Unmanned 24 Hour 7 Day Operation Chamber Design

A test chamber that runs day and night has no one at the door. A soak can last ninety-six hours. The work goes on through the night and the weekend. The chamber has to handle every fault on its own and end it in a safe state. The design that allows this is an independent protector, a way to call for help, and a record that runs itself.

A staffed test ends when something goes wrong: an operator sees the alarm and acts. An unmanned test has no operator to see it. The chamber has to see its own faults and bring itself to a safe state with no hand on the controls. Unmanned operation is a design that makes a person unnecessary for safety.

◆The control that does not need a hand

Unmanned work starts before the first fault. The control system has to run the test from end to end with no hand on it. The operator loads a program: a ramp down to the test temperature, a soak of a set length, a ramp back. The controller follows the program step by step. It starts the soak clock when the space reaches the band. It ends the run when the soak is done. It needs no one to press the next step. A watchdog timer sits behind the controller. A controller that locks up stops feeding the watchdog. The watchdog then drops the system to its safe state. A frozen controller is a fault like any other. The design treats it as one. The program, once proven on a sample, runs the same way every night. The test a product gets on a Sunday matches the one it gets on a Tuesday. A test that needs a button pressed at midnight is not an unmanned test at all. The control runs the clock, the steps, and the safe ending, all on its own.

◆The chamber that watches itself

Two systems run in a chamber built for unmanned work. The control loop holds the temperature at the setpoint. A separate protector watches for danger and acts when the control loop cannot. The two are kept apart on purpose. The fault that lets a chamber overheat is often a failure of the control loop itself. A safe design does not let the control loop guard against its own failure. The protector has its own sensor, its own power, and its own way to cut the heat.

The split runs deep. The protector does not borrow the controller’s sensor, its power, or its logic. It is wired to fail safe. Its cutout holds the heater circuit closed only while the protector is healthy and the temperature is in range. A broken wire, a lost supply, or a dead protector all open the circuit and drop the heat. The safe state is the state the chamber falls into when a part dies. A design that needs power to stay safe is not safe for unmanned work.

◆The independent protector

The over-temperature protector is the heart of unmanned safety. It carries its own temperature sensor, placed in the working space. It carries its own cut-off, wired to remove power from the heaters. It does not read the control loop’s sensor, and it does not wait for the controller’s command. When the temperature passes the limit set on it, it cuts the power, and it holds the power off until a person resets it by hand. A protector that resets itself could let a chamber cycle in and out of an overheat all night.

The protector’s limit sits between the test temperature and the point where damage begins. The gap leaves room for the normal swing of the test. The protector is verified to act, on its own evidence, as part of commissioning and on a set schedule after.

The protector comes in more than one form. The simplest is a mechanical thermostat. A bulb of fluid expands with the heat and throws a switch at a set point. It needs no power to work. It holds even when the electronics are dead. An electronic protector reads its own thermocouple and drives its own relay. It sets a sharper limit and reports its state to the log. Many chambers carry both, with the mechanical device as the last line behind the electronic one. The protector’s sensor sits in the working space, near the load, away from the ductwork where the air runs hottest or coldest. A limit judged on duct air does not match what the load feels.

◆When the control sensor reads wrong

The clearest case for an independent protector is a control sensor that reads low. A loose thermocouple, a broken wire, a bad connection: any of these can make the controller see a temperature lower than the truth. The controller calls for more heat. The real temperature climbs. The controller, blind to the truth, keeps calling for heat. A chamber with only one sensor has no way to catch this, because the one sensor is the one that is wrong. The protector, with its own separate sensor, sees the real temperature and cuts the power. The second sensor is what turns a single point of failure into a fault the chamber survives.

The two sensors do not sit in the same spot. A control sensor and a protector sensor placed side by side can foul on the same drip or the same draught. Set apart, they fail apart. One reads the air the loop controls. The other reads the air the load sits in. A gap between the two readings is itself a warning. A control sensor that drifts from the protector’s reading by more than a small margin is a sensor to check, well before either crosses a limit. Two sensors that always agree prove each other right. Two that part company name a problem between them. The chamber that compares its own sensors catches a fault while it is still small.

