EP2239752A1 - Secure switching device and modular error-proof control system - Google Patents

Abstract

The device (10) has a switching element e.g. relay to perform switching process of electrical load using control signal generated by a control system (20). A detection apparatus detects the switching process amount. The detection apparatus includes a memory apparatus (28) for permanent storage of switching process amount. The memory apparatus has an associated section to identify the faults in the memory apparatus. An independent claim is included for modular failsafe control system for switching ON/OFF states of electrical load.

Description

The present invention relates to a safe switching device for a modular fail-safe control system for switching a load on and off safely, with at least one wear-prone switching element which is designed to perform a switching operation by means of a control signal generated by the control system in order to switch the load. The invention further relates to a modular fail-safe control system for switching on and off safely an electrical load, in particular an electrically driven machine, via at least one switching device, with a control device for evaluating input signals and for generating a control signal for the switching device depending on the evaluation.

Such switching devices are well known and form part of fail-safe control systems, which are also commonly referred to as safety relays. Fail-safe control systems serve to reliably evaluate the signal of a safety transmitter, for example an emergency stop switch, a protective door position switch, etc., and to actuate one or more safe output contacts of a switching device. Actuators, such as contactors, valves, motors, dangerous machine parts, for example saw blades, robot arms, high-voltage devices, etc., are then brought to a safe state via these switched output contacts. The applicant offers under the name "PNOZ" a variety of different safety relay types. An example of a modular safety relay with a modular fail-safe control system and a safe switching device is, for example, in DE 100 20 075 C2 disclosed. Also in the publication DE 100 11 211 a safety switching device of the applicant is shown.

Since such safety switching devices are used in safety-critical environments, the dangers that can be caused by defective components must be mastered. In addition to the erroneous measures, e.g. Redundant design and the use of automatic diagnostic tests to detect dangerous hardware failures mean that it is increasingly important to consider the failure rates of the components used in safety relays.

It is well known that safety relays can not be completely safe. Therefore, the risk that the safety relay will fail due to the failure of a component must be evaluated and this risk must be below an accepted limit.

For electrical and electronic components, it is usually assumed that their failure rate is constant. The risk of failure is therefore the same for a new and for an old, identical safety relay.

For mechanical and electromechanical components, such as relays, contactors, brakes, etc., usually wear must be expected. Therefore, the failure rate increases sharply from a wear limit, so that the accepted risk at the end of life of the component is exceeded. It is therefore prescribed to replace these components before their wear limit or operate the components so that the wear limit is not reached in the intended operation.

Component reliability quantification is required to demonstrate compliance with current standards IEC 61508 and ISO 13849-1.

The requirements imposed by the standards for functional safety and the continuous endeavor to increase the safety and availability of safety relays give rise to the desire to improve the diagnosis, especially of components subject to wear.

"Diagnosis" is used in the context of the present application within the meaning of the IEC 61508 series of standards.

There, "diagnostics" refers to the use of automatic diagnostic checks to detect dangerous hardware failures in safety-related systems.

Against this background, the object of the present invention is to develop the aforementioned switching device so that a better, especially safer diagnosis is possible.

This object is achieved in the switching device mentioned above in that a device for detecting the number of switching operations performed (detection device) is provided, which has a memory device for permanent fail-safe storage of the detected number.

In other words, this means that in the switching device itself a counter is led decentrally, which indicates the number of switching operations (also called "switching cycle number"), and which can be evaluated centrally at the control system level. In order to take account of the high security requirements, the memory device is equipped with fail-safe memories, which also store the information "permanently", that is, even when the operating voltage (zero voltage safe). The term "failsafe" in the context of the present application means that the memory may indeed be defective, but this must be recognized in order to avoid a misinterpretation of the memory contents.

The user of a modular safety switching device is provided with the solution according to the invention a means to make a diagnosis of wear-prone switching elements on the basis of the stored fail-safe number of switching operations.

Especially with the use of relays as switching elements can be avoided with the help of fail-safe stored number of switching operations that they are operated beyond the wear limits specified by the manufacturers. In addition, for example, a warning system on the basis of the stored number of switching operations can be implemented to inform the user in good time before reaching the wear limit and / or change to another operating mode to prevent safety-critical behavior in case of failure of the switching element.

In a preferred development, the detection device has a counter circuit which increments a counter reading, preferably one, by means of a counting signal and stores this counter reading in the memory device.

In other words, the decentralized safe switching device has all the elements required to detect the number of switching operations, namely a counter which can be incremented by means of a counting signal, and on the other hand, the already mentioned memory device for storing the count. It is therefore not necessary that the central control system supplies the meter reading and this is stored locally.

