EP1738383B1 - Signaling device for a protective circuit - Google Patents

Abstract

A signaling device for a safety circuit has an input part for receiving an external state variable, at least one switching element and a control part. The control part controls the at least one switching element as a function of the external state variable, such that a signal applied to the input is communicated to the output. According to one aspect of the invention, the input of the switching element is internally connected to a fixed potential, preferably a fixed High potential. In a safety circuit for turning off a hazardous installation, such signaling devices are connected in series with one another to a safety controller. In such an arrangement, the control part of the downstream second signaling device also controls its switching elements as a function of the output of the first signaling device.

Description

The present invention relates to a signaling device (other name: sensor, signal generator) for a safety circuit, having an input part for receiving an external state variable, with at least one switching element having an input and an output, and having a control part, which is designed as a function of from the external state variable to control the at least one switching element so that one at the input applied signal is switched through to the output, so at the output appears.

The invention further relates to a safety circuit for safe shutdown of a dangerous plant, with a safety controller, which is designed to switch off the system fail-safe, and with a first and at least a second signaling device of the aforementioned type, which are connected in series to each other to the safety controller ,

Such a signaling device and such a safety circuit are off EP 1 363 306 A2 known.

The operations of modern technical equipment, such as industrial production lines and production lines, transport and conveyor systems, rides and the like, are increasingly being controlled fully automatically. An operating control receives setpoint and process variables of the system and uses them to form control signals which actuate actuators of the system with the aid of a predetermined control program. In addition to controlling the intended operation, safety aspects, ie the avoidance of risks for persons who are in the area of the plant, gaining increasing attention. For example, systems that perform automated movements are nowadays usually shielded by protective fences, photocells, treadmills and the like. Furthermore, it is known to equip technical systems with emergency stop buttons, when the operation of the system (or at least a part thereof) is switched off or otherwise brought into a safe state. Such safety-relevant signaling devices, which thus produce only for the protection of the system relevant state signals and provide, are usually not evaluated with the "normal" operation control of the system, but a so-called safety control or in simpler cases supplied to a so-called safety switching device. For the sake of simplicity, a distinction is not made in the following between complex safety control and simpler safety switching device, ie the term "safety control" includes both simpler safety switching devices, as offered for example by the present applicant under the name PNOZ ^® , as well as complex safety controls, such as PLC-based PSS® of the applicant.

However, safety controllers differ from "normal" control systems in that they are inherently fail-safe through measures such as redundant signal processing channels, regular self-tests and the like. Although simple operation controls have some degree of error detection and error avoidance measures, but these are usually not sufficient to ensure the safe shutdown of the system under all circumstances. In order to distinguish between "simple" controls and "simple" signaling devices, the present invention relates to signaling devices, safety controllers and safety circuits constructed therefrom which meet at least category 3 of the European standard EN 954-1, preferably the highest category 4, or comparable safety requirements.

The aforementioned EP 1 363 306 A2 describes a so-called safety switch, ie a signaling device for position monitoring of protective grids, protective doors, machine trim parts and similar protective devices. Such safety switches have an actuator by means of which the opening or closing position of the safety door can be determined to be fail-safe. To date, such safety switches are usually constructed electromechanically in practice and the necessary function tests and error monitoring, such as cross-circuit detection, are performed by or at least with the help of the parent safety controller. Corresponding safety switches are therefore usually only approved in combination with the safety control in accordance with EN 954-1 or comparable standards.

In order to allow a higher safety category for the safety switch itself, the EP 1 363 306 A2 to integrate a safety logic in the safety switch, as is already known from photoelectric sensors, light grids and other "smart" signaling devices. In the described embodiments, the proposed safety switches have two mutually redundant electronic switching elements, which are controlled by a fail-safe control part. About the switching elements an external enable signal is looped, which is ultimately supplied to the higher-level safety controller. The enable signal can thus be suppressed by the control part, which signals the safety controller that the monitored system should be brought to a safe state. The enable signal can also be looped through a plurality of series connected in series safety switch, so that each of these safety switch can suppress the enable signal.

Such a series connection of signaling devices has already been implemented in practice with electro-mechanical signaling devices, the release signal was generated in these cases by the safety controller and was looped back via the series-connected relay contacts of the individual signaling devices.