◆More than one way to overheat

The loose sensor is one fault among several. A heater contactor can weld shut. The heat then stays on with no call from the controller. A solid-state relay can fail closed for the same effect. A fan can stall. The heat the element makes then pools in one place. One spot climbs. The control sensor across the space still reads normal. A door can sit open on a bad latch. The chamber heats against the gap. It never reaches a steady hold. The chamber has to end each of these faults in a safe state.

The independent protector covers the faults that drive the temperature past its limit. A welded contactor and a stalled fan both end at the protector’s cutout. Some faults need their own watcher. A door switch catches the open door. An airflow sensor catches the stalled fan early. A current monitor on the heater line catches a welded contactor before the heat builds. Each watcher reports to the log and to the alarm. The chamber saves itself and records the cause.

◆The cold side has its own limit

Heat is not the only fault that spoils a load. A refrigeration system stuck on drives the temperature down. A cell culture, a battery on test, or a material held near its glass point can be ruined by cold as surely as by heat. A chamber that runs these loads alone needs an under-temperature cut-off as well. It carries its own low limit. It cuts the cooling when the space falls past that limit. DIN 12880 covers this in its higher protection class, where the protector watches a low limit as well as a high one. The load, and the direction its fault would take, set what the chamber needs.

◆A warning and a cut-off

Safety works in two stages. A soft alarm sounds at a limit close to the test, before anything is wrong, to warn that the run is drifting. The alarm sends a message to a phone or a screen. A hard cut-off acts at a limit further out, with no decision to make: it removes the power and stops the run.

The two stages sit at two limits. The soft alarm sits close to the test, a few degrees outside the band. It fires on a drift that has not yet harmed anything. The hard cut-off sits further out, below the point where the load or the chamber takes damage. The gap between the two is the room a person has to act. A drift trips the alarm. A climb that no one stops reaches the cut-off. The soft alarm can save a ninety-six-hour soak from a small wobble. The hard cut-off gives that up to save the chamber. The two limits are set for the load, the test, and the cost of losing the run.

The alarm has to reach a person who is not in the room. A chamber for unmanned work sends its alarms out, by message, by light, by a link to the building’s system. An alarm that only beeps in an empty room at two in the morning is no alarm at all. The chain of who is called, and who is called next when the first does not answer, is set before the chamber is left to run alone.

◆Watching the chamber from off site

The alarm tells a person something is wrong. A remote link tells them what. A chamber on a network publishes its live state to a dashboard the operator can open from anywhere. The reading, the setpoint, the running step, and the time left all show on a screen at home. A person woken at two in the morning can read the trend before deciding. A slow drift toward a limit may wait until morning. A fast climb needs someone on site now. The link carries the record out as the run goes. A copy lives off the machine from the start.

Remote access is a door into the chamber. It is locked like one. The link is authenticated and encrypted. A view of the data is open to many. The right to change a setpoint or start a run stays with a few. A chamber left to run alone should never accept a command from a stranger on the network.

◆When the power fails

A power cut in the night is a fault the chamber has to handle. The safe answer is simple: the heaters and the cooling stop. The chamber drifts to room temperature. Heat and cold both fade with no power. The risk is the record and the alarm. A small uninterruptible supply keeps the controller and the link alive long enough to log the cut and send the alarm. When the power returns, a chamber for unmanned work does not restart the heat on its own. It waits for a person to confirm the load is sound, because a blind restart onto a fault is its own hazard.

The safe direction is not the same for heat and for cold. A heat test that loses power cools toward the room. A cold test that loses power warms toward the room. Both drift away from the extreme, toward a state that harms nothing. The load may be spoiled by the lost hours. The chamber and the building are not put at risk. The reserve supply does not try to keep the test going. It keeps the controller, the sensors, and the link alive long enough to write the cut into the log and send the alarm. A few minutes is enough for that. Holding the heat or the cold through a long outage is a different job, with a different cost, taken on only when the load demands it.

The return of power is its own event. A chamber for unmanned work does not pick up where it left off. It waits. A person confirms the load is sound and the cause of the cut is understood. Only then does the run restart. A blind restart can drive heat into a load that has already failed, or onto a fault that caused the cut in the first place. The log carries the time of the cut and the time of the return. The gap in the exposure is plain to anyone who reads the trace later.

