DE10261453B4 - motor control - Google Patents

motor control Download PDF

Info

Publication number
DE10261453B4
DE10261453B4 DE2002161453 DE10261453A DE10261453B4 DE 10261453 B4 DE10261453 B4 DE 10261453B4 DE 2002161453 DE2002161453 DE 2002161453 DE 10261453 A DE10261453 A DE 10261453A DE 10261453 B4 DE10261453 B4 DE 10261453B4
Authority
DE
Germany
Prior art keywords
safety
control
card
switching
microprocessor
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Expired - Fee Related
Application number
DE2002161453
Other languages
German (de)
Other versions
DE10261453A1 (en
Inventor
Andreas Faaborg
Kurt Steen Frederichsen
Allan Thams
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Danfoss Drives AS
Original Assignee
Danfoss Drives AS
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Danfoss Drives AS filed Critical Danfoss Drives AS
Priority to DE2002161453 priority Critical patent/DE10261453B4/en
Publication of DE10261453A1 publication Critical patent/DE10261453A1/en
Application granted granted Critical
Publication of DE10261453B4 publication Critical patent/DE10261453B4/en
Expired - Fee Related legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • GPHYSICS
    • G05CONTROLLING; REGULATING
    • G05BCONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B9/00Safety arrangements
    • G05B9/02Safety arrangements electric
    • GPHYSICS
    • G05CONTROLLING; REGULATING
    • G05BCONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B19/00Programme-control systems
    • G05B19/02Programme-control systems electric
    • G05B19/04Programme control other than numerical control, i.e. in sequence controllers or logic controllers
    • G05B19/042Programme control other than numerical control, i.e. in sequence controllers or logic controllers using digital processors
    • G05B19/0428Safety, monitoring
    • GPHYSICS
    • G05CONTROLLING; REGULATING
    • G05BCONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B2219/00Program-control systems
    • G05B2219/20Pc systems
    • G05B2219/24Pc safety
    • G05B2219/24188Redundant processors run different programs
    • GPHYSICS
    • G05CONTROLLING; REGULATING
    • G05BCONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B2219/00Program-control systems
    • G05B2219/20Pc systems
    • G05B2219/25Pc structure of the system
    • G05B2219/25021Profibus
    • GPHYSICS
    • G05CONTROLLING; REGULATING
    • G05BCONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B2219/00Program-control systems
    • G05B2219/30Nc systems
    • G05B2219/41Servomotor, servo controller till figures
    • G05B2219/41295Ac-to-ac converter frequency controlled
    • GPHYSICS
    • G05CONTROLLING; REGULATING
    • G05BCONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B2219/00Program-control systems
    • G05B2219/30Nc systems
    • G05B2219/42Servomotor, servo controller kind till VSS
    • G05B2219/42237Pwm pulse width modulation, pulse to position modulation ppm
    • GPHYSICS
    • G05CONTROLLING; REGULATING
    • G05BCONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B2219/00Program-control systems
    • G05B2219/30Nc systems
    • G05B2219/42Servomotor, servo controller kind till VSS
    • G05B2219/42284Stop and brake motor
    • GPHYSICS
    • G05CONTROLLING; REGULATING
    • G05BCONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B2219/00Program-control systems
    • G05B2219/30Nc systems
    • G05B2219/42Servomotor, servo controller kind till VSS
    • G05B2219/42286Speed, ramp controlled slow down of motor

Abstract

Motor control with a control device (2) assigned to the motor (3) and a safety device (4) for engagement in the control device (2) for achieving a secure hold of the motor (3), with a control unit (10, 12, 72, 73 ) with memory (K1, K2, K3, K4) in which a program associated with the control device (2) for the operation of the control device (2) and the safety device (4) is stored,
- wherein the control unit (10, 12, 72, 73) and the memory in a first control part (10, 12) with a first memory part (K3, K4), in which a first program for the operation of the control device is stored, and a second control part (72, 73) is divided with a second memory part (K1, K2) in which a second program for the operation of the security device (4) is stored,
- wherein the control device (2) has a low-current control unit (6) and a high-current control unit (8),
- With shutdown commands of the safety device (4) to shut down the engine ...

