GB1605145A - Alarm and/or control apparatus - Google Patents

Description

(54) IMPROVEMENTS IN OR RELATING TO ALARM ANDIOR CONTROL APPARATUS We, CENTRAL ELEcrRIclTY GENERATING BOARD, a British Body Corporate, of Sudbury House, l5,Newgate Street, London, EClA 7AU, ROBERT EDGAR MARTIN, a British Subject, of Driftway, Warwicks Bench Road, Guildford, Surrey, and PENELOPE MARION BULLEN, a British Subject, of 116, Haselmere Close, Leatherhead, Surrey, do hereby declare the invention, for which we pray that a patent may be granted to us, and the method by which it is to be performed, to be particularly described in and by the following statement:: This invention relates to alarm and/or control apparatus for giving an alarm or effecting a control operation when the magnitude of a sensed parameter of a process or system differs from a predetermined magnitude or limit.

In some process plant, an exceptionally high degree of reliability is often required in the sensing of conditions of operation of the plant; a failure of the instrumentation can easily hazard the plant and may endanger life. Whilst it is essential that the parameter condition is detected and the alarm or control operation effected, it is important that the alarm or safeguard control should not normally be operated through any malfunction or failure in the alarm and/or control instrumentation itself.

In conventional sensing systems, an instrument malfunction can not only prohibit a wanted operation in the event of the genuine condition pertaining but it can also give rise to false operation which may cause a costly and unnecessary shut-down of a large plant. In conventional instruments, high reliability is achieved by using a sound physical principle and by ensuring that the system is well engineered with high quality components. The confidence of the user in the ability of the instrument to perform correctly has to be supported by frequent functional checks. In an instrument used to detect an infrequent condition, checks must be made at relatively short intervals to reveal any inability to operate correctly. This is costly and disadvantageous because of the consequent hazards to the controlled plant.Even frequent checking however gives no guarantee of continuous instrument availability.

In order to achieve higher reliability, it is therefore known to utilise two or more sensors each with its associated circuitry and indicator or other output referred to hereinafter as the sensor path. Parallel duplication of measurement paths may be employed. With more than two sensors, "voting" systems, e.g. 2sut-of-3 or 2-out-of4 systems may be employed. As is described for example in Patent Specification No. 1438271, the indications of two or more sensors may be compared and safeguard control action initiated only when two or more sensor paths simultaneously agree that the abnormal plant state exists. A "validated pair" system can continue to operate in the presence of a fault on one path.

It is an object of the present invention to ensure the availability of such a system employing two or more sensors for sensing a parameter and in which the outputs of the sensor paths are compared in order to provide an indication or control signal.

According to this invention, in alarm and/or control apparatus having two or more sensors with separate sensor paths responsive to the magnitude of a parameter, separate indicators associated with the respective sensor paths for separately indicating if each of the various path outputs corresponds to an abnormal magnitude of the parameter, and means for comparing the outputs of the sensor paths for providing a validated alarm or control signal when all the sensors provide signals indicating an abnormal magnitude of the parameter, fault indicator means are provided arranged to indicate when the outputs of the sensor paths differ and each sensor with its sensor path is arranged so that a fault in the sensor or sensor path or the power supply thereto causes the output of the sensor path to revert to that corresponding to an abnormal condition of the parameter.

When two outputs from separate sensor paths differ, when the sensors are responsive to the same parameter, there must be a fault in one of the sensors or its associated measurement path or circuitry. The fault indicator means indicating this discrepancy thus provides immediate indication that maintenance is required. By arranging the sensors and their measurement paths so that any fault in a sensor or sensor path causes the output to the comparison means to correspond to the abnormal state ensures then that, if there is such an instrumental failure, the comparison means will then respond to the remaining sensor or sensors, giving the required alarm or control signal only if the abnormal condition is sensed by the remaining sensor or sensors.

