DE102009007559B4 - Drive system, multiple drive system, method of testing a drive system or multiple drive system, method of operating a machine, machine with a drive system or multiple drive system, computer program and product - Google Patents

Abstract

Drive system (10) with a control unit (12) and at least two components (14, 16, 18, 20, 22), which communicate with the control unit (12) via one or more data transmission channels (30, 32, 34, 36, 38). The at least two components (14, 16, 18, 20, 22) each have a memory element with identification data, wherein the memory elements each with the control unit (12) via the respective data transmission channel (30, 32, 34, 36, 38 ) of the respective component (14, 16, 18, 20, 22) are connected via corresponding interfaces and are readable by the control unit (12), wherein comparison means are provided such that the detection data with predetermined in the control unit (12) stored detection data for the corresponding component (14, 16, 18, 20, 22) are comparable, so that the control unit (12) classifies the drive system (10) only for safe and the drive system (10) for further control and / or start en, when the detection data of the memory element of each component (14, 16, 18, 20, 22) coincide with the corresponding predetermined detection data stored in the control unit (12), the memory element being partially writable by the control unit (12) Control unit (12) drives a first component (14) of the at least two components (14, 16, 18, 20, 22) with defined input values via the corresponding data transmission channel (30, 32, 34, 36, 38), wherein the first component ( 14) is operatively connected to a further component (16) of the at least two components (14, 16, 18, 20, 22), and the further component (16) provides output values based on the input values of the first component (14) associated control unit (12) are readable and with predetermined output values, which correspond to the defined input values, by the control unit (12) are mutually verifiable, so that when the output values agree with the predetermined output values, the further component (16) can be classified as safe and the control unit (12) releases the drive system (10).

Description

The invention relates to a drive system, a multiple drive system, a method for checking a drive system, a method for checking a multiple drive system, a method for starting up a machine, a machine with a drive system or with a multiple drive system, a computer program and a computer program product with a computer program.

It is well known to provide a drive system with individual components, each of which is safe for itself. Safe in this context means that there is no danger to people or machines in the vicinity of the drive system or damage to devices connected to the drive system. For this purpose, the component fulfills a non-trivial, higher safety category of a standard, such as: safe torque off, safe stop, or switch off safe braking.

From the DE 10 2008 026 465 A1 a method for safe operation of a system is known.

From the US 5,666,010 is a safety system for machine tools known.

From the WO 2004/010 387 A1 is known a method for accident prevention.

From the US 6 118 374 A is a method for detecting screws used in extruders.

From the DE 103 08 386 A1 is an identification of modular machine parts known.

From the DE 10 2005 014 941 A1 is a method for providing documentation information of complex machinery and equipment, in particular an injection molding machine, known.

From the DE 102 33 870 A1 is a crane system with transport mechanism known

From the AT 007 303 U1 is known an injection molding machine.

The invention is therefore based on the object to further develop a drive system, so that the drive system is safe overall.

According to the object of the drive system according to claim 1, in the multiple drive system according to claim 4, in the method for testing a drive system according to claim 5, in the method for checking a multiple drive system according to claim 7, in the method for starting a machine according to claim 9, in the machine according to claim 10, in the computer program according to claim 11 and in the computer program product with a computer program according to the features specified in claim 12.

Important features of the invention in the drive system are that the drive system comprises a control unit and at least two components, which are connected via one or a respective data transmission channel to the control unit, wherein the at least two components each having a memory element with detection data, wherein the memory element with the Control unit is connected via the data transmission channel via corresponding interfaces and is readable by the control unit, wherein the detection data with predetermined stored in the control unit detection data for the corresponding component is comparable, so that the control unit classifies the drive system only for safe and the drive system for further control or is enabled for starting when the detection data of the memory element of each component coincide with the corresponding predetermined detection data stored in the control unit. The advantage here is that the drive system at any time as sure verifiable.

According to the invention, the memory element is partially writable by the control unit. The advantage here is that an unambiguous assignment of the component to the corresponding control unit is possible.

