METHOD, COMPUTER PROGRAM PRODUCT AND ARRANGEMENT FOR GUARDING AN AUTOMATED PROCESS TO OPERATE A HOUSEHOLD APPLIANCE BASED ON A SENSOR MEASUREMENT TO PROVIDE AN EXPECTED PROCESS PARAMETER

In modern household environments, customers using household ap ^¬ pliances are accustomed to save time in order to save as much of their spare leisure time for recreational or hobby purposes. The industry has taken care of this desire by providing automated ovens, driers, washing machines and the like. Such devices fol ^¬ low a pre-programmed process in order to perform their respec ^¬ tive tasks. The more complicated the household appliances be ^¬ come, the more they depend on sensor information provided in or- der to control that they perform the automated process correct ^¬ ly. Due to a malfunction of a sensor or of the associated con ^¬ trol device or an operational error of an operating person damage can be caused, hazardous to objects that are subject of the automated process or dangerous in situations where the use of high energy, e.g. for heating, is a basis of the automated pro ^¬ cess. Under these circumstances, there is a substantive require ^¬ ment to safeguard the proper functioning of an automated process or, in case this is not possible, to stop the process immediate ^¬ ly.

In the German publication DE 3146566 Al related to a process to supervise the proper functioning, a functional element of a household appliance deals with the comparison of an actual sen ^¬ sor measurement with an expected value and the generation of a failure signal in case an inadmissible discrepancy between the values is detected. The invention is based on the problem to improve the proper functioning of a household appliance.

This problem is solved by a method for guarding an automated process to operate a household appliance based on a sensor meas ^¬ urement according to claim 1, by a computer program product according to claim 13, and an arrangement according to claim 14.

Advantageous embodiments of the invention are given in the de- pendent claims.

Advantageously, the method according to the present invention, in addition to sensor information for a response to a failure, takes a control parameter into account. This allows it to better adapt a failure response to a present state of the automated process .

Beneficially, according to a further development of an embodi ^¬ ment of the method according to the present invention, the pro- cess is stopped in case no process parameter is measured. Thus, the method according to this further development can properly respond to a non-connected or a misplaced sensor.

Beneficially, according to a further development of an embodi- ment of the method according to the present invention, if a measured process parameter cannot be determined, it is extrapo ^¬ lated from a previous measurement, and a weighted failure is de ^¬ termined based on a magnitude of a control parameter. In this manner, an adapted response to a corresponding failure is facil- itated.

Favorably, a corresponding action is performed in case the pro ^¬ cess parameter cannot be measured properly. In this manner as well, the evaluating side of the measurement chain as the deter ^¬ mination side of the measurement chain are taken into account in the failure response. Beneficially, according to a further development of the method according to the present invention, the failure evaluation is based on an interdependency in a manner that a control parameter leads to an expected range of a process parameter. In this man ^¬ ner, a response to a measured process parameter can accurately be evaluated by facilitating the decision-making in basing it on a range of process parameter.

Favorably, in case the process parameter is out of range, a weighted failure is determined based on the control parameter and a difference between the expected process parameter and a measured process parameter. In this manner, an adequate response can be provided.

Beneficially, according to a further development of a method ac- cording to the present invention, zones with defined control pa ^¬ rameters are provided and a zone and an associated process pa ^¬ rameter are verified. In this manner, beneficially an error per ^¬ formed by an operator, such as a misplacement of the sensor in the wrong zone, can be accommodated and properly processed.

Advantageously, according to a further development of the method according to the present invention, in case plural failures have occurred, after a first threshold has been transgressed, a first message is generated, and after a second threshold transgression has occurred, the process is stopped. In this manner, corrective measures by an operator can be initiated, and in case they do not happen, the automated process beneficially stops and thus hazardous failures are reliably avoided. Beneficially, according to a further development of a method ac ^¬ cording to the present invention, the household appliance is re ^¬ alized in a kitchen hob, such as an induction hob, as in this case high energies are applied which may cause corresponding hazardous failures.

