EP2239752B2 - Secure switching device and modular error-proof control system - Google Patents

Description

The present invention relates to a safe, decentralized switching device, which can be connected to a modular, fail-safe control system for switching an electrical load on and off safely via a bus, with at least one switching element that is subject to wear and is designed to carry out a switching process using a control signal generated by the control system to switch the electrical load. The invention also relates to a modular fail-safe control system for switching an electrical load on and off safely, in particular an electrically driven machine, via at least one external switching device, with a control device for evaluating input signals and for generating a for the external switching device specific control signal depending on the evaluation.

Such switching devices are generally known and form part of fail-safe control systems, which are also generally referred to as safety switching devices. Fail-safe control systems are used to safely evaluate the signal from a safety transmitter, for example an emergency stop switch, a protective door position switch, etc., and to control one or more safe output contacts of a switching device. Actuators, for example contactors, valves, motors, dangerous machine parts, for example saw blades, robotic arms, high-voltage equipment, etc., are then brought into a safe state via these switched output contacts. The applicant offers a large number of different types of safety switching devices under the name "PNOZ". An example of a modular safety switching device with a modular, fail-safe control system and a safe switching device is given in DE 100 20 075 C2 disclosed. Also in print DE 100 11 211 a safety switching device from the applicant is shown. Another example is from WO 2007 014725 famous. Furthermore, switching devices are off DE 102 96 915 T5 , DE 198 04 442 C2 or DE 35 05 818 A1 famous.

Since such safety switching devices are used in safety-critical environments, the dangers that can be caused by defective components must be controlled. In addition to the error-controlling measures, e.g. by means of a redundant structure and the use of automatic diagnostic tests to detect dangerous hardware failures, taking into account the failure rates of the components used in safety switching devices is becoming increasingly important.

It is well known that safety switching devices cannot be absolutely safe. Therefore, the risk of the safety switching device failing due to the failure of a component must be assessed and this risk must be below an accepted limit.

In the case of electrical and electronic components, it is usually assumed that their failure rate is constant. The risk of a failure is therefore the same for a new and an old, identically constructed safety switching device.

In the case of mechanical and electromechanical components such as relays, contactors, brakes, etc., wear and tear must usually be expected. The failure rate therefore increases sharply above a wear limit, so that the accepted risk at the end of the component's service life is exceeded. It is therefore prescribed to replace these components before their wear limit or to operate the components in such a way that the wear limit is not reached in the intended operation.

The quantification of the component reliability is necessary to prove that the current standards IEC 61508 or ISO 13849-1 are complied with.

The requirements of the standards on functional safety and the ongoing efforts to increase the safety and availability of safety switching devices give rise to the desire to improve the diagnosis of components that are subject to wear in particular.

"Diagnosis" is used in the context of the present application in the sense of the IEC 61508 series of standards.

There, "diagnosis" is understood to mean the use of automatic diagnostic checks to detect dangerous hardware failures in safety-related systems.

Against this background, the object of the present invention is to further develop the switching device mentioned at the outset in such a way that better, and in particular more reliable, diagnosis is possible.

In the case of the switching device mentioned at the outset, this object is achieved in that a device is provided for recording the number of switching operations carried out (recording device), which has a storage device for permanent, fail-safe storage of the recorded number.

In other words, this means that a counter is kept decentrally in the switching device itself, which indicates the number of switching operations carried out (also known as the "number of switching cycles"), and which can be evaluated centrally at the control system level. In order to take account of the high safety requirements, the memory device is equipped with fail-safe memories, which also store the information "permanently", ie even when the operating voltage fails (non-volatile). In the context of the present application, the term “fail-safe” is to be understood to mean that the memory may be defective, but this must be recognized in order to avoid misinterpretation of the memory content.

The solution according to the invention provides the user of a modular safety switching device with a means of carrying out a diagnosis of switching elements subject to wear on the basis of the stored, fail-safe number of switching operations carried out.

Especially when relays are used as switching elements, the fail-safe stored number of switching operations can be used to prevent them from being operated beyond the wear limits specified by the manufacturers. In addition, a warning system based on the stored number of switching operations can also be implemented, for example, in order to inform the user in good time before the wear limit is reached and/or to switch to another operating mode in order to prevent safety-critical behavior if the switching element fails.

In a preferred development, the detection device has a counter circuit which increments a counter reading, preferably by one, using a counting signal and stores this counter reading in the memory device.

In other words, this means that the decentralized safe switching device has all the elements that are required to record the number of switching operations, namely a counter that can be incremented using a counting signal on the one hand, and the memory device already mentioned for storing the counter reading on the other. It is therefore not necessary for the central control system to deliver the meter reading and for this to be stored in a decentralized manner.