The in EP 1 363 306 A2 described structure of the safety switch allows a quick response of the parent safety controller, even if a larger number of signaling devices are connected in series with each other to the safety controller. On the other hand, looping through the enable signal limits the maximum spatial distribution of the signaling devices connected in series. Moreover, from the point of view of the higher-level safety controller, the entire row is "dead" when one of the signaling devices suppresses the release signal, either due to a change in the actuator (opening the protective door or the like) or due to an internally detected malfunction. The flexibility and performance of the described safety switch does not go beyond what has been possible for a long time with comparable relay-based signaling devices.

DE 600 01 235 T2 discloses a signaling device and a safety circuit with a series circuit of signaling devices, wherein the signaling device is a proximity switch for monitoring a protective door. The proximity switch has a signal input to which a digital or pulsed input signal can be supplied. It modulates a high frequency carrier wave with the input signal supplied in the manner of an amplitude shift keying. The modulated carrier wave serves to excite an actuator that generates a second amplitude modulated high frequency carrier wave at a different frequency. The proximity switch may receive the second amplitude modulated carrier wave when the actuator is near the proximity switch. In this way he can monitor the presence of the actuator. When the proximity switch receives the second carrier wave, the rectifier circuit reconstructs the digital or pulsed modulation signal and provides it via an inverter at an output of the proximity switch. The output signal of the proximity switch thus corresponds to the inverted input signal, if the actuator is located near the proximity switch.

Against this background, it is an object of the present invention to provide a signaling device of the type mentioned, which allows a more flexible use, in particular in a series arrangement.

It is a further object of the invention to provide a safety circuit with a series arrangement of such signaling devices, which allows a more flexible response to a reporting event.

According to one aspect of the invention, these objects are achieved by a signaling device of the type mentioned, wherein the new signaling device has at least one input, preferably a redundant safety input, for an external enable signal, which is supplied to the control part, and wherein the control part, the at least one switching element also in response to the enable signal drives.

The object is further achieved by a corresponding safety circuit, wherein the output of the at least one switching element in the first signaling device is supplied to the control part of the second annunciator, and in which the control part of the second annunciator, the at least one switching element of the second annunciator also in dependence on the first signaling device controls. In a preferred safety circuit, the enable signal is supplied to the first reporting device from the safety controller.

From a circuit engineering point of view, the new signaling device thus differs from it EP 1 363 306 A2 known safety switch in that a release signal is no longer looped through the at least one switching element. Rather, the enable signal is now recreated in each reporting device. However, the control part of a downstream, second signaling device of a series connection, however, takes into account the output signal of the upstream of him reporting device. It is thus easily possible to model the looping through of a release signal by a plurality of signaling devices in such a way that, from the point of view of the higher-level safety control, no difference can be recognized. On the other hand, however, the individual signaling devices in a series arrangement are not "dead" when an upstream signaling device has suppressed the release signal. On the basis of the invention, it is possible, in particular, for a downstream signaling device to send a message to other subsequent signaling devices and / or the higher-level security controller by means of a data telegram or the like, which enables a flexible reaction of the entire security circuit. In this case, the data message, as in the following with reference to a preferred embodiment is shown, are transmitted via the existing connections, ie the wiring complexity is low despite increased flexibility.

Irrespective of this, each signaling device assumes a repeater function due to the new interconnection, and therefore significantly greater distances between the signaling devices arranged in series with one another can be realized. This also allows for more flexible plant planning. Even a group shutdown can be easily realized due to the new functionality of the signaling devices, since each signaling device of the array can generate independent of the upstream signaling devices at its output a message signal.

The stated task is therefore completely solved.

In one embodiment, the signal switched through to the output of the at least one switching element is supplied to the control part of the signaling device.

In other words, the output signal of the switching element (and thus at least indirectly also the output signal of the signaling device) is fed back to the control part. The control unit is thus able to detect device-internal malfunctions. This embodiment is also made by itself EP 1 363 306 A2 and has long been known by photoelectric sensors and other "smart" signaling devices and safety switching devices. However, the advantages of this embodiment are only due to the present invention to full advantage, since Each signaling device of a series arrangement can pass on an internal functional error independently of the state of upstream signaling devices.

In a further embodiment, the control part of the signaling device is adapted to detect a device-internal malfunction and to generate a data telegram at the output thereof with the aid of the at least one switching element.