Description

  • The The invention relates to a motor controller with a motor associated with Control device and a safety device for a Intervention in the control device to achieve a secure stop of the engine, with a control unit with memory, in which one of the control device associated program for the operation of the control device and the safety device is stored.
  • In a known engine control of this type ( EP 1 211 774 A1 ), whose control device comprises a converter, a microprocessor for controlling a power or high-current control unit is provided on a low-current control card, are arranged in the semiconductor switching elements of the inverter provided in the inverter. The microprocessor contains a memory in which not only the control program for the inverter but also the control program for the safety device is stored Control program for the inverter to be changed, for example, for another application of the engine, then it also has an influence on the control program for the safety device, and vice versa.
  • Out DE 44 32 768 A1 a safety module for monitoring and controlling safety-relevant machine parameters and operating states is known. The safety module has a safety device (switch-off unit) and three-channel monitoring units, the number of which corresponds to the number of motor movements to be monitored. The safety module can be operated as a stand-alone device or in the form of individual components in a control cabinet. The monitoring processes are implemented by user-specific integrated circuits, so-called ASICs. It is mentioned that instead of the integrated circuits and processors can be used, and this will not be explained in detail. The safety device is connected to a motor controller via a bidirectional bus (status / fault), monitoring parameters being transmitted from the motor controller to the safety module. The safety device is connected to the motor via a regulator enable line and a dual channel emergency stop interface circuit. If a fault occurs, the safety device ensures a secure hold of the motor by switching off the drive power of the motor and blocking the motor controller by outputting a corresponding signal. The operating and error states are stored in a status error register.
  • Out US Pat. No. 6,243,629 B1 an electronic control device is known, wherein the operation of a first microprocessor is monitored by a second microprocessor. Both processors have a memory. However, this is not a motor control with a motor associated safety device to engage in the control device to achieve a secure stop. The microprocessors should rather parallel arithmetic processes are performed, for example, to control an ABS system.
  • Of the Invention is based on the object, a motor control of the above indicate the nature of the change in the program for operation the control device possible is without going into the program for to interfere with the operation of the safety device, and vice versa.
  • According to the invention this is Task by a motor control according to claim 1.
  • A such division of the software has the advantage that the two program blocks independently of each other can be replaced. If the electronics of the controller and the electronics of Safety device are mounted on a common card, then the program of the memory of the controller can be replaced be without the program in the memory of the security device to impair. For the Manufacturer of engine controls, this means that a complex Certification from the safety authorities due to a minor change can be omitted in the program of the controller.
  • Preferably is for that taken care that the control device and the first control part having the first memory part on a first one Map device and the second control part with the second program having security device on a second card device are arranged and that the both card devices by a detachable connector electrically are connected. This ensures that not only the software is shared, but also the electronics, namely in an operating electronics and a "safe" electronics. Also this version has in the manufacture of the advantage that the control device to be changed can, without the functionality the safety device again.
  • Furthermore, it is advantageous if the first card device has lines for security signals, wherein the lines are effective only after connecting the two card devices. The controller is then also operable alone, if the second card device not with the ers connected. The second card device therefore forms an "option card" which can be provided if desired, but also omitted.
  • thereupon can do that be taken care of that first card device a low power control card and one with this electrically connectable power control card has that the safety device on the second card device, a safety switching device for the Having control device. This training has the advantage that a card can be replaced with a new without the electric Parts of the other cards also need to replace.
  • Especially easy is a replacement of the cards when the electrical connections have between the card devices connectors.
  • The Connection between the second card device and the first Card device may have a first security channel and a second security channel Have safety channel over each z. B. a Abschaltbefehlssignal an external safety and monitoring circuit or from the security device itself to the control device For switching off the engine transferable is. The formation of two safety channels increases safety: if only a security channel is inoperative, can still over the another causes a secure hold by a Abschaltbefehlssignal become. The safety and monitoring circuit is for monitoring any operating functions or operating variables, be it by the control device controlled motor or other devices that shut off the Motors require, or if the shutdown for other reasons, for safety's sake he wishes is.
  • in this connection is for that taken care of everyone Security channel associated with a security feedback channel is over the z. B. a shutdown command signal to the control device transferable is when triggered a Abschaltbefehlssignals by the safety and monitoring circuit or the safety device of the engine has not been switched off is. about these feedback channels, their feedback signals reported back to the safety device and / or safety and monitoring circuit and optionally, if a previous shutdown command signal is not led to the engine stop should again have a shutdown command signal and / or an alarm signal trigger can.
  • Especially For example, the first security channel and the first security feedback channel may have one Connection between the second card device, the "option card", and the power control card guided and the second security channel and the second security feedback channel via a Connection between the second card device and the low power control card guided be. Here you can the shutdown command signals from the option card directly into the power control part or in the low-power control part and engage the feedback signals directly from there back to the option card. But it is also possible, the connection of the first security channel and the first security feedback channel over the Low-voltage control card to lead.
  • thereupon can be on the low power control card between the first control part and a security or feedback channel a largely reaction-free Separator be arranged. This isolator verhin changed that the control part the security feedback channel burdened and thus leads to a malfunction.
  • Preferably is for that taken care that the control device a converter whose inverter is controllable semiconductor switching elements having, determined by the output frequency of the inverter Switching pulses are controllable, that from the repetition frequency of the Switching pulses a Drehzahlmeßsignal is derivable that over a third feedback channel as a "safe signal" transferable is, and that out a Motorstrommeßsignal a speed measurement signal is derivable that over a fourth feedback channel transferable is.
  • These measuring signals can additionally for confirmation, that the by z. B. a shutdown command signal triggered shutdown successfully was, reported back to increase safety even further.
  • The Invention and its developments are described below with reference to the accompanying drawings of preferred embodiments and modifications these embodiments described in more detail. In the drawings:
  • 1 1 is a schematic block diagram of a motor control for an electric motor with a safety device,
  • 2 a modification of the safety device according to 1 .
  • 3 a further modification of the safety device according to 1 .
  • 4 a third modification of the safety device according to 1 .
  • 5 the modification of the invention the security device 1 .
  • 6 a device according to the invention for automatically checking the operability of a safety switching device in the safety device according to the invention and an associated pulse diagram,
  • 7 a modification of the test device according to 6 with an associated pulse diagram,
  • 8th a generalized block diagram of the test apparatus according to the 6 and 7 with associated pulse diagrams,
  • 9 a circuit diagram of a modified test device according to the invention for the functionality of inputs and outputs one of in 5 illustrated safety switching devices with associated pulse diagrams,
  • 10 a circuit diagram of a further modification of a device for testing the functioning of a safety switching device with associated pulse diagrams,
  • 11 a circuit diagram of another device according to the invention for testing the functioning of a safety switching device with associated timing diagrams and
  • 12 schematically an electric motor with a motor controller according to the invention in the form of an inverter.
  • The embodiments of the 1 to 4 do not contain all the features of the embodiment according to the invention and serve only to explain the principle.
  • The engine control 1 to 1 contains a safety device 4 that with a control device 2 , here a converter, and connected to the one user-side, external, ie outside the engine control 1 arranged, safety and monitoring circuit 5 connected. The control device 2 is the engine 3 assigned and contains a low power control unit 6 on a map 7 (Board) - also called "control card" - and a power control unit 8th (also called "power control unit") on a power control card 9 (also called "power control card").
  • The low power control unit 6 contains a digital signal processor (DSP) 10 containing a pulse duration modulator (PDM) 11 and with a microprocessor (μP) 12 communicates via the connection shown as a double arrow.
  • The heavy current control unit 8th contains an inverter 13 comprising power semiconductor switching elements, here called IGBTs (IGBT = insulated gate bipolar transistor), in three-phase bridge circuit. Further, the power control unit includes 8th a switching pulse driver 14 , the control terminals of the power semiconductor switching elements of the inverter 13 supplying switching pulses for controlling the power semiconductor switching elements via a number of driver stages corresponding to the number of power semiconductor switching elements. The switching pulse driver 14 Includes isolating transformers for a safe, floating connection of the low voltage or low voltage side to the high voltage or high voltage side. The switching pulses are through the digital signal processor 10 in conjunction with the microprocessor 12 generated and by the pulse duration modulator 11 in their duration so modulated that the engine 3 over the inverter 12 as operating current receives an approximately sinusoidal three-phase current whose frequency corresponds to the desired value of the speed. The microprocessor 12 provides, inter alia, further that a device or a system, such as a pump or a lift, is driven according to the load requirements with the respective required speed. The digital signal processor 10 controls among other things by the pulse duration modulator 11 executed pulse duration modulation.
  • On the map 9 is another microprocessor 15 appropriate. In addition to the processing of measuring signals of currents, voltages, temperatures and the control of a fan, it also serves to test the functioning of the safety device 4 More precisely, a safety switching device contained in it. Essentially, the operability check is to determine whether a halt signal or halt command signal is present when it is supplied from the external safety and monitoring circuit 5 Lastly, the engine 3 should stop without actually restarting, was actually effective. If the engine 3 does not stop after a halt command signal is issued, or no stall activity is initiated in the engine controller, the microprocessor performs 15 the microprocessor 12 via a bus connection 16 a stop signal to through the microprocessor 12 and the digital signal processor 10 is performed.
  • The security device 4 contains on a map 18 , also called "option card", a safety switching device 19 with a relay 20 , Transistors 21 and 22 and a delay means of two delay elements 23 and 24 , whose delay time by adjusting devices 25 and 26 is adjustable.
