Method for operating a fail-safe device of a flame sensor

Abstract

The invention relates to a method for operating a fail-safe device for a flame sensor, in particular a hydrogen flame sensor, which comprises at least one optical sensor element (16), wherein in at least one method step a control signal (18) is sent in the direction of the optical sensor element (16), and wherein, in at least one method step, the functionality of the flame sensor is inferred based on a signal correlation between the control signal (18) and a sensor signal (20) tapped from the optical sensor element (16). It is proposed that the control signal (18) be sent during regular operation of the flame sensor for monitoring a flame (22).

Description

State of the art

[0001] In US 9,746,181 B2, a method for operating a fail-safe device of a flame sensor has already been proposed, which comprises at least one optical sensor element, wherein in at least one method step a control signal is emitted in the direction of the optical sensor element and wherein in at least one method step a conclusion is drawn as to the functionality of the flame sensor depending on a signal correlation between the control signal and a sensor signal tapped from the optical sensor element.

[0002] In US 5,495,112 A, a method for operating a fail-safe device of a flame sensor has been proposed, in which an operating state of the flame sensor is continuously analyzed and at the same time the flame sensor is enabled to continuously monitor the flame.

[0003] EP 0 047 421 A1 proposes a method for operating a fail-safe device of a flame sensor in which the integrity of the fail-safe device is continuously monitored without relying on mechanical blocking means. Disclosure of the invention

[0004] The invention is based on a method for operating a fail-safe device of a flame sensor, in particular a hydrogen flame sensor, which comprises at least one optical sensor element, wherein in at least one first method step an optical control signal is emitted in the direction of the optical sensor element and wherein in at least one method step a functional capability of the flame sensor is determined depending on a signal correlation between the control signal and a sensor signal tapped from the optical sensor element, wherein the control signal is emitted during regular operation of the flame sensor for monitoring a flame. In at least one method step, in the event of unsuccessful detection of the control signal in the sensor signal, a shutdown signal is generated to interrupt a flame monitored by the flame sensor.

[0005] It is proposed that in at least a first method step the control signal is generated alternately between at least two signal levels.

[0006] The flame sensor is intended, in particular, to detect the presence and, optionally, the absence of a flame within a sensor range of the flame sensor. The fail-safe device is intended, in particular, to monitor the functionality of the flame sensor, in particular in accordance with EN 298. In particular, the fail-safe device is intended to prevent a false-negative or false-positive evaluation of the sensor signal. "Intended" should be understood, in particular, to mean specially configured, specially programmed, specially designed, and / or specially equipped. The fact that an object is intended for a specific function should, in particular, be understood to mean that the object fulfills and / or executes this specific function in at least one application and / or operating state.

[0007] Preferably, the optical element of the flame sensor is designed to detect electromagnetic radiation emitted by a flame. The optical element preferably has the greatest sensitivity in the ultraviolet range of the electromagnetic spectrum. Alternatively or additionally, the optical element is designed to detect electromagnetic radiation in the visible or infrared range of the electromagnetic spectrum. In particular, at least a portion of the electromagnetic radiation emitted by a hydrogen flame can be detected by the optical sensor element. A "hydrogen flame" is understood to mean, in particular, a flame fed by a fuel that consists at least substantially or entirely of hydrogen.A "significant proportion" should be understood to mean, in particular, at least 10%, preferably at least 50%, particularly preferably at least 90%, based on the total volume of the fuel. Preferably, the flame sensor infers the presence of a flame based on the electromagnetic radiation detected by the optical sensor element. Optionally, the flame sensor infers the absence of a flame based on the electromagnetic radiation detected by the optical sensor element. In particular, the optical sensor element generates the sensor signal based on the detected electromagnetic radiation. The flame sensor preferably evaluates the sensor signal with regard to the presence or, optionally, the absence of a flame.

