EP1454747B1 - Device for monitoring safety-relevant processes in machines - Google Patents

Description

In the field of mechanical engineering, especially in printing press construction, it is necessary for the professional associations that safety-relevant operations on the machines must run error-proof. That is, a controller or part of it is failsafe if a single fault in the controller results in no danger. Circuitically, this means that certain functions must be duplicated, that is redundant.

In the control of the company. Heidelberger Druckmaschinen AG (CP-Tronic) this is done by the fact that in the control a central security module is provided, in which states of security-relevant processes are read in parallel to the control modules. In this case, a switch, each with a normally closed and a normally open contact is read or monitored in two separate systems to actuate a safety-relevant operation. That is, one line leads to the control module and a second redundant line leads to a central security module. The safety-relevant process is only triggered if simultaneous triggering of both contacts is detected both in the control module and in the safety module.

The main drive of the machine is also monitored by two redundant systems and in the event of a mismatch of safety-related conditions is a shutdown of the drive. Redudant structure includes two computers, one of which takes over the control of the main drive and the other the actual machine control. In case of failure of the actual main drive computer takes over the computer for the machine control, the control function of the drive computer and controls the main drive controlled to a standstill. In addition, a safety module various protective contacts, emergency stop ect. read in, on the one hand via an input card indirectly to the drive computer and redundantly to direct input to the drive computer as well as the drive computer supplied. Farther the actual values of the main drive element are read in via two separate incremental encoders, one of which is mounted directly on the motor and the other on a rotating part of the printing press, for example on the plate cylinder. The signals of the first incremental encoder on the motor are supplied to the drive computer via separate signal lines and the signals of the incremental encoder on the plate cylinder also via separate signal lines both the drive computer, as well as the computer for the machine control.

A disadvantage of this technology is that of all safety-relevant devices each have a line to the actual control modules and an additional line to the central security module must be performed to keep reading the state redundant. This solution is on the one hand consuming and expensive and on the other hand offers only limited expansion options. The expansion options are also associated with high overhead lines and an extension is only as far as possible, as the central security module provides free inputs for reading the security-relevant state.

From the prior art is still the DE 195 29 430 A1 known, which proposes so-called security modules for monitoring electric drive systems, in particular on printing machines with multiple drives. These security modules consist of the fact that they are predominantly realized as software and have a total of three components. These three components are fault detection and diagnostics, fault type and size decision making, and response and action initiation. These safety modules have access to signals in the area of the functional parts, such as rotating cylinders of the printing press, in the field of electric motors, power electronics, the signal processing unit and power supplies and are designed for their comparison or evaluation for plausibility.

A disadvantage of the prior art according to the DE 195 29 430 A1 is that in addition to the monitoring of the drives no further monitoring for other security-related operations are taken into account. This means that no safety-relevant inputs can be read in and no redundant safety outputs can be set.

Based on this prior art, the object of the invention is to provide a more cost-effective solution with which an extension of safety-related functions is possible without additional cable expense. Furthermore, the object of the invention is that at the same time the prescribed by the BG conditions are met in the simplification.

The object is achieved by the features of the device or method claims 1 and 5 respectively. Advantageous embodiments will be apparent from the respective dependent claims.

The advantage of the invention is that the read-in of the states relevant for safety does not take place centrally at a location reachable by means of a line, but rather decentrally directly at the point at which the state is generated or changed. That is, a bus system installed for the transmission of these status signals is routed along the press and connects a plurality of field mounted security I / O devices to one or more security monitoring controls responsible for a security critical area. The connection to the bus system is made by the shortest route from the place to which the safety-relevant state is read. A simple extension to the additional monitoring of other safety-related conditions is possible in that each designed as a modular design safety monitoring controls and safety read device can be connected anywhere to the bus system.