Favorably, according to a further development of the method ac ^¬ cording to the present invention, a temperature is measured as a process parameter, and a power input is associated as a control parameter to the temperature. In this manner, beneficially a ma ^¬ jority of automated processes in a kitchen environment can be efficiently and securely guarded by the method of the present invention .

Advantageously, a computer program product according to the pre ^¬ sent invention comprises instructions to perform the method steps of the present invention in form of process steps when they are executed by a processor. In this manner, the method ac- cording to the present invention can be implemented on the basis of a general purpose microprocessor in a household appliance. Favorably, such processors are already used to implement the au ^¬ tomated process. Advantageously, according to an arrangement of the present in ^¬ vention, only a minimum number of components are required that allows implementing a method of the present invention in the form of hardware in a technically most efficient way. Further, advantageously, according to a further development of the arrangement according to the present invention, a line con ^¬ nection is established between the sensor and the control unit of the kitchen hob. Thus, a technically easy-to-implement con- figuration is provided that at the same time is reliable and can be implemented with a minimum number of parts.

Subsequently, examples of the invention will be further ex- plained on a basis of embodiments shown in drawings, wherein shows an overall process flow;

shows an overall process flow for failure determina ^¬ tion;

shows a failure handling in case of a read error;

shows a failure determination in terms of signal strength;

shows a failure determination in terms of temperature range ;

shows a failure determination in terms of non- increasing temperature;

shows a failure determination in terms of a temperature jump; and

shows an example of an arrangement according to an em ^¬ bodiment of the present invention.

As Fig. 1 shows, an example of an overall process flow is pre ^¬ sented. In particular, in the detection of possible failures ei ^¬ ther based on malfunctions or operator errors, preferably a failure routine is required in order to detect failure, to switch on failure detection and to resort to particular failure handling routines.

In 1000, the user starts a sensor-operated process e.g. by pressing a button or generating some sort of detectable signal actively or by his presence detected by an e.g. infrared sensor. At 1010, this process is stopped, if an error counter is smaller than a io beneficially a one digit number starting from two. At 1020 it is verified how much time has passed since the last stop by error. In the affirmative case if bio usually a single digit minute value is exceeded, the process is stopped by 1030 due to too many failed tries. At 1040, it is determined if temperature readings are available from the sensor. If this is not the case, the process is stopped at 1050 due to the assumption that there is no sensor present. In case there are proper sensor readings available, it is determined at 1060, if the temperature is smaller than Cio beneficially a two digit number in the middle of the cooking temperature range around 40 to 60°C. If not, the au ^¬ tomated process is preferably stopped at 1070, as the starting temperature is judged to be too hot to e.g. run some of the au ^¬ tomated functions. At 1080, an automated e.g. cooking program is started. At 1090, it is detected if there is a cooking pot on a cooking zone. If this is not the case, at 1100 the process is stopped by error due to no pot presence. Since now in case a pot is detected to be present a cooking phase has started, a failure detection running phase is commenced at 1110. At 1130, it is de ^¬ termined if a cooking program has been stopped by an error. If this is the case, it is detected at 1150 if eio beneficially a single digit number of minutes have passed since it has last been stopped by an error. If this is not the case, a stopped-by- error counter is increased by 1 at 1190. If it is the case, the stopped-by-error counter is set to 1 at 1220. At 1230, the pro- gram is stopped due to failure detection. At 1160, it is deter ^¬ mined if a cooking program has ended. If this is the case, the cooking zone is switched off at 1200. After that, the failure detection is stopped at 1240. At 1120, it is waited for e.g. dio seconds a duration in the range of the duration of the measure- ment cycle plus some buffer time. At 1140, it is determined if there is an answer from a reader from the sensor-automated pro ^¬ cess. If this is not the case, a failure detection running phase is entered again at 1110. If it is the case, it is determined if fio a suitable single digit number of minutes e.g. between 3 to 7 have passed since the last error stop due to an error has oc ^¬ curred at 1170, if not, a stop-by-error counter is increased by 1 at 1180. If affirmative, the stop-by-error counter is set to 1 at 1210. The failure detection running phase is then stopped at 1250.

