Safety Provisions - Honeywell 7800 Series Manual

7800 SERIES RM7830A, RM7850A RELAY MODULE

SAFETY PROVISIONS

Internal Hardware Status Monitoring
The RM7830A or RM7850A Relay Module check the purge
card for correct parity to prevent purge timing shifts and
circuitry failures. It also analyzes the integrity of the
configuration jumpers and internal hardware. The POWER
LED blinks every four seconds, signifying an internal
hardware check.
Closed Loop Logic Test
The test verifies the integrity of all safety critical loads,
terminals 8, 9, 10 and 21. If the loads are not energized
properly; eg, the main valve terminal is powered during
PURGE, the RM7830A or RM7850A will lockout on safety
shutdown. The RM7830A or RM7850A must react to input
changes but avoid the occurrence of nuisance shutdown
events. Signal conditioning is applied to line voltage inputs to
verify proper operation in the presence of normal electrical
line noise such as transient high voltage spikes or short
periods of line dropout. Signal conditioning is tolerant of
synchronous noise (line noise events that occur at the same
time during each line cycle).
Dynamic Ampli-Check®
Dynamic AMPLI-CHECK® circuitry tests the flame signal
amplifier during burner operation and shuts down the
RM7830A or RM7850A if the flame amplifier fails.
Dynamic Flame Amplifier and Shutter Check
Self-checking circuitry tests all electronic components in the
flame detection system and amplifier 12 times per minute and
shuts down the RM7830A or RM7850A if the detection
system fails.
Dynamic Input Check
All system input circuits are examined to verify the RM7830A
or RM7850A is capable of recognizing the true status of
external controls, limits and interlocks. If any input fails this
test, a safety shutdown occurs and the fault is annunciated.
Dynamic Safety Relay Test
Checks the ability of the dynamic safety relay contacts to
open and close. It also verifies that the safety critical loads,
terminals 8, 9, 10 and 21, can be de-energized, as required,
by the Dynamic Self-Check logic.
Dynamic Self-Check Safety Circuit
The microcomputer tests itself and related hardware while at
the same time the safety relay system tests the
microcomputer operation. If a microcomputer or safety relay
failure occurs and does not allow proper execution of the self-
check routine, safety shutdown will occur and all safety
critical loads will be de-energized.
Expanded Safe-Start Check
The conventional safe-start check, which prevents burner
start-up if flame is indicated at start-up, is expanded to
include a flame signal check during STANDBY, a preignition
interlock check, an airflow switch check, and a safety critical
load check.
65-0222
High Fire Purge and Low Fire Start Switch
Tests (RM7850A)
High Fire Purge Switch Test examines the Purge Position
Interlock Switch at the moment the firing rate motor is
commanded to the high fire position. Purge timing starts
when the High Fire Switch Input is closed. This switch will
also cause a hold (five minutes) condition when the switch is
open before purge or opens during purge. The RM7850A will
lockout and annunciate an alarm if the switch fails to close
within the hold time period.
Low Fire Start Switch Test examines the Low Fire Start
Switch at the moment PURGE is completed. Ignition trials
start after the Low Fire Switch Input closes. The test is also
used to prove that the firing rate motor is at low fire position
throughout the ignition trial period. This switch will also cause
a hold (five minutes) condition if the switch opens after
purging is complete. The RM7850A will lockout and
annunciate an alarm if the switch fails to close within the hold
time period.
Mandatory Postpurge
If lockout occurs after the initiation of ignition trials, (or at
anytime during a sequence when the fuel valves may have
been energized), a mandatory POSTPURGE period is
imposed.
Off Cycle (STANDBY or PURGE) Flame
Signal Check
The flame detection subsystem (flame detector and amplifier)
is monitored during STANDBY. If a flame simulating condition
or an actual flame exists, a system hold occurs and start-up is
prevented. If the flame signal exists at any time after the first
40 seconds of STANDBY, a safety shutdown will occur and be
annunciated. A shutter-check amplifier and self-checking
detector are energized for the first 40 seconds during
STANDBY and the last two seconds before exiting STANDBY.
If a flame exists, a safety shutdown occurs. An AMPLI-
CHECK™ Amplifier is energized continually through
STANDBY and PURGE to detect any possibility of a runaway
detector or a flame. If either situation happens, a safety
shutdown occurs. A standard amplifier is energized
continually through STANDBY and PURGE to detect any
possibility of a runaway detector or a flame. If either situation
happens, a safety shutdown occurs.
Preignition Output Circuit Check
At the end of PURGE, the Dynamic Safety Relay operation is
checked. Also, all safety critical loads, terminals 8, 9, 10 and
21 are checked to verify the terminals are not powered. If the
Dynamic Safety Relay operation is faulty, or if any of the
safety critical loads are powered, safety shutdown occurs and
is annunciated.
Tamper Resistant Timing and Logic
Safety and logic timings are inaccessible and cannot be
altered or defeated.
Verified Spark Termination
The ignition terminal is monitored to verify early spark
termination during PILOT STAB.
8