Considering an arrangement where there are only two sensors, the alarm or control operation will normally only be brought into operation when both sensors agree that there is an abnormal state of the sensed parameter. If however only one of the sensors indicates an abnormal state, with the arrangement of the present invention, the further fault indicator will give a warning of this condition. This warn ing indicates immediately that one of the sensors is malfunctioning since, if both were operating correctly, they would both indicate the abnormal state of the parameter. Hence the present invention provides immediately an indication of a failure in one of the sensors, or paths.

As mentioned above the individual sensors are arranged so that, if any one fails, its output will revert to a condition corresponding to that which would exist if the sensor sensed the abnormal state or magnitude of the sensed parameter. If the sensors are electrically powered or are transducers with an electrical output, the final output from the sensor path would be an electrical signal, possibly applied to a relay, indicator or other device; in such an arrangement, the sensor path would be arranged so that any failure of the electrical power supply would cause the relay, indicator or the like to revert to the state indicating an abnormal state or magnitude of the sensed parameter. In other words, when the normal state is sensed, an electrical output holds the relay, indicator or the like in a condition requiring energisation.

More generally a sensor arranged to initiate operation of an alarm or of a control when a parameter departs from a predetermined value or from predetermined limits would normally have a two-state output; commonly the two states are represented by the presence or absence of a signal. One of these states corresponds to the abnormal plant condition and the sensor is arranged so that if the sensor fails, it will tend to revert to this state indicating the abnormal plant condition. The manner of achieving this will depend on the form and construction of the sensor but, in general it is readily possible to ensure that a faulty sensor gives an indication state corresponding to the abnormal plant state.Provided this is done, if a second sensor which is not faulty then senses the abnormal plant state, both sensors will give the same output and the comparison of their outputs will then initiate the required alarm or control operation. With this arrangement the malfunctioning of any one sensor does not affect the overall reliability of the apparatus in its primary purpose of effecting an alarm or control operation. The provision of the indication of discrepancy between the sensor outputs however provides, as described before, immediate indication of malfunctioning of one sensor.

It will be seen that this arrangement is particularly valuable in cases where the abnormal plant condition to be sensed is rare. In conventional instruments, an instrument fault inhibiting genuine operation of alarm or control apparatus may go undiscovered until the event occurs;in that case the abnormal plant condition is not correctly detected. With the arrangement of the present invention and in which the sensors have, on malfunctioning, an output state corresponding to sensing of the abnormal plant state, indication is immediately given of any malfunctioning of any sensor of its path.

There is therefore no need for regular testing procedure with the consequent hazards introduced thereby.

Thus, as an example, if apparatus is arranged to indicate that the level of water in some equipment, e.g. a boiler, exceeds a predetermined limit, the provision of corresponding independent output signals from all or from the majority of two or more sensors with their separate paths indicates that the abnormal plant state of "water level high", is genuinely existing with a high level of confidence in the reliability of this indication. With the arrangement of the present invention, any failure or malfunction in one of the sensors or associated circuit paths can be made to cause a false "water level high" signal from that path. This is a false indication and the discrepancy of the output of the other sensor or sensors immediately provides indication of malfunctioning of one of the sensors or associated circuits.Since the other sensor sensors) does not indicate "water level high the alarm or control operation will not be initiated unless and until the "water level high" state is detected by another sensor.

It will be immediately apparent that if the equipment includes some sensors which are normally in steam and which serve to sense when the water level is high and other sensors are normally in water and serve to sense when the water level is low, it is necessary, with the present invention to employ different sensors and/or sensor paths according to whether the normal state is water or steam.

Thus considered from another aspect, the invention includes within its scope an alarm and/or control apparatus having, for each of a number of different magnitudes of a parameter, two or more sensors with separate sensor paths and associated indicators, each responsive to the state of the parameter and means for com- paring the outputs of the sensor paths for providing a validated alarm or control signal when an abnormal state for a particular magnitude is detected and for providing a fault indication when the outputs of the sensor paths differ, and wherein the sensors' and their associated sensor paths are so constructed that, for each different magnitude of the parameter, the sensors and sensor paths will, in the event of a fault, give an output corresponding to the abnormal state for that magnitude.