[0008] The fail-safe device comprises an optical transmitting element for generating the control signal. In particular, in at least one method step of the method, the transmitting element emits electromagnetic radiation as a control signal, which radiation can in particular be detected by the optical element. The electromagnetic radiation emitted by the transmitting element can in particular be coherent or incoherent. Particularly preferably, the transmitting element emits radiation in the ultraviolet range of the electromagnetic spectrum as a control signal. Alternatively or additionally, the transmitting element emits electromagnetic radiation in the visible or infrared range of the electromagnetic spectrum as a control signal. Preferably, a control unit of the fail-safe device controls the transmitting element.In particular, the transmitting element converts a control signal, in particular a wired one, from the control unit into a time profile of a signal parameter of the control signal. In particular, the control signal defines an amplitude of the control signal. Alternatively or additionally, the control signal defines a frequency of the control signal. Preferably, a main transmission direction of the transmitting element is directed towards the optical sensor element. A beam path of the control signal from the transmitting element to the optical element can be designed in particular as a straight line or, via deflecting optical elements such as mirrors, as a line. Alternatively, the transmitting element is provided for indirect illumination of the sensor area of ​​the flame sensor by means of scattering.

[0009] In particular, the optical sensor element detects the control signal in at least one method step and converts it into the sensor signal. The control unit preferably evaluates the sensor signal as a function of the control signal. In particular, the control unit compares the sensor signal with the control signal for the control signal in order to assess the functionality of the flame sensor, in particular of the optical sensor element and / or the transmitting element. A specific evaluation method for detecting the control signal in the sensor signal can be carried out, for example, by evaluating a correlation integral across the sensor signal and the control signal, in particular in the case of a pulsed control signal, by counting edges, extrema, zero crossings or the like, in particular in the case of an alternating control signal, by frequency analysis or filtering.

[0010] Regular operation of the flame sensor is, in particular, an active operating state of the flame sensor. In particular, during regular operation, the flame sensor monitors the sensor range of the flame sensor and, upon detection of a flame, preferably generates an output signal to a higher-level device, for example a burner system or a fire protection system, and / or to a user. In particular, the transmission of the control signal during regular operation is independent of the actual presence or absence of a flame in the sensor range of the flame sensor. In particular, during regular operation, the actual presence or absence of a flame is independent of the transmission of the control signal. In particular, during the regular operating phase, the optical sensor element detects a superposition of the electromagnetic radiation from the flame and from the transmission element.In particular, during the regular operating phase, the optical sensor element generates the sensor signal with a flame signal component caused by a flame and with a control signal component caused by the control signal. In particular, the flame signal component and the control signal component are uncorrelated, in particular apart from commissioning and decommissioning of the flame sensor, and in particular have at most a random similarity. In particular, in the regular operating state, a simultaneous occurrence, a temporal overlap, a temporal interval and / or a sequence of the flame signal component and the control signal component, each with an amplitude different from zero in the sensor signal, is random.Optionally, the fail-safe device additionally transmits the control signal in a calibration mode different from the regular operation, a diagnostic mode and / or other active operating states of the flame sensor in which flame formation and transmission of the control signal are designed to be dependent on one another.

[0011] The inventive design of the method allows for advantageously high operational reliability of a flame sensor with an optical sensor element. In particular, advantageously high operational reliability can be achieved during controlled combustion of carbon-free fuels, in particular hydrogen. In particular, the optical sensor element can be monitored without interrupting regular operation. In particular, a separate control phase with an interruption in operation for checking the optical sensor element can be dispensed with.

[0012] It is further proposed that the control signal be emitted during regular operation of the flame sensor for a substantial period of an operating time of the flame sensor, in particular be emitted continuously. Preferably, the fail-safe device is automatically activated or deactivated together with the optical sensor element. In particular, in an activated state, the transmitting element emits the control signal permanently or at regular or irregular time intervals, in particular as long as the optical sensor element is active. Preferably, the control signal has an amplitude different from zero or a background noise during the substantial period of time. The substantial period of time can be continuous or composed of a plurality of individual intervals.In particular, the essential time period comprises at least 10%, preferably at least 25%, particularly preferably at least 33% of the operating time. The control signal is preferably transmitted continuously, wherein the control signal in particular has a repetition rate and a utilization rate of the control signal corresponds at least to the above-mentioned numerical values. The configuration according to the invention advantageously allows a failure of the flame sensor to be detected at short notice. In particular, the functionality of the flame sensor can advantageously be digitally logged in detail and, in particular, made available for fault diagnosis.

