DE4232720C1 - Function self-monitoring and measurement signal processor for vibration-fill-state limit switches - has parallel-working microprocessors each associated with pair of safety relays, which are switched-over for each self-test while maintaining connection state with external relay - Google Patents

Abstract

An evaluation unit (1) has two microprocessors (17,18) with identical hardware and software working in parallel. The unit has four safety relays (30,34,43,44) divided into two pairs, each pair controlled by one of the processors. The two pairs are successively switched over for each self-test, so that before the start of the test, the existing connection condition of the external relay connections are also maintained during the self test. The two safety relays of each pair are connected in series respectively related to the external relay connections and lie parallel respectively to the other pair. The microprocessors are connected with all four control contacts of the four safety relays. The two microprocessors are mutually monitored by watch-dog circuits. USE/ADVANTAGE - Esp. vibration level gauge limit switches. Gives high protection against failure and faults.

Description

The invention relates to an arrangement for function Monitoring and evaluation of level sensors, ins special vibration level limit switches, according to Preamble of claim 1.

Such an arrangement is e.g. B. from DE 31 27 637 C2 be known. This level measuring system consists of a sensor that is connected via a two-wire line to a remotely located evaluation device that uses cyclically recurring test procedures to check the functionality of the sensor. However, the error and failure safety of the known system is not very high, so that it is not suitable as a self-monitoring overfill protection in the liquid gas area. In particular, in the case of overfill protection applications in the liquefied gas sector, these are automatically classified in safety class 3 , which results in high safety requirements.

DE 34 01 761 C2 is a control device for control  described the output power of a device at which a Microcomputer is used to carry out tests. The Possibility of using two two-channel working Microcomputer is addressed there, but as rejected economically. Level sensors are in not discussed in this publication.

The invention has for its object an arrangement for Function monitoring and measurement value evaluation of level sensors, especially vibration level limit switches, to create the characterized by high reliability and reliability.

This object is achieved with those specified in claim 1 Features resolved.

Advantageous embodiments of the invention are in the Un claims specified.

The arrangement according to the invention thus becomes a system a self-monitoring overfill prevention system that the increasingly stringent requirements for measuring systems for Overfill protection is sufficient and also as an overfill protection in the Liquid gas range is suitable. To the resulting Meeting high security requirements is the end with two microprocessors working in parallel identical hardware and software. Through this re There is a clear redundancy in the evaluation and monitoring increased safety factor. Here are four safe safety relays are available, which are constructed identically and by two each by one of the microprocessors be controlled. By using four security rules lais, d. H. two pairs of safety relays, these can also be checked, taking the other pair can be controlled so that the current connection status of the external relay connections also during execution of the test can be retained.  

All control contacts are preferably the Safety relay connected to both microprocessors, see above that a parallel monitoring of the Safety relay redundant through both microprocessors expires.

The safety factor can be further increased considerably increase that the two microprocessors mutually monitor so that a possible malfunction of one Microprocessor immediately by the other, still intact Microprocessor can be detected and corresponding Security measures can be initiated.

Failure safety can be increased even further if the two microprocessors at predetermined time intervals Carry out self tests so that this self test and the external verification (by the other microprocess sor) the error detection probability is extremely high.

By decoupling the supply voltages for the The microprocessors can react in the event of a fault avoid on the still intact system.

In the same way, by using your own Interfaces for the microprocessors - despite feeding identical input data - repercussions between the two Suppress processor systems.

The mutual connection of the two processors through Communication lines allow mutual Ver equal to the data read into it, so that its over attunement can be checked independently by each processor can. This increases the reliability even further.  

The overfill prevention system is due to its extremely high Security standard suitable for continuous monitoring operation and no longer needs the otherwise usual annual Check of overfill prevention systems. This system one self-monitoring overfill protection is not on Liquid gas applications limited, but also in other Be range (e.g. VbF / WHG) can be used.

The invention is illustrated below with reference to embodiments play described with reference to the drawings ben. Show it:

Fig. 1 is a schematic overall view of an exemplary embodiment of the arrangement according to the invention for function monitoring and measured value evaluation in level detectors, and

Fig. 2 is a block diagram of the redundant evaluation device of the system according to the invention.

In Fig. 1, a schematic representation of an inventive arrangement is shown, which comprises an evaluation device 1 , which is connected via a two-wire line 2 to a sensor 3 , which evaluates a physical parameter P acting on it. The sensor is used for level measurement and can have different designs, for example designed as a fork resonator, coaxial oscillator, etc. Alternatively, the sensor can also be designed as a capacitive or conductive sensor or in some other way. The sensor can not only output the actual measured values in the form of voltage or current signals, but also test and reference values for functional testing.