  • The relay 20 has three contacts 27 . 28 and 29 , here in the de-energized state of the coil 30 of Relays are shown. The contact 27 is via lines 31 . 32 with the microprocessor 15 connected. The contact 29 lies in the operating circuit 33 the switching pulse driver 14 , The contact 28 is about connections 34 a terminal block 35 on the map 18 with a test voltage across the safety and monitoring circuit 5 that z. B. in a cabinet 17 is arranged, connected. The transistor 21 is in line with the coil 30 of the relay 20 at an operating voltage U B1 of, for example, 24 V and is connected via "relay" and "earth" connections, which are used to connect a switch 36 , here a contact of a relay, in the external safety and monitoring circuit 5 and serve "earth", as well as over the switch 36 connected to "earth". On to trigger a normal stop signal to stop the motor 3 actuatable switch 40 in the safety and monitoring circuit 5 is over a line 41 and a "Ramp generator input" connection on the card 7 with a ramp generator in the microprocessor 12 connected.
  • At other connections 42 and 43 the terminal block 35 , on the one hand, in each case with an input of the delay element 23 respectively. 24 for their tripping via a line 44 respectively. 45 on the other hand, are separate output lines 46 the safety and monitoring circuit 5 connected.
  • At a connection 47 of the pulse duration modulator 11 with the switching impulse driver 14 is a sensor 48 for measuring the (following) frequency of the switching pulse driver 14 supplied switching pulses as a measure of the speed of the motor 3 connected. The frequency measurement signal is via a line 49 another input of the microprocessor 15 fed.
  • The cards 7 and 18 and their circuitry mounted thereon are connected by a connector 50 , here a connector having terminals a, b, c ..., connected, wherein the connecting lines 31 . 32 . 33 . 37 to simplify the presentation outside the connector 50 are shown. Instead of a connector 50 can the connection of the cards 7 and 18 also by means of a cable provided at its ends with plug contacts, in particular flat cable, between receiving contacts on the cards 7 and 18 getting produced. Likewise, the cards can 7 and 9 or the circuitry mounted thereon through a connector, such as the connector 50 , or a connector cable connected. The on the cards 7 and 9 arranged circuitry can also be arranged together on a single card (board), so that a connector for connecting the cards 7 and 9 can be omitted.
  • The entire circuitry on the cards 7 and 9 is designed so that when the card 18 is not connected, as normal motor control, here as a converter, without safety function acts. Is the card 18 On the other hand connected, which is preferably provided from the factory, but also by retrofitting is possible, the function of the engine control changes 1 or the converter from a "normal function" to a "safety function", in the present case in the "safe stop" function. The map 18 is therefore also referred to as an "option card", since it also allows a security function. The presence of the card 18 is determined by measuring a voltage at one of the terminals a-g, z. B. at the terminal a, checked. If the card 18 is not connected, is at the terminal a high, otherwise a low voltage.
  • The microprocessor 15 is programmed so that it without option card 18 only its usual function in the control loop, here speed control loop, and perceives when connected option card 18 also contributes to the safety function and functionally part of the safety device 4 forms.
  • The security device 4 can be designed for additional safety functions, eg. For example, it may respond to an "emergency stop", a photocell, speed limit overshoot, safety bus, or a signal from other sensors that requires stopping the engine. These signals can come from the safety and monitoring circuit 5 be fed. As an example, based on 1 only the response to a stop signal via the switch 40 explained, for example, by switching on a relay in the circuit 5 can be closed to the engine 3 to stop.
  • Thus, a pump, not shown, of the engine 3 is driven, cause an overflow, which is reported by a sensor and a relay in the circuit 5 pressed, then the switch 40 closes, allowing the microprocessor 12 over the switch 40 , The administration 41 and the ramp generator input terminal is supplied with a signal in the microprocessor 12 a ramp signal generator or an equivalent programmed function of the microprocessor 12 triggers by the or a rapidly decreasing to zero speed setpoint signal, a "ramp signal" in the control unit 6 causes the speed of the motor 3 Accordingly decreases rapidly until it stops or expires after the disappearance of the ramp signal due to its inertia.
  • This is the microprocessor 12 the ramp signal to the digital signal processor 10 wei ter, the pulse duration modulator 11 Continually turns off, so that the switching pulse driver 14 and thus also the switching elements in the inverter 13 finally no further scarf timpulse be supplied. Simultaneously with the closing of the switch 40 is, with still closed switches 36 and 39 the safety and monitoring circuit 5 , over the wires 46 , the "Delay Trigger" connections and the lines 43 . 44 the triggering lengths of the delay elements 23 and 24 each supplied with a trigger signal. In normal operation, the delay elements hold 23 and 24 the transistors 21 and 22 controlled by, so that a current through the relay coil 30 flows and the contacts 27 . 28 are open, however, the contact 29 closed is. After expiry of the delay time, the delay element blocks 23 the transistor 21 so that the relay 20 drops, the contact 29 opened and the operating current of the switching pulse driver 14 is interrupted. At the same time the contacts 27 and 28 closed. The delay time of the delay element 23 corresponds approximately to the duration of the shutdown of the engine 3 , including the response delay time of the relay 20 , Disabling or interrupting the operating current of the switching pulse driver 14 occurs when the engine speed is zero or nearly zero. Instead of switching off all driver stages, only those can be switched off, those with the positive or negative pole of the operating voltage of the inverter 13 connected "upper" or "lower" power switching elements of the inverter 13 Taxes.
  • The other delay element 24 generates at the end of its delay time, which is equal to that of the delay element 23 is a redundant shutdown signal. This signal blocks the transistor 22 whereby a reset signal (voltage zero) is supplied to the reset input R, so that the operation of the digital signal processor 10 and the pulse duration modulator 11 is set and thus the switching pulse driver 14 also receives no more switching pulses. Simultaneously with the switch-off signal, the delay element reports 24 via a connection "feedback" of the terminal block 35 to the safety and monitoring circuit 5 back that it has issued the shutdown signal. In memory devices of the adjusting devices 25 and 26 the delay times are ready for call.
  • In addition to the stop signal via the switch 40 receives the control device 2 to increase the safety therefore two more (redundant) stop signals to ensure with high security that the engine 3 - after the release of the stop signal via the switch 40 - No operating power via the control device 2 or the inverter is supplied and the motor 3 not only stops, but does not start again.
  • The contacts 27 and 28 of the relay 20 are used for feedback and verification that or whether the delay element 23 has actually issued a shutdown signal. After dropping the relay 20 checks the microprocessor 15 the switching state of the contact 27 by trying to get a signal through the contact 27 to lead. If the contact 27 passing a signal, the microprocessor interprets 15 this so that the contact 27 is closed and the contact 29 the operating current of the switching pulse driver 14 actually interrupted. About the with the terminal block 35 connected contact 28 of the relay 20 directs the external safety and monitoring circuit 5 the test voltage. If the test voltage is let through, it will be from the safety and monitoring circuit 5 interpreted as feedback or confirmation that the contact 29 opened, the controller 2 supplied a shutdown signal or the operating current of the switching pulse driver 14 interrupted and therefore the engine 3 was stopped.
  • The microprocessor 15 also checks over the line 37 whether the voltage on the relay coil 30 by locking the transistor 21 has risen. If this is the case, and contact 27 is closed, everything is fine. If the contact 27 was not closed, there is a fault in the safety device 4 before, and the microprocessor 15 triggers an alarm signal.
  • In applications with high security requirements, feedback or acknowledgment signals, such as those given through the contacts, are sent 27 and 28 delivered to the external safety and monitoring circuit 5 which in turn supplies the main power supply to the motor control 1 interrupts, if contrary to expectation no feedback signal in the external safety and monitoring circuit 5 arrives. To prevent a premature interruption of the main power supply is therefore also in the external safety and monitoring circuit 5 a delay element is provided, which allows an interruption of operation only after the expiry of its delay time. Instead of this delay element can also be a relay with a correspondingly high response delay to trigger the Betriebsunterbre chung in the safety and monitoring circuit 4 be provided.
  • The delay elements 23 and 24 can each as an integrated circuit, for example of the type 555 be formed, which blocks a transistor after the delay time. The delay time can also be fixed, z. B. in a memory element. But it can also be done by insertable connectors on the card 18 or be adjustable by a user by means of a potentiometer. Alternatively, it can by the external safety and monitoring circuit 5 via the terminal block 35 be specified. Furthermore, it is possible for the delay time to be dynamic as a function of the speed and / or the mass inertia of the motor 3 specify automatically adjustable. An alternative to training with discrete components is to implement the delaying means by software in a microprocessor.
  • About the switches 36 and 39 in the user-side safety and monitoring circuit 5 In each case a stop can be triggered without delay. For example, the user can connect a monitoring switch to the "Relay" and "Earth" or "Relay" and "U B3 " connections (U B3 = eg 5 V). As a photocell switch, when actuated, the circuit of the relay coil 30 - Without delay by the delay element 23 - interrupted or the reset of the digital signal processor 10 via its reset input R without delay by the delay element 24 is released from. The delay elements 23 and 24 are thereby overdriven.
  • The engine control 1 to 2 is opposite to in 1 modified as an additional safety function, the speed monitoring according to the standard IEC 61800-5, on the option card 18 is implemented. It is used to monitor the engine speed to the operation of the controller 2 and thus the operation of the engine 3 To stop as soon as possible when the speed exceeds a predetermined limit. Speed monitoring is particularly advantageous when commissioning larger systems to the engine 3 to carry out a test of the system or, if maintenance must be carried out during operation, only to operate at, for example, 30% of its rated operating speed. By the rotation speed monitoring device, the operation of the control device 2 and thus the engine 3 stopped as soon as the specified speed limit is exceeded.
  • To realize the speed monitoring in "safe technology", three speed signals are provided. Two speed signals are obtained by directly measuring the speed by means of two speed sensors 51 and 51 generated at the motor shaft and the third of the repetition frequency of the pulse duration modulated output pulses of the pulse width modulator 11 by means of the speed sensor 48 derived and the microprocessor 15 over a line 49 fed. The derivation of the speed signal from the repetition frequency of the switching pulses is possible in a simple manner. One possibility is the voltage at the connection 47 to measure and compare with a given U / f ratio. This allows the frequency f to be determined. However, this procedure is only possible for inverters with V / f control.
  • On the option card 18 is a transistor 52 with the transistor 21 connected in series and a speed monitor 53 on the output side with the base of the transistor 52 connected or integrated with it. On the input side is the speed monitor 53 via connections "sensor input" of the terminal block 35 with the speed sensor 51 connected. The series connection of the transistors 21 and 52 forms an OR gate. Therefore, if the delay element 23 the transistor 21 or the speed monitor 53 the transistor 52 locks, the contact becomes 29 of the relay 20 opened and the operating circuit 33 the switching pulse driver 14 interrupted.
  • As in the embodiment according to 1 is on the option card 18 the redundant delay element 24 and additionally a redundant speed monitor 54 arranged, one with the transistor 22 in series transistor 55 locks if the speed signal from the speed sensor also supplied to it via "sensor input" connections 51 ' exceeds the preset speed limit.
  • Also in this embodiment, the user can by means of the closed during operation switch 36 and 39 by opening the switch 36 or 39 the operation of the inverter and therefore of the motor 3 directly, under overload of the delay elements 23 . 24 and the speed monitor 53 . 54 , stop.
  • In the modification to 3 is the safety device 4 of the embodiment according to 2 extended by another safety function "safer bus", the in 2 illustrated second delay element 24 and the second speed monitor 54 with the transistors 22 and 55 to simplify the presentation in 3 are omitted.
