Background to the invention The invention relates in particular, but not exclusively, to the technical field of the production of systems for controlling the gas supply of burners, comprising valve means whose opening and closing is controlled and which may be modulated.

In accordance with current regulations, devices adapted to open or close valve means must be safe to the second malfunction, i. e. if two independent malfunctions take place in the device, the valve means must remain closed to avoid hazardous gas leakages.

In known control systems, based on"complex electronics", the control panels of boilers are provided with a microprocessor adapted to send a gas supply request signal to a circuit that controls an actuator adapted to open the valve means. The same microprocessor usually detects the possible malfunctions that may take place in this circuit by means of appropriate feedback and takes appropriate countermeasures to prevent the valve means from opening.

This means, however, that the microprocessor must be provided with software that is sufficiently complex to control the above-mentioned functions, with the result that the, overall system is more intensive in terms of the resources used and its circuits are more complex.

In known control panels, moreover, in order to control and take action in cases of malfunction of the microprocessor, a module, called a"watchdog", is normally provided separately from the control circuit of the actuator in order to monitor the operation of the microprocessor and lock the control device if it malfunctions.

The technical problem on which the present invention is based is that of providing a control and safety device for valve means which is structurally and functionally designed to remedy the drawbacks of the known prior art discussed above.

Statement of the invention This problem is resolved by the device as defined and characterised in general in the main claim.

Brief description of the drawings The characteristic features and advantages of the invention are set out in further detail in the following description of an embodiment thereof, given purely by way of non-limiting example, and made with reference to the

accompanying drawing, in which the Figure shows a circuit representing the control device of the present invention.

Preferred embodiment of the invention In the single Figure, a control and safetyFdevice for valve means which are normally closed (not shown) according to the present invention is shown overall by 1.

The control device 1 comprises a control circuit 2 comprising actuator means, in particular a relay 3, adapted to open the above-mentioned valve means when a current is passing through the control circuit 2 and to close these means when no current is passing through the circuit.

The control circuit 2 is supplied by a relay supply voltage source Vr and has an input IN (EN2) adapted to receive a first direct voltage signal EN2 generated by a control unit, such as a microprocessor 4, electrically connected to the circuit 2.

The control circuit 2 further comprises a first transistor Q1, a first diode D1 and the coil of a relay 3 connected together in parallel being interposed between the collector of this transistor and the relay supply terminal Vr. The diode D1 is adapted to prevent currents generated by the electromotive forces acting in the relay 3 from reaching the transistor Q1 and damaging it. The supply terminal Vr is also connected to a terminal of anti-interference means

adapted to filter any electromagnetic interference and including a capacitor Cl connected between the supply terminals (Vr and earth).

, The transistor Q1 is biased in inhibition in the absence of a direct voltage signal EN2 generated by the microprocessor 4. This signal may be supplied to the input terminal IN (EN2) of the circuit 2 as a result of a control signal to open the valve means that is supplied to the microprocessor 4 (this control signal may come either from sensors, for instance temperature sensors, or from other circuits connected to the device in question). The signal EN2 is supplied to the control circuit 2 for the time interval in which the valve means are to be kept open.

First means for chopping signals of low amplitude, comprising a first Zener diode D2 and a first resistor R1, called the base resistor of the transistor Q1, are interposed between the base of the transistor Q1 and the input terminal IN (EN2). A terminal of a second resistor R2, whose other terminal is connected to earth, is connected between the first resistor R1 and the first Zener diode D2.

The control and safety device 1 further comprises a monitoring circuit 5, described in detail below, which is adapted to enable or disable the operation of the control circuit 2 as a function of an alternating voltage signal EN1,

in this case a square wave of predetermined frequency, generated by the microprocessor 4. The monitoring circuit 5 comprises a second transistor Q2, whose collector is connected to the emitter of the transistor Ql, and two further transistors Q3 and Q4.

The collector of the transistor Q4 is connected, via a load resistor R5, to a terminal of a voltage supply Vcc, its emitter is connected to earth and its base is connected, via a base resistor R7, to the input terminal IN (EN1) to which the alternating voltage signal EN1 is supplied. A first and a second branch in parallel with one another, each formed by a Zener diode and a resistor in series with one another, shown respectively by D3 and R3 in the first branch and by D4 and R4 in the second branch, are connected between the supply terminal Vcc and the base of the transistor Q4. The Zener diodes D3, D4 form first and second means for chopping signals of high amplitude.

Second means for chopping signals of low amplitude, comprising a fifth Zener diode D5, are also interposed between the input terminal IN (EN1) and the base resistor R7.

A further branch comprising a resistor R6, whose other terminal is connected to earth, leads from the Zener diode D5 and the base resistor R7.

Means for blocking signals of a frequency higher than a

predetermined value, comprising a capacitor C5, are also interposed between the base of the transistor Q4 and earth.

The collector of the transistor Q4 is connected to first and second means for blocking input signals of a frequency lower than a predetermined value comprising two capacitors C2, C3 in series with one another, downstream of which two branches lead, a first branch comprising an inversely biased third diode D6 with its anode earthed, and a second branch comprising means for chopping the negative component of the input signal, including a fourth diode D7. By means of the third diode D6 the negative component of the alternating voltage signal emerging from the two capacitors C2, C3 is discharged to earth with the result that only the positive component of the signal passes through the fourth diode D7.