In Fig. 2 is a block diagram of the evaluation device 1 Darge provides. The arrangement comprises two connections 4 and 5 , which are connected to the two-wire line 2 and use this to establish the connection to the remote sensor 3 . To supply power to the sensor 3 , there is a current source 6 which supplies the sensor 3 with impressed current during the start of a test phase, and a voltage source 8 which supplies the sensor with a fixed voltage during the remaining times. Switching between voltage and current supply of the sensor takes place via a normally closed switch 7 which is connected in parallel to the current source 6 and in series between the voltage source 8 and the connection 4 . The switch 7 is periodically opened by a control generator 12 via a line 11 to initiate a respective test phase, so that the sensor 3 is then fed by the impressed current from the current source 6 . Sensor 3 interprets this as a start command for a test cycle.

All of the current flowing through the sensor 3 flows through the connection 5 and a current sensing resistor 9 connected to it for the negative connection of the voltage source 8 . A voltage occurs at the current sensing resistor 9 , which corresponds to the current flowing back from the sensor 3 . Since the sensor is designed so that it controls the current intensity in accordance with the measurement or reference value to be transmitted, the voltage occurring at the current sensing resistor 9 is a direct measure of the measurement and reference values supplied by the sensor 3 . Each drop across the resistor 9 is converted by a voltage to the terminal 5 and the current sensing resistor 9 connected analog / digital converter 10 into a corresponding digital value and the latter two to two parallel-connected inputs interfaces 15, applied sixteenth

The test start command generated by the control generator 12 and supplied to the switch 7 is also applied to inputs of the two interfaces 15 , 16 connected in parallel and to a self-test timer 13 , the output signal of which is also applied to inputs of the interfaces 15 , 16 connected in parallel.

There are also display and operating elements 14 , via which the communication between the system and the operating and monitoring personnel takes place. The input and output signals of the display and control elements 14 are also carried out via parallel inputs / outputs of the two interfaces 15 , 16 .

The interface 15 is connected to a microprocessor 17 , while the interface 16 is connected to a microprocessor 18 . The microprocessors 17 , 18 work in parallel and are equipped with identical hardware and software in order to form a redundant security system. The microprocessors 17 , 18 communicate via the interfaces 15 , 16 with the blocks 10 , 12 , 13 and 14 . As already leads out, all inputs of the interfaces 15 , 16 are connected in pairs, so that the microprocessors 17 , 18 each receive identical input data.

The use of separate interfaces 15 , 16 for each microprocessor makes it possible to avoid interference between the two microprocessors.

Each microprocessor 17 , 18 is provided with an identical control program EEPROM and a reset circuit and furthermore has a watchdog circuit 19 or 21 , which is in each case coupled to the other microprocessor.

The two watchdog circuits 19 and 21 can alternatively also be simulated in the microprocessors by software, so that in each case one microprocessor represents the watchdog for the other microprocessor.

The two microprocessors 17 , 18 are also connected to one another via communication lines 20 , via which the two microprocessors can mutually check whether the same data are read. If this is not the case, this means errors in the interfaces or in the microprocessors. If such errors occur, the two microprocessors then initiate appropriate safety and display measures.

Each microprocessor 17 or 18 is connected via an output line 22 or 23 to a fault signal relay 25 with a light-emitting diode display, which drops off when a fault is detected and opens the fault signal line 27 by opening its contact 26 . The two lines 22 , 23 are linked together by an AND gate 24 , the output of which is connected to the fault relay 25 .

To generate a level signal, there are two outputs connected to lines 33 , 45 , the mutual connection state of which is controlled by the microprocessors 17 , 18 via four safety relays 30 , 34 , 43 and 44 .

As shown in FIG. 2, the four safety relays 30 , 34 , 43 and 44 are configured identically. The safety relays 30 and 34 are controlled by the microprocessor 17 via lines 28 , 29 in their switching state, while the safety relays 43 , 44 are controlled by the microprocessor 18 via lines 42 , 46 . Each safety relay 30 , 34 , 43 and 44 contains a normally closed contact 31 and a normally open contact 32 , which are each switched over simultaneously. One terminal of each normally closed contact 31 of each safety relay is connected to ground potential, while the other terminals of the normally closed contacts are each connected via a separate line 37 to 40 to inputs of an interface 36 , which via output lines 35 and 41 to the microprocessors 17 and 18 in the are shown coupled.