  • Safety buses are common communication buses that are enhanced by a safety feature. In this embodiment, as a safety bus 56 The bus Profisafe ® , which is the "safe" version of the so-called "Profibus". "Profibus" is a well-known bus protocol for the communication buses between plant elements such as motor controls and programmable logic controllers (PLCs). Other buses, such as CANopen Safety, AS-i Safety at Work, Devicenet Safe, Interbus Safety, also have so-called "safe technology". The safety bus shown here 56 allows communication via a two-wire cable and is via a connection "safety bus" of the terminal block 35 with a bus controller 57 connected. The redundancy of a shutdown signal via the safety bus 56 becomes through two microprocessors 58 and 59 ensured. The bus controller 57 monitors the communication. If an error occurs somewhere in a factory and the engine installed there or remotely 3 is to be stopped is via the safety bus 56 and the "Safety Bus" port on the option card 18 a stop signal to the bus controller 57 transmitted, and from this on the microprocessor 58 and the microprocessor 59 over a connection 60 to the microprocessor 12 on the map 7 which in turn supplies the reset input R with a reset signal, so that the power supply to the motor 3 is interrupted.
  • With the transistors 21 and 52 is another transistor 61 in series in the circuit of the relay coil 30 , The microprocessor 58 leads the transistor 61 another (redundant) stop signal, so that the transistor 61 is locked and the relay 20 drops.
  • Thus, from the safety bus 56 generated from two stop signals, for the safe stop of the engine 3 to care.
  • The microprocessor 12 can also be programmed and connected so that it also the reliability of the relay 20 and the signal transmission paths of the safety device 4 reviewed. The microprocessor 58 Further, it may be programmed to verify signal transmission over the safety bus through a Cyclic Redundancy Check (CRC) procedure.
  • According to the embodiment 4 is unlike the embodiments according to the 1 to 3 on the map 9 no microprocessor provided. Rather, the function of the microprocessor 15 in the microprocessor 12 included by appropriate programming. It is therefore possible in the event of a defect in the high-voltage control unit 8th the map 9 with the heavy current control unit 8th without the microprocessor 15 replaced.
  • Furthermore, the relay has 20 only the two contacts 28 and 29 , The contacts 28 and 29 are in normal operation with live relay coil 30 closed and connect the operating voltage U B2 with the switching pulse driver 14 , here the primary-side switching pulse driver 14 1 in the primary-side and a secondary-side switching pulse driver 14 2 divided switching pulse driver 14 , The primary-side switching pulse driver 14 1 and the secondary-side switching pulse driver 14 2 are over a transformer 62 inductively coupled for potential isolation.
  • The safety and monitoring circuit 5 contains in addition to the switches 36 and 40 more switches 63 . 64 and 65 , The operating voltage U B4 is located at the one terminal of the switch 36 . 63 and 64 , The other connections of the switches 63 and 64 are via the connections "delay element tripping" of the terminal block 35 each with a triggering input of the delay elements 23 and 24 connected. The desk 65 is with its other connection via the connection "Safety Channel II" with the one input of an INHIBIT member 66 connected. The delay element 24 is on the output side with the other input of the INHIBIT element 66 connected. The output of the INHIBIT member 66 is with the reset input R of the pulse width modulator 11 or the DSP 10 and a separation step 68 , here a high-impedance resistor, with an input of the microprocessor 12 connected. The administration 33 is also via a separation step 67 with an input of the microprocessor 12 connected. A sensor 69 measures the voltage at the connection 47 and carries the measured value via a line 70 a converter 71 on the map 18 to. The output of the converter 71 is via a connection "Safety Feedback II" of the terminal block 35 with the safety and monitoring circuit 5 connected. The converter 71 converts the PDM signals to an ON or OFF signal.
  • The operation of the embodiment according to 4 is largely the same as that of the previous embodiments. If a stop signal the safety and monitoring circuit 5 is fed, the switch closes 40 and it becomes the ramp generator in the microprocessor 12 over the switch 40 switched on, so that the engine 3 shut down. At the same time, the switches 63 to 65 closed. This will become the delay elements 23 and 24 triggered, and the INHIBIT member 66 a signal is supplied through which the reset input R, a reset signal is supplied. After expiry of the delay time of the delay element 23 falls the relay 20 from. By the fall of the relay 20 become the switches 28 and 29 open, so that the operating voltage U B2 of the switching pulse driver 14 1 is turned off and the microprocessor 12 over the separation stage 67 receives a signal. This signal will open the switch 29 approved. After expiry of the delay time of the delay element 24 gives this over the INHIBIT member 66 another reset signal to the reset input R from which the digital signal processor 10 and the pulse duration modulator 11 resets.
  • About the separation stage 68 In addition, the reset signal is sent to the microprocessor 12 supplied, which requires this signal, after a shutdown of the control device 2 or the inverter later to perform a correct start. After receiving a reset signal, the microprocessor will save 12 Relevant process data, which at Wiederin commissioning be used. The separation stages 67 and 68 serve the separation of the safe signal electronics from the usual operating electronics. The processor 12 monitors the safety channel II whether a stop signal has been issued via this. An electronic error in the microprocessor 12 should not be able to cause the shutdown signal on the safety channel II does not arrive, what z. B. may be the case when the potential on the microprocessor 12 undesirably drops to ground potential. In the simplest case, the separation stage is a high-impedance resistor.
  • The sensor 69 measures the voltage at the connection 47 and passes the measure value to the translator 71 on the map 18 to. This compares the measured value with a reference value, and if the measured value is below the reference value, then the converter reports 71 the safety and monitoring circuit 5 via the connection "Safety Feedback II" that actually a reset signal has been issued and no switching pulses occur more.
  • According to the embodiment 5 are the delay elements provided in the previous embodiments 23 and 24 in each case by software, ie by appropriate programming of two mutually connected via a multiple line M microprocessors 72 and 73 realized. The adjustment of their delay times continues to be done by means of the adjusting devices 25 and 26 , With the microprocessors 72 and 73 are also two safety switching devices 74 and 75 connected, each having only one transistor, as shown, but here have a plurality of transistors and, if necessary, resistors. Possible embodiments of the safety switching devices 74 and 75 with several transistors are in the 7 . 8th . 9 and 10 shown, which will be described later. The functionality of these safety switching devices 74 and 75 is determined by the respective microprocessor associated with them 72 respectively. 73 checked. These microprocessors 72 and 73 As far as their delay function is concerned, they can also functionally be considered as part of the safety switching devices. The security device 4 on the option card 18 essentially ensures the entire functional reliability, ie the software and the hardware. The usual control device 2 is not burdened with the backup tasks. To accomplish this, the necessary "safe" wiring of the controller is factory done. On the cards 7 and 9 Copper tracks are applied, which are supposed to provide safety signals for a "secure hold", but which are only put into operation when an option card is connected.
  • An essential aspect in this embodiment is that all essential to the function of the safety device 4 belonging components on the option card 18 are arranged, in particular the microprocessors 72 and 73 , Their software (program) thus essentially only needs to carry out the safety functions and here also to check the safety switching devices 74 . 75 to be coordinated. The software of the microprocessor 12 and the DSP 10 the control device 2 therefore essentially only needs the control tasks of the control device 2 to be coordinated. A change in software for the operation of the controller 2 can therefore with regard to the particular application of the engine 3 be performed without the security device software 4 to change, and vice versa. Accordingly, the software for the operation of the controller 2 in a memory part K 3 , K 4 of the microprocessor 12 and the DSP 10 and the software for operating the safety device 4 in a memory part K 1 , K 2 of the microprocessors 72 and 73 saved. Another advantage of the spatial separation of the program memory parts K 1 , K 2 and K 3 , K 4 is that in case of a defect of a component of the control device 2 or the security device 4 only the defective card 7 . 9 or 18 needs to be replaced with a new one. Because even in this embodiment, the cards 7 and 9 such as 7 and 18 through connectors, such as the connector 50 or attachable cables (flat cables), which allow easy and quick replacement of the relevant card.
  • As in the embodiment according to 4 , are also after the modification 5 two safety channels I and II for triggering a safe stop and two safety feedback channels I and II for acknowledgment (confirmation) to the external, user-side safety and monitoring circuit 5 (in the 5 is omitted for simplicity of illustration) that the "secure stop" has actually taken place provided.
  • So is about the speed sensor 51 , the connection "sensor input" of the terminal block 35 and a voltage level adapter SA, a speed signal to the microprocessor 72 supplied, which compares it with a stored limit and via an output A1 of the safety switching device 74 a shutdown signal or stop signal feeds. When the speed signal is equal to or greater than the threshold value, the safety switching device interrupts 74 the operating voltage U B2 and the operating circuit 33 the switching pulse driver 14 1 , In addition, by a sensor 76 the output current of the inverter 13 measured as a measure of the speed and the measuring signal to a converter 77 over a line 78 fed. This converts the current measurement signal I into a proportional frequency f as a measure of the rotational speed and performs this Speed signal also to the microprocessor 72 to. The microprocessor 72 compares the speed signal with the stored limit and optionally interrupts the operating voltage U B2 and the operating circuit 33 the switching pulse driver 14 1 if this has not already happened. Via a buffer amplifier TR and the connection "Safety Feedback I" of the terminal block 35 the microprocessor reports 72 the safety and monitoring circuit 5 whether the interruption of the operating voltage has occurred or not. The signal fed back to the "Safety Feedback I" terminal is also sent over the line 78 1 the microprocessor 73 which checks whether the safety feedback signal has been given. If this is not expected, there is an error, and the microprocessor 73 reports an error.
  • Via connectors "Activation DSF I (DSF = designated safety function) and" Activation DSF II "of the terminal block 35 can be provided by the external safety and monitoring circuit 5 also shutdown depending on other monitoring functions, such as the monitoring of the torque, the temperature or the voltage of the motor 3 or any other predetermined or desired functions, in turn via the microprocessor 72 or the microprocessor 73 and the safety switching device 74 effect the "safe stop" of the engine. Connections "Safety Channel I" and "Safety Channel II" can be made in the same way via the internal delay devices of the microprocessors 72 and 73 Shutdown command signals from the external circuit 5 the respective safety switching device 74 and 75 be supplied.
  • If the microprocessor 73 via the "DSF II", for which a direct shutdown function is programmed in this example, as well as a shutdown command signal or halt signal is supplied via a voltage level adapter SA, actuates the microprocessor 73 via its output A4, the safety switching device 75 , Then the digital signal processor 10 from the safety switching device 75 over the line 38 and the reset input R is supplied to a reset signal and the further generation of switching pulses by the pulse duration modulator 11 interrupted. Thus, the engine 3 stopped. The signal at the reset input R is also sent via the line 79 to an input E 1 of the microprocessor 72 and about the separation step 68 to the microprocessor 12 recycled. If no reset signal has occurred after the shutdown command signal is issued, the microprocessor will report 72 possibly this via its output-side isolation amplifier TR and the connection "safety feedback I" of the external safety and monitoring circuit 5 as well as the microprocessor 73 over the line 78 1 as a sign that in the safety device 4 an error has occurred or a defect has occurred. In all circumstances, it also switches over the safety switching device 74 the engine 3 from. In addition, the sensor measures 48 at the output of the pulse duration modulator 11 or on the connection 47 the frequency or speed of the motor 3 and leads the measuring signal to the converter 71 over a line 80 to. If the measure signal does not match a reset signal, the microprocessor will report 73 a fault that it via its output-side isolation amplifier TR on the one hand via the connection "Safety Feedback II" to the external safety and monitoring circuit 5 and on the other hand via a line 81 to the microprocessor 72 forwards. The microprocessors 72 and 73 Consequently, they carry out the same tests alternately and always check each other.