In an advantageous embodiment of the drive system, the control unit repeatedly retrieves the identification data of the memory element, especially when the drive system is running or after replacement of a component, and compares with the corresponding, predetermined detection data, and in a deviation of the detection data from the predetermined detection data, the drive system of the control unit into a predefined safe state can be transferred. The advantage here is that the drive system is constantly monitored.

According to the invention, the control unit controls a first component of the at least two components with defined input values via the corresponding data transmission channel, the first component being in operative connection with a further component of the at least two components, and the further component based on the input values of the first component Provides output values that are readable by the associated control unit and with predetermined output values corresponding to the defined input values, by the control unit can be checked with each other, so that when the output values agree with the predetermined output values, the further component can be classified as safe and the control unit, the drive system releases. The advantage here is that the different components without expensive attaching additional elements or measuring devices are verifiable.

In a further advantageous embodiment of the drive system, the drive system has a sensor connected to the control unit via a further data transmission channel, the sensor receiving input values from the components and / or an environment of the sensor, on the basis of which the sensor provides a sensor output value which is determined by the sensor Control unit is comparable to a predetermined value, and the control unit provides at a deviation of the sensor output value of the predetermined value, a control variable and passes to the corresponding components via the data transmission channel, so that the drive system drives a safe state. The advantage here is that the control unit simultaneously evaluates the environment monitoring sensors and can target the drive system targeted.

In a further advantageous embodiment of the drive system, the storage elements are each designed as an RFID or electronic nameplate. The advantage here is that the memory element is simple and inexpensive.

In a multiple drive system according to the invention, the multiple drive system comprises at least two drive systems according to the invention, which are preferably in operative connection with each other, wherein a higher-level control unit with the control units of at least two drive systems via at least one data transmission channel is in communication, so that the multiple drive system only as safe and ready for operation of the parent Control unit is controlled, if all drive systems are safe. The advantage here is that multiple drive systems are safe to operate.

A method according to the invention for checking a drive system which has a component and a control unit comprises the following steps:
the control unit reads recognition data of a storage element of the component and compares the recognition data with predefined recognition data,
in the case of the identity of the identification data with the predefined identification data, the control unit classifies the component as safe;
if the recognition data is inequality with the predefined recognition data, the control unit classifies the component as unsafe,
and only in the presence of only safe components does the control unit classify the drive system as safe and the control unit starts the drive system or executes the further control instructions. The advantage here is that the multiple drive system can be checked as safe.

A particularly preferred embodiment of the method, wherein
The drive system has at least two components, additionally comprising the steps that
the control unit drives a first component with defined input values via the corresponding data transmission channel,
wherein the first component is operatively connected to another component and the further component provides output values based on the input values of the first component,
the control unit reads out the output values and compares them with predetermined output values which correspond to the defined input values,
wherein the control unit classifies the drive system as safe if the output values of all components coincide with the corresponding predetermined output values. The advantage here is that a functionality of the drive systems and the components and thus the multiple drive system is guaranteed.

Another embodiment includes the steps that
the control unit shuts off a component whose output value deviates from the predefined output value, so that the state of the drive system remains safe or becomes again. The advantage here is that the necessary steps for a safe operating state of the multiple drive system are possible.

A method according to the invention for checking a multiple drive system with a higher-order control unit and at least two drive systems which are in operative connection with each other and which each comprise a control unit,
includes the following steps:
the higher-order control unit transmits defined input variables to a drive system by activating the corresponding control unit, and as a result output variables are generated in another drive system of the multiple drive system, which are detected by the control unit of the other drive system and optionally forwarded to the higher-level control unit and the output variables are compared with correspondingly stored output variables corresponding to the defined input variables and if the output variables match the output variables corresponding to the defined input variables, the higher-level control unit classifies the other drive system as safe. The advantage here is that the multiple drive system is safe.