The particular advantage is that the new signaling device can transmit diagnostic data via the existing connections to the higher-level safety controller, i. There is no need to provide additional ports and lines for transmitting diagnostic data. Accordingly, the wiring is simplified and both the signaling device and the safety control can save installation space and costs for additional connections.

In preferred embodiments, the data telegram is a pulse telegram, i. the control part switches the at least one switching element on and off in pulses.

In this way, messages with an information content of several bits on the existing signal lines can be transmitted very inexpensively and variably. This enables the efficient transfer of very detailed diagnostic information. In this embodiment, an address assigned to the signaling device can also be transmitted to the higher-order control with little effort so that the security control can individually identify each signaling device of a series connection.

In a further embodiment, each signaling device has at least two redundant switching elements, each having an input and an output, wherein each of the at least two redundant switching elements on the input side is assigned to the fixed potential.

This configuration, already known from safety controllers, has in combination with the present invention Invention the advantage that the annunciator can report an internal malfunction on the existing signal lines to the parent safety controller, even if one of the switching elements is the cause of the malfunction. The provided in the known safety switching devices for security redundancy leads here so also to a higher availability.

In a further embodiment, the signaling device has an input for supplying an operating voltage, wherein the operating voltage is supplied to the at least one switching element as a fixed potential.

This embodiment is particularly advantageous in view of the above-described repeater function of the new signaling device. By the input side, the at least one switching element is connected to the operating voltage, large distances between multiple signaling devices can be easily bridged.

In a further embodiment, the signaling device includes a movable actuator, which is movable between a first and at least a second spatial position, wherein the external state variable is a current spatial position. In a particularly preferred embodiment, the actuator is a transponder.

In this embodiment, the new signaling device is in particular a safety door switch, an emergency stop button, an end or position switch, a sensor for a treadmill or a manually operated start or command button. The actuator can be integrated into the signaling device or disconnected from the signaling device be executed, as is common, for example, in safety door switches. The connection of the actuator to the signaling device can be made optically, inductively, capacitively or in any other way. This refinement is preferred because the aforementioned signaling devices are relatively simple components which have so far had virtually no own signal processing. The extended range of functions is therefore particularly strong in these reporting devices. The use of the present invention in such "simple" signaling devices can also make the use of a higher-level safety controller for smaller applications superfluous by the reporting device activates an actuator without intermediate safety controller via its outputs.

Therefore, it is preferred in a further embodiment, when the new signaling device has a read back input for supplying an external readback signal from an actuator.

The signaling device of this embodiment thus combines the previously separate functions "capture state variable" (sensor) and "shutdown system" (signal processing). Small safety applications can be realized very cost-effectively.

In a further refinement, the input part is designed to record a physical measured variable, in particular a rotational speed, a voltage and / or a current, as an external state variable.

Sensors for picking up such state variables are usually installed in a control cabinet, while emergency stop buttons, limit or position switches, safety door switches and similar signaling devices are usually installed on the system. However, the aforementioned advantages can be transferred in the same way to such measuring sensors as reporting devices. For example, several speed monitors can be connected in series in the manner described here, so that several moving axes of a system can be monitored very cost-effective safety.

It is understood that the features mentioned above and those yet to be explained below can be used not only in the particular combination given, but also in other combinations or in isolation, without departing from the scope of the present invention.

Fig. 1

eine vereinfachte Darstellung einer Anlage, bei der ein Meldegerät gemäß der vorliegenden Erfindung zur Absicherung eingesetzt wird,

Fig. 2

eine schematische Darstellung eines Ausführungsbeispiels des neuen Meldegerätes,

Fig. 3

eine Sicherheitsschaltung mit zwei Meldegeräten der in Fig. 2 gezeigten Art in einer Reihenanordnung,

Fig. 4

eine Zeitdiagramm mit Signalverläufen beim Initialisieren einer Sicherheitsschaltung gemäß Fig. 3, und

Fig. 5

ein weiteres Ausführungsbeispiel eines neuen Meldegerätes.

Embodiments of the invention are illustrated in the drawings and are explained in more detail in the following description. Show it:

Fig. 1

a simplified representation of a system in which a signaling device according to the present invention is used for protection,

Fig. 2

a schematic representation of an embodiment of the new signaling device,

Fig. 3

a safety circuit with two signaling devices of in Fig. 2 shown type in a series arrangement,

Fig. 4

a timing diagram with waveforms when initializing a security circuit according to Fig. 3 , and

Fig. 5

another embodiment of a new signaling device.