  • A voltage sensor 82 also measures the voltage U B2 at the operating voltage input of the switching pulse driver 14 1 over a line 83 after the safety switching device 74 was locked. If the operating voltage U B2 still exists, the voltage sensor signals 82 this the microprocessor 73 as a "mistake". Thereupon the microprocessor gives 73 a stop signal via the safety switching device 75 and at the same time tells the microprocessor 72 with that now must be switched off.
  • The voltage at the operating voltage input of the switching pulse driver 14 1 will also be the microprocessor 12 over the separation stage 67 submitted for review.
  • Via a "tripping" connection in the terminal block 35 After activating a designated safety function, this function can be reset. Thereafter, the engine control operates again in normal operation.
  • As described above, from the measurement signals of the sensors 76 and 48 Derived speed signals and compared with a limit. In a particular embodiment, these two speed values are compared. For this purpose, two of the three PDM signals of the pulse duration modulator 11 fed to a low pass filter. The filter generates a sine signal, which is applied to a Schmitt trigger, which converts the sine signal into a pulse signal. The pulse signal, whose pulse repetition frequency corresponds to the speed, is the microprocessor 73 fed. The second speed signal to be used for the comparison is obtained from the motor current. The measurement signal is converted by a Schmitt trigger into a pulse signal and the second microprocessor 72 fed. The microprocessors compare the two speeds, and if the difference outside ei is the permitted range, the motor control is stopped. Alternatively, the DC link current can be measured as a measure of the speed.
  • These Function can for the function speed monitoring to be used. It can thus be obtained a "safe" speed signal, so that one Speed sensor on the motor shaft can be omitted.
  • Also in the embodiment according to 5 is via the "safety bus" connection of the terminal block 35 the safety bus 56 , here the safety bus Profisafe ® , connected, whose information in turn from the bus controller 57 (please refer 3 ) are checked to see if they contain an error or represent a shutdown command signal. If necessary, this is done by the bus controller 57 a stop of the engine via the microprocessor 73 and the safety switching device 75 or via the microprocessor 72 and the safety switching device 74 triggered. About the bus 56 can also provide the required delay time to the microprocessors 72 . 73 be sent.
  • So far to shut down a relay or any other consumer Switching elements are connected in series with this, they can while of the operation are not shut down to check if they are still functional. This would resemble a stop command. Nevertheless, it is necessary, even during the Operating, z. B. once a minute, the functionality of the switching elements in the "safe Technology "too check.
  • 6 represents a circuit diagram of a device for automatically checking the functionality of a safety switching device, by the function of at least one shutdown signal of a safety and / or monitoring device, here the safety and monitoring circuit 5 after the 1 to 3 , in case of danger or for safety's sake, the operation of a consumer, here the engine 3 , can be switched off. The test apparatus is exemplified by in 3 illustrated safety switching device be written that the relay 20 and the switching elements connected in series therewith, here the transistors 21 . 52 and 61 , and with the delay element 23 , the speed monitor 53 , the microprocessor 15 as well as the microprocessor 58 connected is. The one with the relay 20 (or its coil 30 ) connected collector of the npn transistor 61 is additionally connected to the operating voltage U B1 and its emitter connected to "ground".
  • The test apparatus consists essentially of a pulse generator 88 with a number corresponding to the number of switching elements (transistors), here three, of outputs and logic gates 89 . 90 and 91 , As gates AND and NOR gates are shown. But it can also be only AND gates, depending on whether the blocking signals to be triggered by the normally-conducting transistors in normal operation by 1-signals or O-signals on the input side of the gates. In the present case there are 1-signals.
  • The pulse generator 88 , including the gates in the microprocessor 58 can be formed cyclically generates sequentially at its outputs 1 signals as test or switching pulses P 1 , P 2 and P3, each via one of the gates 89 . 90 and 91 in this or another order the control terminals of the transistors as blocking pulses P 1 , P 2 and P 3 are fed, as is in 6 (b) is shown. The duration of the switching pulses P 1 , P 2 and P 3 is different and can each be, for example, 2 μs, 4 μs and 6 μs. The duration is therefore shorter than the response delay of the relay 20 , which can be about 20 ms. Therefore, the relay does not fall off at such a short interruption of its circuit, so that its contacts maintain their respective switching state, "on" or "off" or "closed" or "open". In contrast, the voltage U R at the relay coil at each blocking pulse P 1 , P 2 and P 3 completely, as in 6 (b) represented, or only slightly fall off. To 6 (b) With each blocking pulse, it completely decreases to zero, but only for a short time according to the duration of the respective blocking pulse. A microprocessor, here the microprocessor 15 , which is programmed according to a discriminator, or a suitably trained discriminator, which constantly checks the voltage U R on the relay coil, whether it drops briefly or not, recognizes a brief decrease or fluctuation of the voltage U R as an error-free operation of the transistors , However, if at least one of the transistors remains conductive due to a defect and does not respond to inhibit pulses, the voltage U R at the relay coil does not disappear at each inhibit pulse, and the discriminator or microprocessor 15 recognizes this as a fault of one of the transistors and signals this fault condition of the safety and / or monitoring device, here the safety and monitoring circuit 5 , and stops the engine control. Since the duration of the blocking pulses is different lengths, the discriminator also detects in which of the transistors the defect is present, since the voltage U R during the duration of the delivery of a blocking pulse to the relevant transistor, for. B. the blocking pulse P 2 to the transistor 21 , would not change, ie would remain constant. This check is in principle possible for the determination of a blown transistor, ie a transistor which represents a short circuit. Regardless, generate the microprocessor 58 , the delay element 23 and the speed monitor 53 also, as in the case of 3 , after a stop signal redundant Ab switching signals which are each supplied to one of the NOR elements (as 1-signals).
  • As a general rule this principle is based on the examination of operability a switching element thus on the utilization of the response delay of a consumer, here the relay, with a quicker responsive switching element is connected in series, which assumes a first switching state in normal operation, in which the consumer is switched on (energized), and in case of danger can be switched to a second switching state, in which the operation of the Consumer is turned off, the switching element in normal operation cyclically during a duration in the second switching state is switchable, the shorter than the response delay the consumer is on a shutdown. Is advantageous it thereby, if provided at least one further switching element is that assumes a first switching state in normal operation, in the consumer is switched on, and in case of danger in a second Switching state is switchable, in which the operation of the consumer is turned off, and when the switching elements in normal operation cyclically one after the other during a duration in the second switching state are switchable, the shorter than the response delay the consumer is on a shutdown. If then the off period of the Switching elements is different Lich, it can be determined which Switching element is possibly defective. Generally, the consumer can be a relay, through which the operation of a second consumer can be switched off.
  • The general principle of the above-described device for testing the functionality of the transistors 21 . 52 and 61 or corresponding electronic switching elements which are connected in series with another consumer with response delay is in 7 shown.
  • To 7 the consumer consists of an ohmic resistor R and a capacitor connected in series with this, at which the operating voltage U B is tapped for a safety channel, wherein the series circuit of the load and the transistors at a constant DC voltage of for example 24V. Here, it is tapped off as a test voltage, the voltage drop U R of the ohmic resistance R.
  • The safety switching device consisting of the transistors, switch-off signaling devices (safety bus, speed monitor and delay element) as well as the test pulse generators (pulse generator (IPG) 84 and gatekeys 89 - 91 ) are schematic in 7 (a) represented in the form of functional units. 7 (b) represents the time course of the test voltage U R at the resistor R.
  • 8th put that in the 6 and 7 Thereafter, in place of the special Abschaltbefehlsgeber, such as Drehzahlüberwacher or delay elements, other Abschaltbefehlsgeber be used, due to other security functions by the security and monitoring circuit 5 be monitored, at the outputs A 1 , A 2 , A 3, for example, the microprocessor 72 Shutdown signals that cause a safety switching device, such as the safety switching device 74 be supplied. In this case, between the switch-off signals for testing the functionality of the switching elements S 1 , S 2 , S 3 of the safety switching device test switching pulses P 1 , P 2 and P 3 at the outputs A 1 , A 2 and A 3 in the chronological order and duration t 1 , t 2 and t 3 according to the three lower diagrams in 8 (b) or delivered in any order and the respective switching element S 1 , S 2 and S 3 fed. At the common output of the series connection of the switching elements S 1 , S 2 and S 3 , the lines 33 and 83 in 5 corresponds, then comes from the sensor 82 to be measured, in the top diagram in 8 (b) shown waveform (voltage or current waveform), when the function of all switching elements S 1 to S 3 is error-free.
  • Depending on this process then "no error" or "error", here by the microprocessor 73 to the safety and monitoring circuit 5 reported as it is based on 6 has been described.
  • 9 illustrates an embodiment of the safety switching device 75 according to 5 during normal operation of the microprocessor 73 Its outputs A 4 and A 5 are checked for their functionality and for switching off the motor 3 via both outputs A 4 , A 5 simultaneously receives a shutdown signal. The microprocessor 75 Therefore, it can be functionally considered as part of the test apparatus and as part of the safety switch device.
  • The safety switching device 75 contains a controllable circuit consisting of two ohmic resistors connected in series 92 and 93 and one with the resistors 92 . 93 series connected transistor 94 , This circuit is located between the output A 4 of the microprocessor 73 and "earth". Furthermore, the safety switching device contains 75 a second controllable circuit of two ohmic resistors connected in series 95 and 96 as well as one with the resistors 95 . 96 series connected transistor 97 , This circuit is between the output A 5 and "earth". The connection between the resistors 92 and 93 and the connection between the resistors 95 and 96 form the outputs of the two circuits. The Outputs are connected together and form the output A 6 of the safety switching device 75 , At the operating voltage U B1 are also two further series circuits, each having two ohmic resistors 98 and 99 , respectively. 100 and 101 , each having a transistor between them 102 and 103 lies. The transistor 102 is via a resistor 104 from the output A 4 and the transistor 103 over an ohmic resistance 105 controlled by the output A 5 . The transistors 102 and 103 control over an ohmic resistance 104 respectively. 105 each one of the transistors 94 and 97 at. In normal operation is at the output A 6, a voltage with a constant level PK.
  • During the test phase, the microprocessor generates 73 At its outputs A 4 and A 5 three-stage signals, as shown in the two lower diagrams of the 9 (b) are shown. These signals are in anti-phase with respect to a mean voltage U and each have a first switching pulse SP 1 and SP 3 and a second switching pulse SP 2 and SP 4 , which repeat cyclically as long as the test phase continues. The switching pulses are in the microprocessor 73 generated via two series-connected, alternately switched transistors. As long as none of the switching pulses SP 1 to SP 4 occurs, the voltage U is at the outputs A 4 and A 5 , so that both transistors are locked and also at the output A 6 is a relatively high voltage. If, on the other hand, the falling pulse SP 1 occurs at the output A 4 , the rising pulse SP 3 is simultaneously generated at the output A 5 . By the pulse SP 1 , the transistors 102 and 94 conductive while the transistors 103 and 97 be locked simultaneously by the switching pulse SP 3 . The voltage at the output A 6 decreases to a smaller test level PP, because the resistors 93 and 96 during the duration of the switching pulses SP 1 and SP 3 , ie the turn-on time of the transistor 94 , with locked transistor 97 , are not connected in parallel. The microprocessor 72 recognizes this as "error-free" of the safety switching device 75 at.