[0013] According to the invention, in at least one method step, if the control signal is unsuccessfully detected in the sensor signal, a shutdown signal is generated to interrupt a flame monitored by the flame sensor. In particular, the control unit analyzes the sensor signal with regard to the control signal component. If the control unit cannot isolate the control signal from the sensor signal and / or detect it in the sensor signal, the control unit generates the shutdown signal. Optionally, the control unit counts the number of attempts to detect the control signal and only generates the shutdown signal after a threshold value for failed attempts has been exceeded. Depending on the application, the attempts can be carried out at specific intervals, in particular synchronized with a repetition rate of the control signal, or directly one after the other.Alternatively or additionally, the control unit measures a period of time during which the control signal could not be detected and generates the shutdown signal only after a threshold value for the period without detection of the control signal has elapsed. The shutdown signal carries at least or exclusively the information that the flame sensor is not functional. The shutdown signal is preferably intended to trigger an emergency shutdown in a flame-generating device. For example, the functionality is implemented directly in the shutdown signal as a logic level (functional - non-functional). The control unit outputs the shutdown signal to a data interface of the shutdown device, which is intended in particular for a data connection to the flame-generating device, for example a burner system.Optionally, the shutdown signal carries additional information, for example a time of the last successful attempt, an accumulated number of failed attempts in a specific period, for example the last two weeks, since the last maintenance appointment, or the like. Optionally, the control unit outputs the shutdown signal via the data interface or a further data interface of the fail-safe device, in particular additionally, to a user or maintenance service, in particular in order to have the flame sensor serviced and / or replaced. The data interface and / or the further data interface can be designed, in particular, to be wired and / or wireless, in particular radio-wave-based. Due to the configuration according to the invention, a flame-generating device designed with the flame sensor can advantageously be operated safely.

[0014] According to the invention, in at least a first method step, the control signal is generated alternating between at least two signal levels. In particular, the signal levels are designed differently. In particular, the signal parameter, in particular the intensity or the frequency of the electromagnetic radiation, of the control signal has at least one maximum and at least one minimum during a repetition cycle of the control signal. Preferably, all maxima of the control signal within a repetition cycle have the same magnitude. Preferably, all minima of the control signal within a repetition cycle have the same magnitude. Particularly preferably, the control signal is designed as a square-wave signal, a trapezoidal signal, a sine signal, a triangular signal, a half-wave, a sawtooth signal, a combination of the aforementioned signals, or the like.Preferably, the repetition rate of the control signal is faster, in particular at least 10 times faster, preferably more than 50 times faster, than an average rate of change of the flame signal component. The inventive design allows the flame signal component and the control signal component of the sensor signal to be easily and / or reliably distinguished and separated from one another.

[0015] In an embodiment of the method not encompassed by this invention, a modulation depth of the sensor signal is kept smaller than an average amplitude of the sensor signal upon successful detection of flames. The average amplitude of the sensor signal upon successful detection of flames is preferably determined and / or updated in a calibration step of the method and / or during regular operation. The "modulation depth of the sensor signal" is to be understood in particular as the difference between the maximum and minimum of the control signal component of the sensor signal caused by the different signal levels of a repetition rate of the control signal.

[0016] Preferably, at least one temporal average, preferably the maximum of a repetition rate, of the control signal component is smaller than a detection threshold for the flame signal component. This design allows the fail-safe device to be operated in an advantageous, energy-saving manner.

