EN 14459:2007

2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.Control functions in electronic systems for gas burners and gas burning appliances - Methods for classification and assessmentKrmilne in nadzorne funkcije v elektronskih sistemih za plinske gorilnike in plinske aparate - Metode za klasifikacijo in ocenjevanjeFonctions de commande des systemes électroniques pour les bruleurs a gaz et les appareils a gaz - Méthode de classification et d'évaluationRegel- und Steuerfunktionen in elektronischen Systemen für Gasbrenner und Gasgeräte - Verfahren für die Klassifizierung und BewertungTa slovenski standard je istoveten z:EN 14459:2007SIST EN 14459:2008en,fr,de97.100.20Plinski grelnikiGas heaters91.140.40Sistemi za oskrbo s plinomGas supply systemsICS:SIST ENV 14459:20041DGRPHãþDSLOVENSKI
STANDARDSIST EN 14459:200801-januar-2008

EUROPEAN STANDARDNORME EUROPÉENNEEUROPÄISCHE NORMEN 14459November 2007ICS 91.140.40; 97.100.20Supersedes ENV 14459:2002
English VersionControl functions in electronic systems for gas burners and gasburning appliances - Methods for classification and assessmentFonctions de commande des systèmes électroniques pourles brûleurs à gaz et les appareils à gaz - Méthode declassification et d'évaluationRegel- und Steuerfunktionen in elektronischen Systemenfür Gasbrenner und Gasgeräte - Verfahren für dieKlassifizierung und BewertungThis European Standard was approved by CEN on 26 March 2007.CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this EuropeanStandard the status of a national standard without any alteration. Up-to-date lists and bibliographical references concerning such nationalstandards may be obtained on application to the CEN Management Centre or to any CEN member.This European Standard exists in three official versions (English, French, German). A version in any other language made by translationunder the responsibility of a CEN member into its own language and notified to the CEN Management Centre has the same status as theofficial versions.CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Cyprus, Czech Republic, Denmark, Estonia, Finland,France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal,Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland and United Kingdom.EUROPEAN COMMITTEE FOR STANDARDIZATIONCOMITÉ EUROPÉEN DE NORMALISATIONEUROPÄISCHES KOMITEE FÜR NORMUNGManagement Centre: rue de Stassart, 36
B-1050 Brussels© 2007 CENAll rights of exploitation in any form and by any means reservedworldwide for CEN national Members.Ref. No. EN 14459:2007: E

Reset functions.26 J.1 General.26 J.2 Classification.26 J.3 Construction requirements.26 J.4 Performance requirements.26 J.5 Protection against internal faults for the purpose of functional safety.27 J.6 Long term performance.27 J.7 EMC/Electrical requirements.27 J.8 Marking, installation, operating instructions and declarations.27 Annex K (normative)
Temperature control functions (TCF).28 K.1 General.28 K.2 Classification.29 K.3 Construction requirements.30 K.4 Performance requirements.30 K.5 Protection against internal faults for the purpose of functional safety.30 K.6 Long-term performance test.30 K.7 EMC/Electrical requirements.31 K.8 Marking, installation, operating instructions and declarations.31 Annex L (normative)
Gas shut-off function.33 L.1 General.33 L.2 Classification.33 L.3 Construction requirements.34 L.4 Additional safety measures.35 L.5 Performance requirements.35 L.6 Protection against internal faults for the purpose of functional safety.35 L.7 Long-term performance test.36 L.8 EMC/Electrical requirements.36 L.9 Marking, installation, operating instructions and declarations.37 Annex M (informative)
Hazards in gas appliances handled by control functions.39 Annex N (informative)
Control standards for gas burners and gas burning appliances.43 Annex O (informative)
Examples of new solutions.44 Bibliography.48