In Fig. 1 is a system which is secured by means of the invention, designated in its entirety by the reference numeral 10.

The system 10 here includes a robot 12 whose automated movements would be dangerous to a person (not shown) who would be in the range of motion of the robot 12. Therefore, as is well known, the range of movement of the robot 12 is secured with a protective door 14 and protective fences. At the protective door 14, an actuator 16 is attached. On a fixed frame, on which the protective door 14 rests in the closed state, there is a safety switch 18, more generally so the fixed part of a signaling device according to the present invention. The safety switch 18 is connected via a plurality of lines to a safety controller 20. On the output side, the safety controller 20 controls two contactors 22, 24 whose contacts can interrupt the power supply 26 to the robot 12.

The system 10 is shown simplified here. As is known to those skilled in the art, in practice, the protective door 14 is usually equipped with at least two safety switches 18 and corresponding actuators 16, one of the safety switches often being concealed to make manipulation more difficult. In addition, such contains Plant frequently more signaling devices, such as emergency stop button or other safety door switch (not shown here). In addition, the required operation control for the robot 12 is not shown here for the sake of simplicity. To allow limited operation with the guard open, one or more speed monitors (not shown) may be connected to the drives and / or moving axes of the robot.

The safety controller 20 can be a safety relay in a simple scenario, as offered by the applicant under the name PNOZ ^®. However, if numerous safety-related signaling devices are needed to protect the system 10, it is advantageous to use a more complex safety controller, such as those sold under the name PSS ^® by the applicant safety controls. At least in the latter case, the safety controller 20 usually has a field bus connection and further interfaces for communication with the operating control, not shown here, and / or for communication with a higher-level control computer.

In the preferred embodiment according to Fig. 2 the safety switch 18 has a dual-channel redundant design. Accordingly, the safety switch 18 here has two redundant microcontrollers 30, 32, which monitor each other, which is represented by a double arrow between the microcontrollers. In preferred embodiments, the microcontroller are different, ie the safety switch 18 is constructed diversified.

The reference numerals 34, 36, two electronic switching elements are referred to, which are shown here as field effect transistors. Alternatively, however, bipolar transistors or other, preferably electronic switching elements can be used.

The control terminal (gate) of the switching element 34 is connected to the microcontroller 30. The input 38 (source) is connected to a line 40 to which an operating voltage U _B is applied during operation of the safety switch 18. The output 42 (drain) is connected to a terminal 44 at which the safety switch 18 can be externally wired. Thus, the output 42 of the switching element 34 forms an output signal of the safety switch 18th

The second switching element 36 is connected to the microcontroller 32 at its control terminal (gate). Its input 38 is also connected to the operating voltage U _B via the line 40. Its output 42 is fed to a second output connection 46 of the safety switch 18.

The signals at the outputs 42 of the switching elements 34, 36 are fed back via two voltage dividers 48, 50 to the microcontroller 30, 32. This makes it possible for the microcontrollers 30, 32 to monitor the respective switching state of the switching elements 34, 36.

The reference numeral 52 denotes an input part, by means of which the microcontroller 30, 32 determine the current state of the actuator 16, in this case its spatial position. In the preferred embodiment shown here, the Actuator 16 a transponder with a signal generating circuit 54 and a transmitting and receiving coil 56. In the signal generating circuit 54, an individual coding 58 is stored. The input part 52 has a transmitting and receiving coil (shown here only symbolically), via which it emits an interrogation signal. Once the transponder 16 is in the vicinity of the input part 52 (protective door closed), the signal generating circuit 54 is activated in the actuator 16. The actuator 16 then sends the stored encoding 58 back to the input part 52. There, the encoding 58 is demodulated from the received signal and provided to the microcontrollers 30, 32.

If the protective door 14 is opened, however, the actuator 16 is outside the transmission and reception range of the input part 52, which is in Fig. 2 is shown at the position 16 '. In this case, no communication takes place between the actuator 16 and the input part 52. The microcontrollers 30, 32 consequently receive no coding, which is interpreted as an opened protective door 14. If a second safety door switch or at least a second actuator (not shown) is present, a defect of the actuator 16 or the input part 52 can also be detected.

