SAFETY CONTROLLER FOR AN ACTUATOR

Abstract

The invention relates to a safety controller for an actuating drive (2.1, 2.2, 2.3) for controlling a gas flow or a liquid flow in an open-loop or closed-loop manner by means of a flap (3.1, 3.2, 3.3) or a valve, in particular in the field of heating, ventilation, and air conditioning (HVAC) systems, fire-protection systems, and/or room protection systems. A safety circuit (9.1, 9.2, 9.3) is implemented to ensure the energy supply in a safety operating mode if an electricity supply circuit (8.1, 8.2, 8.3) drops off or is lost. A control value output circuit (1.1, 1.2, 1.3) detects status signals, in particular signals of a sensor (11.1, 11.2, 11.3), and/or status parameters of a system and/or a specifiable setting of an adjustment device that can be actuated manually. The safety control value is set to one of at least two different control values (SW1, SW2, . . . ) depending on the status signals so that the safety position of the flap is determined adaptively.

Claims

1. A safety controller for an actuator, in particular for an actuator having an actuating drive (2.1, 2.2, 2.3) with a flap (3.1, 3.2, 3.3) or a valve for open-loop or closed-loop control of a gas or liquid flow, in particular for use in an installation for heating/ventilation/air conditioning (HLK), fire protection and/or area protection, having a setpoint output circuit (1.1, 1.2, 1.3) which outputs a safe setpoint (SSW), which defines a safe position of the actuator, for the actuator, characterized in that the setpoint output circuit (1.1, 1.2, 1.3) has at least one input (E1, . . . , E4) for a variable state signal, and in that it is designed to set the safe setpoint (SSW) to one of at least two different setpoints (SW1, SW2, . . . ) as a function of said state signal.

2. The safety controller as claimed in claim 1, characterized in that the safety controller comprises a controller (10), which comprises an input for a voltage drop signal or a detector for a voltage drop of an external current feed circuit (8.1, 8.2, 8.3) and has a safety mode in which, in the event of a predetermined voltage drop, the actuator (2.1, 2.2, 2.3) is moved with the aid of an electrical energy store (30), in particular a capacitive energy store, to the safe position which corresponds to the safe setpoint (SSW) which is output by the setpoint output circuit (1.1, 1.2, 1.3).

3. The safety controller as claimed in claim 1 or 2, characterized in that the safety controller comprises a sensor (11.4) which is connected to the at least one input (E3) for the variable state signal such that the safe setpoint (SSW) is fixed to one of the at least two different setpoints (SW1, SW2, . . . ) as a function of a signal from the sensor (11.4).

4. The safety controller as claimed in one of claims 1 to 3, characterized in that an installation parameter module (12) is connected to the input (E1) for the state signal such that the safe setpoint is fixed as a function of at least one parameter value of the installation control unit (12).

5. The safety controller as claimed in one of claims 1 to 4, characterized in that a manually operable adjusting apparatus (13) is connected to the input (E4) for the state signal, such that the safe setpoint is fixed as a function of an instantaneous position of the adjusting apparatus (13).

6. The safety controller as claimed in one of claims 1 to 5, characterized in that the safety controller has a data interface (E2) for access to a server (15), and in that the safe setpoint is fixed as a function of at least one parameter value of the server (15).

7. The safety controller as claimed in one of claims 2 to 6, characterized in that the safety controller comprises a capacitive energy store (30), and in that the controller (10) is integrated in a microprocessor (16) for controlling the energy store (30).

8. The safety controller as claimed in one of claims 2 to 7, characterized in that the safety controller comprises a drive controller (6.3).

9. The safety controller as claimed in one of claims 3 to 8, characterized in that the sensor (11.1, 11.2, 11.3) is a gas sensor, a smoke sensor, a temperature sensor, an air-pressure sensor and/or a flow sensor.

10. The safety controller as claimed in one of claims 1 to 9, characterized in that a time module (17) is provided in order to determine the safe setpoint (SSW) as a function of time, in particular as a function of the time of day, the day of the week and/or the season.

11. The safety controller as claimed in one of claims 1 to 10, characterized in that the safety controller has a delay circuit (18) in order to change to the safety mode only after a delay time has elapsed in the event of absence or failure of the current feed circuit (8).

12. An actuator having an actuating drive (2.1, 2.2, 2.3) for positioning of a flap (3.1, 3.2, 3.3) or of a valve for open-loop or closed-loop control of a gas or liquid flow, in particular for use in an installation for heating/ventilation/air conditioning (HLK), fire protection and/or area protection, characterized by a safety controller as claimed in one of claims 1 to 11.

