Monitor system

Claim 2

A monitor system for monitoring a microprocessor based control device having an output for effecting control of a system by means of control information therefrom in dependence on reference information received from system sensors of physical parameters in safety critical situations, said monitor system being configured without the requirement of a further microprocessor and including first input means for receiving said control information from the output of the microprocessor based control device; second input means for receiving reference information from the system sensors; memory means having address inputs continuously receiving both the control information and the reference information form the first and second input means respectively to define in combination an accessed memory address wherein the contents of said accessed memory address is used for continuously determining whether the control information from the device corresponds to that expected in view of the reference information; and means for overriding the control information if any error in this control information is detected.

Claim 3

A system as claimed in claim 1, including generator means connected to said memory means for generating an output connected to the address inputs, and wherein the memory means is provided for storing binary data accessible when addressed at the address inputs in dependence on the output of the generator means and the control and reference information received form the first and second input means, respectively and for outputting data for overriding the control information if an error in the control information occurs.

Claim 4

A system as claimed in claim 2, including feedback means connected between an output of the memory means and the generator means for updating the output of generator means in dependence on data stored within the memory means so as to address locations within the memory at locations defined by the output of the generator means and both the control and reference information in combination.

Claim 5

A system as claimed in claim 1, wherein the memory is configured to contain information mirroring the control device information and to contain overriding information, the information mirroring the control device information being located at addresses accessible during normal operation of the control device and the overriding information being located at addresses accessible during an error phase of the control device.

Claim 6

A system as claimed in claim 4, including selector means, and wherein the memory has sufficient capacity to store additional sequencing information for receipt by the selector means to cause different memory areas to be made available to the control device information and reference information.

Claim 7

A system as claimed in claim 5, wherein the selector means includes a counter and the memory includes a data bus, and wherein feedback means are provided from the data bus of said memory to reset or increment the counter in dependence on preprogrammed instructions within selected memory storage locations.

Claim 12

A system as claimed in claim 10, wherein the checking means includes a dynamically operable check circuit for continually checking system integrity.

Claim 13

A system as claimed in claim 11, including a controllable oscillator for dynamically exercising parity of the check circuit and a lockout device for initiating operational lockout in the event of a detected failure.

Claim 14

A system as claimed in claim 12, wherein the oscillator is controlled by an output provided by the memory means.

Claim 15

A system as claimed in claim 12, including at least one relay and a relay operating circuit under the control of a signal derived from the oscillator to establish the integrity of the at least one relay.

Claim 16

A system as claimed in claim 14, wherein the at least one relay includes a bistable lockout relay having a first coil for effecting a lockout condition on receipt of an error detection signal from the parity check circuit, said relay being resettable by means of a second coil.

Claim 18

A system as claimed in claim 16, wherein the relay means are provided to by-pass the monitor in the event of monitor failure.

Claim 20

A monitor for independently monitoring a microprocessor based control device provided to control a system in safety critical situations, said microprocessor based control device having an input for receiving reference information from system sensors of physical parameters and an output for supplying control information to said system in dependence on said reference information from said system sensors, said monitor including first input means for receiving the control information for the system control from the microprocessor based control device; second input means for receiving the reference information from the system sensors, memory means for continuously receiving both the system control information and the reference information from the first and second input means respectively, and generator means connected to an input of said memory means for generating addresses to define an accessible memory address in combination with the control information and the reference information wherein the contents of said address memory is used for continuously determining whether the control information from the said device corresponds to that expected in view of the reference information; and means for overriding the control information for the system control if any error in this control information is detected.

Claim 21

A monitor for independently monitoring a microprocessor based control device provided to control a system in safety critical situations, said microprocessor based control device having an input for receiving reference information from system sensors of physical parameters and an output for supplying control information to said system in dependence on said reference information from said system sensors, said monitor including first input means for receiving the control information for the system control from the microprocessor based control device; second input means for receiving the reference information from the system sensors, memory means for continuously receiving both the system control information and the reference information from the first and second input means respectively, and generator means connected to an input of said memory means for generating addresses to define an accessible memory address in combination with the control information and the reference information wherein the contents of said address memory is used for continuously determining whether the control information from the said device corresponds to that expected in view of the reference information; and means for overriding the control information for the system control if any error in this control information is detected.