The following is a description of two embodiments of the invention, reference being made to the accompanying drawings in which: Figure 1 illustrates, in simplified form, the essential features of an alarm or control system; and Figure 2 shows a modification of part of the apparatus of Figure 1.

Referring to Figure 1 there is shown apparatus providing an alarm signal or effecting a control operation when water 10 in a vessel 11 (typically a boiler) reaches the level of a sensor 12; the sensor is normally in the steam region and it is required to operate an alarm or effect a control operation when the water level reaches a predetermined level. In the arrangement illustrated, there is a second sensor 13 which is at the same level as the sensor 12; the alarm or control operation is to be initiated only when both sensors confirm the rise in the water level. The circuit arrangements for the two sensors are similar and only the circuit arrangement 14 associated with the sensor 12 will be described. The circuit arrangement associated with sensor 13 is indicated diagrammatically by the rectangle 15.

The sensor 12 is an electrode to which an alternating current supply is applied from a winding 20 on a transformer 21 fed from an A.C. supply source 22. The alternating voltage is applied to the electrode 12 via impedances 23, 24; in this case resistive and capacitive impedances respectively. The boiler metallic structure is earthed at 25 and is also connected by a lead 26 to provide current return paths to the aforementioned winding 20. An electronic detecting circuit 27 with input terminals 28 has one input terminal 28 connected via a capacitor 29 to the electrode 12 and the other input terminal 28 connected to the vessel 11. The circuit 26 is activated by the presence of an input signal at the input terminals 28 so that an output signal is given at 31 so long as the electrode 12 remains in steam which is the normal condition in this particular apparatus.The circuit 26 is provided with a power supply system 32 deriving energy via a winding 33 on the aforementioned transformer 21. In the event of any failure of the supply to the transformer or any inadvertent disconnection of any of the wires connecting the supply to the sensor or the boiler structure or the wires between the circuit 27 and the sensor and boiler structure, the output signal normally present at 31 is arranged to revert to the same state as would indicate water at the level of sensor 12.

The second sensor 13,which would normally have an independent power supply, similarly provides an output signal at 34 and is arranged to revert to the state indicative of water in the event of any failure. A comparator 35 compares the output signals from the two sensors and if they both agree in indicating water, then a signal (e.g. the presence or the absence of current) on a lead 36 operates an alarm or control 37. The signal on lead 36 is a validated indication of water derived from two independent sensors. The two sensors 12, 13 have separate indicators 38, 39 to show when that sensor has an output representative of water.

The two outputs from the sensors are compared, e.g. in comparator 35 and an indicator 40 is arranged to give an indication of instrument malfunction when the two outputs from 31 and 34 differ. This indicator 40 shows that there is an unvalidated indication of water; this must necessarily mean that there is an instrumentation malfunction and shows therefore that maintenance action is required.

It will be seen that the above-described apparatus has all the reliability of a two-sensor system in which the sensor outputs are correlated and operation of the alarm or control system initiated only when both sensors agree that water is present at the level of the sensors.

If either sensor should fail, its output will revert to the state corresponding to water and hence the alarm and control operation will be sensed and initiated correctly if and when the other sensor senses water. It is unnecessary however to effect routine testing of all the equipment at frequent intervals because of the provision of indicators 38, 39 giving immediate indication of any failure of either of the sensors 12, 13 and their associated circuits 14, 15.

The indicators 38,39 and 40 may be visual devices, e.g. lamp indicators, and/or annunciateors giving an audible signal.

