Safety Provisions - Honeywell 7800 Series Manual

RM7840E,G,L,M

SAFETY PROVISIONS

INTERNAL HARDWARE STATUS MONITORING
The RM7840 checks the purge card for correct parity to
prevent purge timing shifts and circuitry failures. It also
analyzes the integrity of the configuration jumpers and
internal hardware. The POWER LED will blink every four
seconds, signifying an internal hardware check.
CLOSED LOOP LOGIC TEST
The test verifies the integrity of all safety critical loads,
terminals 8, 9, 10 and 21. If the loads are not energized
properly; i.e., the main valve terminal is powered during
PREPURGE, the RM7840 will lockout on safety shutdown.
The RM7840 must react to input changes but avoid the
occurrence of nuisance shutdown events. Signal condition-
ing is applied to line voltage inputs to verify proper opera-
tion in the presence of normal electrical line noise such as
transient high voltage spikes or short periods of line drop-
out. Signal conditioning is tolerant of synchronous noise
(line noise events that occur at the same time during each
line cycle).
DYNAMIC AMPLI-CHECK™
Dynamic AMPLI-CHECK™ circuitry tests the flame
signal amplifier during burner operation and shuts down the
RM7840 if the flame amplifier fails.
DYNAMIC FLAME AMPLIFIER AND SHUTTER
CHECK
Self-checking circuitry tests all electronic components
in the flame detection system and amplifier 10 to 12 times
per minute and shuts down the RM7840 if the detection
system fails.
DYNAMIC INPUT CHECK
All system input circuits are examined to verify the
RM7840 is capable of recognizing the true status of external
controls, limits and interlocks. If any input fails this test, a
safety shutdown occurs and the fault is annunciated.
DYNAMIC SAFETY RELAY TEST
Checks the ability of the dynamic safety relay contacts to
open and close. Verifies that the safety critical loads, termi-
nals 8, 9, 10 and 21, can be de-energized, as required, by the
Dynamic Self-Check logic.
DYNAMIC SELF-CHECK SAFETY CIRCUIT
The microcomputer tests itself and related hardware while
at the same time the safety relay system tests the microcom-
puter operation. If a microcomputer or safety relay failure
occurs and does not allow proper execution of the self-check
routine, safety shutdown will occur and all safety critical
loads will be de-energized.
EXPANDED SAFE-START CHECK
The conventional safe-start check, which prevents burner
start-up if flame is indicated at start-up, is expanded to include
Safety Provisions
a flame signal check during STANDBY, a preignition inter-
lock check, an interlock check, and a safety critical load
check.
HIGH FIRE PURGE AND LOW FIRE START
SWITCH TESTS
High Fire Purge Switch Test (RM7840E,L) examines the
Purge Position Interlock Switch at the moment the firing rate
motor is commanded to the high fire position. If the switch is
bypassed, welded or otherwise closed prematurely, the sys-
tem will automatically add 30 seconds to allow additional
drive time for the firing rate motor to reach or near the open
position before starting the purge timing; otherwise, purge
timing starts when the High Fire Switch is closed. This switch
will also cause a hold (four minutes, fifteen seconds) condi-
tion when the switch is open before purge or opens during
purge. The RM7840E,L will lockout and annunciate an
alarm if the switch fails to close within the hold time period.
Low Fire Start Switch Test examines the Low Fire Start
Switch at the moment PREPURGE is completed. If the
switch is bypassed, welded or otherwise prematurely closed,
the system will automatically add 30 seconds to allow the
firing rate motor additional time to reach or near the low fire
start position before ignition trials; otherwise, ignition trials
start after the Low Fire Switch closes. The test also is used to
prove that the firing rate motor is at low fire position through-
out the ignition trial period. This switch also will cause a hold
(four minutes, fifteen seconds) condition if the switch opens
after purging is complete. The RM7840 will lockout and
annunciate an alarm if the switch fails to close within the hold
time period.
MANDATORY PURGE
If lockout occurs after the initiation of ignition trials (or
at any-time during a sequence when the fuel valves may
have been energized), a mandatory POSTPURGE period
is imposed.
OFF CYCLE (STANDBY OR PREPURGE) FLAME
SIGNAL CHECK
The flame detection subsystem (flame detector and ampli-
fier) is monitored during STANDBY. If a flame simulating
condition or an actual flame exists, a system hold occurs and
start-up is prevented. If the flame signal exists at any time
after the first 40 seconds of STANDBY, a safety shutdown
will occur and be annunciated. A shutter-check amplifier and
self-checking detector are energized for the first 40 seconds
during STANDBY and the last two seconds before exiting
STANDBY. If a flame exists, a safety shutdown occurs. An
AMPLI-CHECK™ Amplifier is energized continually
through STANDBY and PREPURGE to detect any possibil-
ity of a runaway detector or a flame. If either situation
happens, a safety shutdown occurs. A standard amplifier is
energized continually through STANDBY and PREPURGE.
If either situation happens, a safety shutdown occurs.
8