A preferred embodiment of the method for checking a multiple drive system includes checking according to the invention by the corresponding control unit of the corresponding drive system, and in the presence of safe drive systems, the higher-level control unit classifies the multiple drive system as safe and releases the multiple drive system for operation. The advantage here is that the multiple drive system is easy and safe to check.

A further preferred embodiment of the method for checking a multiple drive system comprises the step that when the output variables deviate from the defined output variables, the higher-level control unit with the safe drive systems converts the multiple drive system into a safe state. The advantage here is that the multiple drive system even in case of failure of a component or a drive can still be converted into a safe state, or can safely continue.

In a method according to the invention for starting up a machine having a drive system or multiple drive system, the safety of the drive system or multiple drive system is checked by a method according to the invention of a multiple drive system and / or a method for checking a drive system. The advantage here is that the commissioning is safe and easy to perform, or is carried out independently by the control unit safely.

In a machine according to the invention with a drive system or multiple drive system, the drive system or the multiple drive system is checked with a method according to the invention prior to startup and / or constantly, especially after replacement of a component or a drive checked. The advantage here is that always a safe state is guaranteed.

A computer program according to the invention can carry out a method according to the invention. The advantage here is that the method is easily adaptable to the respective circumstances.

A computer program product according to the invention contains or stores a computer program according to the invention. The advantage here is that the method is easily applicable and transportable.

The invention will now be explained in more detail by means of exemplary embodiments with reference to the drawing. It shows purely schematically:

1 a schematic of a drive system with multiple components; and

2 a schematic of a multiple drive system with two drive systems.

1 schematically shows a first to fifth component 14 . 16 . 18 . 20 . 22 a drive system 10 , The drive system 10 has a control unit 12 on. The first to fifth component 14 . 16 . 18 . 20 . 22 are each a data transmission channel with the control unit 12 connected. The fifth component 22 communicates for example via a radio unit 30 with the control unit 12 while the first to fourth component 14 . 16 . 18 . 20 via one cable each 32 . 34 . 36 . 38 with the control unit 12 are connected. The radio unit 30 is executable as a passive radio such as an RFID chip or as a well-known active radio unit. Alternatively, the first to fifth components 14 . 16 . 18 . 20 . 22 also via a single bus cable as a data transmission channel with the control unit 12 signal-technically connectable. It turns out that even possible combinations of the various known signal transmissions between the individual components 14 . 16 . 18 . 20 . 22 and the control unit 12 are executable.

For example, the first component 14 a frequency converter, which uses a motor as the second component 16 controls. A rotation of a motor shaft of the motor is by means of a brake as a third component 18 braked. For example, a rotary monitor designed as an encoder monitors as the fourth component 20 the rotation of the motor shaft. As the fifth component 22 a transmission is conceivable which is driven by the motor via the motor shaft. Every component 14 . 16 . 18 . 20 . 22 has a memory element with recognition data, which is generated by the control unit 12 individually readable and comparable to predefined detection data stored in the control unit. So are the components 14 . 16 . 18 . 20 . 22 verifiable and possibly controllable.

In the control unit, for example, several identification data for a component 14 . 16 . 18 . 20 . 22 storable, allowing different versions of the component 14 . 16 . 18 . 20 . 22 still be recognized as safe.

If a component 14 . 16 . 18 . 20 . 22 is not comparable to predefined detection data, the control unit transfers the drive system to a safe state. Different levels of security are possible, such as a warning or warning, or a limited speed, to emergency stop.

The drive system 10 is expandable by other components, such as a room monitoring sensor, such as a photocell or infrared sensor, or a clutch, a second brake, a transmission oil cooler, a transmission oil heater, an auxiliary engine, a forced cooling fan for engine and / or transmission, etc.