Figure 2 shows a modification of the circuit 14 of Figure 1 for use with a sensor 41 which would normally be below the water level. It is required, in this case, that the output indication should correspond with the abnormal state, i.e.

the sensor being in steam. In Figure 2, the same reference numerals are used as in Figure 1 to indicate corresponding components and mention will be made only of distinctive features of Figure 2. In Figure 2, the detector 27 is connected across the impedance 23 at points 42, 43 so as to be activated only when a potential drop across impedance 23 is produced by the current from the winding 20 of transformer 21 through the impedances 23,24 to the sensor 41 and thence through the water to the earthed boiler structure at 25 and so via the return lead 26 to the winding 20. Any failure of the supply to the transformer 21 or disconnection of wires in the circuit such as will prevent this voltage being sensed at the input of detector 27 causes the output signal at 31 to revert to a state corresponding to the presence of steam at the level of sensor 41.

It will be noted that the circuit of Figure 2, like that of Figure 1, provides an activating signal voltage to the detector 27 so that this circuit remains continuously operated as long as the associated plant parameter remains normal.

This signal is compared with a corresponding signal from a second sensor as in the arrangement of Figure 1 to give the required alarm and/or control operation and to provide indication of circuit malfunction.

In a water level indication or control system, a plurality of sensors may be provided for sensing the presence or absence of water at various different levels. At each level, two or more sensors may be provided to give a validated output. At each level, the sensors may be constructed and arranged as described above; those sensors which are above the normal water level would be arranged so that a fault causes a failure to the abnormal state, i.e. "water" whereas those which are below the normal water level would be arranged so that a fault causes a failure to indicate "no-water" (e.g.

steam in a boiler), this being the abnormal state for these sensors.

WHAT WE CLAIM IS:- 1. An alarm and/or control apparatus having two or more sensors with separate sensor paths responsive to the magnitude of a parameter separate indicators associated with the respective sensors for separately indicating if each of the various path outputs corresponds to an abnormal magnitude of the parameters and means for comparing the outputs of the sensor paths for providing a validated alarm or control signal when all the sensors provide signals indicating an abnormal magnitude of the parameter, wherein fault indicator means are provided arranged to indicate when the outputs of the sensor paths differ and wherein each sensor with its sensor path is arranged so that a fault in the sensor or sensor path or the power supply thereto causes the output of the sensor path to revert to that corresponding to an abnormal magnitude of the parameter.

2. Apparatus as claimed in Claim 1 and in which the sensors are electrically powered or are transducers with an electrical output so that the final output from the sensor path is an electrical signal applied to a relay, indicator or other device, wherein the sensor path is arranged so that any failure of the electrical power supply causes said relay, indicator or other device to revert to the state indicating an abnormal state or magnitude of the sensed parameter.

3. Apparatus as claimed in Claim 1 wherein each sensor gives an electrical output in one or other of two states dependent on whether or not the sensor senses an abnormal plant condition and wherein the apparatus and sensors are arranged so that the absence of any electrical output from a sensor corresponds to an abnormal plant condition.

4. An alarm and/or control apparatus having, for each of a number of different magnitudes of a parameter, two or more sensors with separate sensor paths and associated indicators, each responsive to the state of the parameter and means for comparing the outputs of the sensor paths for providing a validated alarm or control signal when an abnormal state for a particular magnitude is detected and for providing a fault indication when the outputs of the sensor paths differ, and wherein the sensors and their associated sensor paths are so constructed that, for each different magnitude of the parameter, the sensors and sensor paths will, in the event of a fault, give an output corresponding to the abnormal state for that magnitude.

5. Alarm and/or control apparatus as claimed in any of the preceding claims and arranged for providing an alarm or control output when a liquid level is above an upper or below a lower predetermined limit characterised in that said sensors comprise a plurality of sensing units at different levels, each arranged to give an electrical output of one or other of two states according to the presence or absence of liquid at the level of the sensor and each having a separate indicator to indicate the state of the electrical output, those sensing units above the upper limit being arranged so that absence of electrical power for any unit causes that sensing unit output to revert to a state corresponding to the presence of liquid and those sensing units below the lower limit being arranged so that absence of electrical power for any unit causes that sensing unit output to revert to a state corresponding to the absence of liquid, and wherein, for each level, comparator means are provided to compare the output states of at least two sensing units at that level with indicator means to give a validated indication when the output states agree and to give a fault indication when the output states differ.

