IGNITION CONTROL WITH SAFEGUARD FUNCTION

Abstract

An ignition control and method are provided for overseeing an ignition process on a fuel-fired appliance having a fuel burner, a fuel flow control valve, an ignition source, and a flame detection device. A primary processor initiates the ignition process, monitors the flame status signal and terminates the ignition process in the presence of a flame status signal indicating no flame after a specified period of time following the initiation of the ignition process. A secondary processor monitors the flame status signal independently of the primary processor and terminates the ignition process in the event that the primary processor fails to terminate the ignition process in the presence of a flame status signal indicating no flame after a specified period of time following the initiation of the ignition process. The primary and secondary processors may each have the functional capability to monitor the operation of the other.

Description

FIELD OF THE INVENTION

This invention relates generally to ignition control on gas or other fuel-fired appliances and, more particularly, to an ignition control including a microprocessor safeguard for an ignition system.

BACKGROUND OF THE INVENTION

Ignition controls are customarily used in connection with gas appliances, such as, for example, residential gas furnaces, boilers, water heaters and commercial cooking equipment, equipped with direct spark ignition systems. On gas appliances with direct spark ignition, the stream of gas supplied to the burner of the appliance is directly ignited by a spark. In conventional practice, the ignition spark is provided by an electronic device, such as for example an electronic spark generator. While such direct spark ignition systems generally function properly to quickly ignite the gas flowing to the burner, it is critical that the supply of gas to the burner to be promptly terminated in the event that ignition has not occurred or has failed to sustain a stable flame.

Conventional ignition control systems used in connection with direct spark ignition gas appliances include a gas valve having an open position and a closed position, an air blower, an ignition source, a flame sensing device and a microprocessor controller. The flame sensing device is operative to detect the presence of a flame within the combustion chamber of the gas appliance and generate a signal indicative of the flame status, i.e. a flame present signal or a no flame present signal. The microprocessor controller oversees the ignition process, as well as controlling the operation of the air blower and positioning of the gas valve.

In response to the receipt of a demand signal indicating that operation of the burner of the gas appliance is desired, the microprocessor controller will initiate the ignition process. To initiate ignition, the microprocessor controller activates the air blower to initiate the supply of combustion air to the burner of the gas appliance, and then transmits an activation command signal to the ignition device, and then opens the gas valve to initiate the supply of gas into the burner. In response to the activation command, the ignition device begins to generate a series of sparks to attempt to ignite the air-gas mixture forming as the gas flows into the burner. If ignition is successful, a flame is established.

The microprocessor controller monitors the flame sensing device to ensure that a flame has indeed been established and maintained within the combustion chamber. The flame sensing device is operative to detect whether or not a flame is present in the combustion chamber. If the flame sensing method does detect the presence of a flame, it emits a “flame present” signal. However, if the flame sensing method does not detect the presence of a flame, it emits a “no flame present” signal.

In conventional practice, the controller triggers a timer circuit upon entry into the ignition process. If within a preset time interval following entry into the ignition process, the controller receives a “flame present” signal, the controller maintains the gas valve in its open position, resets the timer circuit, and goes into a combustion monitoring mode during which the controller will at periodic time intervals, check the signal received from the flame sensing device to verify that the signal received from the flame sensing device is still a “flame present” signal. However, if at the lapse of the preset ignition verification time period, the signal received by the microprocessor controller from the flame sensing device is a “no flame present” signal, the controller will close the gas valve, lockout the gas valve and the ignition device for a preselected lockout time period, and operate the air blower for a preset period of time to purge the gas appliance of any gas remaining in the combustion chamber. The controller will not again initiate an ignition attempt until the lockout time period has expired.

Thus, the timer circuit acts as a watchdog to prevent uncontrolled release of gas into the combustion chamber when ignition has not occurred within the preset time period following entry into the ignition process. It is critical that the ignition control and oversight function be made as reliable as possible. Failure to terminate gas flow in the event of an ignition failure or a subsequent flame failure, would lead to an undesirable build up of gas within the combustion chamber. For example, U.S. Pat. No. 4,695,246 discloses an ignition control system for a gas appliance that includes a single microprocessor having redundant circuitry.