Fig. 2 gives an example of a failure detection running process 2000. At 2100, a subroutine is commenced that determines if there is a pot on a dedicated cooking zone. At 2105, failure de ^¬ tection is performed if no pot is present, and subsequently, ir ^¬ respective of the result, a next failure detection subroutine related to a read error in evaluating the sensor data at 2200 is commenced. Irrespective of the presence of a read error or not, which is determined at 2205, a next failure detection subroutine related to a low signal strength is commenced at 2300. In this routine, it is determined if there is enough signal strength present at a signal received from a sensor at 2305. Irrespective of the result of the determination, e.g. a next failure detec- tion subroutine is commenced in order to determine if a measured temperature is within a predefined range. At 2405, range detec ^¬ tion is performed, and independent from the result of this de ^¬ termination, preferably another failure detection subroutine is then started at 2500 to determine if the temperature is increas- ing. A decision is made at 2505 if this is the case, and irre ^¬ spective of the decision, preferably another failure detection subroutine to determine a temperature jump is commenced at 2600. A determination is performed at 2605, if a temperature jump is present, and irrespective of the result of the outcome of this determination, another failure detection subroutine preferably related to a pause in the heating is commenced at 2700. A deter ^¬ mination is performed at 2705 if there is a break in the heat- ing, and irrespective of the outcome of this determination, the failure detection is stopped at 2800.

Generally, the selection of a waiting time is preferably select- ed in order to compensate for a measurement cycle and the read ^¬ out of a buffer which may preferably add up to 2 seconds plus 0.5 seconds. A measurement cycle maybe understood as a concate ^¬ nation of the various failure detection routines from strep 2000 to 2800.

Subsequently, examples of individual subroutines are further ex ^¬ plained .

As Fig. 3 shows at 2200, a failure detection regarding a reader error of e.g. a temperature reader is commenced. At 2210 it is determined if a reader error is present. If not, at 2215 a read ^¬ er error counter is set to zero, and at 2265, the reader error detection is stopped. Else, at 2220, different temperature val ^¬ ues are collected as process parameter and processed, e.g. a temperature value at a point time t is estimated by performing a calculation basing it on a temperature value measured at a time t-1 plus a difference of the temperature values between times t- 1 and t-2. At 2225, a power value as a control parameter is es ^¬ timated e.g. a power setting can be read. At 2230, for a deter- mining a weighted failure error, a determination is performed preferably in which range the estimated power is. In case it is between zero and a3o watts a value in the lower hundreds between 100 and 400, preferably an error value of d3o is allocated. If it is between a3o watts and b3o watts preferably a value in the upper hundreds and single digit thousands between 800 to 1400, an er ^¬ ror value of e3o is also preferably allocated. In case an esti ^¬ mated power is between b3o watts and C30 watts preferably a value in the single digit thousands between 1400 to 2600, an error value of f3o is allocated. If the estimated power is greater than c ₃₀ watts, the error value is preferably allocated to g ₃₀ . The values may preferably be in the single digit range and some of them may even be the same as well. At 2235, an accumulated error is determined by adding the error value to the reader counter error. At 2240, it is determined if the reader error counter has a value of greater than h ₃₀ favorably a lower single digit number in relation to the total sum of the allocated error values be ^¬ tween e.g. 2 and 6. If this is not the case, the failure detec- tion is stopped at 2265. If it is the case, a warning is issued to an operator at 2245 e.g. by generating a message or an audi ^¬ ble or viewable signal. At 2250, a reader error counter evalua ^¬ tion is performed. If it is greater than 130 e.g. a suitable val ^¬ ue between 8 and 14, the process stops at 2260. If it is smaller than 130, the failure detection is stopped at 2265.