The cathode of the diode D7 is connected to a node A, from which three branches lead, the first two of which are connected to the transistors Q2 and Q3, and precisely to the base of the transistor Q2 via a diode D8 in series with a resistor R10 and to the base of the transistor Q3 via a resistor R8, and the third comprising means for actuating the second and third transistors Q2 and Q3, in particular an electrolytic capacitor C4 connected to earth. The fourth diode D7 prevents the electrolytic capacitor C4 from discharging in the direction of the two capacitors C2, C3.

The correct loading of the electrolytic capacitor C4 determines the conduction of the transistors Q2 and Q3.

The transistor Q2 has its collector connected to the emitter of the transistor Q1 of. the control circuit 2 and its emitter connected to the collector of the transistor Q3 whose emitter is connected to earth. The base and emitter of the transistor Q2 are also connected together via a resistor R11.

The base of the transistor Q3 is connected to earth via a resistor R9.

When the control signal to open the valve means reaches the microprocessor 4, the latter supplies the signals EN1 and EN2 to the monitoring circuit 5 and the control circuit 2 respectively. The signal EN1 has, in standard operating conditions, an amplitude and frequency value comprised respectively within a predetermined range of voltage values and a predetermined range of frequency values. Similarly, the signal EN2 has an amplitude value greater than a predetermined value. In these conditions, the transistors Q1 and Q4 conduct. When an alternating voltage signal passes through Q4, Q2 and Q3 are also caused to conduct and in this way the control circuit 2 is enabled. If a voltage signal greater than the threshold value imposed by the Zener diode D2 is present at the input terminal IN (EN2), the transistor Q1 conducts and a current excites the relay 3. The valve

means are opened and kept open by the relay 3 as long as the signals EN1 and EN2 are being supplied to the circuits 5 and 2.

According to a main characteristic feature of the invention, in the case of a malfunction of the microprocessor 4 or in the supply of the supply voltage Vcc and/or Vr, the valve means are kept closed because there are no control signals EN1 and EN2, or because there is no excitation current for the relay 3. In this way the device 1 acts as a "watchdog"of the microprocessor 4 and of the supply voltage Vcc and Vr.

If the alternating voltage signal EN1 and/or direct voltage signal EN2 is of an amplitude respectively lower than the lower end of the predetermined range of voltage values and/or the predetermined threshold value, the conducting threshold of the Zener diode D5 and/or D2 is not reached and there is therefore no supply to the base of the transistor Q4 and/or Q1. No current therefore circulates in the circuit 2 and the valve means remain closed.

Moreover, voltage signals supplied to the monitoring circuit 5 having an amplitude which is too high are chopped by the Zener diode D4 and/or D4.

When the signal EN1 is direct voltage rather than alternating voltage or has a frequency lower than the lower

end of the predetermined range of frequency values, the transistors Q2 and Q3 cannot conduct as the passage of such a signal between the transistor Q4 and the bases of the transistors Q2 and Q3 is blocked by the capacitorsF-C2 and C3.

Moreover, when the frequency of the signal EN1 is lower than the lower end of the frequency value range, the loading of the electrolytic capacitor C4 is insufficient to cause the transistors Q2 and Q3 to conduct since, in this case as well, current cannot circulate in the control circuit 2.

Similarly, the passage of a signal EN1 having a frequency higher than the upper end of the predetermined range of frequency values is blocked by the capacitor C5.

According to a further characteristic feature of the invention, the monitoring circuit 5 comprises safety means adapted to prevent current from circulating in the control circuit 2 and therefore the opening of the valve means, when there is a malfunction of one or two components of the control circuit 2 or the monitoring circuit 5.

Three transistors Q1, Q4, Q3 or Q1, Q4, Q2, a single capacitor of the pair C2, C3 and a single Zener diode of the pair D3, D4 in parallel with one another are in fact sufficient to perform the"watchdog"function for the microprocessor 4 and the supply voltage Vcc as described above. The fact that a fourth transistor Q2 (or Q3), the

diode D8, a second capacitor C2 or C3 and a second Zener diode D3 or D4 have been added to the monitoring circuit 5, makes this monitoring circuit 5 safe to the second malfunction, since if there is a malfunction qn any two components of the monitoring circuit 5 or the control circuit 2, the device 1 remains safe, i. e. the control circuit 2 does not have current passing through it and the valve means remain closed. The term"malfunction"means either a short circuit of the component in question or that this component is behaving as an open circuit. For specific components, such as the transistors, the term malfunction may also mean the combination of a short circuit and an open circuit.

The device of the invention therefore resolves the problem as stated and offers a number of advantages in comparison with known solutions.

A first advantage lies in the fact that a single device performs the functions of control of the operation of the microprocessor and of the correct supply of the supply voltage independently and autonomously from further external circuits connected thereto; moreover, it is safe to the second malfunction, i. e. even when two of its components independently malfunction it remains safe and does not cause the valve means to open.

As the device is, moreover, independent from the

operation of external circuits, it is modular and can therefore be used in many different applications.

The device of the invention also enables the use of a microprocessor which may be more simple and economic, as the microprocessor is not responsible for controlling any malfunctions of the device and therefore does not require any complex software.

The device is also very simple to manufacture, enabling the production of a low cost product.