SUMMARY OF THE INVENTION

In an aspect of the invention, an ignition control is provided for controlling an ignition process on a fuel-fired appliance, the appliance having a burner. The ignition control includes a fuel flow control valve having an open position in which fuel flows to the burner and a closed position in which fuel flow to the burner is prohibited, an ignition source operatively associated with the burner, a flame detection device for detecting the presence of a flame at the burner and transmitting a flame status signal indicating flame or no flame, and a controller for overseeing the ignition process of igniting the fuel supplied to the burner, the controller including a primary processor and a secondary processor. The primary processor has functional capability to operate the ignition device, to monitor the flame status signal from the flame detection device and to terminate the ignition process in the presence of a flame status signal indicating no flame after a specified period of time following an initiation of the ignition process. The secondary processor has functional capability to monitor the flame status signal from the flame detection device and to terminate the ignition process in the event that the primary processor does not close the fuel flow control valve in the presence of a flame status signal indicating no flame after a specified period of time following an initiation of the ignition process. Each of the primary processor and the secondary processor has functional capability to position the fuel flow control valve in its closed position to independently terminate the ignition process.

In an aspect of the invention, an ignition control is provided for controlling an ignition process on a direct spark ignition gas appliance, the gas appliance having a burner. The ignition control includes a gas valve having an open position in which gas flows to the burner of the gas appliance and a closed position in which gas flow to the burner of the gas appliance is prohibited, an ignition source operatively associated with the burner of the gas appliance, a flame detection device operatively associated with the gas appliance for detecting the presence of a flame at the burner and transmitting a flame status signal indicating flame or no flame, and a controller for overseeing the ignition process of igniting the gas supplied to the burner of the gas appliance, the controller including a primary processor and a secondary processor. The primary processor has functional capability to operate the ignition device, to monitor the flame status signal from the flame detection device and to terminate the ignition process in the presence of a flame status signal indicating no flame after a specified period of time following an initiation of the ignition process. The secondary processor has functional capability to monitor the flame status signal from the flame detection device and to terminate the ignition process in the event that the primary processor does not close the gas valve in the presence of a flame status signal indicating no flame after a specified period of time following an initiation of the ignition process. Each of the primary processor and the secondary processor has functional capability to position the gas valve in its closed position to independently terminate the ignition process.

In an embodiment, the primary processor has functional capability to monitor the operation of the secondary processor. In an embodiment, the secondary processor may continuously transmit a status signal to the primary processor. In an embodiment, the secondary processor has functional capability to monitor the operation of the primary processor. Each of the primary processor and the secondary processor may comprise a microprocessor.

In an aspect of the invention, a method is provided for overseeing an ignition process on a fuel-fired appliance. The appliance has a fuel burner, a fuel flow control valve, an ignition source operatively associated with the burner, and a flame detection device for detecting the presence of a flame at the burner and transmitting a flame status signal indicating flame or no flame. The method includes the steps of: providing a primary processor for initiating the ignition process, for monitoring the flame status signal and for terminating the ignition process in the presence of a flame status signal indicating no flame after a specified period of time following the initiation of the ignition process, and providing a secondary processor for monitoring the flame status signal independently of the primary processor and for terminating the ignition process in the event that the primary processor fails to terminate the ignition process in the presence of a flame status signal indicating no flame after a specified period of time following the initiation of the ignition process. The secondary processor may independently of the primary processor terminate the ignition process by closing the fuel flow control valve to preclude the delivery of fuel to the burner in the event that the primary processor does not close the fuel control valve in the presence of a flame status signal indicating no flame after a specified period of time following an initiation of the ignition process.

In an aspect of the invention, a method is provided for overseeing an ignition process on a gas appliance. The gas appliance has a burner, a gas valve, an ignition source operatively associated with the burner of the gas appliance, and a flame detection device operatively associated with the gas appliance for detecting the presence of a flame at the burner and transmitting a flame status signal indicating flame or no flame. The method includes the steps of: providing a primary processor for initiating the ignition process, for monitoring the flame status signal and for terminating the ignition process in the presence of a flame status signal indicating no flame after a specified period of time following the initiation of the ignition process, and providing a secondary processor for monitoring the flame status signal independently of the primary processor and for terminating the ignition process in the event that the primary processor fails to terminate in the presence of a flame status signal indicating no flame after a specified period of time following the initiation of the ignition process. The secondary processor may independently of the primary processor terminate the ignition process by closing the gas valve to preclude the delivery of gas to the burner in the event that the primary processor does not close the gas valve in the presence of a flame status signal indicating no flame after a specified period of time following an initiation of the ignition process.