Beneficially, if there is no answer, e.g. from a measurement subsystem in case it is expected, a failure of the system is de ^¬ tected. A corresponding handling of this failure is a switch off of the automated process and a switch-off of a power to a dedi ^¬ cated e.g. cooking zone. In case e.g. an internal failure is present at a reader of sensor data, preferably in case if a cur ^¬ rent measured temperature is not present it is replaced with an extrapolated temperature value, e.g. a weighting of this failure is depending on an estimated power.

Beneficially, the higher the power is, the higher the weighting factor should be that is associated to the failure. Beneficially, the weighting factor is the sum of the failures multiplied with each weighting factor. In case there is a first allocated limit that is exceeded by the weighted failures, bene ^¬ ficially a warning message or an error code may be generated in order to be read-out by an operator. Usually, the operator is a person that cooks food and is present in front of the kitchen hob. If there is a second defined higher failure limit provided which is transgressed, the power will beneficially be switched off in order to stop the automated process. After that, benefi ^¬ cially the counter of weighted values is reset to zero, once there exists a measurement cycle without any failure.

Fig. 4 shows an example of another subroutine. In this case this is dealing with the presence of enough signal strength in a signal received from a sensor performing measurements of a process parameter of the automated process. It is started at 2300. Next, at 2310, a determination is performed if the signal strength is high enough, e.g. if it is above or below a threshold. If it is not below a threshold, a low signal strength counter is set to zero at 2330, and the subroutine is stopped at 2360. In case the signal strength is below this threshold at 2310, temperature es ^¬ timation is performed in a similar manner as was explained in step 2220 a current value is determined by an estimation based on previous measurements. After that, at 2230, an estimated pow ^¬ er is gathered. In this case, this can be done by determining a switch state of a kitchen hob or by measuring an actual power. In an analogous manner as it was explained in Fig. 3, an error value is associated to a respective estimated power at 2325. .

In case it is between zero and a ₄ o watts a value in the lower hundreds between 100 and 400, preferably an error value of d ₄ o is allocated. If it is between a ₄ o watts and b ₄ o watts preferably a value in the upper hundreds and single digit thousands between 800 to 1400, an error value of e ₄ o is also preferably allocated. In case an estimated power is between b ₄ o watts and c ₄ o watts preferably a value in the single digit thousands between 1400 to 2600, an error value of f ₄ o is allocated. If the estimated power is greater than c ₄ o watts, the error value is preferably allocat ^¬ ed to g ₄ o · The values may preferably be in the single digit range and some of them may even be the same as well. In this case it has been provided that four error values can be associated, whereas between 0 and 12 0 0 watts, the error values are the same. It can be, however, beneficial to provide more or less error values and to perform other discriminations and allo ^¬ cations than the ones given in this example here. At 2335 , the determined error value is set for the low signal strength coun ^¬ ter. At 23 40 , it is determined if the low signal strength coun ^¬ ter is of a value larger than h ₄₀ favorably a lower single digit number between e.g. 2 and 6 . If this is not the case, the fail ^¬ ure detection subroutine is stopped at 236 0 . If it is the case, at 23 45 a warning is generated and preferably displayed for an operator or given as an acoustic signal. At 2350 , it is deter ^¬ mined if the low signal strength counter has a value of larger than i ₄ o e.g. a suitable value between 8 and 1 4 . If this is not the case, the failure detection is stopped at 236 0 . On the other hand, if it is the case, the process is stopped at 2355 due to a low signal strength error e.g. because the signal is too weak and thus measured process parameters are unreliable. Preferably, in the case of subroutines 22 0 0 and 23 0 0 , a counter should not be reset and a value should be kept until a next time the sub- routine is performed. In case of a reader error, the reader re ^¬ turns an error instead of a temperature value.