13. A safety circuit (1.4) having a capacitive energy store (30), a detector (27) for a voltage drop of an external current feed circuit (8.1, 8.2, 8.3) and a controller (10), characterized by a safety controller as claimed in one of claims 1 to 11.

14. An installation for open-loop and/or closed-loop control of heating/ventilation/air conditioning (HLK) and/or for fire protection and/or room protection, having at least one actuating drive (2.1, 2.2, 2.3) and a flap (3.1, 3.2, 3.3), which is driven thereby, or a valve for open-loop or closed-loop control of a gas or liquid flow, characterized by a safety controller as claimed in one of claims 1 to 11.

15. The installation as claimed in claim 14, characterized in that the installation comprises at least one sensor (11.1, 11.2, 11.3) externally from the actuating drive (2.1, 2.2, 2.3).

16. The installation as claimed in claim 14 or 15, characterized in that an installation parameter module is connected to the input for the state signal, such that the safe setpoint (SSW) is fixed as a function of at least one installation parameter value, with the at least one installation parameter value being, in particular, a pressure value, a temperature value, a flow value.

17. A method for operation of an installation for open-loop and/or closed-loop control of heating/ventilation/air conditioning (HLK) and/or for fire protection and/or area protection having the following steps: a) detection of a state signal; b) fixing of the safe setpoint as a function of the state signal to one of at least two different setpoints; c) detection of absence or failure of a current feed circuit and d) if required, initiation of a safety mode, in which the actuator is moved to a safe position, corresponding to the safe setpoint.

18. The method as claimed in claim 17, characterized in that the state signal is detected and the safe setpoint is fixed during normal operation of the installation.

19. The method as claimed in claim 17 or 18, characterized in that the state signal consists of at least one installation parameter value.

20. The method as claimed in one of claims 17 to 19, characterized in that the safe setpoint (SSW) is determined as a function of time, in particular as a function of the time of day, the day of the week and/or the season.

21. The method as claimed in one of claims 17 to 20, characterized in that a plurality of sensor signals are detected by sensors (11.1, 11.2, 11.3, . . . 11.n), which are arranged within and/or externally from the actuating drive.

22. The method as claimed in one of claims 17 to 21, characterized in that, in the event of absence or failure of the current feed circuit (8.1, 8.2, 8.3), the safety mode is initiated only when the absence or failure remains throughout a predetermined minimum time interval.

23. A computer program product for carrying out the method as claimed in one of claims 17-22.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

[0065] In the schematic drawings which are used to explain the exemplary embodiment:

[0066] FIG. 1 shows an HLK installation with a safety controller according to the invention;

[0067] FIG. 2 shows a safety controller for a plurality of state signals;

[0068] FIG. 3 shows a safety circuit with a capacitive energy store and a safety controller; and

[0069] FIG. 4 shows a flowchart for definition of an actuating parameter.

[0070] In principle, the same parts are provided with the same reference symbols in the figures.

Approaches to Implementation of the Invention

[0071] The embodiment of the invention described in the following text relates to a flap for controlling a gas flow in a ventilation channel. It can be transferred directly, and used analogously, to and for a valve for controlling a liquid flow in a liquid pipe. An apparatus for controlling an air flow is known from EP 2 052 191 (Belimo). A ball valve for controlling a liquid flow is known, for example, from EP 1 924 793 (Belimo). Installations and apparatuses such as these can be provided with the controller according to the invention.

[0072] The flap 3 is arranged within the ventilation channel 4 and, for example, can rotate about an axis, such that the gas flow in the ventilation channel 4 can be restricted by rotation of the flap 3. Depending on the position, the flap 3 can entirely release the gas flow in the ventilation channel 4 or can partially to entirely suppress it, that is to say the flap 3 can be adjusted from a maximum opening of 100% to complete closure. This makes it possible to adjust the air flow in a heating or ventilation system, in order to control the supply or extraction of, for example, fresh air, hot air or exhaust air.

[0073] The modules mentioned in the following text may in general be in the form of integrated components, that is to say ASICs, or in the form of a software program which can run on a processor.