The safety input / output devices are installed, for example, on site where emergency stop buttons or so-called limit switches of a protective device are located. Furthermore, the safety reading device also interrogates analog signals, for example the temperature of a dryer, which can cause a shutdown when a maximum value is exceeded. The safety input / output device reads in the status states of the emergency stop buttons, limit switches or temperature sensors and transmits these via a bus system to a safety monitoring controller. The safety monitoring control is mounted, for example, on-site to a drive element that performs a continuous or discontinuous safety-critical movement. The movement is safety-critical because an operator can get into the danger zone. Between the drive element and safety monitoring control, a safety input / output device is also connected, which reads in the safety-relevant signals of the drive element and notifies the safety monitoring control. The safety input / output device and the safety monitoring control can in this case be integrated into one unit.

The safety input / output device sets its read-in state to the bus system, as a result of which all safety monitoring controls located on the bus system have access to the reported message. This process is called a broadcast. Whether a security monitoring controller is interested in the reported message is decided by itself. That is, the message is ignored if the reported security critical state is not relevant to the drive monitored by the security monitor controller. However, appropriate measures are taken if the reported safety-critical is relevant for the drive monitored by the safety monitoring controller. Thus, depending on their responsibility, each safety monitoring control only takes over the essential. By targeted evaluation, or use of only the important News will relieve the security system of ballast, because only the necessary messages are processed.

The o.g. Emergency stop switches and limit switches are equipped with double contacts for redundancy, one of which is read in by the safety input / output device and the other via a separate operational input / output device. But it is also possible to read in both contacts with the same safety input / output device, but via separate inputs. The operationally provided input / output device reports its message to the actual operation control, which executes the corresponding functions. In the event that the safety input / output device reads in both contacts, the operatively provided process is also carried out by the operation control. The security concept is not abandoned by this, it is only made the reading through the same hardware means. The safety monitoring control which has access to the message of the safety input / output direction determines therefrom the permitted operating states and only becomes active when a faulty state is present. A faulty state is present, for example, when a drive is outside the command specification of the operation control. The redundancy lies in the double design of the contacts of the respective switches and buttons and the double execution of the input / output devices ("normal" input / output device and safety input / output device). On the drive itself, in addition to the encoder on the motor, either an additional encoder attached or the encoder on the motor is considered safe, which is then provided with a redundant evaluation. The duplicate signals in each case are supplied to the drive control and the safety monitoring control.

In addition to the above-mentioned so-called hardware redundancy, there is still a redundancy in the monitoring of the function. That is, the security control controller is the operation controller as the supervisory body allocated. If the operation control fails, or if there is a malfunction, all safety-relevant functions are guided by the safety monitoring control in a safe state. This is possible because both the operation control and the safety monitoring control have the same information about the safety-relevant operating states. The term "same information" applies as long as the redundant monitoring of the safety-relevant operating states provides identical results. If this is not the case, the safety monitoring control comes into force. Whether there is a match of the information in the operation control and the security monitoring control is checked by means of a consistency check. This check can take place in the operation control or in the safety monitoring control. If the various controllers are connected to separate bus systems connected by means of bus couplers, the health check can also be carried out in the bus coupler. The consistency check has the advantage that a restart of the machine after a faulty state is only possible if the error is corrected.

• Der Normalbetrieb wird immer durch die eigentlichen Betriebssteuerung vollzogen. Der Normalbetrieb liegt dann vor, wenn die Sicherheitsüberwachungssteuerung keinen fehlerhaften Zustand der Betriebssteuerung feststellt. Liegt ein fehlerhafter Zustand vor, greift die Sicherheitsüberwachungssteuerung ein und führt das Stell-/Antriebselement entsprechend der Vorgaben in den sicheren Zustand.

Which control (the actual operation control, or the redundant safety monitoring control) ultimately determines the action is determined as follows:

• Normal operation is always performed by the actual operation control. Normal operation occurs when the safety monitoring controller does not detect a faulty state of the operation control. If there is a faulty state, the safety monitoring control intervenes and leads the actuator / drive element according to the specifications in the safe state.