Fig. 5 shows another example of a failure detection subroutine to detect if a temperature reading is not in an expected range. This is started at 2 40 0 . Here it is determined if a temperature reading provided from the sensor is larger than a ₅ o , a tempera ^¬ ture above a usual boiling point of water for instance e. g. in the range between 1 05 and 1 15 °C. If this is not the case, the temperature out of the range counter is beneficially set to zero at 2425, and the failure detection subroutine related to this failure is stopped at 2455. On the other hand, if a larger tem ^¬ perature reading is present, an estimated power is gathered at 2405 and in a similar manner at 2420 as explained in subroutines 2200 and 2300 at steps 2230 and 2325, an error value is allocat ^¬ ed to a respective estimated power.

In case it is between zero and b ₅ o watts a value in the lower hundreds between 100 and 400, preferably an error value of d ₅ o is allocated. If it is between b ₅ o watts and c ₅ o watts preferably a value in the upper hundreds and single digit thousands between 800 to 1400, an error value of e so is also preferably allocated. In case an estimated power is between C ₅₀ watts and dso watts preferably a value in the single digit thousands between 1400 to 2600, an error value of f so is allocated. If the estimated power is greater than dso watts, the error value is preferably allocat ^¬ ed to gso · The error values may preferably be in the single digit range and some of them may even be the same as well for differ ^¬ ent power ranges.

However, in this case, four discrete error values may benefi ^¬ cially be allocated ranging from 0 to 3 or 5 or 7 or 9. For small powers between 0 to 300 watts, the error value here e.g. is set to 0. The other error values correspond to the ones that are allocated in the above-listed process steps 2230 and 2325. They may be attributed to respective power ranges in a linear manner referring to the total value range or in some distribution manner according to a function such as logarithmic or exponential function. It is conceivable that a low heating power will not affect a temperature change very much, once a temperature is measured very high, and thus the error value being allocated to 0 in such a case is reasonable. In a next step, a temperature out-of-range counter is set to the determined error value at 2430. At 2435, it is checked if the temperature out-of-range counter has a value of larger than h ₅₀ favorably a lower single digit number between e.g. 2 and 6. If this is not the case, the temperature failure out-of-range de ^¬ tection is stopped at 2455. On the other hand, if it is the case, in a first step at 2440, a warning is generated and pre ^¬ sented to the operator in the form of a reading on a display or an acoustical message or a light indication or another form of short-range or long-range communication.

In the next step, a second threshold for a temperature out-of- range counter is evaluated. Here, the threshold is set to iso- In case the counter value is not larger than i ₅ o e.g. a suitable value between 8 and 14, the next step will be 2455 to stop the corresponding failure detection subroutine. On the other hand, if the value is transgressed, the automated process is stopped and an indication is given that a temperature is out of range at 2450. Such a failure subroutine is preferably detecting read-out temperature values, which are out of the expected temperature range, such as which are defined for the offered automated pro ^¬ cess respectively an assisted cooking program. Beneficially, it is detected as a failure, if the measured tem ^¬ perature value is higher than the defined threshold. If a too high temperature is measured, it is an indicator for a misuse of the probe including the sensor. A weighting of such a failure is preferably depending on an estimated power. The higher the pow- er, the higher the weighting factor is. The weighted failure is beneficially the sum of the failures multiplied with each weighting factor. If there are two limits, one first threshold and a second one, at a first stage, a warning message may be is- sued, and at a second stage, the automated process is stopped, respectively the power of a cooking zone may be switched off.