In an embodiment, the method also includes the step of the primary processor monitoring the operation of the secondary processor. In an embodiment, the method also includes the step of the secondary processor monitoring the operation of the primary processor. In an embodiment, the method includes the step of the secondary processor transmitting a status signal to the primary processor whenever the secondary processor is in an active state.

In an embodiment, the method includes the step of the secondary processor cycling in sequence through a primary detect mode, an idle mode and a monitor mode. In an embodiment, the secondary processor may move from any of the primary detect mode, the idle mode and the monitor mode directly into a lockout mode.

BRIEF DESCRIPTION OF THE DRAWINGS

For a further understanding of the invention, reference will be made to the following detailed description of the invention which is to be read in connection with the accompanying drawing, where:

FIG. 1 is a schematic block diagram of the ignition control system of the invention;

FIG. 2 is a flow chart of an ignition oversight sequence as performed by the secondary processor of the ignition control system of the invention;

FIG. 3 is a flow chart of the primary detect mode of the test sequence of FIG. 2;

FIG. 4 is a flow chart of the idle mode of the test sequence of FIG. 2; and

FIG. 5 is a flow chart of the monitor mode of the test sequence of FIG. 2;

DETAILED DESCRIPTION OF THE INVENTION

Referring initially to FIG. 1, there is depicted, in block diagram, an ignition control 10 for controlling an ignition process on a gas appliance 2 having a burner 4. Although the ignition control 10 will be described herein with reference to application a gas furnace, such as a residential or commercial gas furnace, it is to be understood that the ignition control 10 may be used in connection with a wide variety of gas appliances, including but not limited to, gas fired boilers, gas fired water heaters, and gas fired commercial cooking equipment. The ignition control 10 includes a gas valve 20, an ignition source 30, a flame detection device 40 and a controller 50. In the ignition control 10 of the invention, the controller 50 includes a primary processor 150 and a secondary processor 250.

The gas valve 20 has an open position and a closed position and may be selectively positioned in either its open or closed position through the controller 50. The gas valve 20 is disposed a gas supply line 6 connected in gas flow communication with an external gas source (not shown), such as for example a utility natural gas line or a storage tank of liquid natural gas (LNG) or propane. When the gas valve 20 is positioned in its open position, gas flows from the external source through the gas supply line 6 to the burner 4 of the gas appliance 2. When the gas valve 20 is positioned in its closed position, gas flow through the gas supply line 6 to the burner 4 of the gas appliance 2 is prohibited.

The ignition source 30 is operatively associated in a conventional manner with the burner 4 of the gas appliance 2 so as to ignite either the main gas flow to the burner 4 or a pilot gas flow to the burner 4. Although the ignition control 10 will described herein with reference to ignition of the main gas flow, but it is to be understood that the ignition control may be readily applied to direct spark ignition of a pilot gas flow. The ignition source 30 may be an electronic spark generator, such as for example a high-energy capacitive discharge spark across a ⅛ inch electrode gap 32, although any variety of spark generating igniter, or a hot surface igniter, or other type of ignition device, may be employed as the ignition source, as desired.

The flame detection device 40 is operatively associated with the gas appliance 2 for detecting the presence of a flame at the burner 4 and for generating a flame status signal 45 indicating flame or no flame. The flame detection device 40 may be any of a variety of conventional device having functional capability to sense the presence of flame at the burner 4. For example, by way of illustration, but not limitation, the flame detection device may be a flame electrode with rectification circuit. In an embodiment of the ignition control 10, the flame detection device 40 and the ignition source 30 may be coupled into a single device having functional capability to both ignite the gas flow in response to a command signal from the controller 50 and also to detect whether a flame has resulted and generate the appropriate flame signal 45. In an embodiment, the flame detection device 40 may be a flame rod electrode not associated with the ignition source 30.

The controller 50 controls and oversees the process of igniting the gas supplied to the burner 4 of the gas appliance 2. As noted before, the controller 50 of the invention includes a primary processor 150 and a secondary processor 250. Each of the primary processor 150 and the secondary processor 250 may be a microprocessor. For example, by way of illustration, but not limitation, in an exemplary embodiment of the controller 50, the primary processor 150 may comprise the PIC16C622A microcontroller from Microchip Technologies and the secondary processor 250 may comprise the PIC12F629 microcontroller from Microchip Technologies. The primary microprocessor and the secondary microprocessor may be mounted on a single pc board.