[0074] FIG. 1 shows a circuit diagram of an HLK installation having a plurality of ventilation channels 4.1, 4.2, 4.3, in which the through-flow of air is monitored and controlled by flaps 3.1, 3.2, 3.3 in a form known per se. The flaps 3.1, 3.2, 3.3 are operated by a respective actuating drive 2.1, 2.2, 2.3. Each actuating drive 2.1, 2.2, 2.3 comprises a respective electric motor 5.1, 5.2, 5.3 and a step-down transmission 7.1, 7.2, 7.3. The motor controls 6.1, 6.2, 6.3, which are preferably accommodated with the electric motor and transmission in a common housing, are electrically connected to a current feed circuit 8.1, 8.2, 8.3, which circuits are attached to the general power supply system and, during normal operation, provide the electrical power for operation of the actuating drives 2.1, 2.2, 2.3. A safety circuit 9.1, 9.2, 9.3 is respectively inserted between the current feed circuit 8.1, 8.2, 8.3 and the actuating drive 2.1, 2.2, 2.3 and provides the necessary spare energy to move the flap to the safe position in the event of an electrical power failure or power cut of the current feed circuit 8.1, 8.2, 8.3. The safety circuits 9.1, 9.2, 9.3 can be designed subject to matching according to the invention (as is indicated at 9.3 in FIG. 1 and as explained in the following text), as described in WO 2007/134471.

[0075] An installation control unit 23 is provided for open-loop and closed-loop control during normal operation and is connected for control purposes to the motor controller 6.1, 6.2, 6.3 (dashed line).

[0076] FIG. 1 shows three different embodiment variants of the invention. In a first variant, the setpoint output circuit 1.1 is accommodated in the safety circuit 9.1. As can be seen from FIG. 1, the setpoint output circuit 1.1 can be connected to an installation parameter module 12, which is integrated in the central installation control unit 23, and to a local sensor 11.1. The setpoint output circuit 1.1 in this example therefore has two inputs, to which state signals (installation parameter values, sensor values) are supplied.

[0077] In a second variant, the setpoint output circuit 1.2 is integrated in the motor controller 6.2. In this case as well, a signal from a sensor 11.2 is provided as a further input. In this variant, the safety circuit 9.2 may be designed conventionally.

[0078] In the third variant, the setpoint output circuit 1.3 is contained in the central installation control unit 23. The sensor 11.3, whose signal is used to determine the safe setpoint, is connected to the installation control unit 23 and, to be precise, to the setpoint output circuit 1.3. The motor controller 6.3 has only one local safe setpoint memory, which can be accessed in the event of an electrical power failure. The setpoint output circuit 1.3 produces the current safe setpoint (with the previously stored value being deleted), for example at regular time intervals. In the event of an electrical power failure, the data link to the central installation control unit 23 does not need to be functional, since the safe setpoint memory 22.1 in fact contains the most recently transmitted safe setpoint.

[0079] If the supply voltage collapses and the safety circuits 9.1, 9.2, 9.3 detect this and pass on the signal for the safety mode, then each motor controller 6.1, 6.2, 6.3 moves the respectively associated flap 3.1, 3.2, 3.3 to the safe position, which is given by the safe setpoint. The three schematically illustrated flaps 3.1, 3.2, 3.3 do not need to be moved to the same safe position.

[0080] FIG. 2 shows one possible embodiment of a safety controller 1.4 according to the invention.

[0081] By way of example, four inputs E1, . . . , E4 are provided for state signals Z1, . . . , Z4. The state signal Z1 is produced, for example, by the installation parameter module 12. The state signal Z2 is transmitted, for example via the data network 14 (Internet, Intranet) from a server 15. The state signal Z3 is produced, for example, by a sensor 11.4, and the state signal Z4 is obtained by checking the manually adjustable potentiometer 13.

[0082] Depending on the configuration of the safety controller 1.4, the state signals Z1, . . . , Z4 are passed to a calculation module 19 or to a table module 20. These two modules use an application-specific algorithm to determine the safe setpoint SSW, either by using a specific formula SW(Z) to calculate a value or by reading a value from a table SW1, SW2, SW3 on the basis of specific criteria.

[0083] A selector 21 can be provided, which is set such that the calculated value as safe setpoint or the value read from the table is output at the output A, depending on the requirements. (In general, either a calculation module 19 or a table module 20 is provided, and the selector 21 is superfluous). The safe setpoint SSW is stored in a safe setpoint memory 22.2.

[0084] FIG. 2 also shows a time module 17 which is used to initiate a check of the state signals at a specific (preprogrammed or periodic) time.

[0085] FIG. 3 shows an outline of a safety circuit 9.4 which is obtained by variation or adaptation according to the invention of the circuit arrangement according to WO 2007/134471.

[0086] A microprocessor 16 controls an energy converter 28 and a monitoring unit 29 of a capacitive energy store 30 (with one or more supercaps). This means that the microprocessor 16 ensures that the energy store 30 is in the charged state during normal operation. If the normal power supply voltage falls, the microprocessor 16 ensures that the current from the capacitive energy store 30 is supplied to the actuating drive 2.1 (FIG. 1), thus allowing the flap to be moved to the stored safe position.