As Fig. 6 shows, another example of a failure detection subrou- tine is about the determination of the presence of an increasing temperature which is started at 2500. In this case, in a first step 2510, an estimated power is gathered. At 2515, a calibra ^¬ tion program is preferably executed. In one case it is deter ^¬ mined if a sensor temperature is below C6o°C, e.g. a value below the boiling point of water, preferably between 90 and 98 °C and an estimated power is larger than g ₆₀ , a value in the lower hun ^¬ dreds between 100 and 400 watts. If this is not the case, then the associated failure detection subroutine is terminated at 2580. On the other hand, if the sensor temperature reading is smaller than a6o°C, e.g. a value below θς,ο, preferably between 80 and 89 °C and an estimated power higher than g6o watts, step 2530 is entered, which is also entered in case the determination 2520 is affirmative. Then, at 2530, a determination is performed if a temperature measured by the sensor at the point in time t is larger than a sensor temperature reading at a point in time t-1 plus e ₆ oS e.g. a single digit second value in the range of the duration of the measurement cycle times f ₆ oK/s e.g. a suitable value for the temperature gradient between 0.01 to 0.09 K/s or more. In case this is affirmative, a no-failure counter is in- creased at 2540. At 2545, it is determined if the no-failure counter is larger than k ₆₀ , favorably a lower single digit number between e.g. 2 and 6. If this is not the case, the failure de ^¬ termination subroutine is stopped at 2580. On the other hand, if this is the case, a temperature out-of-range counter is set to 0 at 2555. On the other hand, in a similar manner like at step

2420, an error value is associated to an estimated power in e.g. four discrete steps from ranging from 0 to 3 or 5 or 7 or 9 as explained in step 2420. In case it is between zero and g ₆ o watts a value in the lower hundreds between 100 and 400, preferably an error value of n ₆₀ is allocated. If it is between g ₆₀ watts and h ₆₀ watts preferably a value in the upper hundreds and single digit thousands between 800 to 1400, an error value of o ₆₀ is also preferably allocated. In case an estimated power is between h ₆₀ watts and ίβο watts preferably a value in the single digit thousands between 1400 to 2600, an error value of p ₆ o is allocated. If the estimated power is greater than i ₆₀ watts, the error value is preferably allocat ^¬ ed to q ₆ o · The error values may preferably be in the single digit range and some of them may even be the same as well for differ ^¬ ent power ranges. Once this is done, at 2550, the temperature out-of-range counter is preferably set to this error value. At 2560, a determination of a value of the temperature out-of-range counter is performed. If it is not larger than leo favorably a lower single digit num ^¬ ber between e.g. 2 and 6, the failure determination subroutine is stopped at 2580. On the other hand if this is the case, mean ^¬ ing larger than leo, at a first stage, a signal or warning to in ^¬ form an operator is generated and presented to him. At 2565, in a second step at 2570, a second threshold of η¾ο favorably a low ^¬ er double digit number between e.g. 14 and 28 is evaluated for the temperature out-of-range counter. If it is not above η¾ο, then the failure detection subroutine is stopped at 2580. On the other hand, the automated process is stopped at 2575, if the temperature out-of-range counter is higher than m ₆₀ . As indicated above, other values may be chosen to perform discrimination in the process, and more or less subroutines may also be performed depending on the application case. A subroutine to detect such an above failure may be useful in case of an automated process, where plural cooking zones are present when an automated assisted cooking program is performed, and in order to determine if the sensor probe is placed at the right cooking zone. If power above a certain value is applied to the cooking pot, then the temperature should increase signifi ^¬ cantly, once it is significantly below the boiling point. If this is not the case, the pot may be placed in the wrong zone. Beneficially, the temperature should be increasing with a cer ^¬ tain gradient. Thus, a temperature change must be present, if a heating is performed. Such a gradient may be set depending on the applied power. Other implementations not depending on the power are possible as well.

