HK1189667B - Safety switching device for the failsafe shutdown of an electrical consumer - Google Patents

Abstract

The invention relates to a safety switching device for the failsafe shutdown of an electrical consumer, comprising at least one input circuit (54) for receiving an input signal (20, 90) from a signalling device (18, 46), which signals a safety-relevant status, and at least one output circuit (56) for outputting an output signal (48). The safety switching device further comprises at least one switching element (30), which is designed to interrupt a current supply path to the consumer. An evaluation and control unit (28) of the safety switching device is designed to actuate the at least one switching element depending on the input signal (20, 90). The at least one input circuit (54) and the at least one output circuit (56) are joined at a device connection (26), so that said device connection (26) can be used either as an input for receiving the input signal (20, 90) or as an output for outputting the output signal (48). The input circuit has a test switch (68) which is coupled to the evaluation and control unit (28). The evaluation and control unit (28) is designed to suppress the input signal (90) in a targeted manner with the aid of the test switch (68).

Description

The present invention relates to a safety switch device for the safe shutdown of an electrical consumer and in particular for the safe shutdown of a machine or machine system which presents a danger to humans.

Typical safety switchgear signals are emergency shut-off keys, safety door switches, two-hand switches, but also light barriers and various sensors that provide safety-relevant signals of a monitored machine or machinery. The safety switchgear monitors the safety-relevant signals from the monitors, evaluates them and generates a control signal depending on them for actuators that are able to turn off the dangerous signals, but the safety signal is often also generated by the safety switchgear, which is used to automatically turn off the safety signal, which is usually provided by a machine with its own light or electrical emergency switch.

Depending on the number and type of safety features to be monitored on a machine or machinery, a suitable safety switchgear requires a different number of inputs and outputs to connect detectors and actuators. The number of inputs and outputs required increases when a high safety category is required to protect a very dangerous machine or machinery. Typically, the detector, the safety switchgear and the actuators are connected in such cases by redundant wiring, so that the number of inputs and outputs required is doubled.

On the other hand, the applicant has sold, under the name PSS SB DI16, decentralised I/O assemblies for a decentralised safety control system, in which different types of output signals for monitoring the transition of the transmitters could be provided at certain connection terminals. In particular, output signals or output signals with different number of output signals could be provided in a specific way at different time intervals. However, these could not be provided for a single safety-lock, in particular for the use of a stationary switchgear.

EP 1 347 388 B1 reveals a coupling device for connecting devices to a bus system. The coupling device is used in particular to connect signalling devices and actuators to a decentralised control system. In order to allow flexible connection of safety sensors and standard sensors with standardised, cost-effective connections, EP 1 347 388 B1 proposes that individual connecting spins of the connector with different functional characteristics can be fitted from a set of predefined functional characteristics. In an example of implementation, the connector should have five contact elements, at least some of which can be used as input or as a mass connection.

The DE 199 62 497 A1 mentioned above reveals a safety switch with a number of device connections, an input circuit to receive an input signal from a detector signaling a safety-relevant state, an output circuit to emit an output signal and switching elements designed to interrupt a power supply path to an electrical consumer. An evaluation and control unit controls the switching elements depending on the input signal. The input circuit includes an optical input coupling that combines a signal generated by the safety switch wave with the signal generated by the detector. The periodic safety signal modulation modifies the signal output of the signal by means of a periodic optical signal, which is transmitted by a radio transmitter over the internal controller, even if the signal is transmitted by a radio transmitter in the same direction as the signal transmitter. The safety signal is transmitted by a radio transmitter over the internal controller.

DE 102 11 099 A1 is a device for controlling an electrical consumer, whereby a control transistor is connected to a port of a control-and-output unit via a line. One output of the control transistor is connected to the control-input of a driver transistor. At the output of the driver transistor the electrical consumer is located.

In this context, the present invention is intended to specify a safety switch with a number of device connections that can be used as flexibly as possible for different functions, including different safety functions. In particular, it is intended to specify a safety switch with at least one device connector that can be used as either an input or an output optionally, and that device connector is also available for applications that require a high safety category. A high safety category in this sense is category 3 or higher as defined in European standard EN 954-1, SIL2 or higher as defined in EC61508 or category 3 or higher as defined in ISO 13849-1.

According to one aspect of the invention, this task is solved by a safety switch to fail to disconnect an electrical consumer, with a number of device connections, with at least one input circuit to receive an input signal from a detector indicating a safety-relevant condition, with at least one output circuit to emit an output signal, with at least one switch element designed to interrupt a power supply path to the consumer, and with a test-value and control unit designed to do so, which is at least one switch element depending on the input, with at least one output circuit and at least one output circuit running at a specified output signal, so that the output signal is designed to be used as a test unit for the output and output of the control unit, and with at least one output circuit and at least one output signal output circuit, which is designed to be used as an input and output unit, and with a test set for the output and output of the control unit.