The individual components 14 . 16 . 18 . 20 . 22 have in a further embodiment of the drive system according to the invention independent monitoring means. For example, oil temperature sensors, motor winding temperature sensors or brake disk thickness measuring devices are conceivable as monitoring means. Should the monitoring means a malfunction of the corresponding component 14 . 16 . 18 . 20 . 22 determine this component transmits a specific fault message to the control unit 12 , The control unit 12 decides independently on the basis of predefined reactions, whether and how the drive system 10 is switched off. For example, the drive system may drive to a safe position or continue at a safe speed. The predefined response can also be triggered by a room-monitoring or process-monitoring sensor, such as level indicators, temperature or smoke sensors, etc., which is also connected to the control unit control technology

In another embodiment, the control unit controls 12 in a maintenance mode or an idle phase of the drive system 10 a component 14 . 16 . 18 . 20 . 22 so on, that's another component 14 . 16 . 18 . 20 . 22 can be tested. For example, the inverter can be tested in which the expected motor data, such as slip, rotor current, speed, etc. are compared at the given inverter settings, such as output current or clock frequency, etc. with the expected motor data. Or brake torque of the brake is checked by the motor.

2 shows a multiple drive system 50 with a first drive system 54 and a second drive system 56 , a wave 52 and a higher level control unit 58 ,

The first drive system 54 is similar to the one in 1 executed embodiment shown and has a first transmission 60 a first engine 62 which is the first transmission 60 drives, a first brake 64 and a first donor 66 , which are in operative connection with a first motor shaft, on. The first drive system 54 is by a first control unit 112 controlled. The first control unit 112 is about signal transmission means with the components of the first drive system such as the first transmission 60 the first engine 62 the first brake 64 and the first donor 66 in connection. The signal transmission means are realized, for example, as a wire-based line or as a radio line.

The second drive system 56 has a second gear 70 a second engine 72 which is the second transmission 70 drives, a second brake 74 and a second donor 76 , which are in operative connection with a second motor shaft on. The second drive system 56 is through a second control unit 212 controlled. The connection between the second control unit 112 . 212 and the components of the second drive system 56 is analogous to the first drive system 54 executed, wherein the signal transmission means are freely selectable.

The first and second gears 60 . 70 both are driving the wave 52 at. The first and second control units 112 . 212 are signal-technically with the higher-level control unit 58 in connection.

The first and second control units 112 . 212 Check the identity and functionality of the components of the respective drive system 54 . 56 and report a security status to the parent control unit 58 , It can occur, especially in data transmission channels as a radio link, the problem of unambiguous identification. This can be ensured, for example, by the clear assignment of the components to your control unit during startup by the control unit sending an identification to each associated component. Receives the higher-level control unit 58 from the first and second control units 112 . 212 a positive identity and functionality assessment, there is a safe operating state and the higher-level control unit 58 gives the multiple drive system 50 free for operation.

In addition, there is the higher-level control unit 58 in signal communication with a sensor 80 such as a room monitoring sensor or position sensor. This monitors a position of the entire system or the device to be driven or detects an intruding into a defined danger area object or a person. This detects an unsafe state of the entire system and the higher-level control unit 58 correspondingly predefined signals to the first and second control unit 112 . 212 so that they control their components so that the multiple drive system 50 the entire system in a safe state.

In the in 2 the embodiment shown, the higher-level control unit 58 the first and second control units 112 . 212 also so driving that functionality of the first drive system 54 with the help of the second drive system 56 Is tested.

A method for checking the second brake 74 or the second motor 72 is, for example, as follows. For example, by energizing the first motor 62 and open the first brake 64 can by means of the first and second donors 66 . 76 be checked if the second brake 74 is functional or whether the windings in the second motor then operable as a generator 72 that induce expected currents and voltages. That's not just the first and second drive system 54 . 56 individually operate and test safely, but also the multiple drive system 50 as a whole. If a faulty behavior of one or more components or a drive system is detected, the appropriate message is sent to the higher-level control unit 58 which outputs appropriate signals to the multiple drive system 50 into a safe operating state.

Advantageously, the method and the associated parameters can be implemented as a computer program and on the corresponding first and second control unit 112 . 212 or higher-level control unit 58 executable. In particular, the computer program can be stored on a computer program product and can optionally be transferred to the control unit provided for this purpose.