As Fig. 7 shows, another failure detection subroutine may be performed in order to determine a jump in the temperature. This is started at 2600. At 2610, it is determined if a temperature reading at a point in time t is larger than an extrapolated val- ue plus a ₇ oK or smaller than an extrapolated value - a _? oK, meaning a range determination is performed for the temperature at this point in time to be within a +/- a?o Kelvin range from the ex ^¬ trapolated value. a ₇ o favorably being a higher single digit value between e.g. 4 and 9. If this is not the case, the corresponding failure detection subroutine is stopped, as apparently there is no jump present in the measured temperature. On the other hand, at 2615, an estimated power is gathered like in steps 2415 and 2510 that were explained above. At 2620, error values are allo ^¬ cated to certain power ranges ranging from 0 to 3 or 5 or 7 or 9. This means that e.g. here four discrete power ranges may be defined and associated to four discrete power values analogue to the other above-mentioned steps e.g. 2420 and 2535. In case it is between zero and b ₇ o watts a value in the lower hundreds between 100 and 400, preferably an error value of d ₇ o is allocated. If it is between b ₇ o watts and c ₇ o watts preferably a value in the upper hundreds and single digit thousands between 800 to 1400, an error value of e ₇₀ is also preferably allocated. In case an estimated power is between c ₇ o watts and d ₇ o watts preferably a value in the single digit thousands between 1400 to 2600, an error value of f ₇ o is allocated. If the estimated power is greater than d ₇ o watts, the error value is preferably allocat- ed to g ₇ o · The error values may preferably be in the single digit range and some of them may even be the same as well for differ ^¬ ent power ranges.

At 2625, a temperature jump counter error value is set to the determined error value. At 2630 it is determined if the corre ^¬ sponding counter value is larger than h ₇ o favorably a lower single digit number between e.g. 2 and 6. If this is not the case, the failure detection subroutine is stopped at 2650. In an af ^¬ firmative case, a warning is generated at 2635 and presented to an operator. In a further step, it is determined if the tempera ^¬ ture jump counter has a value of larger than i ₇ o favorably a low ^¬ er double digit number between e.g. 10 and 18. If this is not the case, again the failure detection subroutine is stopped at 2650. On the other hand, if the value is higher than at 2645, the automated process is stopped with an error regarding a tem ^¬ perature jump, e.g. indicating a cooking zone can be switched off and a corresponding cooking program can be stopped as well, while at the same time an indication may be given at a display unit that something is wrong with the program and the user should interact. This can also be done by a flashing light or by an audible message. Beneficially, during an automated process, e.g. a running cooking program, the counter of weighted failures for temperature jumps will never be reset and always accumulate the corresponding values.

With such a failure detection subroutine, it can be e.g. deter- mined if an operator removes the sensor from one pot and puts it into another pot. There may be other failure detection subrou ^¬ tines regarding a corresponding power profile. With such a failure detection subroutine, it can be detected and determined if the temperature sensor is in a pot allocated to a zone for which an assisted cooking mode in form of an automated process is per ^¬ formed. In particular, an exchange of a pot with water which is intended to be heated up, which is replaced by a pan filled with oil, can lead to a severe hazard. In such a case, to detect cor ^¬ responding failures, a correlation between an applied power and a temperature change beneficially can be used. If power is ap ^¬ plied, the temperature increases, and if no power is applied, the temperature remains mainly unchanged, except e.g. by the be ^¬ havior caused by the time constants of the system. In such a case, firstly power is applied for a certain period of time, and then no power is applied and the temperature values are checked if they correlate to the power profile. In order to avoid over ^¬ heating of a wrongly placed object, the maximum amount of energy for the first part of this evaluation may be limited. In order to acquire more measurement values by using a fixed measurement rate, a first phase can be prolonged by limiting/reducing the amount of power and using the same amount of energy. This pro ^¬ longation beneficially reduces the influence of the time con ^¬ stants of the system. In order to find out the temperature change per time when heat ^¬ ing up, the difference between the current temperature and the old temperature value is calculated e.g. every measurement cycle until the defined level of energy is reached. With the largest difference determined, the slope for the extrapolated value is fixed for the following evaluation. After a defined level of energy is reached, the power is switched off, until the measured temperature value is lower than the extrapolated temperature, which may be determined in form of a calculated temperature with fixed slope +5 K. For more accurate sensors, a smaller change may be sufficient. Such a condition may e.g. need to become true within a defined time, otherwise it is determined that the tem ^¬ perature probe / sensor is not placed in the chosen cooking zone and the automated process is stopped. In case this condition be ^¬ comes true within the defined time limit, the cooking zone is switched on again with the maximum power value. Such a failure is e.g. only repeated if the pot detection detects no pot. Fig. 8 shows an example of an arrangement according to an embod ^¬ iment of the present invention. Here, a cooking hob 8000 is shown which comprises several cooking zones 8100, 8200, 8300 and 8400. On one cooking zone, a pot 8450 is placed. This pot may be subject to heating in an automated process which needs to be guarded according to a method of the present invention.