In a preferred embodiment, the count signal is generated by the central control system and fed to the decentralized safe switching device, so that there the counter can be incremented accordingly.

However, it is even more preferable to provide the decentralized switching device with a device for detecting the control signal and generating a counting signal. In other words, that means that the decentralized safe switching device generates a counting signal on the basis of the control signal that it is anyway supplied for switching the switching element.

This embodiment is particularly simple and continues the idea of decentralized structure, so that the detection of the number of switching operations can be made decentralized by the safe switching device without the help of the control system.

In a preferred embodiment, the memory device is associated with a means for error detection to detect errors of the memory device.

Such a means has the task, for example, to check whether the memory device works failsafe, that is, for example, that the individual memory cells required for storing are functional. Such a test can be carried out cyclically, for example.

Alternatively or in addition thereto, it is preferably provided to equip the memory device with two redundant memory elements.

This solution has the advantage that in the event of erroneous data storage with the redundant data from the other memory element, operation can be continued. A fail-safe fault-tolerant decentralized diagnosis is thus possible.

As an alternative to two redundant memory elements, it is of course also possible for the stored data (that is to say the number of switching operations) to be provided with parity bits, so that it can be recognized by it as to whether the date is erroneous. Alternatively, for example, a cyclic redundancy check (CRC) could be carried out, with a corresponding CRC value being stored together with the corresponding date. With the help of such a test, it is not only possible to basically detect an error, but it is also possible to correct the error. This can provide a fail-safe decentralized diagnosis.

It is understood that other means and methods are also conceivable to detect incorrectly stored data and correct if necessary.

In a preferred development, the switching device according to the invention has a means for reading out the stored number of switching operations and for transmitting the read-out number to the control system.

In other words, the central control system can interrogate the number of switching operations from a connected switching device in order to make a diagnosis or check on this basis.

Of course, it would alternatively also be conceivable to make the evaluation or diagnosis on the basis of the stored number of switching operations decentralized by the switching device. It would be conceivable that the secure switching device then outputs only diagnostic status messages to the central control system. In this case, the parameters required for diagnosis, such as For example, the number of cycles until the wear limit, etc., stored in the switching device.

The advantage of such a decentralized diagnosis lies in particular in the flexibility, since the replacement of a switching device or a supplement means that no data has to be newly loaded onto the central control system, but that the switching device itself "brings along" the diagnostic parameters.

The object on which the invention is based is also achieved by a modular fail-safe control system of the type mentioned above in that a diagnostic parameter memory device is provided for storing predeterminable switching process threshold values for the at least one switching device and a diagnostic data analysis device which are designed To compare a number of switching operations read from a switching device with the stored threshold values and to initiate an action depending on it.

In other words, the diagnosis is made centrally in the control system, with the required diagnostic parameters, such as switching process thresholds, being stored there. If the diagnosis leads to the result that, for example, a switching element of a switching device shortly reaches the wear limit, the control system can trigger a specific action. Under such an action can be understood in the simplest case, the output of a warning that the wear limit is reached soon and, for example, an exchange of the switching element is required. Another action could be to switch to a restricted operation, for example, in such limited operation only a reduced speed of the machine is allowed or normal operation is allowed only for a limited time. Another action could be to keep the safety system in a safe state and to interrupt operation.

It is understood that the features mentioned above and those yet to be explained below can be used not only in the particular combination given, but also in other combinations or in isolation, without departing from the scope of the present invention.

Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawings. The single FIGURE shows in the form of a schematic block diagram the structure of a safety switching device, wherein only the components necessary for the invention are shown.

In the single figure, a safety switching device is shown as a block diagram and designated by the reference numeral 10. For reasons of clarity, only the modules required for the explanation of the invention are shown in this block diagram. With regard to a concrete mechanical and electrical construction of such a safety switching device 10, reference is made to the documents mentioned in the introduction or to the available from the applicant written documents to the safety relay "PNOZmulti" or "PSSu".

The safety switching device 10 generally serves to connect or disconnect a load 12, for example an electric motor, with a power supply 14. The separation of the consumer 12 from the power supply 14 by means of the safety switching device 10 in a secure manner when, for example, an emergency stop switch 16 is actuated. It should be noted at this point that this wiring of a safety switching device 10 is purely exemplary and represents one of many different circuits. In particular, other switches instead of the emergency stop switch 16 are conceivable, such as light grids, light barriers, etc.