  • The same applies to the delivery of the switching pulses SP 2 and SP 4 , where now the transistor 94 locked and the transistor 97 is conductive. However, if one of the transistors 93 and 94 due to a fault represents a short circuit, then the signal at the output A 6 does not have the ripple according to the top diagram of 9 (b) , Rather, the waveform is changed, and the microprocessor 72 detects this changed waveform and then outputs a signal "error" to the safety and monitoring circuit 5 from, or a stop signal via the safety switching device 74 ,
  • However, if the safety switching device 75 okay, and the engine 3 however, due to one of the safety and monitoring circuitry connected to the microprocessor 73 emitted shutdown command signal is to be turned off, generates the microprocessor 73 at both outputs A 4 and A 5 simultaneously a signal, so that both transistors 94 and 97 become conductive and at the output A 6 of the safety switching device 75 a low voltage PN occurs, which is supplied as a reset signal to the reset input R, so that the motor 3 is switched off.
  • The safety switching device 75 including the microprocessors to be tested 73 and 72 may also be any other consumer, which are provided for switching off with a safety switching device, but no control device, such as the control device 2 , have, be used. Instead of the microprocessor 73 can also be another circuit, eg. B. a corresponding pulse generator with the same test function as that of the microprocessor 73 and instead of the microprocessor 72 a discriminator or comparator is used to discriminate the levels PK, PP and PN.
  • 10 illustrates an embodiment of the safety switching device 74 and schematically the microprocessor 72 together, a device for automatic testing of the functioning of the safety switching device 74 form. They also form part of the safety device 4 on the option card 18 ,
  • To 10 contains the safety switching device 74 a first controllable circuit of the series connection of an ohmic resistance 106 with a transistor 107 and a second controllable circuit of the series connection of an ohmic resistor 108 and a transistor 109 , The between the transistor 107 and the transistor 109 lying outputs of the two circuits are connected to each other and together form the output A 7 of the safety switching device 74 , The output A 7 is over the line 33 to the operating voltage terminal of the switching pulse driver 14 1 and over the line 83 with the voltage sensor 82 connected. Two further series circuits each consisting of two ohmic resistors connected in series 110 and 111 respectively. 112 and 113 as well as a transistor 114 respectively. 115 lie parallel between the operating voltage U B2 and "earth". The connection of the resistors 110 and 111 is connected to the control terminal of the transistor 107 and the connection of the resistors 112 and 113 with the control terminal of the transistor 109 connected.
  • The microprocessor 72 generates in this embodiment at its outputs A 1 and A 2 in normal operation, a (high) signal ON, so that both transistors 109 and 107 are conductive, and during a test phase in each case a test switching pulse SP 4 and SP 5 , the control terminal of the respective transistor 114 respectively. 115 is supplied. The test switching pulses SP 4 and SP 5 are offset in time without mutual overlap and repeat during the test phase. If therefore the test switching pulse SP 4 at the output A 1 of the microprocessor 73 occurs, are the in normal operation at high output voltage at the outputs A 2 and A 1 conducting transistors 114 and 107 locked while the transistors 109 and 115 remain conductive. The voltage at the output A 7 therefore decreases only slightly from the constant level PK to the test level PP. Between the two Prüfschaltimpulsen the voltage at the output A 7 again increases to PK to the next test switching pulse SP 5 at the output A 2 of the microprocessor 73 to lose weight again. The voltage at the output A 7 therefore fluctuates only slightly during the test phase. The small fluctuation of the output voltage is from the connected voltage sensor 82 to the microprocessor 73 forwarded the fluctuation as a faultless state of the safety switching device 74 interpreted. If the fluctuation does not occur or the waveform deviates from the waveform in the test phase, this is considered a failure of the safety switch device 74 recognized. If, on the other hand, the consumer, here the engine 3 , should be turned off in normal operation, the microprocessor generates 72 at both outputs A 1 and A 2 simultaneously a low signal "OFF". This turns the transistors 107 and 109 locked at the same time, allowing the driver 14 1 the operating voltage is removed and the motor 3 stops. On the other hand, if the voltage at output A 7 fluctuates only slightly during a test phase during normal operation, the switching pulse driver remains 14 1 and therefore the engine 3 continue to operate.
  • The resistors 106 and 108 are preferably automatically adjustable depending on the load, ie they can be replaced by smaller circuit arrangements, the respective resistance in dependence on the load current, such as the switching pulse driver 14 , set to the most favorable value. This has the advantage that the resistors 106 and 108 in the design of the safety switching device 74 not have to be dimensioned differently for each application.
  • 11 in principle provides a circuit arrangement of a test unit 116 in a device 117 ( 5 ) for automatically checking the operability of a safety switching device. In the present case, the input terminals of the microprocessors 72 and 73 tested for their functionality, the microprocessors 72 and 73 generalized as the or as part of a safety switching device can be considered. Also the test unit 116 itself is being tested.
  • The reason for this test is essentially the following: The input terminals of the microprocessors 72 and 73 will be in the execution 5 over the connections of the terminal block 35 on the option card 18 Shutdown signals supplied. It should be ensured that these shutdown signals actually from the respective microprocessor 72 respectively. 73 be recorded and processed. It should be noted so-called "sleeping errors". Such an error can z. B. caused by an input terminal of the microprocessors over a long time, for. B. several years, with the same signal, z. B. a constant DC voltage of 24 V, is charged, without the user side a stop signal or shutdown signal is triggered. In the worst case, the error is only detected if a "safe function" is to be activated. This would not be tolerable, because there could be another error that prevents the safety device 4 works.
  • To avoid such a case, the input terminals of the microprocessors become 72 and 73 automatically controlled internally, without the connections of the terminal block 35 to influence.
  • For each input terminal of the microprocessors 72 and 73 is a test unit like the one in 11 shown test unit 116 provided, and each test unit can be controlled individually.
  • It also the output connections of the Microprocessors tested. This happens because the one Microprocessor emits a short signal from the other microprocessor is controlled.
  • The test unit 116 to 11 is connected via a voltage level adapter SA, which contains a resistive voltage divider, with a terminal of the terminal block 35 ( 5 ) connected. The connection is to simplify the illustration in 5 omitted. The test unit 116 has two further inputs E 3 , E 4 , which staggered test switching pulses SP 6 , SP 7 from a pulse generator in the microprocessor 72 be supplied. The pulse generator is by appropriate programming of the microprocessor 72 realized. The test unit 116 also has an output A 8 connected to an input terminal of the microprocessor 73 or the safety switching device is connected via a voltage level adapter SA.
  • The circuit arrangement of the test unit 116 according to 11 (a) includes a first series connection of a first transistor 118 , one in the same direction with the first transistor 118 polarized second transistor 119 and two in the same way with the transistors 118 . 119 polarized diodes 120 . 121 between the transistors 118 . 119 , It also contains a second series connection of two ohmic resistors 122 . 123 , whose connection with the control terminal of the first transistor 118 is connected, and a third transistor 124 , The control terminal of the second transistor 119 forms the input E 4 , the control terminal of the third transistor 124 the input E 3 and the connection of the diodes 120 . 121 the output A 8 .
  • The Prüfschaltimpulse SP 6 and SP 7 repeat cyclically at predetermined times and fixed intervals, the Prüfschaltimpulse SP 7 between the Prüfschaltimpulsen SP 6 , and vice versa occur. Each time a test pulse SP 6 is received from the microprocessor 72 at input E 3 occurs at the output A 8 of the test unit 116 a high output pulse SP 8 and each time a test switching pulse SP 7 is received at input E 4 from the microprocessor 72 a low output pulse SP 9 . The output pulses SP 8 and SP 9 are from the microprocessor 73 over the multiple line M to the microprocessor 72 forwarded. The microprocessor 72 then checks whether at or at the time of delivery of a test switching pulse SP 6, a high output pulse SP 8 of the test unit 116 and at or at the time of delivery of a test switch pulse SP 7, a low output pulse SP 9 of the test unit 116 receives. If the microprocessor 72 upon delivery of a test switching pulse SP 6 or SP 7 receives no corresponding output pulse SP 8 or SP 9 , it generates a signal "error" to the safety and monitoring circuit 5 is returned, or outputs a stop signal to the controller. On the other hand, it generates a signal "no fault" when it outputs a corresponding output pulse SP 8 and SP 9 from the test unit every time a test switching pulse SP 6 and SP 7 is output 116 receives.
  • The application of the high and low output pulses SP 8 and SP 9 of the test unit 116 that the microprocessor 72 is required because it is not known in advance whether the user uses a high or low shutdown signal in normal operation. The check ensures that the microprocessor can handle both low and high shutdown signals. This prevents the possibility that short circuits or interruptions in the input connections will not be detected.
  • The microprocessor 72 may also have its own input terminals via test units correspondingly connected to its input terminals, such as the test unit 116 , check for functionality, although this is in 5 not shown.
  • The exam should be as often as necessary carried out be, but only relatively short and rarely compared to using a shutdown feature, since the shutdown signal of the user during the test is not can be determined. While The examination although the input resistance, as seen by the user, is reduced, from, for example, 4 kohms to 2 kohms. But this seems acceptable, because user-side often a relay is used.
  • 12 represents the structure of the electric motor 3 is, which is designed as a three-phase AC motor and in a known manner with the control device 2 is provided, which is designed here as a converter and the low-power control unit 6 as well as the power control unit 8th with the inverter 13 in a housing 125 of the motor 3 having. The housing 125 consists of three housing parts 126 . 127 and 128 , In the housing part 126 are the stand with the stator winding 129 and the runner 130 arranged. The wave 131 of the runner 130 is in camps 132 and 133 stored and drives a fan 134 in the housing part 128 at. The housing part 127 is on the housing part 126 attached and from the outside after loosening a cover 135 accessible. Inside the motor, ie its housing part 127 , are the control device 2 and with the controller 2 by a connector, not shown (connector or flat cable with connector parts) connected safety device 4 arranged. The security device 4 is on a separate map 18 applied while the low and high current control units 4 and 6 either on separate maps 17 and 8th or together on a card (board) are applied. The security device 4 but it can also be used together with the control device 2 be arranged on a single card. In the engine 3 ie in its out of the housing parts 126 and 128 existing housing unit is the sensor 51 arranged to measure the speed. With the sensors 136 and 137 Further possible mounting locations of the sensor are shown. Under certain circumstances, several sensors can be used.
  • The sensor 51 has only one task, namely to contribute to a "safe function". He is therefore with the safety device 4 inside the engine 3 (his case 125 ) connected. If in addition the speed of the engine 3 is to be controlled, an additional speed sensor may be provided, but usually outside the engine on the shaft 131 is attached.
  • The sensor 51 may be a conventional or specially designed for security purposes sensor, here to measure the speed to compare with a limit.
  • The connecting lines between the safety device 4 and within the engine arranged sensor 51 are all routed inside the engine, as far as it is a "safety sensor". The user therefore does not need to worry about the wiring.