In some preferred embodiments, the new safety switch is a configurable microcontroller that allows the evaluation and monitoring of the connected signalling devices and the control of the actuators to shut down a machine or machine system as a stand-alone device, in which case only the signalling devices and actuators need to be connected to the new safety switch and the safety switch must be configured and/or programmed to meet the desired safety functions.

In other embodiments, the new safety switch may be part of a larger decentralized control system; for example, the safety switch may be a decentralized I/O unit connected to a central control unit via a fieldbus; in yet another embodiment, the safety switch may be a modular component for a programmable control, such as a programmable control, as marketed by the applicant for the present invention under the trademark PSS®; in all cases, it is a safety switch device that meets at least category 3/SIL2 for the purposes of the abovementioned standards or comparable safety requirements.

The safety switch has at least one device connector which can be used as either an input for a safe input function or an output. The output can also perform a safety function - if necessary in combination with another output at another device connection - by using the test switch in the input circuit, the evaluation and control unit can check the plausibility of an input signal at the configurable device connection. In particular, the evaluation and control unit can use the test switch to test whether a signal change from a static high-level input at the input to a low-level input is detected. This is important for the realization of a safe input function with static signals, since the low-level safety represents a typical (restrictive) response.

The evaluation and control unit cannot necessarily determine with the help of the single test switch whether a fault has occurred in the external circuitry of the safety switchgear and in particular in the connecting lines to the one configurable device connection. However, this is fundamentally problematic with a single-channel input and a stationary input signal. Therefore, to achieve a higher safety category, two or more inputs with a redundant circuit are typically used, which allows the new safety switchgear to be equally configurable in the preferred configuration by providing multiple configurable device connections.

On the other hand, the device connection can alternatively be used as an output, wherein the test switch can be used in some embodiments to decouple the input circuit from the output signal, in other embodiments the evaluation and control unit can read back the output signal through the input circuit at the same device connection, which facilitates the realization of a safe output function.

In all cases, it is preferable for the AC power supply to switch off the electrical customer by means of at least one switch if the test of the input signal gives an unexpected result and in particular if a low level (suppressed input signal) deliberately produced by the AC power supply does not reach the AC power supply.

The above problem is therefore completely solved.

In a preferred configuration, the input circuit and the output circuit shall be connected at a node between the device connection and the test switch.

Err1:Expecting ',' delimiter: line 1 column 334 (char 333)

In another design, the safety-belt switch has a signal path connected to the output circuit and bridging the test switch.

This design has the advantage that the output and control unit can detect an undesirable impact of an input signal lock on the connection by the output circuit. In particular, the output and output signal lock can be detected by the control unit, which is able to detect whether a signal lock is permanently located on the high-voltage circuit when a high error is detected between the input and output locks.

In another configuration, the safety-belt switch has a diode or similar component placed between the signal path and the device connection to disconnect the signal path from the connection clamp.

A diode or similar component in this sense is a component that allows a current flow in practically only one direction, but not in the opposite direction. The design is a very simple way to prevent the input signal from reaching the evaluation and control unit via the signal path and thus bypassing the test switch. Combined with the design mentioned above, this design allows for the error-proof detection of low levels at the configurable device connection.

In a further design, the safety-belt switch has a large number of input circuits and a large number of output circuits, each paired together at a large number of device connections.

In this design, the safety switch has several configurable device connections of the type described above. Each of these configurable device connections is advantageously implemented to ensure fault tolerance by means of the two designations mentioned above. The provision of several such configurable device connections allows a particularly flexible use of the new safety switch for applications up to and including category 4/SIL3 by providing two configurable device connections as redundant inputs and/or redundant outputs in each case.

In a further design, at least one of the output circuits shall include at least one switching element.

In this design, at least one of the configurable device connections serves as the output connection through which the safety switch switches off the electrical consumer. Alternatively, it is conceivable in other designs that the output-side switch elements are designed to connect the consumer to non-configurable device connections, i.e. the configurable device connections are essentially designed to control the detectors and to receive the input signals from the detectors. This design, however, allows for even greater input flexibility. In some examples, all device connections connecting the detectors and/or actuators are designed to be configurable connections with a real output circuit and are described above.

In another configuration, the control unit is trained to suppress the input signal repeatedly with the help of the test switch within defined time intervals.