◆The record that runs itself

An unmanned run has no one to write down what happened. The chamber writes it down for itself. It logs the temperature of every sensor, every minute, through the full soak, with the time on each reading. It logs every event: the start, the alarms, the cut-offs, the power cut, the defrost. The log is the only witness to a night with no one in the room. A run that drifted and recovered, or tripped and held safe, leaves a trace that a person can read in the morning. The log lives in the chamber and copies to the building’s system. A single failure does not lose the night’s record.

The log has to be read as easily as it is written. A reading per sensor per minute is enough through a steady soak. The rate climbs during the descent and the rise, where the temperature moves fast. Each reading carries its own time. The times line up across every channel. A fault and the events around it can be placed in order. The log records its own gaps. A break in the trace is itself a fact the file keeps.

The record answers the questions an audit asks. It shows the lowest and the highest the space reached. It shows every door event, every alarm, and every reset. It shows the moment a protector tripped and the moment a hand cleared it. A run that drifted and recovered reads as a dip that returned to band. A run that tripped and held safe reads as a clean cut at a known time. The morning after a long unmanned soak, the file is the only witness. A good one needs no defending.

◆Protection classes

A standard sorts the protectors by what they do. DIN 12880 sets three classes. A class-one protector is a fixed mechanical cut-off, set at the factory and not adjustable. A class-two protector has an over-temperature cut-off the user can set to the run. A class-three protector adds an under-temperature cut-off as well, for a load that a cold fault would spoil. The class is chosen for the load and the risk. A chamber drying a flammable solvent needs a higher class. The class is stated in the chamber’s papers, with the limit and the test that proves it.

The class sets what the protector guards and how its limit is fixed. A fixed limit is set at the factory and cannot be moved. An adjustable limit is set by the user to suit the run, a few degrees above the test temperature. A fixed limit suits a chamber that always runs near one temperature. An adjustable limit suits a chamber that runs a wide range, where a single fixed point would sit far above a low test and offer no real guard. The class, the limit, and the test that proves the trip all belong in the chamber’s papers. A buyer who runs flammable or precious loads reads that page before the price.

◆Bringing an unmanned chamber into service

A chamber is not left to run alone on trust. It is proven first. Commissioning tests the protector against its own evidence. The limit is set. The temperature is driven up to it. The protector trips, cuts the power, and holds the power off until a hand resets it. The trip is recorded. The alarm is tried the same way. A limit is crossed on purpose. The message goes out. The person on the rota confirms it arrived. The power-cut response is tried too. The supply is pulled. The controller rides on its reserve, logs the cut, and sends the alarm.

None of this is a one-time check. The protector is verified again on a set schedule, often once a year. A drifted protector that no longer trips at its limit is no protection at all. The schedule keeps the second line real. The same goes for the alarm path. A phone number changes. A contact leaves. A test call once a quarter proves the chain still reaches a person who can act.

◆A soak that runs for days

A cold or heat soak can run ninety-six hours. Four days is a long time to hold a space inside two degrees with no one watching. The test does not pause for the night or the weekend. A fault on a Saturday cannot wait for Monday. An attended test ends the moment an operator sees trouble. An unmanned test of the same length has to carry that judgement in its own design. The longer the soak, the more the chamber leans on its protector, its alarm, and its record.

A short test rarely meets a fault. A four-day test meets the rare ones. A compressor tires on the third night. A seal leaks after hours of cold. A frost build slowly blinds the coil. The design for unmanned work is the design that holds through the nights no one is there to see. A chamber that runs a long soak unattended earns its place in the hour a fault arrives.

◆What goes on the order

Unmanned-capable is a line on the order, written point by point. The order names the independent protector and its class. It names the limit and asks for the trip test on handover. It names the alarm path: where the alarm goes, who it reaches, and how it escalates when the first call goes unanswered. It names the power-cut behaviour: the safe drift, the reserve supply for the record, and the hold against a blind restart. It names the log: what is recorded, how often, and where the second copy lives. It names the schedule for re-proving the protector and the alarm. A chamber bought on price alone, with none of this on the order, is a day chamber asked to do a night job. The gap shows up the first weekend a fault arrives.

◆Questions on unmanned operation

Envsin builds test chambers for unmanned operation with an independent over-temperature protector, alarms that reach a person off site, a safe answer to a power cut, and a record the chamber keeps for itself.