For electronic controls covered by CEN/TC 58 a consensus was reached by assuming two faults, including hardware and software, that should result in a safe situation. Class C software is regarded as equivalent to this two fault assessment.
In the appliance standards, only specific fault conditions are considered when controls complying with CEN/TC 58 standards are used, e.g. flame simulation and air proving before each new start. In some cases (e.g. switch contacts) shorting is excluded when certain tests have proven that the probability for fault occurrence is low. For gas valves it is considered that a single valve is not sufficient. Regarding protection against overheating of gas appliances reference is made to EN 60730-2-9. For electronic temperature controls, the safety philosophy is not on the same level as for controls covered by CEN/TC 58 (see e. g. EN 483:1999, 5.6.7.6 where only fault conditions of the sensor are considered, however, other hardware or software faults are not considered). Actually the proper safety level for the control is not specified by appliance committees. This Standard gives the manufacturer and the test authority methods for assessing products in the field of gas controls for which no specific product standards are actually available. The assessment is focused on the controlled parameters (high/low temperature, pressure, flow) in the combustion process and in the functionality of the controls (open/closed; lock/unlock; start/stop). Each control function needs to be classified according to the required safety aspects (class A, class B and class C). To analyse the effect of fault conditions it is essential to know the specific application and the related risk.

This European Standard is applicable to control function blocks that are not covered by a dedicated control standard as specified in Annex F.
This European Standard is intended for type testing. 2 Normative references The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. EN 126, Multifunctional controls for gas burning appliances EN 161:2007, Automatic shut-off valves for gas burners and gas appliances EN 297:1994, Gas-fired central heating boilers - Type B11 and B11BS boilers fitted with atmospheric burners of nominal heat input not exceeding 70 kW EN 298, Automatic gas burner control systems for gas burners and gas burning appliances with or without fans EN 13611:2007, Safety and control devices for gas burners and gas-burning appliances — General requirements EN 50159-2:2001, Railway applications — Communication, signalling and processing systems —Part 2: Safety-related communication in open transmission systems EN 60730-1:2000, Automatic electrical controls for household and similar use — Part 1: General requirements (IEC 60730-1:1999, modified) EN 60730-2-9, Automatic electrical controls for household and similar use — Part 2-9: Particular requirements for temperature sensing controls (IEC 60730-2-9:2000, modified) 3 Terms and definitions For the purposes of this document, the terms and definitions given in EN 13611:2007 and the following apply. 3.1 function block part of an electric or electronic system that realises at least one control function with one input and one output signal 3.2 combustion products discharge function TTB control function that initiates (at least) shut down of the main burner when there is an unacceptable spillage of combustion products at the draught diverter
[EN 297:1994, 1.3.3.2.4] 3.3 reset function function that provides reset from lock-out allowing the system to attempt a restart

[IEC 61508-4:1998] 3.7 gas shut-off function function which switches the gas flow off NOTE The assembly to provide this function may consist of a combination of the following parts: closure members, actuators, sensors and the control electronics. 3.8 automatic shut-off valve valve which opens when energized and closes automatically when de-energized [EN 161: 2007, 3.1] 3.9 shut-off valve
valve that opens and closes the gas flow but does not fulfil all requirements of EN 161 3.10 stored closing energy
SCE energy available (even after interruption of the power supply) to move the closure member into the closed position and keep it closed 3.11 non-permanent operation operation in the running position for less than 24 h 4 Classification EN 13611:2007, Clause 4 shall apply.
In addition, the class of the control function shall be identified by manufacturer’s declaration.
5 Units of measurement and test conditions EN 13611:2007, Clause 5 shall apply.

6.6.6.1 General Potential hazards arising from the use of gas appliances are among others covered by means of control functions. Examples are:  hazard of fire caused by overheating, prevented by the temperature control function;  hazard imposed by the discharge of unburned gas, prevented by the gas shut-off function. Safety classes for control functions required by the relevant appliance standards are the basis for assessing electronic control functions.

In this standard, the fault tolerating time determines the fault reaction time of the Control Function, which shall be equal or less than the fault tolerating time. For new Control Functions, of which the fault tolerating time is not yet described, the fault tolerating time shall be declared by the manufacturer based on a clear description of an assessment of the appliance, with choices that have been made to come to the declared fault tolerating time.
NOTE The relevant appliance standard should describe the fault tolerating time. 6.6.6.3 Fault modes Fault modes on the appliance level shall be considered for assessing a certain control function. If not defined by the appliance standard, fault modes that are specific for the appliance with relation to the control function, shall be declared by the manufacturer, based on a clear description.
7 Performance 7.1 General EN 13611:2007, 7.1 shall apply. 7.2 Leak-tightness EN 13611:2007, 7.2 shall apply. 7.3 Test for leak-tightness EN 13611:2007, 7.3 shall apply. 7.4 Torsion and bending EN 13611:2007, 7.4 shall apply. 7.5 Torsion and bending test EN 13611:2007, 7.5 shall apply. 7.6 Rated flow rate EN 13611:2007, 7.6 shall apply. 7.7 Test for rated flow rate EN 13611:2007, 7.7 shall apply. 7.8 Durability EN 13611:2007, 7.8 shall apply.