In a preferred development, the counting signal is generated by the central control system and fed to the decentralized safe switching device, so that the counter can be incremented accordingly there.

However, it is even more preferred to equip the decentralized switching device with a device for detecting the control signal and generating a counting signal. In other words, this means that the decentralized safe switching device generates a counting signal based on the control signal supplied to it anyway for switching the switching element.

This refinement is particularly simple and continues the idea of the decentralized structure, so that the number of switching operations carried out can be recorded decentrally by the safe switching device without the aid of the control system.

In a preferred development, a means for error detection is assigned to the storage device in order to detect errors in the storage device.

Such a means has the task of checking, for example, whether the memory device is working in a fail-safe manner, that is to say, for example, that the individual memory cells required for storing are operational. Such a test can be carried out cyclically, for example.

Alternatively or in addition to this, provision is preferably made for the memory device to be equipped with two redundant memory elements.

This solution has the advantage that, in the event of faulty data storage, operation can be continued with the redundant data from the other storage element. A fail-safe, high-availability, decentralized diagnosis is hereby possible.

As an alternative to two redundant storage elements, it is of course also possible for the stored datum (ie the number of switching operations) to be provided with parity bits, so that it can be recognized from this whether the datum is faulty. Alternatively, for example, a cyclic redundancy check (CRC) could also be carried out, with a corresponding CRC value being stored together with the corresponding data. With the help of such a check, it is not only possible to fundamentally detect an error, but it is also possible to correct the error. A fail-safe decentralized diagnosis can thus be provided.

It goes without saying that other means and methods are also conceivable for recognizing and, if necessary, correcting incorrectly stored data.

In a preferred development, the switching device according to the invention has a means for reading out the stored number of switching operations and for transmitting the number read out to the control system.

In other words, this means that the central control system can query the number of switching operations from a connected switching device in order to carry out a diagnosis or test on this basis.

Of course, it would also be conceivable as an alternative to have the evaluation or diagnosis carried out decentrally by the switching device on the basis of the stored number of switching operations. It would be conceivable that the safe switching device then only outputs diagnostic status reports to the central control system. In this case, the necessary parameters for the diagnosis, such as the number of switching cycles until the wear limit is reached, etc., are stored in the switching device.

The advantage of such a decentralized diagnosis is, in particular, its flexibility, since the replacement of a switching device or an addition does not require new data to be uploaded to the central control system, but that the switching device itself "brings" the diagnostic parameters.

The object on which the invention is based is also achieved by a modular, failsafe control system of the type mentioned at the outset in that a diagnostic parameter storage device designed to be failsafe is provided for storing predeterminable switching operation threshold values for the at least one switching device, and a diagnostic data analysis device is provided, which are designed to compare the number of switching operations read from a switching device with the stored threshold values and to initiate an action depending on this.

In other words, this means that the diagnosis is carried out centrally in the control system, with the required diagnosis parameters, such as switching process threshold values, being stored there. If the diagnosis leads to the result that, for example, a switching element of a switching device will soon reach the wear limit, the control system can trigger a specific action. In the simplest case, such an action can be understood as the output of a warning that the wear limit will soon be reached and, for example, that the switching element will need to be replaced. Another action could be to switch to a restricted operation, in which case, for example, only a reduced speed of the machine is permitted or normal operation is only permitted for a limited period of time. Another action could be to take the security system to the safe state and stop the operation.

It goes without saying that the features mentioned above and those still to be explained below can be used not only in the combination specified in each case, but also in other combinations or on their own, without departing from the scope of the present invention.

Further advantages and refinements of the invention result from the description and the attached drawing. The single FIGURE shows the structure of a safety switching device in the form of a schematic block circuit diagram, only the components required for the invention being shown.

In the only figure, a safety switching device is shown as a block circuit diagram and identified by reference number 10 . For reasons of clarity, only the assemblies required to explain the invention are shown in this block diagram. With regard to a specific mechanical and electrical design of such a safety switching device 10, reference is made to the publications mentioned in the introduction to the description or to the written documents available from the applicant for the safety switching device "PNOZmulti" or "PSSu".

The safety switching device 10 is generally used to connect a consumer 12, for example an electric motor, to a power supply 14 or to separate it. The load 12 is disconnected from the power supply 14 with the aid of the safety switching device 10 in a safe manner if, for example, an emergency stop switch 16 is actuated. At this point it should be noted that this wiring of a safety switching device 10 is purely exemplary and represents one of many different wirings. In particular are other switches are conceivable instead of the emergency stop switch 16, such as light grids, light barriers, etc.