In this design, the output and control unit automatically tests the detectability of the input circuit within the defined time intervals. In some embodiments, the length of the defined time intervals is specified in the output and control unit. In other embodiments, the length of the defined time intervals can be configured by the user of the safety switch device. The design contributes to reduce the likelihood of a second failure occurring after the occurrence of a first failure. This design thus facilitates the achievement of a higher safety category.

In a further configuration, the evaluation and control unit is trained to generate either a stationary output signal or a clocked output signal with a defined clock period using the output circuit.

This design is advantageous when the output circuit is to be used to provide a feedback signal to monitor passive alarms, such as an emergency shut-off button. e design allows for either stationary or timed outputs to the alarms, allowing the user to use the new safety switch even more flexibly.

In another design, the evaluation and control unit has a first and second signal processing channel, which process the input signal redundantly to each other to control at least the switch element. In some embodiments, the first and second signal processing channels control the test switch alternately. In other embodiments, the safety switch may have two redundant test switches, for example in series with each signal processing channel directing one of the two test switches. In other embodiments, however, the input circuit has only one test switch, which is controlled by the first signal processing channel, whereby both signal processing testers have their own signal processing channels as in the case of the single input processing.

The design allows for a simple and continuous single-fault reliability in the signal processing part of the safety switch and thus a high bandwidth and flexibility.

In a further design, the safety-belt switch shall have at least two switching elements which are redundantly controlled by the measurement and control unit to interrupt the power supply path to the consumer.

This design also helps to facilitate the user's implementation of a safety circuit meeting the requirements of category 4/SIL3.

It is understood that the features described above and those to be explained below are applicable not only in the respective combination but also in other combinations or alone, without leaving the scope of the present invention.

Examples of the invention are shown in the figure and are described in more detail in the following description. Figure 1 a simplified illustration of a preferred embodiment of the new safety switch on a machine system, and Figure 2 one of the configurable device connections of the safety switch from Figure 1.

In Figure 1, an installation with an example of the new safety switch is referred to as a whole by reference 10. For example, Annex 10 includes a robot 12 whose movements during operation are likely to be dangerous to persons in the robot 12's working area. For this reason, the robot 12's working area is secured by a protective fence with a protective door 14. The protective door 14 allows access to the robot 12's working area, for example for maintenance or installation. However, in normal operation, the robot 12 may only work when the protective door 14 is closed. Once the protective tower 14 is opened, the robot 12 must be locked or otherwise restored.

To detect the closed state of the guard door 14, a guard door switch with a door part 16 and a frame part 18 is fitted to guard door 14 and the frame part 18 generates a guard door signal on a line 20 fed via line 20 to an embodiment 22 of the new guard switch.

In some embodiments, the device connections are 26 connector pins, arranged on one side of the housing of the housing 27 of the safety switch 22. For example, these may be spring clamps or screw clamps. In other embodiments, the device connectors may be plugs or sockets containing several contact elements (pins), with one pin forming a gate connection. Frequently, M8 sockets with five pins are used to connect detectors or other sensors at the field level.

The safety switch 22 has two redundant signal processing channels in this embodiment. As an example, two microcontrollers 28a, 28b are shown here, each connected to the I/O part 24. The microcontrollers 28a, 28b here redundantly process the input signal received by the safety switch 22 at the device connections 26 of the I/O part, and they compare their results, which is shown by an arrow 29. Instead of two microcontrollers 28a, 28b, microprocessors, ASICs, FPGAs and/or other signal processing circuits may be used.

In the case shown here, the safety switch 22 has two redundant switching elements 30a, 30b. Each of these two switching elements is capable of switching a high voltage potential 32 to a device connection 38a, 38b of the safety switch 22 to allow or interrupt a current flow to a junction 40a, 40b. Each of these switching elements 30 can therefore switch off an actuator, such as a junction or a magnetic valve.

Err1:Expecting ',' delimiter: line 1 column 469 (char 468)

The safety switch 12 controls the switch elements 30a, 30b here depending on the signal from the safety door switch on line 20 and depending on another input signal from an emergency shut-off switch 46.

In some embodiments, the safety switch generates 22 output signals fed to the individual alarm devices. For example, such an output signal is carried by a line 48 to the guard door's frame part 18. The frame part 18 carries the output signal of the safety switch 22 from the line 48 to the line 22 when the door part 16 is near the frame part 18, i.e. when the guard door 14 is closed. Therefore, the guard door 22 can cross the guard door switch by means of the output signal on line 48 and by means of the input signal on guard 20. In a similar way, the guard door 22 is used to determine the emergency button 46.

In practice, two redundant output signals from the safety switch 22 are often used, each of which is sent via a separate signal line to a signal transmitter and then carried back to the safety switch 22 via this transmitter.