Any interference between individual control functions shall be assessed with respect to both the functional condition and any fault conditions. Failures in any function shall not affect safe operation of the control function. Each individual function shall be assessed in accordance with the requirements of this Standard. With regard to a specific component or a group of components, use or application of a multifunctional system shall be classified as one of the following. a) no additional loading on a multifunctional component (for example a sensing element, the signal of which is multiply analysed):
no additional requirement; b) higher load is to be expected (e. g. on relays):
components shall withstand and are to be properly specified for this higher load; c) monitoring or controlling elements associated with two or more function blocks:
each control function shall be able to detect any failure of such elements and process them in a safe way according to their fault behaviour class. Control functions, integrated into a multifunctional system, shall be able to withstand the same long-term performance requirements as required for independent controls. 7.13 Data exchange 7.13.1 General Systems or apparatus with control functions may be connected to separate, independent apparatus or systems (which may themselves contain control functions or provide other information). Any data exchange between these systems or apparatus shall be taken into consideration regarding safety.

Data Safety related (not exhaustive list) Non-safety related (not exhaustive list)Operating data Messages such as “RESET from LOCKOUT” Messages such as on/off instructions, room temperature information Configuration parameters Messages modifying parameters that determine safety related functions Messages modifying parameters that determine performance related functions Software modules Modules downloaded into a system, that determine safety related functions Modules downloaded into a system, that determine performance related functions
7.13.3 Communication of safety related data 7.13.3.1 Transmission Safety related data shall be transmitted authentically concerning:  quantity of data (i.e. all data expected to and from respective addresses);  quality of data (i.e. in a correct and precise manner);  appropriate transmission time. Data variation or corrupted data shall not lead to an unsafe state. This shall be illustrated by assessment according to EN 60730-1:2000, Annex H. In addition to the EN 60730-1 requirements, the following failure modes shall be met: − permanent “auto-sending” or repetition; − interruption of data transfer.
Acceptable measures are specified in EN 60730-1:2000, Annex H. Further examples of measures are given in Table 2. NOTE Special attention is drawn to EN 60730-1:2000, Table H.11.12.7, Clause 6, which mentions data deformation, address deformation or wrong timing or sequences, that can be detailed further, as follows:
 data deletion from the original message;  data insertion into the original message;  corruption of the data in the original message;  change in sequence of data in the original message;

Table 2 — Examples of defences against unauthorized access
Defences Threats Sequence number Time stamp Time-out Feed-back message Source and destination identifier Identification procedure Safety code Crypto-graphic techniques Repetition of a message x x
Deletion of data in a message x
Insertion of data in a message x
x x x
changed sequence of data in a message x x
Corrupted data in message
x x Delay in sending / receiving the message
x x
Masquerade, making an inauthentic message look like an authentic message
x
x
x For further details see EN 50159-2. NOTE This table has been taken from EN 50159-2:2001.
7.14 Specific requirements for other control functions See Annex I, Combustion products discharge function (TTB) See Annex J, Reset Functions See Annex K, Temperature Control Functions (TCF) See Annex L, Gas shut-off Functions NOTE These annexes show the implementation of risk assessment on new functions and/or technologies. Instead of introducing these functions in specific product standards, it was decided to include them in an annex. In time, when there is a better idea of where to implement these functions, they will be moved into specific product standards or stay in this standard.

8 EMC/Electrical requirements EN 13611:2007, Clause 8 shall apply. 9 Marking, installation, operating instructions and declarations EN 13611:2007, Clause 9 shall apply.

(informative) Gas connections in common use in the various countries EN 13611:2007, Annex A should apply.

(informative) Leak-tightness test – volumetric method EN 13611:2007, Annex B should apply.