In other embodiments, the input part 52 may be configured for other types of actuators. In this case, the actuator may also be integrated in the safety switch 18. For example, the safety switch 18 could be an emergency stop button and the actuator in this case would be the plunger of the button. In further embodiments, the input portion 52 includes inductive, capacitive, optical or otherwise Sensors for determining a current position of a mechanically movable actuator. In addition, the invention can in principle also be applied to light barriers and other signaling devices that distinguish between at least two states. In further exemplary embodiments, the input part is designed to measure a physical state variable, as described below Fig. 5 is explained in more detail.

On the input side, the safety switch 18 here has three terminals 60, 62, 64 which are each designed as safety inputs and are connected redundantly to the two microcontrollers 30, 32. Via the terminals 60 to 64, the microcontroller 30, 32 external release signals are supplied redundantly. In addition, a connection 66 for supplying an operating voltage U _B and a ground connection 68 is provided in a manner known per se. It is understood that the said connections are each accessible on the outside of a housing 70 of the safety switch 18.

In Fig. 3 a safety circuit with two of the described safety switches 18 is designated in its entirety by the reference numeral 80. Incidentally, the same reference numerals designate the same elements as before. The two safety switches are designated for mutual discrimination with 18a and 18b.

The safety switch 18a is connected at its terminals 60, 62 to outputs of the safety controller 20. These are preferably so-called clock outputs of the safety controller 20, on which two clock signals different Frequency and / or phase abut, so that a cross-circuit detection in both the safety switch 18a and (by read back, not shown here) in the safety controller 20 is possible. In addition, the safety switch 18a is connected to the terminals 66, 68 with operating voltage U _B or ground. On the output side, the terminals 44, 46 of the safety switch 18a are routed to the terminals 60, 62 of the subsequent safety switch 18b. The two safety switches 18a, 18b are thus arranged in series with each other. Operating voltage receives the safety switch 18b in the arrangement shown also from the safety switch 18a. Alternatively, however, the safety switch 18b could also be connected to another source for the operating voltage U _B.

The two output signals of the safety switch 18b, that is, the signals applied to the terminals 44, 46, safety inputs of the safety controller 20 are supplied. On the output side, the safety controller 20 is connected between the power supply 26 and a drive 82 to be switched off, for example an actuator of the robot 12. In addition, it is shown schematically here that the safety controller 20 is connected via a field bus 84 with an operating controller 86 for the robot 12 and / or a higher-level master computer. The actuators belonging to the safety switches 18a, 18b are in for clarity Fig. 3 Not shown.

The operation of the security circuit 80 is as follows:

After startup, the safety controller 20 generates at its outputs two clock signals 88, 90 which are the safety switch 18a are supplied as enable signals. The microcontroller 30, 32 of the safety switch 18a monitor with the aid of the input part 52, the current state of the associated actuator. If the actuator is located in the region of the input part 52 and if the enable signals 88, 90 are received correctly, the microcontrollers 30, 32 generate two output signals with the aid of the switching elements 34, 36, which are reproduced on the enable signals 88, 90. However, they could also differ from the clock signals 88, 90, for example in terms of their frequency. The second safety switch 18b receives the simulated enable signals and, in turn, trains them at the output if it also detects a closed safety door and proper function. The safety controller 20 receives the simulated enable signals via the lines 92, 94.

Now, when the safety switch 18a detects the opening of its associated protective door, i. When the associated actuator changes state, the microcontrollers 30, 32 open the switching elements 34, 36. Consequently, the subsequent safety switch 18b no longer receives the replicated enable signals. This is detected by the microcontrollers in the safety switch 18b and reported by switching off the switching elements 34, 36 to the safety controller 20. This can then turn off the drive 82.

In the same way, the signal flow takes place when the safety switch 18a detects a malfunction, such as a cross-circuit at the input or output side terminals, a suppression of one of the switching elements 34, 36 or any other malfunction. After a short wait, which is stored in the microcontrollers of all safety switches 18a, 18b and the safety controller 20, the safety switch 18a generates a data telegram 96 on at least one of its output lines by pulsatingly closing and reopening at least one of the switching elements 34, 36. The subsequent safety switch 18b receives this data telegram and passes it on to the safety controller 20 in the same way. If required, it can also integrate further information into the data telegram 96.