Fig. 2 shows a preferred embodiment for the implementation of a configurable device connection of the safety-belt 22 In the preferred embodiments, all signal inputs for the connection of signalling equipment are implemented in the form of such or similar configurable device connection Furthermore, the outputs of the I/O part 24 are implemented in the form of such or similar device connection in the preferred embodiments, so that the safety-belt 22 has in the preferred embodiments only configurable device connections 26 that can be used as input or output by default.

In addition, the device connections 38a, 38b of the safety switchgear 22 can be configurable device connections of the type shown in Figure 2. In these cases, the safety switchgear 22 may have only configurable device connections for connecting signalling devices and/or actuators. In such embodiments, the safety switchgear 22 only needs additional connections to supply an operating voltage (UB and mass) and possibly device connections for data communication, such as a connection for fieldbus systems such as SafetyNET® p.

In the preferred embodiments, the safety switch 22 has an input circuit 54 and an output circuit 56 for each device connection 26 The input circuit 54 is used to receive an input signal supplied to the device connection 26, for example, to receive the signal 20 from the guard door switch 18 The output circuit 56 is used to generate an output signal, such as the signal transmitted via the line 48 to the guard door switch 18 It is understood that the configurable device connection 26 is configured in these cases to be either an input or an output, i.e. it does not perform both functions simultaneously.

The input circuit 54 and the output circuit 56 are connected at a node 58. In this example, the node 58 is connected directly to the connector 26 electrically. In other examples, however, there may be separate components, such as a filter circuit or the like, between the clamp or contact element at the device connection 26 and the node 58.

The output circuit in this embodiment has a MOS transistor 60 whose source connection is connected to a defined voltage potential 62. The voltage potential 62 may, for example, be a 24 volt potential derived from the operating voltage supplied to the safety switch 22 for power supply (not shown here). Parallel to the source-drain line of the MOS transistor 60 here is an extinguishing diode 64 to limit voltage peaks when turning off inductive loads. The gate connection of the MOS transistor 60 is connected to a connection point 66 wherein in the preferred embodiments the output values of the controller and the connected safety switch 28 are shown so that this signal cannot be blocked by at least one of the two outputs of the control unit UNO 28 and UNO 28 (the output values of the control unit UNO 28 and UNO 28 are not equal to one or two E values).

The input circuit 54 has a test switch, which is here arranged as a longitudinal transistor 68 between node 58 and another connection point 70. In the example shown, the transistor 68 is a PNP transistor. The collector of the PNP transistor 68 is connected to the connection point 66, while the emitter of the PNP transistor 68 is connected to node 58 via a resistor 72. The base of the PNP transistor 68 is connected by a plug of a voltage divider, with a first resistor 74 of the voltage divider being connected parallel to the bus mid-range, while a second resistor 76 of the voltage divider leads to another transmitter of a 78 transistor. The further transmitter 78 of the transistor is connected to a transistor.The base connection of the other transistor 78 is connected to another connector 80; the other connector 80 is also connected to the output and control unit (not shown here). In some embodiments, the output 80 is connected to one of the signal processing channels 28a, 28b only. In any case, the output and control unit can switch to a control signal at the output 80 conducting or locking the longitudinal transistor 68 in order to switch an input signal at the device connection 26 to the input 70 or to disconnect from the input 70; in the latter case, the input and control unit can only express values with the help of the longitudinal transistor 68 because the output value of this input and control unit can no longer reach the output 70 at the output 26 and the output 70 at the output 26 point.

reference number 82 is a signal path leading from the drain connection of the MOS transistor 60 to a node 84. The node 84 is connected to the manifold of the longitudinal transistor 68. Thus, the signal path 82 forms a bridging path leading over the node 58 and the node 84. In the signal path 82 there is also a resistor 86 located here. Furthermore, between the node 58 and the drain connection of the MOS transistor 60 a diode 88 is switched in a locking direction so that an input signal from the device connection 26 cannot pass through the signal path 82 to the node 84. However, an output signal at the drain connection of the MOS transistor 60 is sent through the 86 and the 84 nodes to the access point 70.

The function of the configurable device connector 26 is now as follows:

If the device connector 26 is to be used as an output to output an output signal, the processing channels 28a, 28b of the output and control unit control the MOS transistor 60 via the input point 66 either conductively or locking. In this way, the output and control unit at the device connector 26 can generate an output signal that alternates between a high level (voltage potential 62) and a low level (0 volts, high). Via the signal path 82 and the input point 70, the processing channels 28a, 28b can re-read the output generated at the input point 26 from the device connector. This is particularly important when the MOS transistor 60 is used as a 30a switch, which is used to switch the output of the transistor around the input point 80 or 80a, while the output of the MOS transistor is switched to a 40 or 80a switch. In some cases, the control signal is switched to the output point 80 or 80a, while the output of the transistor is switched to the input point 80 or 80a, which is in some cases the control signal.