The safety switching device 10 shown in the figure has a modular structure and comprises a central module 20, which is also referred to below as a control system, and at least one relay module 40, which is also referred to below as a switching device. The control system 20 is connected to the switching device 40 via a data bus 60. As the bus 60 different systems in question, the applicant offers, for example, a secure bus system that could be used here.

In order to be able to handle a communication between the control system 20 and the switching device 40 via the bus 60, an interface 22 or 42 is provided in each case, wherein these interfaces or interfaces 22, 42 are adapted to the particular bus system used.

Both the control system 20 and the switching device 40 each have a control unit 24 and 44, which are connected to the respective interfaces 22 and 44, respectively. The control units 24, 44 are responsible for the control of the complete processes within the respective module 20, 40, wherein at this point can be dispensed with a detailed description. Rather, reference is made to the already mentioned publications, in which the structure is explained.

The central control unit 24 comprises an evaluation unit 26, which evaluates certain data for diagnostic purposes. In particular, this involves the evaluation of the number of switching operations (switching cycle number) that the switching elements 46 of the connected switching devices 40 have performed. This number is important if the switching elements 46 are wear-affected switching elements, such as relays.

The central control unit 24 is assigned a memory unit 28 which comprises at least two memory elements 30, 32. The memory unit 28 is used to store diagnostic parameters, with a redundant storage is required for security reasons. In other words, that means the two Memory elements 30, 32 each store identical diagnostic parameters, so that even with a faulty date the data stored in the redundant memory element date can be used for further operation.

Of course, other possibilities of fail-safe data storage are conceivable. For example, it would also be possible to store a CRC value for each stored datum, so that when reading out this datum it can be determined on the one hand whether an error exists and on the other hand this error can be corrected.

The diagnostic parameters to be stored are, for example, values for switching operations of wear-prone switching elements 46. Consequently, such a diagnostic parameter can be, for example, the number of switching operations of a switching element that the manufacturer of this switching element allows. In other words, that the switching element should be replaced upon reaching this number of switching operations.

It is understood that other diagnostic parameters can also be stored in the memory unit 28. In addition, it should be noted at this point that the stored diagnostic parameters relate to a single modular switching device 40. In the event that several different switching devices 40 are connected to the bus 60, the memory unit 28 contains the corresponding diagnostic parameters for each switching device.

The modular switching device 40 likewise comprises a memory unit 48 which is assigned to the control unit 44, that is to say connected to it via corresponding data and control lines. The memory unit 48 is constructed as a redundant memory unit, so that memory elements 50, 52 are provided which store identical data.

The memory unit 48 is designed to store diagnostic data, wherein in the present embodiment, a diagnostic date is the number of switching operations of the switching element 46.

In order to detect the number of switching operations on the one hand and on the other hand to store permanently and fail-safe, a first counter register 54 and a second counter register 56 are provided, which may be part of the memory unit 48. The two counter registers 54, 56 store a count, which is incremented by one upon the occurrence of a particular event, here the switching on of the switching element 46.

Important in the case of the two counter registers 54, 56 is that they retain their register value even when the supply voltage ceases, ie they are zero-voltage-proof.

In addition, it must be ensured that the stored counter, which indicates the number of switching operations, is fail-safe. This does not necessarily mean that the storage of redundant data is required in order to be able to continue working with the redundant second date if the date is erroneous, but initially only that erroneous storage of a date is recognized.

For this purpose, different methods exist, wherein - as already mentioned above - the storage of additional parity bits offers a possibility to detect faulty storage. Another possibility is to store in addition to the date a so-called CRC value (cyclic redundancy check), so that not only an error is recognized on the basis of this CRC value, but also the error can possibly be corrected.

In order to ensure operation of the switching device even with incorrect counter value, however, the second counter register 56 shown in the figure is preferably provided as redundancy. In other words, that means the number of Switching operations identical in two different counter registers 54, 56 is stored.

In order to increment the values in the counter registers 54, 56 by one, the control unit 44 generates a count signal and transmits this to the two counter registers 54, 56 whenever it transmits a turn-on signal to the switching element 46.

Alternatively, it would of course also conceivable that a count signal is generated by the control system 20 and transmitted via the bus 60 to the respective switching device 40.

To evaluate the value stored in the counter register 54 or 56, the control system 20 calls a diagnostic program which requests the data stored in the counter register 54, 56 of the switching device 40. This has the consequence that the switching device 40 transmits this date to the interface 42 and via this and the bus 60 to the control system 20. After receiving this date, which indicates, for example, the number of switching operations that have occurred, a comparison is made with one or more diagnostic parameters that are stored in the memory unit 28. These diagnostic parameters are, for example, various threshold values which are usually specified by the manufacturer of the switching element 46 and trigger a specific action when they are exceeded. If, for example, a diagnostic parameter describes the number of switching operations up to the wear limit, the switching device 40 is safely switched off via the control system 20 when this value is reached.