In this case, also a controller 8500 is present which is con ^¬ trolling the measurements of a sensor probe 8550 which is placed inside of the cooking pot to measure the temperature of a sub ^¬ stance that is to be heated there. The controller 8500 may as well perform the automated process as the method of the present invention. For instance, it may comprise a memory and a memory reader 8600, where a corresponding program to effect an automated process stored on a data carrier can be inserted and read. The program can be stored on the memory card or another suitable device or may be transferred wirelessly into a memory of the controller 8500. Then, it will be read out by a computing unit of the controller and performed in a sequence of steps as indi ^¬ cated in the method steps of Fig. 1 to Fig. 7, for instance. Also storage medium 8810 is depicted that contains computer in ^¬ structions 8810 in form of program code or the like. That when executed by a computing unit of the hob 8000 such as the con ^¬ troller 8500 make it execute the guarding of the automated pro ^¬ cess.

Above, embodiments and examples of the invention have been giv ^¬ en. There may be other values used, and there may be a sub- selection of steps performed. The sensor may be connected by wire 8560 or wirelessly to the controller 8500. A range of household appliances may be subject to automated processes.

Here, a kitchen hob in a kitchen environment has been discussed. There may be, however, other applications as washing machines, driers or microwave ovens where the present invention may bene ^¬ ficially be applied.

List of reference numerals

1000, 1010, 1020,

1030, 1040, 1050,

1060, 1070, 1080,

1090, 1100, 1110,

1120, 1130, 1140,

1150, 1160, 1170,

1180, 1190, 1200,

1210, 1220, 1230,

1240, 1250 Steps of an overall process flow

2000, 2800 Failure detection running process

start stop

2100, 2105 Pot Detection

2200, 2205 Reader Error Detection

2300, 2305 Signal Strength Error Detection

2400, 2405 Temperature Range Error Detection 2500, 2505 Rising Temperature Error Detection 2600, 2605 Jumping Temperature Error Detection 2700, 2705 Pause Heat Up Error Detection

2210, 2215, 2220

2225, 2230, 2235

2240, 2245, 2250

2260, 2265 Steps of a Subroutine for Reader Error

Detection

2310, 2320, 2325,

2330, 2335, 2340,

2345, 2350, 2355, 2360 Steps of a Subroutine for Signal

Strength Error Detection

2410, 2415, 2420,

2425, 2430, 2435,

2450, 2455 Steps of a Subroutine for Temperature

Range Error Detection 2515, 2580, 2530,

2520, 2540, 2545

2580, 2555, 2430,

2550, 2560, 2580,

2565, 2570, 2580,

2510, 2575, 2580 Steps of a Subroutine for Rising

Temperature Error Detection

2610, 2615, 2535

2620, 2625, 2630,

2650, 2635, 2645,

2650 Steps of a Subroutine Jumping

Temperature Error Detection

1000 Cooking Hob

1100, 1200,

1300, 1400 Cooking Zone

1450 Pot

1500 Controller

1550 Sensor Probe

1600 Memory Reader

1560 Cable, Wire

1800 Storage Medium

1810 Instructions