The bus system does not have to be redundant, it is necessary that a failure of the bus system is reliably detected. Since the safety monitoring control is assigned directly to the drive and in case of failure of the bus system in the Safety monitoring control stored routine leads the drive in the safe state.
The same applies to the safety input / output device. If this detects a failure of the bus system, measures are also carried out, which cause a safe state of the actuating elements to be controlled. These measures are also stored on the safety input / output device.

However, it is conceivable that a bus system is affected in the transmission speed when a large number of subscribers are connected, or if the distance covering a bus system is very long, that for example provided for the safety path and the operating path separate bus systems. In this case, a coupling of one bus system with the other is performed by means of a bus coupling. It is also conceivable that several bus systems are connected by such a bus coupling. That a bus system is not affected in terms of transmission speed, is avoided in the design. But also an impairment of the transmission speed of the bus system is detected and the machine is in the safe state.

In order to detect whether a bus system has failed, there is the possibility that the various participants send information in a defined time cycle. If information remains this is considered as a failure of the bus system and the safety monitoring controllers, for which the failure of the bus system is relevant activate the routines that lead to the safe state. This monitoring process is called Watch Dog. Based on the cyclical transmission and reception of information can be detected in case of failure of a local bus system which of the local bus systems has a defect. It is then also conceivable that the bus coupling puts information on the still intact bus systems, whereby the defect of the faulty bus system is reported. Whether a safety monitoring device responds to this message on a still intact bus system or not is incumbent on the Safety monitoring device itself, as it detects whether the situation is a safety-critical condition or not.

A further variant of the invention provides for different monitoring criteria to be defined for different operating states of the machine. If a machine is operated with the grille open in a creep mode deviating from the actual operating situation, other safety requirements are set for this, which are defined by the operator by means of appropriate inputs. For example, pressing a separate switch or button can initiate this creep speed. Since this creep speed is safety-relevant and the opened protective grid is recognized by the safety input / output device, a corresponding message is available to the safety monitoring controller. The safety monitoring control can now, in contrast to the normal operating case, in which an open protective grid would lead to a standstill of the machine, even with the protective grille open a maximum speed of the drive element. That is, grant a release for operation of the drive. Different monitoring criteria may continue to refer to angular position monitoring, acceleration, torque or otherwise. Thus, different safety regulations can be assigned to the different operating modes.

• Das Stell-/ Antriebselement verfügt über eine direkt ihm zugeordnete Regelung, Stromrichter und Leistungsteil. Diese Regelung empfängt seitens der Betriebssteuerung Befehle, welche beispielsweise heißen:
  • fahre mit einer konstanten Drehzahl 3000 Druck/h,
  • bringe das Antriebselement bei der Winkelstellung 270 Grad zum Stillstand,
  • usw.

With regard to the spatial arrangement of the security monitoring control, the following variant is possible:

• The actuator / actuator has a control, converter and power section directly assigned to it. This control receives on the part of the operation control commands, which are called, for example:
  • drive at a constant speed 3000 pressure / h,
  • bring the drive element to a standstill at an angle of 270 degrees,
  • etc.

That is, the task of operation control is to manage and issue commands. The now monitoring the operation control and the drives safety monitoring control is therefore also associated with the actuator / drive element, because in the case of an error, a down to the safe state can be performed directly on the actuator / drive element, even without commands over the bus system must be sent , In this case, the safety monitoring controller uses redundant signals to set the actuator / drive element in the safe state. The spatial assignment of the safety input / output device is provided similarly. This is also attached directly on site where a reading or an output is made.

Since this safety input / output device has a universal structure with several possibly freely definable inputs / outputs, this device can also be used to manage non-safety-relevant inputs or outputs. Thus, the safety input / output device has a dual function. Not least because of the o.g: dual function, the system can be described as an effort-saving redundancy.

The freely configurable inputs / outputs of the safety input / output device offer the advantage that they can be manufactured as modules in large quantities and are therefore inexpensive.

An additional advantage of standardization is the fact that the service technician on site only has to pay attention to a small number of variants, as a result of which rapid replacement can be carried out and the availability of the machine is quickly restored. It is also conceivable to remove a safety input / output device on a component that is less used or not used for different operating modes and to replace it with a defective one. The configuration of the module could be done by a software input made by the machine's operating computer. To the To meet regulations of the trade association, this process a final safety inspection would be required, for example, can be such that when improper configuration of the safety input / output devices starting the machine is prevented.