The normally open contacts of the safety relays 30 and 43 are connected in series with one another, as are the normally open contacts of the safety relays 34 , 44 . Both series connections of the normally open contacts are parallel to one another between the output lines 33 , 45 , which lead to the external connections. With this connection, it is possible to check the function of the safety relays 30 , 34 , 43 and 44 as well as their ability to be set and reset without the external switching lines 33 , 45 being affected by the instantaneous switching state produced by the safety relays. If, for example, the current switching state of the work or power contacts connected to the lines 33 , 45 corresponds to that shown in FIG. 2, z. B. the switching functions of the safety relays 30 , 34 can be checked by changing the line level of the lines 29 , 28 accordingly. At closing, the safety relays 30 , 34 can be switched back to the switching state shown, after which a check of the safety relays 43 , 44 can take place by corresponding switching of the control commands supplied to them. Likewise, the function of the relays can be checked in the reverse switching state of the output stage, ie in the case of a permanently required connection of the output lines 33 , 45 . For this purpose, the power contacts of the two relays 30 , 43 are opened, while the power contacts of the relays 34 , 44 maintain the connection between lines 33 and 45 . Then, after relays 30 , 43 have picked up again, the other two relays 34 , 44 are set to the dropped state. In this way, even in this switching state of the output lines 33 , 45, all four relays can be checked for their function without this having an effect on the switching state of the output.

On the other hand, the normally closed or control contacts 31 of the safety relays 30 , 34 , 43 and 44 shown on the left are connected in such a way that when the switching state of the safety relays changes, corresponding level changes (switchover between floating potential and ground potential) occur on lines 37 to 40 , which can be evaluated by the microprocessors 17 , 18 . Due to the fact that each microprocessor 21 , 28 monitors all four control contacts, a mutual check of the microprocessor systems is also realized.

The supply voltages for the microprocessors 17 , 18 are decoupled from one another and from the other circuit parts, so that in the event of a fault, effects on system parts that are still intact are prevented. The supply voltages are generated by a switching power supply, not shown.

The operation of the arrangement described above is as follows:

The measured values are from the sensor 3 to the evaluation device 1 z. B. transmitted in the form of a two-wire signal. In order to initiate a test cycle, the evaluation device 1 generates a test command which, for. B. is realized in that the switch 7 is opened and thereby the current flow on the line 2 between the sensor 3 and the evaluation device 1 briefly by the current source 6 to a value of z. B. 4 mA, which is below the current occurring in the normal measuring range, is limited. This lowering of current is recognized by the electronics in sensor 3 and triggers a series of internal tests which are designed in such a way that all errors occurring in the sensor, both mechanical and electrical errors, can be detected. In addition, reference values can be transmitted from sensor 3 either before or after a current measured value is transmitted.

For example, in the first phase of a measuring cycle Current briefly limited to 4 mA for 50 ms, whereby the measuring cycle is started. Then for  a duration of approx. 200 ms as the first reference value transfer current value, its size within the also with a normal measurement possible current range from 5 to Is 20 mA and z. B. is 15 mA. After that, for a duration transmit a second reference value of approx. 100 ms, whose Size above that which occurs in a normal measurement Current amplitudes and is, for example, 25 mA. In the subsequent phase then becomes the current measured value transfer. The total duration of these phases is z. B. 1 s, can also be shorter or longer.

If errors occur, this signal curve changes with regard to the amplitude and time values. This change is determined by a comparison with stored characteristic values in the evaluation device 3 and the safety relays 30 , 34 , 43 and 44 are switched to the de-energized state.

The core of the evaluation device 1 are the redundant ar working microprocessor systems 17 , 18 and the safety relays 30 , 34 , 43 and 44 .

By the control generator 12 designed as a free-running pulse generator, the following functions are additionally carried out: on the one hand, a start pulse for the sensor (by briefly opening the switch 7 ) is emitted to initiate a measuring cycle. On the other hand, the control generator 12 effects the synchronization of the two micro processor systems 17 , 18th Finally, the Steuerge generator 12 also forms a basic clock for deriving the repetition time of the self-test and is related to the self-test timer 13 .

During the measurement cycle comprising the four phases specified above, the following checks / measurements are carried out by both microprocessor systems 17 , 18 :

• 1) checking the first reference value of sensor 3 ,
• 2) checking the second reference value of sensor 3 ,
• 3) evaluation of the measured value of sensor 3 ,
• 4) checking the time behavior of the two-wire signal,
• 5) checking the time behavior of the free-running control generator 12 ,
• 6) Checking the time behavior of the self-test timer 13
• 7) detection of a failure of the supply voltages,
• 8) detection of a short circuit / open circuit on the connecting line 2 to the sensor 3 ,
• 9) Checking the correct assignment of the power contacts to the control contacts of the safety relays 30 , 34 , 43 and 44 ,
• 10) Monitoring the measured value for exceeding / falling below the Switching thresholds for a level signal, d. H. execution the level switch function.

