Safe Heater Control Best Practice (preventing runaway)

I am doing a system where I have to control a heater on a mold. I will use a PID lood with a PWM output to a SSR to control the heater.

The heater is 1000 Watt, 240V 1 PH.

What I am not sure about is best practice for preventing a runaway condition. I know that when SSR's fail they typically short, allowing current to pass to the heater regardless of the state on the input to the SSR.

I have a bolt on thermocouple on the mold for temperature feedback for the PID.

Is it acceptable to have a contactor upstream of the SSR to open the line voltage if a XXX value above the normal operating range is detected? Im also assuming that this contactor would be in the estop circuit as well, to de energize the heaters in an estop condition.

Can the SAME thermocouple that is used for the PID loop be used to monitor the runaway condition? Or, does a separate thermocouple need to be in place for runaway monitoring?

Im sure there is a standard for this for the US but I cant seem to find it.

Typically a heater would have an integrated thermostatic cut off to a contactor or a thermal resistor rated for max design temp, IF the designer deemed it necessary. A lot of industrial applications I've seen having nothing but the process temperature control and SSR or contactor to be relied on.

The upstream contactor is normal in that application
I would use a separate thermocouple or a temperature switch to control the contactor.

Yes, yes and maybe. Yes, you want what's referred to as a safety limit controller, separate from the PID controller and tied to a line contactor that is usually held closed by the limit controller and is dropped out if you reach the safety limit. yes, you would have a separate sensor dedicated to that function, you would not use the same sensor because a sensor failure could result in losing the safety limit function. Factory Mutual (FM) has standards that require this in some applications, determining whether or not yours is going to fit that is a process of investigation on your part.

I guess that’s the issue I’m having. If it did runaway it would only maybe cause damage to the mold.

The only thing I can find a standard on is for fluid heating, haven’t found anything on mold or die heating.

Next question, can the “limit controller” be the plc, that is also controlling the PID loop?

I’m going to assume that there is a risk and I need limit control, until I can prove otherwise. Also just for the simple fact that I’d like to know.

jraef said:

Yes, yes and maybe. Yes, you want what's referred to as a safety limit controller, separate from the PID controller and tied to a line contactor that is usually held closed by the limit controller and is dropped out if you reach the safety limit. yes, you would have a separate sensor dedicated to that function, you would not use the same sensor because a sensor failure could result in losing the safety limit function. Factory Mutual (FM) has standards that require this in some applications, determining whether or not yours is going to fit that is a process of investigation on your part.

Click to expand...

This!

and to answer your most recent question, the limit control should be something separate, not the plc. Honeywell makes a variety of switches that would do the job well, and are standard in my industry (which uses burners on everything).



Make the controller part of an interlock, along with alarm notification to the plc. It would also be a good idea to periodically test it, just to be sure everything is working properly. I do monthly tests on a pair of high limit switches at a site; purposely shutting down the plant (that's their spec's). While I don't think you need to go this far, you should set up at least an annual test.


Oh, the stories I (and others here) could tell.... lol

_Dock_ said:

Next question, can the “limit controller” be the plc, that is also controlling the PID loop?

I’m going to assume that there is a risk and I need limit control, until I can prove otherwise. Also just for the simple fact that I’d like to know.

Click to expand...

The answer is probably "it depends". A big part of what it depends on is what standard you're trying to satisfy.

However, if you're using a PLC with failsafe functionality (Rockwell guardlogix, Siemens 1500F, etc), then you may be able to connect a temp sensor to a failsafe input. That would put you on the road to machine functional safety, which is one of many standards that could be relevant.

We do this all the time on extruders. I install (in order of power flow) fuses, enabling contactors and then solid state relays. I also add current monitoring relays so my PLC can determine if we are drawing current when we are asking for heat and not drawing current when we are not asking for heat. This can tell us if we have blown fuses, bad heaters, or a solid state relay that has failed on or off.

We have done this with the PID being controlled by the PLC and also when using PID controllers monitored by the PLC or limit controllers as mentioned above.

Thank you all for your input.

jraef said:

Yes, yes and maybe. Yes, you want what's referred to as a safety limit controller, separate from the PID controller and tied to a line contactor that is usually held closed by the limit controller and is dropped out if you reach the safety limit. yes, you would have a separate sensor dedicated to that function, you would not use the same sensor because a sensor failure could result in losing the safety limit function. Factory Mutual (FM) has standards that require this in some applications, determining whether or not yours is going to fit that is a process of investigation on your part.

Click to expand...

Another adder to this...
The High Limit (safety) instrument has to be "FM approved", or insurance will not cover damages...
You also cannot use High Limit contact to control heat contactor with PLC logic alone.
The high Limit needs drive a relay, one contact for input to the PLC for logic/alarm purposes, and another contact in the PLC output wiring to the heat contactor. Legally...... you cannot use the safety circuit in the PLC logic alone.

When I have dealt with heater controllers that use SSRs, I have used a shunt trip breaker upstream of the SSR wired to a fault contact on the controller. If there is a PLC in the mix, I might also wire a PLC output to trip the breaker in case I detect anomalous temp signals.

The shunt trip breaker is more compact than a contactor in many cases and you need circuit protection anyway.

OkiePC said:

When I have dealt with heater controllers that use SSRs, I have used a shunt trip breaker upstream of the SSR wired to a fault contact on the controller. If there is a PLC in the mix, I might also wire a PLC output to trip the breaker in case I detect anomalous temp signals.

The shunt trip breaker is more compact than a contactor in many cases and you need circuit protection anyway.

Click to expand...

Just a minor word of caution on this; if the breaker is also providing control power, when you shunt trip it, you lose all indication as to what happened and uninformed operators will tend to re-close the breaker too soon (been there, done that, got the T-shirt). So if you go this route, make sure your control power comes from a different source and take appropriate safety measures for that.

jraef said:

Just a minor word of caution on this; if the breaker is also providing control power, when you shunt trip it, you lose all indication as to what happened and uninformed operators will tend to re-close the breaker too soon (been there, done that, got the T-shirt). So if you go this route, make sure your control power comes from a different source and take appropriate safety measures for that.

Click to expand...

Yes, I should have specified that I had a two pole shunt trip breaker just for the heater power circuit.