[0017] Furthermore, it is proposed that in at least one method step, a maximum signal level of the control signal is adjusted depending on a detection of the control signal. In particular, the control unit increases the maximum signal level of the control signal if the control signal could not be detected in the sensor signal. Preferably, the control unit increases the maximum signal level until the control signal can be detected or an upper threshold value for the maximum signal level is reached. If the maximum signal level is reached and the control signal cannot be detected, the control unit evaluates the attempt as a failure. Preferably, the control unit lowers the maximum signal level of the control signal if the control signal could be detected in the sensor signal.In particular, the control unit lowers the maximum signal level until the control signal can no longer be detected or a lower threshold for the maximum signal level is reached. Optionally, the control unit outputs the shutdown signal if the maximum signal level is set to the upper threshold for at least one or more attempts and / or a specific period of time, regardless of whether the control signal can be detected or not. The configuration according to the invention enables an advantageously reliable assessment of the functionality of the flame sensor. In particular, noise in the sensor signal can be advantageously compensated. In particular, a decrease in the luminosity of the transmitting element, for example due to aging, can be advantageously compensated.

[0018] In an embodiment of the method not encompassed by this invention, the control signal is determined from the sensor signal by means of a phase-locked loop. In particular, the control unit comprises the phase-locked loop. In particular, the control unit uses the phase-locked loop as a tracking filter. Preferably, the control unit uses the control signal as a reference for regenerating the control signal from the sensor signal, in particular for isolating the control signal component from the sensor signal. This embodiment allows the control signal, in particular the control signal component, to be advantageously reliably determined even from a highly noisy sensor signal.

[0019] Furthermore, a fail-safe device for a flame sensor, in particular a hydrogen flame sensor, is proposed, comprising at least one optical transmitting element and at least one control unit, in particular the one already mentioned, for carrying out a method according to the invention. A "control unit" is to be understood in particular as a unit with at least one control electronics unit. "Control electronics" is to be understood in particular as a unit with a processor unit and a memory unit, as well as with an operating program stored in the memory unit. The fail-safe device comprises in particular the transmitting element. For example, the transmitting element is designed as a light-emitting diode circuit. In particular, the light-emitting diode circuit comprises at least one light-emitting diode (LED), in particular an ultraviolet light-emitting diode (UV-LED), and in particular at least one series resistor for this light-emitting diode.Optionally, the light-emitting diode circuit is designed as a light-emitting diode cluster. Preferably, the light-emitting diode or at least one of the light-emitting diodes is based on aluminum nitride, aluminum gallium nitride, aluminum gallium indium nitride, diamond, hexagonal boron nitride, or the like. The fail-safe device preferably comprises a directional element, for example a concave mirror or a free-form reflector, for determining a main transmission direction of the transmission element, in particular in the direction of the optical sensor element. Optionally, the fail-safe device comprises at least one redundant additional transmission element, in particular for replacing the transmission element without assembly if no control signal can be detected. In particular, the control unit comprises a signal generator for controlling the transmission element or elements.Optionally, the control unit comprises a frequency filter and / or a frequency analysis module, in particular for performing a fast Fourier transformation (FFT), in analog or digital implementation, for analyzing the sensor signal. In particular, the fail-safe device comprises at least one sensor interface for querying the sensor signal from the optical sensor element. The fail-safe device preferably comprises the data interface for outputting the shutdown signal. The embodiment according to the invention makes it possible to provide a fail-safe device for flame sensors for carbon-free fuels, in particular hydrogen.