LIST OF REFERENCE NUMBERS

10

drive system

12

control unit

14

first component

16

second component

18

third component

20

fourth component

22

fifth component

30

radio unit

32

first cable

34

second cable

36

third cable

38

fourth cable

50

Multi-drive system

52

wave

54

first drive system

56

second drive system

58

higher-level control unit

60

first transmission

62

first engine

64

first brake

66

first donor

70

second gear

72

second engine

74

second brake

76

second donor

80

sensor

112

first control unit

212

second control unit

Claims (12)

Drive system ( 10 ) with a control unit ( 12 ) and at least two components ( 14 . 16 . 18 . 20 . 22 ), which via one or a respective data transmission channel ( 30 . 32 . 34 . 36 . 38 ) with the control unit ( 12 ), the at least two components ( 14 . 16 . 18 . 20 . 22 ) each having a memory element with recognition data, wherein the memory elements each with the control unit ( 12 ) via the respective data transmission channel ( 30 . 32 . 34 . 36 . 38 ) of the respective component ( 14 . 16 . 18 . 20 . 22 ) are connected via corresponding interfaces and by the control unit ( 12 ) are readable, wherein comparison means are provided such that the detection data with predetermined in the control unit ( 12 ) stored identification data for the corresponding component ( 14 . 16 . 18 . 20 . 22 ) are comparable so that the control unit ( 12 ) the drive system ( 10 ) classifies only for safe and the drive system ( 10 ) for further activation and / or for starting, if the identification data of the memory element of each component ( 14 . 16 . 18 . 20 . 22 ) with the corresponding preset in the control unit ( 12 ), wherein the memory element is partly occupied by the control unit ( 12 ), the control unit ( 12 ) a first component ( 14 ) of at least two components ( 14 . 16 . 18 . 20 . 22 ) with defined input values via the corresponding data transmission channel ( 30 . 32 . 34 . 36 . 38 ), the first component ( 14 ) with another component ( 16 ) of at least two components ( 14 . 16 . 18 . 20 . 22 ) is in operative connection, and the further component ( 16 ) based on the input values of the first component ( 14 ) Provides output values determined by the associated control unit ( 12 ) are readable and with predetermined output values which the defined Input values by the control unit ( 12 ) are mutually verifiable, so that when the output values agree with the predetermined output values, the further component ( 16 ) is classifiable as safe and the control unit ( 12 ) the drive system ( 10 ) releases. Drive system ( 10 ) according to claim 1, characterized in that the drive system ( 10 ) one with the control unit ( 12 ) connected via a further data transmission channel sensor ( 80 ), wherein the sensor ( 80 ) Input values from the components ( 14 . 16 ) and / or an environment of the sensor ( 80 ), on the basis of which the sensor ( 80 ) provides a sensor output value which is provided by the control unit ( 12 ) is comparable to a predetermined value, and the control unit ( 12 ) at a deviation of the sensor output value from the predetermined value provides a drive variable and to the corresponding component ( 14 . 16 . 18 . 20 . 22 ) via the data transmission channel ( 30 . 32 . 34 . 36 . 38 ), so that the drive system ( 10 ) drives a safe state. Drive system ( 10 ) according to one of the preceding claims, characterized in that the storage elements are each designed as an RFID or electronic nameplate. Multiple drive system ( 50 ) with at least two drive systems ( 54 . 56 ), which are in operative connection with each other, according to one of the preceding claims, characterized in that a higher-level control unit ( 58 ) with the control units of the at least two drive systems ( 54 . 56 ) is connected via at least one data transmission channel, so that the multiple drive system ( 50 ) only as safe and ready for operation from the higher-level control unit ( 58 ), if all drive systems ( 54 . 56 ) are safe. Method for checking a drive system ( 10 ), which has at least two components ( 14 . 16 . 18 . 20 . 22 ) and a control unit ( 12 ), comprising the following steps: - the control unit ( 12 ) reads recognition data of a storage element of each of the components ( 14 . 