The safety switching device 10 shown in the figure has a modular structure and includes a central module 20, which is also referred to below as a control system, and at least one relay module 40, which is also referred to below as a switching device. The control system 20 is connected to the switching device 40 via a data bus 60 . Various systems can be used as the bus 60, with the applicant also offering a safe bus system, for example, which could be used here.

In order to be able to handle communication between the control system 20 and the switching device 40 via the bus 60, an interface 22 or 42 is provided in each case, with these interfaces or interfaces 22, 42 being adapted to the bus system used in each case.

Both the control system 20 and the switching device 40 each have a control unit 24 or 44 which is connected to the respective interfaces 22 or 44. The control units 24, 44 are responsible for controlling all of the processes within the respective module 20, 40, and a detailed description can be dispensed with at this point. Rather, reference is made to the documents already mentioned, in which the structure is explained.

The central control unit 24 includes an evaluation unit 26, which evaluates specific data for diagnostic purposes. In particular, this involves the evaluation of the number of switching processes (number of switching cycles) that the switching elements 46 of the connected switching devices 40 have carried out. This number is important when the switching elements 46 are switching elements that are subject to wear, such as relays.

The central control unit 24 is assigned a storage unit 28 which includes at least two storage elements 30 , 32 . The storage unit 28 is used to store diagnostic parameters, redundant storage being necessary for safety reasons. In other words, this means that the two memory elements 30, 32 provided each store identical diagnostic parameters, so that the data stored in the redundant memory element can be used for further operation even if the data is incorrect.

Of course, other options for fail-safe data storage are conceivable. It would also be possible, for example, to store a CRC value for each stored datum, so that when this datum is read out it can be determined on the one hand whether there is an error and on the other hand this error can be corrected.

The diagnostic parameters to be stored are, for example, values for shifting operations of shifting elements 46 subject to wear. Such a diagnostic parameter can consequently be, for example, the number of shifting operations of a shifting element that the manufacturer of this shifting element allows. In other words, this means that the switching element should be replaced when this number of switching operations is reached.

It goes without saying that other diagnostic parameters can also be stored in the memory unit 28 . In addition, it should be noted at this point that the stored diagnostic parameters relate to an individual modular switching device 40 . If several different switching devices 40 are connected to the bus 60, the memory unit 28 contains the corresponding diagnostic parameters for each switching device.

The modular switching device 40 also includes a memory unit 48 which is assigned to the control unit 44, that is to say is connected to it via appropriate data and control lines. Storage unit 48 is designed as a redundant storage unit constructed so that storage elements 50, 52 are provided which store identical data.

The memory unit 48 is designed to store diagnostic data, a diagnostic data item being the number of switching operations of the switching element 46 in the present exemplary embodiment.

A first counter register 54 and a second counter register 56 , which can be part of the memory unit 48 , are provided in order to record the number of switching operations on the one hand and to store them permanently and fail-safe on the other. The two counter registers 54, 56 store a count value which is incremented by one when a specific event occurs, in this case the switching element 46 is switched on.

It is important for the two counter registers 54, 56 that they retain their register value even if the supply voltage is lost, ie they are non-volatile.

In addition, it must be ensured that the stored counter, which indicates the number of switching operations, is fail-safe. This does not necessarily mean that storing redundant data is necessary in order to be able to continue working with the redundant second data item in the event of an incorrect data item, but initially only that incorrect storage of a data item is detected.

There are different methods for this, with--as already mentioned above--the storage of additional parity bits offers the possibility of detecting faulty storages. Another option is to save a so-called CRC value (cyclic redundancy check) in addition to the date, so that this CRC value can be used not only to detect an error but also to correct the error under certain circumstances.

However, in order to ensure operation of the switching device even if the counter value is incorrect, the second counter register 56 shown in the figure is preferably provided as redundancy. In other words, this means that the number of switching operations is stored identically in two different counter registers 54, 56.

In order to increment the values in the counter registers 54, 56 by one, the control unit 44 generates a count signal and transmits this to the two counter registers 54, 56 whenever it transmits a switch-on signal to the switching element 46.

Alternatively, it would of course also be conceivable for a counting signal to be generated by the control system 20 and transmitted to the respective switching device 40 via the bus 60 .

To evaluate the value stored in the counter register 54 or 56, the control system 20 calls up a diagnostic program which requests the data stored in the counter register 54, 56 of the switching device 40. The consequence of this is that the switching device 40 transmits this data to the interface 42 and via this and the bus 60 to the control system 20 . After receiving this data, which indicates, for example, the number of switching operations that have occurred, a comparison is made with one or more diagnostic parameters that are stored in memory unit 28 . These diagnostic parameters are, for example, different threshold values that are usually specified by the manufacturer of the switching element 46 and trigger a specific action when they are exceeded. If, for example, a diagnostic parameter describes the number of switching processes up to the wear limit, the switching device 40 is safely switched off via the control system 20 when this value is reached.