[0020] Furthermore, a flame sensor, in particular a hydrogen flame sensor, with an optical sensor element and with a fail-safe device according to the invention for carrying out a method according to the invention is proposed. The optical sensor element can be designed in particular as a single sensor or as a sensor array, in particular a spatially resolving or accumulating one. The optical sensor element can be designed, for example, as a photodiode, as an active pixel sensor (CMOS sensor), a charge-coupled device (CCD) sensor, or as another measuring element that appears appropriate to a person skilled in the art for detecting electromagnetic radiation, in particular ultraviolet radiation. Optionally, the flame sensor comprises at least one redundant additional optical sensor element, in particular for replacing the optical sensor element without assembly if no control signal can be detected.In an embodiment of the optical sensor element with multiple pixels, the flame sensor preferably comprises a scanning element with which the transmitting element or a main emission direction of the transmitting element can be varied in order to scan the pixels. Alternatively, the flame sensor comprises an expansion optic or an LED cluster with a size matched to a maximum extension of the optical sensor element. Preferably, the flame sensor comprises a common structural element, for example a common housing or a common mounting base plate, on or in which the fail-safe device and the optical sensor element are arranged. Optionally, the control unit of the fail-safe device is designed separately from the transmitting element and the optical transmitting element, for example for an arrangement outside a flame formation region.Optionally, the flame sensor, in particular the housing of the flame sensor, comprises a protective shield that is transparent to the electromagnetic radiation to be detected and is intended to be arranged between the flame and the optical sensor element. Preferably, the flame sensor comprises an electrical power connection. Preferably, the flame sensor comprises, in particular in addition to the electrical power connection, an internal emergency power supply, in particular a battery or accumulator. The configuration according to the invention makes it possible to provide an advantageously operationally reliable flame sensor for fuels, in particular carbon-free fuels.

[0021] Furthermore, a burner system, in particular a hydrogen burner system, with at least one burner element for generating a flame, in particular a hydrogen flame, with a flame sensor according to the invention for carrying out a method according to the invention is proposed. For example, the burner system is designed as a boiler, instantaneous water heater, hot water tank, combination boiler, fan heater or the like. The burner element is designed in particular to be fuel and / or oxygen permeable. For example, the burner element is designed as a porous layer, in particular as a perforated plate, fabric, wire mesh or the like, or as a jet pump. In particular, the burner system comprises at least one fuel supply, in particular a hydrogen supply, to the burner element. The burner system preferably comprises at least one oxygen supply.The oxygen supply is provided to supply an oxygen flow predetermined by it upstream or downstream of the burner element to a fuel flow predetermined by the fuel supply. Optionally, the burner system comprises a premixing chamber for mixing the fuel flow and the oxygen flow before being passed on to the burner element. Optionally, the burner system comprises a plenum for distributing the fuel to different openings of the burner element. The burner system preferably comprises an igniter for igniting a fuel-oxygen mixture. Depending on the application, the burner system comprises a heat exchanger, which is arranged in particular in an exhaust gas outlet region of the burner element. Alternatively, the burner system is designed as a direct heater. The design according to the invention makes it possible to provide an advantageously operationally reliable burner system even for carbon-free fuels.

[0022] The method according to the invention, the fail-safe device according to the invention, the flame sensor according to the invention and / or the burner system according to the invention should not be limited to the application and embodiment described above. In particular, the method according to the invention, the fail-safe device according to the invention, the flame sensor according to the invention and / or the burner system according to the invention can have a number of individual elements, components and units as well as method steps that differs from the number stated herein in order to fulfill a function described herein. Furthermore, in the value ranges specified in this disclosure, values ​​lying within the stated limits should also be considered disclosed and can be used as desired. Drawings

[0023] Further advantages will become apparent from the following description of the drawings. The drawings illustrate an exemplary embodiment of the invention. The drawings, the description, and the claims contain numerous features in combination. Those skilled in the art will expediently consider the features individually and combine them into further meaningful combinations.

[0024] They show: Fig. 1 is a schematic representation of a burner system according to the invention and Fig. 2 is a schematic block diagram of a method according to the invention. Description of the embodiment