The continuous mutual monitoring of the microprocessors 17 , 18 via the watchdog circuit 19 , 21 also detects the failure of a microprocessor. At the same time, the two supply voltages that feed the microprocessors 17 and 18 are also monitored.

The aforementioned monitoring functions are continuous repeated, the repetition frequency being the reciprocal of the Total duration of the four phases given above corresponds (Continuous monitoring). The total duration of such a cycle of four phases can be one second, but also others Accept values.

In order to further increase the security against errors and also to determine errors within the microprocessor systems 17 , 18 , a self-test is carried out every thirty minutes, triggered by the self-test timer 13 . All units are monitored that cannot be checked during normal continuous monitoring. The self-test checks:

• 1) The internal direct access memories (RAM) of the microprocessors 17 , 18 by means of a "walking pattern" test with 100% error detection,
• 2) the read-only memory (ROM) of the microprocessors 17 , 18 by "CRC check" with 99.98% error detection,
• 3) CPU test: all internal registers and flags are tested by a program and there are all commands used in the normal operating program performed at least once,
• 4) A peripheral test is carried out, in which all hardware components and I / O functions of the microprocessors 17 , 18 are tested,
• 5) The function of the safety relays 30 , 34 , 43 and 44 is checked, the ability of the safety relays to be set and reset is tested. The use of the four safety relays and the corresponding connection of the power contacts ensures that the self-test can be carried out without the current switching state of the safety relay appearing to the outside.

The described arrangement of the two redundant microprocessor systems 17 , 18 and the four positively driven safety relays 30 , 34 , 43 and 44 , which work as comparators, ensures that the overall system is sufficiently fail-safe, ie that all possible safety-relevant ones can be achieved Detect faults, in which case the system changes to the safe state in a defined manner by switching off safety relays 30 , 34 , 43 and 44 .

The system described is therefore for permanent surveillance suitable and does not have to, as otherwise with overfill fuses usual, checked annually.  

The control generator 12 and the self-test timer 13 can also be simulated in software in both processors 17 , 18 , in that one of the processors alternately emits the pulses and the other processor monitors whether this is done correctly.

In order to establish a functional monitoring of the evaluation device 1 and to allow the system to transition reliably to the fail-safe state in the event of an error, the processor system and the fill level output relay are thus constructed redundantly, as shown in FIG. 2. Via the four safety relays 30 , 34 , 43 and 44 working as a comparator arrangement, the output signals of the microprocessors can therefore also be monitored for coincidence, so that a divergent mode of operation of these components is detected and the still intact processor system switches the fill level output to the safe state.

The above-mentioned solution with redundant microprocessor systems 17 , 18 and comparators leads to a functionally reliable, fail-safe system of a self-monitoring overfill protection.

Claims (8)

1. Arrangement for function monitoring and measured value evaluation of level sensors, in particular vibration level limit switches, in which the level is detected by a sensor that is connected via a line to a remotely located evaluation device that the sensor at regular intervals a test command to initiate a test cycle for checking the correct functioning of the sensor, characterized in that the evaluation device ( 1 ) has two microprocessors ( 17 , 18 ) working in parallel with identical hardware and software, that the evaluation device ( 1 ) has four safety relays ( 30 , 34 , 43 , 44 ) which are constructed identically and two of which are each controlled by one of the microprocessors ( 17 , 18 ), and that the four safety relays ( 30 , 34 , 43 , 44 ) in two pairs of two safety relays are subdivided and the two pairs in this way in each self-test be switched over so that the connection state of the external relay connections before the start of the self-test is retained even during the self-test. 2. Arrangement according to claim 1, characterized in that the two safety relays ( 30 , 34 , 43 , 44 ) of each pair are each connected in series with respect to the external relay connections and are parallel to the other pair. 3. Arrangement according to claim 1 or 2, characterized in that the microprocessors ( 17 , 18 ) with all four control contacts of the four safety relays ( 30 , 34 , 43 , 44 ) are connected. 4. Arrangement according to one of claims 1, 2 or 3, characterized in that the two microprocessors ( 17 , 18 ) by means of watch-dog circuits ( 19 , 21 ) monitor each other. 5. Arrangement according to one of the preceding claims, characterized in that the two microprocessors ( 17 , 18 ) carry out self-tests at predetermined time intervals. 6. Arrangement according to one of the preceding claims, characterized in that the supply voltages of the two microprocessors ( 17 , 18 ) are decoupled from one another. 7. Arrangement according to one of the preceding claims, characterized in that each microprocessor ( 17 , 18 ) is coupled to its own input interface, the inputs of which are connected in parallel. 8. Arrangement according to one of the preceding claims, characterized in that the two microprocessors ( 17 , 18 ) are connected to one another by communication lines via which each microprocessor checks whether the two microprocessors ( 17 , 18 ) read similar data.