The primary processor 150 has functional capability to operate of the ignition device 30, to drive the flame detection device 40 and monitor the flame status signal 45 generated by the flame detection device 40, and to terminate the ignition process in the presence of a flame status signal 45 indicating no flame after a specified period of time following an initiation of the ignition process. The secondary processor 250 has functional capability to monitor the flame status signal 45 from the flame detection device 40 and to terminate the ignition process in the event that the primary processor 150 does not terminate the ignition process in the presence of a flame status signal 45 indicating no flame after a specified period of time following an initiation of the ignition process. Each of the primary processor 150 and the secondary processor 250 have functional capability to independently terminate the ignition process by disabling the gas valve relay 22 thereby forcing the gas valve 20 into its closed positioned in the presence of a flame status signal 45 indicating no flame after a specified period of time following an initiation of the ignition process.

The secondary processor 250 may also have functional capability to monitor the operation of the primary processor 150. In an embodiment, the secondary processor 250 has functional capability to monitor the drive signal from the primary processor 150 to the flame detection device 40 and the drive signal from the primary processor 150 to the gas valve relay 22 as a means of monitoring the operation of the primary processor 150. For example, if the flame detection device is active and generating a flame present flame detection signal 45, but the signal from the primary processor 150 to the gas valve relay is a disable signal, the secondary processor 250 will conclude that some form of hardware malfunction has occurred and will go into lockout, thereby shutting the system down as a safety precaution.

The primary processor 150 may also have functional capability to monitor the operation of the secondary processor 250. For example, the secondary processor 250 may continuously transmit an “I'm alive” status signal 55 to the primary processor 150. The “I′m alive” status signal 55 may, for purposes of illustration, but not limitation, comprise a digital signal having a repeating sequence of four high beats followed by four low beats.

The primary processor 150 will monitor the thermostat 8, which is mounted in the space to be heated by the gas furnace 2, for a heat demand signal. In response to the heat demand signal, the primary processor 150 will enable the gas valve relay 22 to open the gas valve 20 and start an ignition time out clock. The primary processor 150 may also have the functional capability to control the operation of the air blower 60 for supplying combustion air and purge air to the burner 4 of the furnace 2. If so equipped, the primary processor 150 also starts the air blower 60 to supply air to the burner to support ignition and combustion of the gas. The ignition time out clock defines a preprogrammed time period for ignition to occur such as, for example, but without limitation, in the range of 1 to 25 seconds.

As an example, for an appliance having direct spark ignition, before the gas valve 20 has been opened, the primary processor 150 enables the ignition source 30 to produce a series of high voltage sparks at a programmed interval of about 16 milliseconds. During the ignition time out clock period, the primary processor 150 monitors the flame signal 45 generated by the flame detection device 40 at preprogrammed intervals of at least every 16 milliseconds. If a valid “flame present” flame signal 45 is detected within the time period of the ignition time out clock, thus indicating successful ignition and a stable flame, the primary processor 150 cuts power to the ignition source, thereby terminating sparking, and leaves the gas valve 20 open and the air blower 60 operating. Unless the flame is subsequently lost, the primary processor 150 does not change the status of the gas valve 20 or the air blower 60 until the primary processor detects a loss of the heat demand signal from the thermostat 8. Upon completion of the heating cycle, indicated by loss of the demand for heat signal, the primary processor 150 immediately closes the gas valve 20 and, after a preprogrammed purge out period, disables, i.e. cuts power to, the air blower 60 to terminate air flow to the burner 4 and goes into an idle mode until a demand for heat signal is next detected.

If the flame signal 45 indicates that no flame is present at the expiration of the ignition time out clock, the primary processor 150 immediately disables the gas valve relay 22 to close the gas valve 20. If also designed to control the blower 60, the primary processor 150 will, after a preprogrammed purge out period, disable the air blower 60 to terminate air flow to the furnace 2. The primary processor 150 will reinitiate the ignition process for a preselected number of retries until either a successful ignition has occurred or the maximum number of permitted retries has been reached. If a stable flame is not present after the last permitted trial for ignition, the primary processor 150 goes into a lockout mode during which no further attempts to ignite are permitted. The lockout period will last until the current demand for heat signal expires and a new demand for heat signal is detected.