Claims (9)

  1. Motor control with a motor ( 3 ) associated control device ( 2 ) and a security device ( 4 ) for an intervention in the control device ( 2 ) to achieve a safe stop of the engine ( 3 ), with a control unit ( 10 . 12 . 72 . 73 ) with memory (K1, K2, K3, K4) in which one of the control device ( 2 ) associated program for the operation of the control device ( 2 ) and the security device ( 4 ), the control unit ( 10 . 12 . 72 . 73 ) and the memory in a first control part ( 10 . 12 ) with a first memory part (K3, K4) in which a first program for the operation of the control device is stored, and a second control part ( 72 . 73 ) with a second memory part (K1, K2) in which a second program for the operation of the safety device ( 4 ) is divided, - wherein the control device ( 2 ) a low power control unit ( 6 ) and a power control unit ( 8th ), wherein shutdown commands of the security device ( 4 ) for switching off the engine via a first safety channel with a first safety switching device ( 74 ) into the power control unit ( 8th ) and via a second safety channel with a second safety switching device ( 75 ) into the low power control unit ( 6 ), wherein the safety channels are each assigned a safety feedback channel and feedback signals are sent via the safety feedback channels to the safety device ( 4 ), the functioning of the safety switching devices ( 74 . 75 ) by a respective microprocessor connected to one of the safety switching devices ( 72 . 73 ) is checked.
  2. Motor control according to Claim 1, characterized in that the control device ( 2 ) and the first control part ( 10 . 12 ) with the first memory part (K3, K4) on a first card device ( 7 . 9 ) and the second control part ( 72 . 73 ) security device having the second program ( 4 ) on a second card device ( 18 ) and that the two card devices ( 7 . 9 ; 18 ) are electrically connected by a releasable connector.
  3. Motor control according to Claim 2, characterized in that the first card device ( 7 . 9 ) Lines for security signals, wherein the lines only after connecting the two card devices ( 7 . 9 ; 18 ) are effective.
  4. Motor control according to Claim 2 or 3, characterized in that the first card device ( 7 . 9 ) a low power control card ( 7 ) and one with this electrically connectable power control card ( 9 ) that the safety device ( 4 ) on the second card device ( 18 ) a safety switching device ( 72 - 75 ) for the control device ( 2 ) having.
  5. Motor control according to Claim 4, characterized in that the electrical connections between the card devices ( 7 . 9 ; 18 ) Connectors ( 50 ) exhibit.
  6. Motor control according to Claim 5, characterized in that the connection of the second card device ( 18 ) with the first card device ( 7 . 9 ) the first security channel ( 72 . 74 . 33 ) and the second security channel ( 73 . 75 . 38 ), via which in each case a safe signal of a safety and monitoring circuit ( 5 ) or the security device ( 4 ) to the control device ( 2 ) to shut off the engine ( 3 ) is transferable.
  7. Motor control according to Claim 6, characterized in that the first safety channel ( 72 . 74 . 33 ) and the first security feedback channel ( 83 . 82 . 73 ) via a connection between the second card device ( 18 ) and the power control card ( 9 ) and that the second security channel and the second security feedback channel are connected via a connection between the second card device ( 18 ) and the low power control card ( 7 ) are guided.
  8. Motor control according to one of Claims 4 to 7, characterized in that on the low-current control card ( 7 ) between the first control part ( 12 ) and a safety or feedback channel a largely reaction-free separation stage ( 67 ; 68 ) is arranged.
  9. Motor control according to one of Claims 6 or 7, characterized in that the control device ( 2 ) is an inverter whose inverter ( 13 ) has controllable semiconductor switching elements, which are controllable by the output frequency of the inverter switching pulses, that from the repetition frequency of the switching pulses a Drehzahlmeßsignal is derivable, via a third feedback channel (UPM) as a "safe signal" is transferable, and that of a Motorstrommeßsignal a Drehzahlmeßsignal is derivable, which is transferable via a fourth feedback channel (f).
DE2002161453 2002-12-31 2002-12-31 motor control Expired - Fee Related DE10261453B4 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
DE2002161453 DE10261453B4 (en) 2002-12-31 2002-12-31 motor control