Claim 22

A monitor as claimed in claim 19 wherein the monitor is connected in series with the microprocessor based control device and the memory means is configured to contain information mirroring the control device and to contain overriding information, the information mirroring the control device information being located at addresses accessible during normal operation of the control device as defined by the generator means, the system control information and the reference information in combination and the overriding information being located at the addresses accessible during an error phase of the control device.

Claim 23

A monitor as claimed in claim 19 or 20, wherein said generator means including a counter having an address output and the memory means includes a data bus, and wherein feedback means are provided from the data bus of said memory means to reset or increment the counter output in dependence on preprogrammed instructions within memory storage locations selected in dependence on a combination of the control information, reference information and counter output.

Claim 24

A monitor as claimed in claim 21 including checking means provided to ensure the integrity of the monitor system is maintained, said checking means including a dynamically operable check circuit for continuously checking system integrity in response to data stored within the memory means.

Claim 25

A monitor as claimed in claim 22, wherein the check circuit includes a parity check output and a controllable oscillator is provided for dynamically exercising the parity of the circuit and effecting a lockout device for initiating operational lockout in the event of a detected failure.

Claim 26

A monitor as claimed in claim 23 including at least one relay and a relay operating circuit under the control of a signal derived from the oscillator to establish the integrity of the at least one relay, at least one relay including a bistable lockout relay configuration having a first coil operable to a lockout condition on receipt of an error detection signal from the check circuit, and said relay being resettable by means of a second coil.

Claim 27

A monitor as claimed in claim 24, wherein the first input means is configured to receive control information for controlling a fan, ignition, pilot and main burners and wherein the second input means is configured to receive thermostat, air status input and flame presence information from a burner device.

Claim 28

In a burner system having a plurality of sensors for providing reference information indicative of the status of the burner system and a microprocessor based control device for receiving reference information, said device including an output for providing control information to control burner operation in dependence on the reference information, the improvement comprising a monitor device having first input means for receiving the control information controlling burner operation, second input means for receiving the reference information indicative of burner status, memory means for continuously receiving both the control information and the reference information for the purpose of selecting memory addresses within said memory means for measuring physical parameters from the first and second input means respectively and wherein the control units of said selected address within said memory means is used for continuously determining whether the control information from said control device corresponds to that expected in view of the reference information, means for overriding the control information if any error in this control information is detected and means for checking the integrity of the memory means to ensure correct operation thereof is effected, said means for checking the integrity of the memory means including feedback means connected between an output of the memory means and an input thereto, said memory input being configured to receive addressing information dependent on information stored within the memory means together with the control information and reference information from the first and second input means to define an accessed memory address.

Claim 29

In a burner system having a plurality of sensors for providing reference information indicative of the status of the burner system and a microprocessor based control device for receiving reference information, said device including an output for providing control information to control burner operation in dependence on the reference information, the improvement comprising a monitor device having first input means for receiving the control information controlling burner operation, second input means for receiving the reference information indicative of burner status, memory means for continuously receiving both the control information and the reference information for the purpose of selecting memory addresses within said memory means for measuring physical parameters from the first and second input means respectively and wherein the control units of said selected address within said memory means is used for continuously determining whether the control information from said control device corresponds to that expected in view of the reference information, means for overriding the control information if any error in this control information is detected and means for checking the integrity of the memory means to ensure correct operation thereof is effected, said means for checking the integrity of the memory means including feedback means connected between an output of the memory means and an input thereto, said memory input being configured to receive addressing information dependent on information stored within the memory means together with the control information and reference information from the first and second input means to define an accessed memory address.

Claim 30

A system as claimed in claim 26, wherein the first input of the monitor is connected to receive burner control information from the control device for effecting control of a fan, ignition, pilot burner or main burner.

Claim 31

A system as claimed in claim 27, wherein the second input of the monitor is connected to receive reference information on thermostat, air or flame presence status.

Claim 32

A system as claimed in claim 26, 27 or 28, wherein the memory means of the monitor contains stored information including a first set of information mirroring the control device information and a second set of information containing overriding information, the overriding information being located at addresses accessible during an error phase of the control device.

Claim 33

A system as claimed in claim 26 wherein the means for checking the integrity of the memory means includes a parity check circuit and includes output means connected to said memory means to receive a periodic data bit therefrom to exercise the parity check circuit to ensure no erroneous operation of the memory or the parity check circuit is occurring.