In addition to these diagnostic parameters are further, as already stated, conceivable. Thus, another diagnostic parameter could indicate the number of switching operations, from which a warning must be issued, which alerts the user that the corresponding switching element 46 of the switching device 40 must be replaced.

Finally, an action that is initiated by the control system may also be to allow operation of the load 12 only at reduced speed or only for a certain time.

It is thus understood that different diagnostic parameters (for example, as threshold values) are stored in the memory unit 28 for different actions. These diagnostic parameters may originate from the manufacturer of the switching device, or else from the user of the safety switching device 10. In other words, the diagnostic data stored in the memory unit 28 can be predetermined or set.

Since the threshold values stored as diagnostic parameters are often only reached after a few years of operation of the safety switching device, it is absolutely necessary for the diagnostic parameters or diagnostic data stored in the two memory units 28, 48 to be permanently maintained even if the operating voltage ceases. On the other hand, the counter registers must be equipped with sufficient bit width, so that even very large values can be stored without an overflow takes place.

With the help of zero-voltage safe and failsafe storage of the number of switching operations within a modular switching device 40, it is possible to make a diagnosis to detect the risk of failure based on stored diagnostic parameters and then be able to initiate certain actions based on an evaluation. The result is that the availability of the safety switching device is increased because the failures caused by wear of switching elements can be substantially avoided by early reaction.

Alternatively to the embodiment shown in the figure, it would also be conceivable that the diagnostic parameters associated with a switching device 40 are not stored centrally but decentrally in the respective switching device. The central Control system 20 may then request these diagnostic parameters via the bus to store them in its own memory unit 28. It would also be conceivable, of course, that the diagnosis takes place decentrally in the respective switching device 40 and only the result is transmitted to the central control system.

Claims (15)

Safe switching device for a modular fail-safe control system (10, 20) for switching on and off safely an electrical load (12), with at least one wear-prone switching element (46), which is designed by a control signal generated by the control system (10, 20) Performing switching operation to switch the electrical load (12), characterized by a device for detecting the number of switching operations (44, 48) (detection device) with a storage device (48, 50, 52) for permanent fail-safe storage of the detected number. Switching device according to claim 1, characterized in that the switching element is a relay (46). Switching device according to claim 1 or 2, characterized in that the detection device comprises a counter circuit (54, 56) which increments a count, preferably by one, by a count signal, and stores this count in the memory device. Switching device according to claim 3, characterized in that the counter circuit (54, 56) and the memory device (48, 50, 52) are formed as a unit (28). Switching device according to claim 3, characterized in that the counting signal is generated and supplied by the control system (20). Switching device according to claim 3, characterized in that the detection device comprises a device for detecting the control signal and generating a count signal. Switching device according to one of the preceding claims, characterized in that the memory device (48) is associated with a means for error detection to detect errors of the memory device. Switching device according to one of the preceding claims, characterized in that the memory device (48) has two redundant memory elements (50, 52). Switching device according to claim 8, characterized in that the number of switching operations is stored in both memory elements. Switching device according to claim 8, characterized in that a check sum of the number stored in the other memory element is stored in one of the two memory elements. Switching device according to one of the preceding claims, characterized in that a means for reading the stored number of switching operations and transmitting the read-out number is provided to the control system. Modular fail-safe control system for switching on and off safely an electrical consumer, in particular an electrically driven machine, via at least one, preferably external switching device (40), in particular according to one of claims 1 to 11, with a control device (24, 26) for evaluating Input signals and for generating a control signal for the switching device (40) depending on the evaluation, characterized by a diagnostic parameter storage device (28) for storing predeterminable switching thresholds for the at least one switching device (40), and a diagnostic data analysis device (26) , which is designed, the read out of a switching device number of switching operations with the stored To compare thresholds and to initiate an action depending on them. Control system according to claim 12, characterized in that an action is the issuance of a warning message and / or the switching to a limited operation of the consumer and / or the switching of the consumer in a safe state. Control system according to claim 12 or 13, characterized in that the diagnostic parameter storage device (28) is formed fail-safe and / or redundant. Control system according to claim 12, 13 or 14, characterized in that the diagnostic parameter memory device (28) is formed zero voltage safe.

Images