In one embodiment, data telegram 96 is implemented as with an asynchronous serial interface, i. it starts with a defined start bit and ends with a defined stop bit. In between, there is an arbitrary or fixed number of data bits. In another embodiment, each data telegram 96 includes a fixed number of pulses having a defined pulse duration. The meaning of each individual pulse depends on the protocol established between the safety switches 18 and the safety controller 20.

In the same way, the safety switch 18b generates its own data telegram 96 when it in turn detects a malfunction. In contrast to the known arrangement, the safety switch 18b can generate its data telegrams independently of whether the safety switch 18a has opened or closed the switching elements 34, 36.

In a preferred embodiment, the data telegrams of the safety switches 18a, 18b include address information identifying the safety switch which want to report information to the parent safety controller 20. The respective address can be assigned to the safety switch 18a, 18b in various ways. For example, each safety switch 18a, 18b may be provided with a multi-level address selector switch (not shown) to which the associated address is set. In another embodiment, the safety switches 18a, 18b use as address in each case the coding 58 of the actuators 16 assigned to them.

In a further embodiment, the safety switches 18a, 18b connected in series are assigned an address in an initialization mode after the safety circuit 80 has been put into operation. A preferred method of doing this address assignment is by way of Fig. 4 shown.

Fig. 4 shows the signal diagrams for this initialization mode. The uppermost pulse train 100 is the switching on of the operating voltage U _B for all components of the safety circuit 80. At reference numeral 102, the signal at the first clock output of the safety controller 20, ie the signal on the line 88 is shown. At reference numeral 104, the signal at the second clock output of the safety controller 20, ie the signal on line 90 is shown. The first safety switch 18 thus receives after switching on the operating voltage U _B at its input 60, a continuous high and at its input 62 a single pulse. As soon as he recognizes this, he trains the signal (continuous high) applied to his terminal 60 at its output 44 (reference numeral 106). After a waiting time T, he then generates at his output 46 two pulses, as at Reference numeral 108 shown. The waiting time T is used to detect whether further pulses are received on the input side.

The second safety switching device 18b receives at its inputs 60, 62 the signals 106, 108 and forms them at its outputs 44, 46. In doing so, it adds a single pulse to the individual pulses 108 received at terminal 62. Consequently, at the outputs of the second safety switch 18b are the pulse sequences, which are shown at the reference numerals 110, 112. In the same way, further safety switching devices 18c, 18d etc. (in Fig. 3 not shown) simulate a continuous high on the one signal line (reference numeral 114) and on the second signal line a pulse train, and each safety switch would increase the pulse train by one pulse.

At the end of the chain, the safety controller 20 receives the signals according to the reference numerals 114, 116. From the signal 114, the safety controller 20 detects that the wiring of the channel A is correct. From the pulse train 116, the safety controller 20 detects that the wiring of the channel B is correct. In addition, it can determine the number of series-connected safety switches 18a, 18b, etc. from the number of pulses (minus 1). Similarly, each safety switch 18a, 18b can recognize its address from the number of received pulses. In this way, when the security circuit 80 is turned on, an individual address can be automatically assigned to each security switch arranged in series. If the security circuit 80 changed later, a new and correct address assignment to the then existing configuration automatically when switching on again.

The flexibility of the new signaling devices is here further increased by the previously not explained input port 64. This port can be used to feed an external feedback signal to the safety switch 18. Thus, it is possible, for example, that the safety switch 18 a contactor with positively driven contacts independently, i. without activating a hitherto usual safety switching device or a corresponding safety control. It is sufficient if the positively driven NC contact of the contactor is guided on the feedback input 64 of the safety switch 18.

In further exemplary embodiments, signaling devices, such as the safety switch 18 shown, have a further input connection for applying a start signal. Thus, it is possible without the usual safety control to realize a monitored restart of the system.

Furthermore, the respective function of the signaling devices 18 can be parameterized via the input terminal 64, as for example in DE 100 16 712 A1 is described. In addition, parameterization can be carried out from outside using different transponder codes.

Fig. 5 shows an embodiment of a new signaling device 100 as a speed monitor. The same reference numerals designate the same elements as before.