In a further variant it is provided that a machine consists not only of a component, but as usual in the printing industry from a printing machine which undertakes the imaging of paper and a downstream of this machine further processing machine, for example from a folder. Taken individually, both components can form separate control units, but these are to be regarded as uniform in the safety concept. For this case, it is provided to connect the respective separate bus systems to one another by means of a bus coupler so that the safety-related messages from the safety input / output devices are accessible to all safety monitoring controllers coupled to the two bus systems. The procedure regarding the handling of the message is identical to the type described above. Of course, a coupling of multiple bus systems is conceivable.

• Fig. 1 ein Blockschaltbild des Sicherheitskonzepts,
• Fig. 2 ein Blockschaltbild des Sicherheitskonzepts mit getrennten Bussystemen.

The invention will be explained later with reference to an embodiment.
It shows:

• Fig. 1 a block diagram of the security concept,
• Fig. 2 a block diagram of the security concept with separate bus systems.

Fig. 1 shows an operating control 1 for a number of driving and actuating operations on a machine, not shown, preferably printing press. This operation control 1 is connected by means of bus system 2 with a number of input / output devices 3, with safety input / output devices 4, with a drive control 5 and a safety monitoring control 6. The task of the operation control 1 consists of the coordination of the various drives 7, which relates to the main drive of the machine, auxiliary drives for various tasks such as lifting and lowering the paper stack, driving the ink fountain roller or the like and also actuators, for example, for adjusting registers. In addition, the interaction of control elements 8, the reading of switches 9, 10 or the displays 11 are coordinated by the operation control 1. The input / output devices 3 and the drive controller 5 serve as input / output devices. The safety-related adjustment processes are assigned a safety input / output device 4, which controls or reads these processes in a redundant manner.

The drive 7, which, as already mentioned, can be a main drive, an auxiliary drive or also an actuator, which in turn can be embodied by motors of various technologies (DC motor, three-phase motor, brushless motor, etc.), is started by the drive control 5 by means of the power section 12 set. The connection between drive control 5 and power unit 12 is bidirectional. On the power unit 12 and the safety input / output device 4 has bidirectional access. On the drive 7 are each an encoder 13, 14 which consists of a transmitter and an evaluation circuit, whereby the position, possibly also the speed of the drive 7 is detected. This information is supplied by both encoders 13,14 on the one hand the drive control 5 and on the other hand, the safety input / output device 4. Furthermore, each of the drive control 5 and the safety input / output device is a possible drive to a brake 15, which is in mechanical Wikverbindung to the drive 7 and can shut down in an emergency. If a faulty behavior of the drive control 5 occurs, as a result of which the drive 7 is operated outside the predetermined speed, the safety monitoring device 6 directly accesses the power unit 12, interrupts the power supply for the drive 7 and causes the brake 15 to occur. The drive 7 is thus guided in the safe state.

The adjusting element 8, which may be, for example, a pneumatic cylinder for turning on and off of ink rollers, is activated by an input / output control 3. Redundant to the access is also provided via a security input / output device. If there is a faulty behavior, the safety input / output device brings the actuator 8 in the safe state.

The switches 9, 10 are safety relevant because they are e.g. trigger an emergency stop, or represent the opened state of a protective grid. Both status requests are referred to as security-relevant inputs, which is why redundant switch contacts 9a, 9b and 10a, 10b are required. These are read in a separate way through the input / output device 3 and the safety input / output device 4. The safety input / output device 4 can be present for all applications, a common device or separately for each application. This depends on the number of available inputs / outputs or on the spatial allocation. In faultless operation of the switch 9,10 have the switch contacts 9a, 9b and 10a, 10b respectively the same states. If a switch contact 9a, 9b or 10a, 10b is faulty or if the cable connection between switch contact 9a, 9b or 10a, 10b is faulty, different states are detected in the input / output device 3 and the safety input / output device 4. The safety monitoring device 6 then brings the drive 7 and the actuator 8 in the safe state.

