relay and a second relay, wherein the final control element is activated only if the first relay and the second relay are tripped,   a first monitoring device by which a flow of current across the first relay is monitored,   a second monitoring device by which a flow of current across the second relay is monitored, and   a control device which is programmed in such a way that the final control element is activated by tripping the two relays only if both the first monitoring device and the second monitoring device report to the control device that there is no flow of current before the activation of the final control element.   
     
     
         15 . The method according to  claim 2 , wherein the final control element is switched to a safe state blocked for further control by closing the gas valve. 
     
     
         16 . The method according to  claim 3 , wherein the information is stored by means of an EEPROM storage module. 
     
     
         17 . The method according to  claim 4 , wherein the renewed control of the final control element is enabled by a manual reset. 
     
     
         18 . The method according to  claim 6 , wherein the delay is around 100 ms. 
     
     
         19 . The method according to  claim 7 , wherein the delay is around 100 ms. 
     
     
         20 . The method according to  claim 13 , wherein the at least one monitoring device is operated by means of voltage feedback from a forcibly guided double contact.