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
DE2002161453 DE10261453B4 (en) 2002-12-31 2002-12-31 motor control
AU2003287890A AU2003287890A1 (en) 2002-12-31 2003-12-15 Motor controller
PCT/DK2003/000872 WO2004059494A1 (en) 2002-12-31 2003-12-15 Motor controller

Publications (2)

Publication Number Publication Date
DE10261453A1 DE10261453A1 (en) 2004-09-02
DE10261453B4 true DE10261453B4 (en) 2010-04-15

Family

ID=32667558

Family Applications (1)

Application Number Title Priority Date Filing Date
DE2002161453 Expired - Fee Related DE10261453B4 (en) 2002-12-31 2002-12-31 motor control

Country Status (3)

Country Link
AU (1) AU2003287890A1 (en)
DE (1) DE10261453B4 (en)
WO (1) WO2004059494A1 (en)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP4226632B2 (en) 2007-03-08 2009-02-18 ファナック株式会社 Numerical control device having motor deceleration stop control means at abnormal time
JP5494255B2 (en) * 2010-06-07 2014-05-14 富士電機株式会社 Safety control system
JP5444421B2 (en) 2012-06-28 2014-03-19 ファナック株式会社 Brake abnormality diagnosis method and brake abnormality diagnosis device

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE4432768A1 (en) * 1994-09-14 1996-04-11 Gemac Ges Fuer Mikroelektronik Monitoring and controlling machine parameters and working conditions e.g. for CNC equipment and industrial robots
US6243629B1 (en) * 1996-04-19 2001-06-05 Honda Giken Kogyo Kabushiki Kaisha Electronic control unit for automotive vehicles
EP1211774A1 (en) * 2000-11-29 2002-06-05 Siemens Aktiengesellschaft Inherent safe speed monitoring for sensorless three phase current drives

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP3198629B2 (en) * 1992-07-08 2001-08-13 松下電器産業株式会社 Motor control device
DE19504404C1 (en) * 1995-02-10 1996-06-20 Pilz Gmbh & Co System architecture
SE514818C2 (en) * 1999-04-30 2001-04-30 Abb Ab Constant-frequency varying / variable rotational speed and the method in such a machine
JP3658340B2 (en) * 2001-05-17 2005-06-08 キヤノン株式会社 Method and apparatus for motor control

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE4432768A1 (en) * 1994-09-14 1996-04-11 Gemac Ges Fuer Mikroelektronik Monitoring and controlling machine parameters and working conditions e.g. for CNC equipment and industrial robots
US6243629B1 (en) * 1996-04-19 2001-06-05 Honda Giken Kogyo Kabushiki Kaisha Electronic control unit for automotive vehicles
EP1211774A1 (en) * 2000-11-29 2002-06-05 Siemens Aktiengesellschaft Inherent safe speed monitoring for sensorless three phase current drives

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
LENZE: Installation Inbetriebnahme, Global Drive, Reihe 9300, Variante V004, "Sicherer Halt", 12/2002, S. 1-28, EDB9300DE-V004-Firmenschrift *

Also Published As

Publication number Publication date
WO2004059494A1 (en) 2004-07-15
DE10261453A1 (en) 2004-09-02
AU2003287890A1 (en) 2004-07-22

Similar Documents

Publication Publication Date Title
US7687935B2 (en) Electrical power control system
US5847533A (en) Procedure and apparatus for braking a synchronous motor
US5089974A (en) Building technical management controller with a two-wire data and power transmission line
JP4295373B2 (en) Monitoring device for elevator operation control
US7378821B2 (en) Method and apparatus using VAR measurements to control power input to a three-phase induction motor circuit
US8659254B2 (en) Servo system, servo motor driving device, safety unit and method for controlling servo system
US9407086B2 (en) Safety switching device with power supply
EP1222087B1 (en) Method and arrangement for controlling a circuit connection between the electric outputs of a fuel cell and an isolated electric network
US7167348B2 (en) Miniaturized motor overload protector
EP0890242B1 (en) Process for determining potential shifts between electronic modules in a wire bus network
RU2289175C2 (en) Interrupter control and protective module
CN203827308U (en) Device for preventing output of input signal, device for providing output voltage for driving motor, and motor driving system
CN101180698B (en) Safety switch device for cutting off safely electrical load
US6917186B2 (en) Monitoring and control for power electronic system
US6985343B2 (en) Programmable power management switch
US8547668B2 (en) Management techniques for electric power generation equipment
DE102005055325C5 (en) Safety switching device for fail-safe disconnection of an electrical consumer
JP4191494B2 (en) Safety switch module and switching element OFF capability inspection method
US6373376B1 (en) AC synchronization with miswire detection for a multi-node serial communication system
DE102004018966B4 (en) Series motor
US5955859A (en) Interface module between a field bus and electrical equipment controlling and protecting an electric motor
US8400092B2 (en) Motor drive component verification system and method
EP1490700B1 (en) Circuit arrangement and method for testing an electric circuit
US9477212B2 (en) Safety switching device for the failsafe shutdown of an electrical load
US8675330B2 (en) Safety switching device for setting a safety-related device to a safe state

Legal Events

Date Code Title Description
OP8 Request for examination as to paragraph 44 patent law
8364 No opposition during term of opposition
R119 Application deemed withdrawn, or ip right lapsed, due to non-payment of renewal fee