[0087] A detector 27 for the voltage drop is connected to the microprocessor 16. When this detector 27 responds, the delay module 18 (which is provided in the sense of an embodiment variant) is activated. If the signal for the voltage drop remains for a predetermined duration T.sub.0 (for example 5 seconds), the controller 10 then becomes active, initiating the safety mode. If the electrical power failure duration is shorter than the predetermined duration T.sub.0, the controller 10 remains in normal operation.

[0088] In the safety mode, the controller transmits the safe setpoint SSW, which is stored in the safe setpoint memory 22.3, to the motor controller, and transmits the energy contained in the capacitive energy store 30 in order to allow the motor controller to carry out the received command and to move the flap to the safe position.

[0089] According to one embodiment variant, it is also possible for the setpoint output circuit 1.5 not to determine the safe setpoint SSW until the controller 10 changes to the safety mode. The signal from the sensor 11.5 and possibly a further state signal are/is then used to calculate the safe setpoint.

[0090] The current feed circuit 8.1, 8.2, 8.3, for example a 230 V or 110 V AC mains power feed or a 24 V or 72 V AC or DC power feed, may be arranged directly adjacent to the actuating drive 2.1, 2.2, 2.3 or may be arranged centrally in the building in which the heating or ventilation installation is installed.

[0091] Sensor signals may be transmitted from the sensors to the central computer in particular via digital communication links, such as an Ethernet or Wireless LAN. In principle, it is also feasible to use a unidirectional digital data link, either cable-based or wire-free, in order to transmit the measured sensor values to the central computer.

[0092] The central computer may be formed by any computer system and may comprise a detection module and a determination module, in order to determine the safe setpoint based on sensor signals or installation parameters. A fire propagation module 24 may be provided, in order to estimate the propagation of a fire or of the flue gas, by calculating these various scenarios, on the basis of an electronically recorded building description, that is to say in particular on the basis of the area geometry and the arrangement of the ventilation installation. Once the sensors have determined that there is a current fire situation, it is possible, for example in a first, second and third scenario, to assume the safe setpoint of the actuating drive 2.1 to be completely closed, half open or entirely open, and to assume the remaining actuating drives 2.2, 2.3 to be completely closed, with the propagation of the fire and of the smoke gases being determinable by calculation by the fire propagation module 24 for future time intervals. In further scenarios, the actuating drives 2.2, 2.3 can likewise be assumed to be successively half-open or entirely open, with the fire propagation being determined by the fire propagation module 24. Finally, from the scenarios determined in this way, that having the least damage to be expected to people or buildings is chosen, and the safe setpoints of the actuating drives 2.1, 2.2, 2.3 are fixed accordingly.

[0093] The central computer may furthermore comprise a time module in the sense of the embodiment in FIG. 3.

[0094] FIG. 4 schematically illustrates a flowchart of a software module with the most important steps for fixing the safe setpoint. As mentioned, this can be done during normal operation and, once new sensor signals from the sensors 11.1, 11.2, 11.3 have been recorded at a recording time, this can be done as the safety mode is commenced (that is to say started), or this can be done at a recording time after the start of the safety mode.

[0095] In step S1, sensor signals from the sensors 11.1, 11.2, 11.3 are detected by the setpoint output circuit 1.4 (FIG. 2), and are stored in a main memory of the microprocessor. The sensor signals can be recorded virtually continuously, by recording them at a high sampling frequency of, for example, several 100 Hz. For many applications, it is sufficient to store the sensor signals at time intervals of several minutes or hours. The storage may relate only to the most up-to-date value, or a time series can be recorded in the table structure.

[0096] In step S2, the stored sensor signals are evaluated in order to determine the safe setpoint. A future development of the sensor signals, and therefore damage to buildings and people, can also be estimated. If a sensor signal exceeds a threshold value that is stored in a comparison table, that is to say for example a temperature measurement indicates a high level of heat, then this may require specific actuating drives 2.1, 2.2, . . . , 2.3 to be set to a closed or predominantly closed position during the initiation of the safety mode, in order to prevent the propagation of a fire. By way of example, the future development of the sensor signals can be calculated in order to determine the position to which the flap should be set, that is to say whether, for example, an opening of 10% or one of 70% should be set.

[0097] In step S3, the safe setpoints of the various actuating drives are stored, for example, using a vector structure.

[0098] In step S4, the safe setpoints of the vector structure are transmitted to the individual actuating drives 2.1, 2.2, 2.3. This is preferably done immediately after the said values have been determined, such that updated values are always available in the actuating drives.

[0099] In summary, it can be stated that the safety controller according to the invention can be used for events such as an electrical power failure, and keeps the damage to buildings or people as minor as possible.