As noted previously, the controller 50 includes a secondary processor 250 in addition to the primary processor 150. The secondary processor 250 functions as a safeguard monitor of the ignition process. The secondary processor 250 has the functional capability to monitor the flame status signal 45 from the flame detection device 40 and also has the functional capability to monitor the operation of the primary processor 150 by monitoring the flame sensor drive signal and the gas valve relay drive signal generated by the primary processor 150. The secondary processor 250 also has the functional capability to terminate the ignition process independently of the primary processor 150 in the event that the primary processor 150 does not close the gas valve 20 in the presence of a flame status signal 45 indicating no flame after a specified period of time following an initiation of the ignition process.

Referring now to FIGS. 2-5, the various modes in which the secondary processor 250 operates in carrying out in its safeguard oversight role with respect to the ignition process are illustrated in the flow charts shown. Referring now to FIGS. 2 and 3, when powered up, the secondary processor 250 operates in one of the following modes: primary detect mode 220, idle mode 230, monitor mode 240 and lockout mode 260. At 210, the secondary processor 250 determines whether it is undergoing a power up or a reset. When the controller 90 is first powered up, the secondary processor 250 enters the primary detect mode. In this mode, the secondary processor 250 verifies whether the primary processor 150 is active by checking for signal levels on a designated two of its output pins. The secondary processor 250 checks for high on the flame drive pin at 222 and for low on the gas valve drive pin at 224. If this signal pattern is not present, the primary processor 150 is not active or malfunctioning and the secondary processor 250 will set a FindPrimary counter. The secondary processor 250 will continue to monitor these I/O pins and at 226 will decrement the primary detect counter each time a specified time interval has elapsed. If the primary FindPrimary counter reaches zero, at 228, the secondary processor 250 will enter the lockout mode 260. If the signal pattern is present on the designated I/O pins, the primary processor 150 is verified active and the secondary processor 250 will transition into the idle mode 230. If the signal pattern is found, the secondary processor 250 will also set a static flag to prevent noise induced resets from executing the primary detect mode 220 again. The secondary processor 250 will also transition to the idle mode 230 after a hardware reset. The transition into the idle mode 230 may include a time delay.

In the idle mode 230, the secondary processor 250 continuously monitors the gas valve 20 to determine whether the gas valve 20 is in an open state or a closed state. In this mode 230, the secondary processor 250 also continuously monitors the flame detection signal 45 to establish whether a flame is present or not. Referring now to FIG. 4, at 232, if the detected state of the gas valve 20 is open, the secondary processor transitions to the monitor mode 240. If, however, the detected state of the gas valve 20 is closed, the secondary processor 250 at 234 checks the state of the flame detection signal. If the flame detection signal indicates that a flame is present, the secondary processor 250 immediately enters the lockout mode 260. The indication that a flame is present even though the state of the gas valve 20 is detected as closed is an indication that some form of hardware failure has occurred, thereby necessitate a system shut down as a safety precaution.

In the monitor mode 240, the secondary processor 250 will continuously monitor the flame detection signals 45 from the flame detection device 40 generated in response to periodic command signals from the primary processor 150. Referring now to FIG. 5, at 242, the secondary processor 250 checks the state of the gas valve 20. If the gas valve 20 is detected to be in its closed state, the secondary processor 250 transitions back into the idle mode 230. If the gas valve 20 is detected to be in its open state, the secondary processor 250 proceeds at 244 to check the flame detection signal 45. If the flame detection signal indicates that no flame is present, the secondary processor 250 sets a FaultTimer at 246. The secondary processor then loops back through steps 242 and 244 and at 248 decrements the FaultTimer at the completion of each cycle, which represents a time interval of about 400 microseconds.

If at 244 the flame detection signal indicates that flame is present, the secondary processor 250 resets the FaultTimer at 249. However, if the FaultTimer expires, that is reaches zero, the secondary processor 250 immediately enters the lockout mode 260. The FaultTimer is preset to a time period beyond which the gas valve 20 is not to remain open in the event that a stable flame is not established in the gas appliance 2. Since the primary processor 150 continuously tests for the presence of flame, the secondary processor 250 will reset the FaultTimer to this maximum permissible time period each time a successful flame detection is verified at 244. Thus, the gas valve 20 is never allowed to remain open beyond the maximum permissible safe time limit without a positive flame detection signal being detected by the second processor 250.