The operating control 1 can also be used to access inputs or outputs which are operated by the safety input / output device 4. These inputs or outputs are then defined as ordinary inputs or outputs, ie they are not considered to be safety-relevant. The advantage is that free, unused inputs or outputs can be used on the safety input / output device. These can be used for display 16 or similar functions, for example.

Fig. 2 shows essentially the same arrangement of safety devices as Fig. 1 however, with separate bus systems. In this case, the bus system 2 is used for the connection of the safety input / output device 4 and the safety monitoring device 6, while an additional bus system 17 takes over the connection of the actual operating devices input / output device 3 and drive control 5. This constellation is advantageous if a high number of bus subscribers (3, 4, 5, 6) are connected to the bus system or if the line length of the bus system exceeds a certain length. In Fig. 2 the bus systems 2, 17 are coupled by a bus coupler 18. It can be seen that further bus systems 19 can be connected by the bus coupler 18. The operation control 1 is connected to the bus coupler 18 by a further bus system 20, which may be, for example, a VME bus system.

LIST OF REFERENCE NUMBERS

1

operational control

2

bus system

3

Input / output device (bus participant)

4

Safety input / output device (bus participant)

5

Drive control (bus participant)

6

Safety monitoring device (bus participant)

7

drive

8th

actuator

9

switch

9a, 9b

switch contact

10

switch

10a, 10b

switch contact

11

display

12

power unit

13

encoder

14

encoder

15

brake

16

display

17

bus system

18

Bus Coupler

19

bus system

20

bus system

Claims (8)

1. Device for monitoring safety-relevant processes at actuating/drive elements on a machine, in particular a printing press, comprising an operation control for a number of driving and actuating processes and at least one safety monitoring control connected to a number of safety input/output devices, and an input/output system of redundant design for safety-relevant processes,
   characterized in
   that the signals of the actuating/drive elements are importable by the safety input/output device (4), that a bus system (2) for transmitting the signals to the safety monitoring control (6) is provided,
   that when a defect condition is detected, the actuating/drive elements are transferrable to a safe state by the safety monitoring control (6) via the safety input/output device (4), and
   that the safety input/output device (4) and/or the safety monitoring control (6) is arranged in a decentralized way on the actuating/drive element (7, 8, 9, 10) that carries out the safety-relevant process and/or that is inputtable.
2. Device according to Claim 1,
   characterized in
   that the bus system (2) is designed as a VMEbus system.
3. Device according to Claim 1,
   characterized in
   that the bus system (2) connects multiple safety input/output devices (4) to one or more safety monitoring controls (6) responsible for a safety-critical region.
4. Device according to Claim 1,
   characterized in
   that the safety monitoring control (6) is of modular construction.
5. Method for monitoring safety-relevant processes on actuating/drive elements on a machine, preferably a printing press, and an input/output system of redundant design for safety-relevant processes,
   characterized in
   that signals of the safety-relevant processes are imported in a decentralized way by a safety input/output device (4) and are fed to a safety monitoring control (6) by means of a bus system (2),
   that when a safety-relevant condition is detected, suitable measures are supplied to the safety input/output device (4) by means of the bus system (2) and are applied there and that the safety input/output device (4) and/or the safety monitoring control (6) is arranged in a decentralized way on the actuating/drive element (7, 8, 9, 10) device that carries out the safety-relevant process and/or that is inputtable.
6. Method according to Claim 5,
   characterized in
   that the safety input/output device (4) places its imported condition on the bus system (2) in accordance with a broadcast method.
7. Method according to Claim 5,
   characterized in
   that to test the bus system (2), the different bus devices (3, 4, 5, 6) send information in accordance with a defined timing cycle.
8. Method according to Claim 7,
   characterized in
   that when the bus system fails (2), a routine stored in the safety input/output device (4) transfers the actuating/drive element to the safe state.

Images