(informative) Leak-tightness test – pressure loss method EN 13611:2007, Annex C should apply.

(normative) Conversion of pressure loss into leakage rate EN 13611:2007, Annex D shall apply.

(normative) Electrical/electronic component fault modes EN 13611:2007, Annex E shall apply.

(normative) Additional requirements for safety accessories and pressure accessories as defined in EU Directive 97/23/EC EN 13611:2007, Annex F shall apply.

(informative) Materials for pressurized parts EN 13611:2007, Annex G should apply.

(normative) Requirements for controls used in DC supplied gas burners and gas burning appliances EN 13611:2007, Annex I shall apply.

The Control Function TTB consists of a sensing element and a control. The requirements in this clause are applicable for the combination of a sensing element and a control. This clause provides the requirements for electronic TTBs based on a sensing element that monitors a significant physical value in relation to a spillage of combustion products into the environment where the gas appliance is installed. If the spillage becomes unacceptable, the TTB shall initiate a protective action. I.2 Classification The safety class of a TTB Control Function shall be class A, class B or class C, depending on the application. The manufacturer shall declare the class. I.3 Construction requirements I.3.1 General Constructional requirements for electronic controls are given in Clause 6.
In addition:
I.3.2 Adjusting and regulation The TTB shall not be adjustable. Protection against unintended or unauthorized access, is considered to be non-adjustable. I.3.3 Sensing element To withstand a temperature overshoot after a protective action, the sensing element, being in contact with this temperature, shall be able to withstand a maximum temperature as declared by the manufacturer (see Clause I.8). This is the maximum temperature that the sensor will face in its application for a short period of time. During the long-term performance test of I.6.3 b) and d) this extreme temperature shall be maintained for 10 min each for the last 10 cycles. The sensing element of the TTB shall not be removable without tools. Incorrect refitting, after servicing shall be made difficult. For TTB based on sensors other than temperature sensors, equivalent requirements shall be applied. I.4 Performance requirements I.4.1 General
For performance requirements see 7.9.

The manufacturer shall declare the maximum TTB reaction time (being the response time of the sensing element + the response time of the electronics) and the minimum waiting time. Minimum times shall not be decreased and maximum times shall not be exceeded when tested under conditions of I.4, and I.7 as well as after the test of I.6.
I.4.3 Threshold value The manufacturer shall declare the significant physical threshold value and its tolerances to which the TTB responds. This should include:  set point;
 manufacturing deviation on the set point;  drift of the set point. The manufacturer shall supply information explaining the maximum deviation of the set point of the protective action, based on a calculation method using averaging with the mean square value.
When tested under conditions of I.4 and I.7 as well as after the test of I.6, the threshold value shall not be outside the specified tolerances. I.5 Protection against internal faults for the purpose of functional safety I.5.1 TTB as a class B function The requirements for protection against internal faults for the purpose of functional safety as given in 6.6 of EN 13611:2007 shall apply, with the exception of 6.6.3.2 c). The fault reaction time shall be declared by the manufacturer with a limit of 24 h. I.5.2 TTB as a class C function
Requirements for protection against internal faults for the purpose of functional safety as given in 6.6 of EN 13611:2007 shall apply, with the exception of
6.6.4.2 c) and 6.6.4.3 a) of EN 13611:2007.
The fault reaction time shall be declared by the manufacturer. I.6 Long term performance I.6.1 General The performance as declared in I.4 shall be verified after the long-term performance tests.
In this clause, the tests for sensing element(s) assembly and control are described separately. As an alternative, both tests can be integrated into a system test of sensing element(s) assembly and control. If the control is integrated in other controls (e.g. the automatic burner control) the long-term performance tests can be combined.

a) 245 000 cycles from 20 °C up to the maximum operating temperature as declared by the manufacturer; b) 1 000 cycles from the maximum operating temperature up to the temperature which the sensing element should be able to withstand, see I.4; Alternatively the two baths method as described in EN 60730-2-9, may be used: c) 100 000 cycles from 20 °C up to the maximum operating temperature as declared by the manufacturer;
d) 400 cycles in the temperature range from the maximum operating temperature up to the temperature which the sensing element should be able to withstand, see I.4. For TTB based on sensors other than temperature sensors, equivalent requirements shall be applied. NOTE Alternative test methods may be applied if comparable results will be achieved e.g. EN 60730-1:2000, Annex J for thermistors. I.7 EMC/Electrical requirements EMC/Electrical requirements are given in Clause 8. I.8 Marking, installation, operating instructions and declarations Marking, installation, operating instructions are given in Clause 9. In addition, the manufacturer shall declare the following:  safety class;
 maximum reaction time;  minimum waiting time;
 threshold physical value (with tolerances);  temperature which the sensing element is able to withstand;  fault reaction time.