[0025] Figure 1shows a burner system 29. The burner system 29 comprises at least one burner element 30. The burner element 30 is provided for generating a flame 22, in particular a hydrogen flame. Preferably, the burner element 30 is designed as a porous layer, in particular made of metal or ceramic. For example, the burner element 30 has a semicircular profile. Alternatively, the burner element 30 is flat. For example, the burner element 30 has a plurality of openings. Alternatively, the burner element 30 forms exactly one opening. Preferably, the burner system 29 comprises at least one plenum 34, at which the burner element 30 is arranged. The burner system 29 comprises in particular a fuel supply 32. Preferably, the fuel supply 32 is provided for supplying a fuel to the burner element 30, in particular indirectly via the plenum 34.The burner element 30 is preferably provided for the controlled combustion of hydrogen or a fuel mixture with a substantial hydrogen content as fuel. The burner system 29 preferably comprises at least one oxygen supply, in particular an intake opening for ambient air (not shown here). The burner system 29 preferably comprises at least one igniter 36 for igniting the fuel. The burner system 29 preferably comprises at least one heat exchanger 38. In particular, the heat exchanger 38 is provided for transferring heat from an exhaust gas from the combustion of the fuel to a heat carrier and / or a target fluid, in particular service water, drinking water and / or room air.

[0026] The burner system 29 comprises at least one flame sensor 14, in particular a hydrogen flame sensor. The flame sensor 14 is provided in particular to detect the presence of the flame 22. Optionally, the flame sensor 14 is provided to detect the absence of flames. The flame sensor 14 comprises an optical sensor element 16, in particular for detecting the flame 22. In particular, the optical sensor element 16 is provided to detect electromagnetic radiation, in particular in the ultraviolet range, from the flame 22. In particular, the flame sensor 14 is provided during regular operation to monitor ignition attempts of the burner system 29 and combustion of the fuel. The flame sensor 14 comprises at least one fail-safe device 12. The fail-safe device 12 is provided in particular to monitor the functionality of the flame sensor 14.The fail-safe device 12 comprises in particular at least one transmitting element 40 for transmitting a control signal 18 (cf. . Fig. 2 ). The transmitting element 40 preferably comprises at least one light-emitting diode. The fail-safe device 12 comprises at least one control unit 28. The control unit 28 is provided for carrying out a method 10 which is described in Figure 2 will be explained in more detail. In particular, the control unit 28 is provided for controlling the transmitting element 40.

[0027] Figure 2shows a schematic block diagram of the method 10 for operating the fail-safe device 12 of the flame sensor 14. In at least one method step of the method 10, a conclusion is drawn about the functionality of the flame sensor 14 depending on a signal correlation between the control signal 18 and a sensor signal 20 tapped by the optical sensor element 16. In particular, the control unit 28 attempts to detect the control signal 18 in the sensor signal 20. If the control unit 28 can detect the control signal 18 in the sensor signal 20, it concludes that the flame sensor 14 is functional. If the control unit 28 cannot detect the control signal 18 in the sensor signal 20, it concludes that the flame sensor 14 is not functional, in particular regardless of whether the optical sensor element 16 or the transmitting element 40 is inoperative.

[0028] In at least one method step of method 10, control signal 18 is emitted in the direction of optical sensor element 16. Control signal 18 is emitted during regular operation of flame sensor 14 to monitor flame 22. Control signal 18 is emitted during regular operation of flame sensor 14 for a substantial period of an operating time of flame sensor 14. In particular, control signal 18 is emitted continuously during regular operation of flame sensor 14. Control signal 18 is generated in particular by transmitting element 40. In particular, control unit 28 generates a control signal 50 for controlling transmitting element 40. Preferably, transmitting element 40 converts control signal 50 into control signal 18. Control signal 18 is generated alternating between at least two signal levels 24, 26.In particular, the transmitting element 40 generates electromagnetic radiation with alternating intensity as the control signal 18. Particularly preferably, the control signal 18 is a square wave signal.

[0029] The optical sensor element 16, in particular, converts incoming electromagnetic radiation into a sensor signal 20. The electromagnetic radiation arriving at the sensor element 16 can, in particular, be the control signal 18, flame radiation 42 from the flame 22, or a combination thereof. Optionally, the optical sensor element 16 or the control unit 28 applies a correction factor to the sensor signal 20 in order to compensate for electromagnetic radiation from an environment. In particular, the sensor signal 20 comprises at least a flame signal component when the flame radiation 42 strikes the optical sensor element 16. In particular, the sensor signal 20 comprises a control signal component 18' when the control signal 18 strikes the optical sensor element 16.