In addition to these diagnostic parameters, others are conceivable, as already stated. Another diagnostic parameter could indicate the number of switching operations a warning must be issued, which draws the user's attention to the fact that the corresponding switching element 46 of the switching device 40 must be replaced.

Finally, an action initiated by the control system can also consist in only allowing the consumer 12 to be operated at a reduced speed or only for a specific time.

It is therefore understood that different diagnostic parameters (for example as threshold values) are stored in the memory unit 28 for different actions. These diagnostic parameters can come from the manufacturer of the switching device, or else from the user of the safety switching device 10. In other words, this means that the diagnostic data stored in the memory unit 28 can be specified or set.

Since the threshold values stored as diagnostic parameters are often only reached after a few years of operation of the safety switching device, it is imperative that the diagnostic parameters or diagnostic data stored in the two memory units 28, 48 are retained permanently even if the operating voltage fails. On the other hand, the counter registers must have a sufficient bit width so that very large values can also be stored without an overflow occurring.

With the help of the non-volatile and fail-safe storage of the number of switching operations within a modular switching device 40, it is possible to carry out a diagnosis in order to be able to detect the risk of failure based on stored diagnostic parameters and then initiate specific actions based on an evaluation. The result is that the availability of the safety switching device is increased, since failures caused by wear of switching elements can essentially be avoided by reacting early.

As an alternative to the exemplary embodiment shown in the figure, it would also be conceivable for the diagnostic parameters belonging to a switching device 40 to be stored not centrally but decentrally in the respective switching device. The central control system 20 can then request these diagnostic parameters via the bus in order to store them in its own memory unit 28 . Of course, it would also be conceivable for the diagnosis to take place decentrally in the respective switching device 40 and for only the result to be transmitted to the central control system.

Claims (15)

1. A safe decentralized switching device, which is configured to be connectable via a bus (60) to a modular failsafe control system (10, 20) for switching on and safely switching off an electrical load (12), having at least one switching element (46) which is subject to wear and is designed to carry out a switching process by means of a control signal which is generated by the control system (10, 20), in order to switch the electrical load (12), characterized by an apparatus for detection of the number of switching processes (44, 46), detection apparatus, carried out having a memory apparatus (48, 50, 52) for permanent failsafe storage of the detected number.
2. The switching device as claimed in claim 1, characterized in that the switching element is a relay (46).
3. The switching device as claimed in claim 1 or 2, characterized in that the detection apparatus has a counter circuit (54, 56) which uses a counting signal to increment a count, preferably by one, and stores this count in the memory apparatus.
4. The switching device as claimed in claim 3, characterized in that the counter circuit (54, 56) and the memory apparatus (48, 50, 52) are in the form of a unit (28).
5. The switching device as claimed in claim 3, characterized in that the counting signal is generated and supplied by the control system (20).
6. The switching device as claimed in claim 3, characterized in that the detection apparatus has an apparatus for detection of the control signal and production of a counting signal.
7. The switching device as claimed in one of the preceding claims, characterized in that the memory apparatus (48) has an associated means for fault identification, in order to identify faults in the memory apparatus.
8. The switching device as claimed in one of the preceding claims, characterized in that the memory apparatus (48) has two redundant memory elements (50, 52).
9. The switching device as claimed in claim 8, characterized in that the number of switching processes is stored in both memory elements.
10. The switching device as claimed in claim 8, characterized in that a checksum of the number which is stored in one of the memory elements is stored in the other memory element.
11. The switching device as claimed in one of the preceding claims, characterized in that a means is provided for reading the stored number of switching processes and for transmitting the number read to the control system.
12. A modular failsafe control system for switching on and safely switching off an electrical load, in particular an electrically driven machine, via at least one external switching device (40) as claimed in one of claims 1 to 11, having a control apparatus (24, 26) for evaluation of input signals and for production of a control signal, which is intended for the external switching device (40), as a function of the evaluation, characterized by a failsafe configured diagnosis parameter memory apparatus (28) for storage of predeterminable switching process threshold values for the at least one switching device (40), and a diagnosis data analysis apparatus (26) which is designed to compare the number of switching processes read from a switching device with the stored threshold values, and to initiate an action as a function of this.
13. The control system as claimed in claim 12, characterized in that an action is the outputting of a warning message and/or switching to restricted operation of the load, and/or switching of the load to a safe state.
14. The control system as claimed in claim 12 or 13, characterized in that the diagnosis parameter memory device (28) is designed to be redundant.
15. The control system as claimed in claim 12, 13 or 14, characterized in that the diagnosis parameter memory device (28) is designed to be zero-voltage-proof.

Images