6. An alarm or control system substantially as hereinbefore described with reference to Figure 1 or Figure 2 of the accompanying drawings.

**WARNING** end of DESC field may overlap start of CLMS **.

Claims (6)

**WARNING** start of CLMS field may overlap end of DESC **. the associated plant parameter remains normal. This signal is compared with a corresponding signal from a second sensor as in the arrangement of Figure 1 to give the required alarm and/or control operation and to provide indication of circuit malfunction. In a water level indication or control system, a plurality of sensors may be provided for sensing the presence or absence of water at various different levels. At each level, two or more sensors may be provided to give a validated output. At each level, the sensors may be constructed and arranged as described above; those sensors which are above the normal water level would be arranged so that a fault causes a failure to the abnormal state, i.e. "water" whereas those which are below the normal water level would be arranged so that a fault causes a failure to indicate "no-water" (e.g. steam in a boiler), this being the abnormal state for these sensors. WHAT WE CLAIM IS:-

1. An alarm and/or control apparatus having two or more sensors with separate sensor paths responsive to the magnitude of a parameter separate indicators associated with the respective sensors for separately indicating if each of the various path outputs corresponds to an abnormal magnitude of the parameters and means for comparing the outputs of the sensor paths for providing a validated alarm or control signal when all the sensors provide signals indicating an abnormal magnitude of the parameter, wherein fault indicator means are provided arranged to indicate when the outputs of the sensor paths differ and wherein each sensor with its sensor path is arranged so that a fault in the sensor or sensor path or the power supply thereto causes the output of the sensor path to revert to that corresponding to an abnormal magnitude of the parameter.

2. Apparatus as claimed in Claim 1 and in which the sensors are electrically powered or are transducers with an electrical output so that the final output from the sensor path is an electrical signal applied to a relay, indicator or other device, wherein the sensor path is arranged so that any failure of the electrical power supply causes said relay, indicator or other device to revert to the state indicating an abnormal state or magnitude of the sensed parameter.

3. Apparatus as claimed in Claim 1 wherein each sensor gives an electrical output in one or other of two states dependent on whether or not the sensor senses an abnormal plant condition and wherein the apparatus and sensors are arranged so that the absence of any electrical output from a sensor corresponds to an abnormal plant condition.

4. An alarm and/or control apparatus having, for each of a number of different magnitudes of a parameter, two or more sensors with separate sensor paths and associated indicators, each responsive to the state of the parameter and means for comparing the outputs of the sensor paths for providing a validated alarm or control signal when an abnormal state for a particular magnitude is detected and for providing a fault indication when the outputs of the sensor paths differ, and wherein the sensors and their associated sensor paths are so constructed that, for each different magnitude of the parameter, the sensors and sensor paths will, in the event of a fault, give an output corresponding to the abnormal state for that magnitude.

5. Alarm and/or control apparatus as claimed in any of the preceding claims and arranged for providing an alarm or control output when a liquid level is above an upper or below a lower predetermined limit characterised in that said sensors comprise a plurality of sensing units at different levels, each arranged to give an electrical output of one or other of two states according to the presence or absence of liquid at the level of the sensor and each having a separate indicator to indicate the state of the electrical output, those sensing units above the upper limit being arranged so that absence of electrical power for any unit causes that sensing unit output to revert to a state corresponding to the presence of liquid and those sensing units below the lower limit being arranged so that absence of electrical power for any unit causes that sensing unit output to revert to a state corresponding to the absence of liquid, and wherein, for each level, comparator means are provided to compare the output states of at least two sensing units at that level with indicator means to give a validated indication when the output states agree and to give a fault indication when the output states differ.

6. An alarm or control system substantially as hereinbefore described with reference to Figure 1 or Figure 2 of the accompanying drawings.