[0030] Preferably, in a signal processing step 44 of the method 10, the sensor signal 20 is processed analogically or digitally by the control unit 28, for example, amplified, attenuated, equalized, filtered, smoothed, averaged, or the like. The method 10 preferably comprises an analysis step 46. In particular, the sensor signal 20 is analyzed by the control unit 28 in the analysis step 46, in particular broken down into the flame signal component and the control signal component 18'. The control signal 18, in particular the control signal component 18', is determined from the sensor signal 20 by means of a phase-locked loop of the control unit 28. Alternatively, the control unit 28 determines parameters for the flame signal component and the control signal component 18' in the analysis step 46, for example, by means of a Fourier analysis.Preferably, the control unit 28 transmits the flame signal component or the corresponding characteristic variable to a system control unit of the burner system 29 for evaluation, in particular for assessing an ignition attempt or a combustion process. Preferably, the method 10 comprises an evaluation step 48 for evaluating the control signal component 18' or the corresponding characteristic variable. For example, in the evaluation step 48, the control unit 28 compares a control signal variable with a threshold value. For example, a maximum signal level 24 of the control signal component 18', a Fourier amplitude determined in the analysis step 46, or a correlation integral of the control signal component 18' or of the entire sensor signal 20 with the control signal 50 can be used as the control signal variable.

[0031] In the evaluation step 48, if the control signal 18 in the sensor signal 20 is unsuccessfully detected, a shutdown signal is generated to interrupt the flame 22 monitored by the flame sensor 14. In particular, the control unit 28 transmits the shutdown signal to the system control unit of the burner system 29. In particular, the system control unit of the burner system 29 closes the fuel supply 32 and optionally the oxygen supply upon receipt of the shutdown signal. In the evaluation step 48, a maximum signal level 24 of the control signal 18 is adjusted depending on the detection of the control signal 18. In particular, the control unit 28 adjusts the control signal 50 depending on the detection of the control signal component 18'.A modulation depth of the sensor signal 20, in particular a peak-valley value of the control signal component 18', is kept smaller than an average amplitude of the sensor signal 20, in particular than the flame signal component, upon successful detection of flames 22.

Claims

1. Method for operating a fail-safe device of a flame sensor, in particular a hydrogen flame sensor, which comprises at least one optical sensor element (16), wherein, in at least one first method step, an optical control signal (18) is emitted in the direction of the sensor element (16), and wherein, in at least one second method step, a functional capability of the flame sensor is inferred on the basis of a signalling correlation between the control signal (18) and a sensor signal (20) tapped off from the sensor element (16), wherein the control signal (18) is emitted during normal operation of the flame sensor for the purpose of monitoring a flame (22), wherein, in at least one third method step, if the control signal (18) is unsuccessfully detected in the sensor signal (20), a switch-off signal for interrupting a flame (22) monitored with the flame sensor (14) is generated, characterized in that that the control signal (18) is generated alternately between at least two signal levels (24, 26).

2. Method according to Claim 1, characterized in that the control signal (18) is emitted during normal operation of the flame sensor (14) for a substantial period of time of an operating period of the flame sensor (14), in particular is emitted continuously.

3. Method according to one of the preceding claims, characterized in that, in at least one method step, a maximum signal level (24) of the control signal (18) is adapted on the basis of detection of the control signal (18).

4. Fail-safe device of a flame sensor, which comprises an optical sensor element, in particular a hydrogen flame sensor, having at least one optical transmission element and a control unit (28) for carrying out a method according to one of the preceding claims.

5. Flame sensor, in particular hydrogen flame sensor, having an optical sensor element and having a fail-safe device according to Claim 4 for carrying out a method according to one of Claims 1 to 3.

6. Burner system having at least one burner element (30) for producing a flame (22), in particular a hydrogen flame, having a flame sensor according to Claim 5 for carrying out a method according to one of Claims 1 to 3.

Images