Reset functions J.1 General For automatic controls that are used for the automatic ignition of gas burners and gas burning appliances, provisions are present to ensure that the appliance can be reset from a lock-out condition (e. g. caused by overheating of the appliance or no flame establishment). Traditional methods for resetting heating appliances are: a) conventional mechanical reset switch (no or minor simple electronic components present); b) removing the power supply to the control unit (only accepted in case of volatile lock-out applications); New technologies provide more complex reset devices, such as: c) remote reset devices (e.g. through communication lines/protocols); d) intelligent complex reset devices (e.g. by means of additional hardware and/or software); e) infrared or radio frequency controlled reset devices; f) combinations of a) and b) and c) (e.g. through Internet by means of a modem and a portable telephone). J.2 Classification The reset function shall be class B.
J.3 Construction requirements Construction requirements for electronic controls as given in Clause 6. J.4 Performance requirements Performance requirements are given in Clause 7.
In addition:
A reset action of a gas appliance is supposed to be a clear defined manual action. An automatic reset (e.g. resets generated by automatic devices, like timers etc.) shall not be possible unless it is accepted by specific applications. The reset device shall be capable of resetting the system in a proper way. Unintended or spontaneous resets from lockout shall not occur. Whenever the reset function is performed by a mobile device at least two manual actions are required to activate a reset. Any fault within the reset function shall not cause the appliance to operate outside the applicable requirements. It shall be detected before the next start-up or shall not prevent the appliance from going to shut-down or lock-out.

The applicability of EN 13611:2007, 6.6.3.2 c) shall be considered together with the control function that will be reset. The fault reaction time shall be declared by the manufacturer.
J.6 Long term performance
For long term performance carry out the test as given in 7.10. The performance as declared in J.4 shall be verified after the long-term performance tests.
J.7 EMC/Electrical requirements EMC/Electrical requirements are given in Clause 8. J.8 Marking, installation, operating instructions and declarations Marking, installation, operating instructions are given in Clause 9. Addition:
The manufacturer shall declare the following:  fault reaction time and applicability of EN 13611:2007, 6.6.3.2 c);
 reset by switching of a thermostat, if applicable.

Temperature control functions (TCF) K.1 General Protection against fire and explosion in a gas appliance, as a result of overheating, requires a safety class
system for the temperature control function (in the following called TCF). This is based on a comparison, made between an automatic burner controller and a temperature control function, the implication on safety of either function being considered equivalent. The purpose of the TCF is to control the temperature (temperature regulator) and to prevent the risk of excessive temperature (temperature limiter) which could lead to the hazard of overheating for gas burning appliances.
Traditional solutions, using a combination of mechanical thermostats as specified in the appliance standards (e.g. EN 297, EN 483) have been considered to fulfil the requirements. This assumption is based on specific mechanical solutions, originating from practice over many years and relying on redundancy as the principle.
New solutions will be based on fault assessment approach like EN 298 or EN 60730 series. Gas appliance standards can allow a lower safety class in combination with constructional measures, resulting in an overall TCF safety class C. TCF is a system which consists of temperature sensing, signal processing, switching actions (on/off or protective action) and reset (see Figure K.1).

Key 1
reset 2
sensing element(s) 3
switching action(s) 4
temperature regulator and protective controller 5
protective action 6
on/off 7
control 8
temperature control function Figure K.1 Temperature Control Function K.2 Classification The TCF shall be safety class C.
A lower class may be acceptable if this is proven by the analysis of the preventative measures within the appliance.
A TCF may consist of various independent hardware and software devices. These individual TCF devices shall be classified as class A, class B or class C.
...