Upon entering the lockout mode, the secondary processor 250 immediately disables the gas valve relay 22 thereby forcing the ignition control into a safe state and also stops transmitting the “I′m alive” signal 55 to the primary processor 150. Upon loss of the “I′m alive” signal 55, the primary processor 150 forces the gas valve 20 closed and goes into a failure mode. The primary processor 150 will not reset until the controller 50 undergoes a power down-power up cycle. The secondary processor 250 will not reset until it again detects that the primary processor 150 is active as it cycles through the primary detect mode 210. Additionally, upon entering the failure mode, the primary processor 150 may signal the existence of a fatal fault, for example by activating an indicator light, such as a light emitting diode (LED) 52 on a control panel 54. For redundancy, the secondary processor 250 may also be provided with the functional capability to activate the indicator light 52.

While the present invention has been particularly shown and described with reference to the exemplary embodiments as illustrated in the drawing, it will be recognized by those skilled in the art that various modifications may be made without departing from the spirit and scope of the invention. For example, the ignition control and the method of the invention may be used in connection with combinations of fuel and ignition sources, other than the exemplary gas and spark igniter embodiment described hereinbefore, such as for example fuel oil and a high temperature igniter. Further, those skilled in the art will recognize that various types of flame detection devices, other than of the flame electrode with rectification circuit type, may be employed in the ignition control of the invention and in practicing the method of the invention.

The terminology used herein is for the purpose of description, not limitation. Specific structural and functional details disclosed herein are not to be interpreted as limiting, but merely as basis for teaching one skilled in the art to use the present invention. Those skilled in the art will also recognize the equivalents that may be substituted for elements described with reference to the exemplary embodiments disclosed herein without departing from the scope of the present invention.

Therefore, it is intended that the present disclosure not be limited to the particular embodiment(s) disclosed, but that the disclosure will include all embodiments falling within the scope of the appended claims.

Claims

1. An ignition control for controlling an ignition process on a fuel-fired appliance, the appliance having a fuel burner, said ignition control comprising:

a fuel control valve having an open position in which fuel flows to said burner and a closed position in which fuel flow to said burner is stopped;

an ignition source operatively associated with said burner,

a flame detection device for detecting the presence of a flame at said burner and transmitting a flame status signal indicating flame or no flame;

a controller for overseeing the ignition process of igniting the fuel supplied to said burner, said controller including a primary processor and a secondary processor:

said primary processor having functional capability to operate the ignition device, to monitor the flame status signal from the flame detection device and to terminate the ignition process in the presence of a flame status signal indicating no flame after a specified period of time following an initiation of the ignition process; and

said secondary processor having functional capability to monitor the flame status signal from the flame detection device and to terminate the ignition process in the event that the primary processor does not close the fuel control valve in the presence of a flame status signal indicating no flame after a specified period of time following an initiation of the ignition process.

2. The ignition control as recited in claim 1 further comprising said secondary processor having functional capability to monitor the operation of said primary processor.

3. The ignition control as recited in claim 1 further comprising said primary processor having functional capability to monitor the operation of said secondary processor.

4. The ignition control as recited in claim 3 wherein said secondary processor continuously transmits a status signal to the primary processor.

5. The ignition control as recited in claim 1 where each of said primary processor and said secondary processor comprises a microprocessor.

6. The ignition control as recited in claim 1 where each of said primary processor and said secondary processor comprises a microcontroller.

7. The ignition control as recited in claim 1 wherein each of said primary processor and said secondary processor has functional capability to position the fuel control valve in its closed position to independently terminate the ignition process.

8. An ignition control for controlling an ignition process on a direct spark ignition gas appliance, the gas appliance having a burner, said ignition control comprising:

a gas valve having an open position in which gas flows to the burner of the gas appliance and a closed position in which gas flow to the burner of the gas appliance is stopped;

an ignition source operatively associated with the burner of the gas appliance,

a flame detection device operatively associated with the gas appliance for detecting the presence of a flame at the burner and transmitting a flame status signal indicating flame or no flame;

a controller for overseeing the ignition process of igniting the gas supplied to the burner of the gas appliance, said controller including a primary processor and a secondary processor:

said primary processor having functional capability to operate the ignition device, to monitor the flame status signal from the flame detection device and to terminate the ignition process in the presence of a flame status signal indicating no flame after a specified period of time following an initiation of the ignition process; and

said secondary processor having functional capability to monitor the flame status signal from the flame detection device and to terminate the ignition process in the event that the primary processor does not close the gas valve in the presence of a flame status signal indicating no flame after a specified period of time following an initiation of the ignition process.