16 . 18 . 20 . 22 ) and compares the recognition data with predefined recognition data, - in the case of the identity of the recognition data with the predefined recognition data, the control unit classifies ( 12 ) the respective components ( 14 . 16 . 18 . 20 . 22 ) as safe; or - in case of inequality of the recognition data with the predefined recognition data, the control unit classifies ( 12 ) the respective components ( 14 . 16 . 18 . 20 . 22 ) as unsafe, and only in the presence of only secure component ( 14 . 16 . 18 . 20 . 22 ) classifies the control unit ( 12 ) the drive system ( 10 ) and the control unit ( 12 ) gives the drive system ( 10 ) free to start and / or execute the further control instructions, - wherein the control unit ( 12 ) each component ( 14 . 16 . 18 . 20 . 22 ) with defined input values via the corresponding data transmission channel ( 30 . 32 . 34 . 36 . 38 ), - one of the components ( 14 . 16 . 18 . 20 . 22 ) with another of the components ( 14 . 16 . 18 . 20 . 22 ), and the other of the components ( 14 . 16 . 18 . 20 . 22 ) due to the input values of the respective components ( 14 . 16 . 18 . 20 . 22 ) Provides initial values, - the control unit ( 12 ) reads out the output values and compares them with predetermined output values which correspond to the defined input values, - the control unit ( 12 ) the drive system ( 10 ) classifies as safe if the initial values of all components ( 14 . 16 . 18 . 20 . 22 ) match the corresponding predetermined output values. Method according to claim 5, characterized in that - the control unit ( 12 ) a respective one of the components ( 14 . 16 . 18 . 20 . 22 ), whose output value deviates from the corresponding predetermined output value, switches off, so that the state of the drive system ( 10 ) that's for sure. Method for checking a multiple drive system ( 50 ) with a higher-level control unit ( 58 ) and at least two drive systems ( 54 . 56 ), which each have a control unit ( 112 . 212 ), characterized in that the higher-level control unit ( 58 ) defined input variables to a first of the drive systems ( 54 ) by controlling the control unit ( 112 ) of the first of the drive systems ( 54 ) and thereby transmits to another of the propulsion systems ( 56 ) of the multiple drive system ( 50 ) Generates output variables which are generated by the control unit ( 212 ) of the other of the drive systems ( 56 ) and to the higher-level control unit ( 58 ) and the output variables are compared with correspondingly stored output variables corresponding to the defined input variables and, if the output variables match the output variables corresponding to the defined input variables, the higher-order control unit ( 58 ) the other of the propulsion systems ( 56 ) classifies as safe and - the control unit ( 112 ) of the first of the drive systems ( 54 ) the other of the propulsion systems ( 56 ) is checked by a method according to one of claims 5 or 6, - and in the presence of safe drive systems ( 54 . 56 ) the higher-level control unit ( 58 ) the multiple drive system ( 50 ) classifies as safe and releases it for operation. Method according to Claim 7, characterized in that, in the case of the deviation of the output variables from the output variables corresponding to the defined input variables, the higher-order control unit ( 58 ) with the drive system classified as safe ( 54 . 56 ) or with the drive systems classified as safe ( 54 . 56 ) the multiple drive system ( 50 ) into a safe state. Method for putting a machine into operation with a drive system ( 10 ) or with a multiple drive system ( 50 ), characterized in that the safety of the drive system ( 10 ) with a method according to one of claims 5 or 6 or the safety of a multiple drive system ( 50 ) is checked by a method according to one of claims 7 or 8. Machine with a drive system ( 10 ) or with a multiple drive system ( 50 ), characterized in that the drive system ( 10 ) with a method according to one of claims 5 or 6 or the multiple drive system ( 50 ) is checked with a method according to one of claims 7 or 8 before startup and / or is constantly checked. Computer program for a method according to one of Claims 5 to 9. Computer program product with a computer program according to claim 11.

Images