If the device connector 26 is to be used as input, the output and control unit opens the MOS transistor 60 via the input point 66. If the MOS transistor 60 is operating without fail, the signal path 82 becomes high-ohm. Now an input signal can be transmitted via the device connector 26 and the longitudinal transistor 68 to the input point 70 and from there to the two signal processing channels 28a, 28b of the control unit. For example, an input signal is shown in Fig. 2 at reference 90 here. The input signal 90 can have any signal state in an initial period 92 that reaches the input point 79 via the conductive longitudinal transistor 68 when the signal reaches a high-ohm period 94 in the signal, but the input signal 90 can be transmitted in a second period 92 when the signal reaches the input point 79 in the signal period 94.However, in the preferred embodiments, the output and control unit suppresses the input signal 90 by means of the longitudinal transistor 68 at periodic intervals by generating a periodic control signal 96 (e.g. a rectangular signal) at the input point 80. With each positive signal pulse of the control signal 96, the control transistor 78 opens the longitudinal transistor 68. Accordingly, the high level 94 of the signal 90 during a defined time interval 98 does not reach the input point 70. Since the input and control unit itself initiated this test, it can check the capability of the input signal 98 to operate at the output point 26 and in particular the low-power detection devices at the input point.

Err1:Expecting ',' delimiter: line 1 column 278 (char 277)

The new safety switch 22 thus has configurable device connections 26 which can be optionally changed as an input or output of a safety switch. Both the input and output function can be used to implement safety functions, as the safety switch 22 ensures that safety-relevant low levels at the output are detected by means of the test switch 68 and the bridging signal 82. To achieve a safe output, the safety switch 22 provides several configurable device connections to the output in preferred output examples, so that two circuits 56 can be used as redundant switching elements for the redundant shutdown of an electrical consumer.

Claims (10)

1. A safety switching device for the failsafe shutdown of an electrical load (12), comprising a number of device connectors (26, 38), comprising at least one input circuit (54) for receiving an input signal (20, 90) from a signaling device (18, 46) which signals a safety-related state, comprising at least one output circuit (56) for outputting an output signal (48), comprising at least one switching element (30) designed for interrupting a current supply path (44) to the load (12), and comprising an evaluation and control unit (28) designed for actuating the at least one switching element (30) in dependence on the input signal (20, 90), characterized in that the at least one input circuit (54) and the at least one output circuit (56) are joined at one from the device connectors (26) so that said one device connector (26) can selectively be used as input for receiving the input signal (90) or as output for outputting the output signal (48), with the input circuit having a test switch (68) which is coupled to the evaluation and control unit (28), and with the evaluation and control unit (28) being designed for selectively suppressing the input signal (90) using the test switch (68).
2. The safety switching device of claim 1, wherein the at least one input circuit (54) and the at least one output circuit (56) are joined at a node (58) which is located between said one device connector (26) and the test switch (68).
3. The safety switching device of claim 1 or 2, further comprising a signal path (82) which is connected to the output circuit (56) and which by-passes the test switch (68).
4. The safety switching device of claim 3, further comprising a diode (88) or a similar component which is arranged between the signal path (82) and the device connector (26) in order to decouple the signal path (82) from the device connector (26).
5. The safety switching device of one of claims 1 to 4, comprising a plurality of input circuits (54) and a plurality of output circuits (56) which are respectively joined in pairs at a plurality of connecting terminals (26).
6. The safety switching device of one of claims 1 to 5, wherein at least one of the output circuits (56) comprises the at least one switching element (30).
7. The safety switching device of one of claims 1 to 6, wherein the evaluation and control unit (28) is designed for suppressing the input signal (90) using the test switch (68) repeatedly within defined time intervals.
8. The safety switching device of one of claims 1 to 7, wherein the evaluation and control unit (28) is designed for selectively generating, by means of the output circuit (56), a steady-state output signal or a clocked output signal having a defined clock period.
9. The safety switching device of one of claims 1 to 8, wherein the evaluation and control unit (28) has a first and a second signal processing channel (28a, 28b) which process the input signal (90) redundantly with respect to one another in order to actuate the at least one switching element (30).
10. The safety switching device of one of claims 1 to 9, comprising at least two switching elements (30a, 30b) which are actuated redundantly by the evaluation and control unit (28) in order to interrupt the current supply path (44) to the load (12).