9. The ignition control as recited in claim 8 further comprising said secondary processor having functional capability to monitor the operation of said primary processor.

10. The ignition control as recited in claim 8 further comprising said primary processor having functional capability to monitor the operation of said secondary processor.

11. The ignition control as recited in claim 10 wherein said secondary processor continuously transmits a status signal to the primary processor.

12. The ignition control as recited in claim 8 where each of said primary processor and said secondary processor comprises a microprocessor.

13. The ignition control as recited in claim 8 where each of said primary processor and said secondary processor comprises a microcontroller.

14. The ignition control as recited in claim 8 wherein each of said primary processor and said secondary processor has functional capability to position the gas valve in its closed position to independently terminate the ignition process.

15. The ignition control as recited in claim 8 wherein the gas appliance comprises a gas furnace.

16. The ignition control as recited in claim 8 wherein the gas appliance comprises a gas water heater.

17. The ignition control as recited in claim 8 wherein the gas appliance comprises a commercial gas cooking apparatus.

18. A method for overseeing an ignition process on a fuel-fired appliance, the appliance having a fuel burner, a fuel flow control valve, an ignition source operatively associated with the burner, a flame detection device operatively associated with the burner for detecting the presence of a flame at the burner and transmitting a flame status signal indicating flame or no flame; said method comprising the steps of:

providing a primary processor for initiating the ignition process, for monitoring the flame status signal and for terminating the ignition process in the presence of a flame status signal indicating no flame after a specified period of time following the initiation of the ignition process;

providing a secondary processor for monitoring the flame status signal independently of said primary processor and for terminating the ignition process in the event that said primary processor fails to terminate the ignition process in the presence of a flame status signal indicating no flame after a specified period of time following the initiation of the ignition process.

19. The method as recited in claim 18 wherein said secondary processor terminates the ignition process by closing the fuel flow control valve to stop the delivery of fuel to the burner in the event that said primary processor does not close the fuel flow control valve in the presence of a flame status signal indicating no flame after a specified period of time following an initiation of the ignition process.

20. A method for overseeing an ignition process on a direct spark ignition gas appliance, the gas appliance having a burner, a gas valve, an ignition source operatively associated with the burner of the gas appliance, a flame detection device operatively associated with the gas appliance for detecting the presence of a flame at the burner and transmitting a flame status signal indicating flame or no flame; said method comprising the steps of:

providing a primary processor for initiating the ignition process, for monitoring the flame status signal and for terminating the ignition process in the presence of a flame status signal indicating no flame after a specified period of time following the initiation of the ignition process;

providing a secondary processor for monitoring the flame status signal independently of said primary processor and for terminating the ignition process in the event that said primary processor fails to terminate the ignition process in the presence of a flame status signal indicating no flame after a specified period of time following the initiation of the ignition process.

21. The method as recited in claim 20 wherein said secondary processor terminates the ignition process by closing the gas valve to stop the delivery of gas to the burner in the event that said primary processor does not close the gas valve in the presence of a flame status signal indicating no flame after a specified period of time following an initiation of the ignition process.

22. The method as recited in claim 20 wherein the steps of providing a primary processor and of providing a secondary processor comprise providing a primary microprocessor and a secondary microprocessor.

23. The method as recited in claim 20 further comprising the step of said secondary processor monitoring the operation of said primary processor.

24. The method as recited in claim 20 further comprising the step of said primary processor monitoring the operation of said secondary processor.

25. The method as recited in claim 24 further comprising the step of said secondary processor transmitting a status signal to said primary processor whenever said secondary processor is in an active state.

26. The method as recited in claim 20 further comprising the step of said secondary processor cycling in sequence through a primary detect mode, an idle mode and a monitor mode.

27. The method as recited in claim 26 further characterized in that the secondary processor may move from any of the primary detect mode, the idle mode and the monitor mode directly into a lockout mode.