The signaling device 100 differs from the signaling device 18 Fig. 2 essentially with respect to the input part 102, which is formed here in contrast to the input part 52 for metrological detection of a rotational speed. The speed detection takes place in this embodiment encoderless by the input part 102 picks up the motor voltages of a rotary drive 104 and evaluates in terms of their frequency. In a particular embodiment, the signaling device 100 is designed as a standstill monitor, ie it monitors the achievement and compliance with a speed zero. This can be done by the input part 102 picks up the generator voltages generated by the expiring rotary drive 104 and monitors, as is known per se from standstill monitors for safety applications.

In further exemplary embodiments, the input part 102 measures a voltage, a current or another physical variable and the microcontrollers control the switching elements 34, 36 as a function of the detected variable, in particular in dependence on the detected variable maintaining a predetermined desired value.

Claims (12)

1. A signaling device for a safety circuit, comprising an input part (52) for receiving an external state variable, comprising at least one switching element (34, 36) having an input (38) and an output (42), and comprising a control part (30, 32) designed to control the at least one switching element (34, 36) as a function of the external state variable, such that a signal applied to the input (38) is communicated to the output (42), wherein the input (38) of the switching element (34, 36) is internally connected to a fixed potential, preferably a fixed High potential (U_B), characterized by at least one input, preferably a redundant safety input (60, 62), for an external enable signal (88, 90) which is supplied to the control part (30, 32), the control part (30, 32) also controlling the at least one switching element (34, 36) as a function of the enable signal (88, 90).
2. The signaling device of claim 1, characterized in that the signal communicated to the output (42) of the at least one switching element (34, 36) is supplied to the control part (30, 32).
3. The signaling device of claim 1 or 2, characterized in that the control part (30, 32) is designed to detect a device-internal fault condition and to use the at least one switching element (34, 36) to produce a data message (96) at its output (42).
4. The signaling device of claim 3, characterized in that the data message is a pulse message.
5. The signaling device of one of claims 1 to 4, characterized by at least two redundant switching elements (34, 36) each having a respective input (38) and a respective output (42), with each of the at least two redundant switching elements (34, 36) having the fixed potential applied to its input.
6. The signaling device of one of claims 1 to 5, characterized by an input (66) for supplying an operating voltage (U_B), the operating voltage being supplied to the at least one switching element (34, 36) as the fixed potential.
7. The signaling device of one of claims 1 to 6, characterized by a moveable control element (16) which can move between a first and at least one second spatial position (16'), particularly a transponder, the external state variable being a present spatial position of the control element (16).
8. The signaling device of one of claims 1 to 7, characterized in that the input part (52) is designed to pick up a physical measured variable, particularly a rotational speed, a variable voltage and/or a variable current, as external state variable.
9. The signaling device of one of claims 1 to 8, characterized by a feedback input (64) for supplying an external feedback signal from an actuator (22, 24).
10. A safety arrangement for safely turning off a hazardous installation (10), comprising a safety controller (20) designed to turn off the installation (10) in a failsafe fashion, and comprising a first and at least one second signaling device (18a, 18b) which are .connected in series with one another to the safety controller (20), with each signaling device (18a, 18b) comprising an input part (52) for receiving an external state variable, at least one switching element (34, 36) having an input (38) and an output (42), and a control part (30, 32) designed to control the at least one switching element (34, 36) as a function of the external state variable, such that a signal applied to the input (38) is communicated to the output (42), wherein the input (38) of the at least one switching element (34, 36) in each signaling device is internally connected to a fixed potential, preferably a High potential, characterized in that the output (42) of the at least one switching element (34, 36) in the first signaling device (18a) is supplied to the control part (30, 32) of the second signaling device (18b), and the control part (30, 32) of the second signaling device (18b) also actuates the at least one switching element (34, 36) of the second signaling device (18b) as a function of the first signaling device (18a).
11. The safety arrangement of claim 10, characterized in that the control part (30, 32) of the first signaling device (18a) is supplied with an enable signal (88, 90) from the safety controller (20), with the control part (30, 32) of the first signaling device (18a) also actuating the at least one switching element (34, 36) of the first signaling device (18a) as a function of the enable signal (88, 90).
12. The safety arrangement of claim 10 or 11, characterized in that the control part (30, 32) in each signaling device (18a, 18b) is designed to detect a device-internal fault condition and to use the at least one switching element (34, 36) to produce a data message (96) at its output (42).

Images