Classifications

• • H—ELECTRICITY
  • H01—ELECTRIC ELEMENTS
  • H01H—ELECTRIC SWITCHES; RELAYS; SELECTORS; EMERGENCY PROTECTIVE DEVICES
  • H01H47/00—Circuit arrangements not adapted to a particular application of the relay and designed to obtain desired operating characteristics or to provide energising current
  • H01H47/002—Monitoring or fail-safe circuits

Definitions

• the present invention relates to a safety switching device for safely switching off an electrical load, in particular in an automated system, with at least one input for connecting a signaling device, with an evaluation and control unit, and with at least one switching element, which can be controlled by the evaluation and control unit is to interrupt a power supply path to the consumer, wherein the evaluation and control unit is adapted to radio at defined times tion tests to check a switching function of the at least one switching element.
• Such a safety switching device is known for example from DE 103 25 363 Al.
• Safety switching devices are used to completely or partially shut down a technical system or a technical device, if this is necessary in order to avoid, for example, a hazard for operating personnel of the system or the device.
• the safety switching devices have on the input side one or more connections for connecting one or more signaling devices, such as emergency stop buttons, safety door switches or photoelectric sensors.
• the safety switching devices On the output side, the safety switching devices have at least one switching element with the aid of which a power supply path to the system or the device can be interrupted.
• the evaluation and control unit is typically used to monitor the entire safety circuit including the connected signaling devices and possibly trigger a safety shutdown.
• a safety switching device must still be able to switch off the system or the device if the output-side switching element of the safety switching device fails.
• the contacts can be welded so that the relay can no longer be opened.
• a transistor can alloy and thereby cause a short circuit, which prevents interruption of the power supply path to the consumer.
• safety switching devices are generally constructed in a multi-channel-redundant manner, so that, for example, in the event of failure of a switching element, a redundant switching element arranged in series can interrupt the power supply path.
• a redundant implementation in itself does not guarantee absolute error safety if the functionality of the individual channels is not regularly tested.
• the aforementioned DE 103 25 363 Al discloses a safety switching device with an evaluation and control unit (referred to therein as a signal processing part), which performs regular shutdown tests in operation to check whether the output-side switching elements are still able to the power supply path to the consumer to interrupt.
• the evaluation and control unit has a dual-channel redundant design in order to control any errors in the signal processing part of the safety device.
• Another example of a two-channel redundant safety switching device is known from DE 100 11 211 Al. Also in this case, the evaluation and control unit, which evaluates the input-side signaling devices and monitors and controls the switching elements, built two-channel redundant.
• the two known safety switching devices are typical examples of implementations that meet the requirements of category 3 and even category 4 of the European standard EN 954-1 or comparable safety requirements according to ISO 13849-1 or IEC 61508.
• the continuous redundant structure of the known safety switching devices is complicated and expensive.
• the assignee of the present invention offers under the designation PNOZ® Xl an emergency stop switchgear having on the output side redundant (in series with each other) relay contacts to interrupt the power supply path to a consumer.
• the PNOZ® Xl is, however, designed as a single channel and without any special diagnostic options. Therefore, the PNOZ® Xl is approved without additional measures only for applications up to safety category 2 of EN 954-1.
• this object is achieved by a safety switching device of the type mentioned, in which the at least one input for connecting the signaling device is also designed as an input for supplying a supply voltage, which is required for the operation of the at least one switching element.
• the new safety switching device is thus characterized by the fact that the input for connecting the signaling device at the same time also the input for supplying the supply voltage, which is needed for the operation of the at least one switching element.
• a signaling device is thus connected to the new safety switching device that automatically with the operation of the signaling device, the supply voltage for the at least one switching element is interrupted. This is particularly easy to implement for signaling devices having one or more ⁇ ffneruttone that are opened upon actuation of the signaling device.
• the invention is not limited to this and can also be implemented, for example, for signaling devices which supply a non-floating output signal.
• the information (signaling signal from the signaling device) and the energy for the operation of the at least one switching element run simultaneously and in the same way.
• the elimination of the supply voltage for the at least one switching element is identical to the information that a safety requirement exists.
• the supply voltage for the output-side switching elements is performed separately from the supply voltage for the output-side switching element in some conventional safety switching devices that meet higher safety categories. Since the information (signal from the annunciator) and the energy are then separated, relatively complex evaluation and control units are required to ensure an interruption of the power supply path to the consumer, as soon as the corresponding information (notification signal from the annunciator) is present. Since the evaluation of the message signal is a safety-critical task, the evaluation and control units of the known safety switching devices are typically multi-channel redundant design. This effort is not required in the new safety switching device, which can therefore be realized significantly cheaper.
• the new safety switching device has an evaluation and control unit, which is designed to perform functional tests in order to monitor the switching function of the at least one switching element.
• the new safety switching device differs from simple devices, such as the above-mentioned PNOZ® Xl.
• the evaluation and control unit can be single-channel and thus relatively inexpensive.
• the at least one input is also designed to supply a supply voltage, which is required for the operation of the evaluation and control unit.
• the safety switching device includes a decoupling network, which is designed to decouple the supply voltage for the at least one switching element and the supply voltage for the evaluation and control unit from each other.
• the decoupling network includes a first timer. In order to delay the supply voltage for the at least one switching element relative to the supply voltage for the evaluation and control unit.
• the supply voltages for the at least one switching element and the evaluation and control unit are not only decoupled from each other in terms of circuitry, but also separated from one another in terms of time. Since the evaluation and control unit receives its supply voltage "earlier" than the at least one switching element, it is ensured that the evaluation and control unit can complete internal self-tests before it activates the at least one switching element to the consumer is thereby better avoided.
• the safety switching device includes a reset circuit which is designed to bring the evaluation and control unit into a defined start state each time the supply voltage returns.
• This embodiment facilitates the realization of the evaluation and control unit with a (single-channel) microcontroller, microprocessor or the like.
• a reset which is forced every time power is restored, ensures that the evaluation and control unit always starts from the same defined starting position. This ensures that the evaluation and control unit completes its self-tests each time before the power supply path to the Consumer is closed. Due to this, the evaluation and control unit can be easily realized with one channel.
• the evaluation and control unit is designed as a single channel.
• This embodiment benefits from the possibilities described above and enables a particularly cost-effective implementation of the new safety switching device.
• the evaluation and control unit includes a microcontroller, which is designed to perform the functional tests at the defined times, in particular before closing the power supply path to the consumer.
• microcontroller is used synonymously here for comparable components whose functionality can at least be determined by the manufacturer, ie it is not limited to microcontrollers in the narrower sense but also includes, for example, microprocessors with or without external memory or other programmable components a particularly simple and cost-effective implementation of the new safety switching device, wherein the respective scope of functions can be individually determined, whereby, for example, safety switching devices which are provided for different types of signaling devices and / or in connection with different types of switching elements can be implemented cost-effectively.
• the safety switching device includes a second timer, which is designed to block a connection between the evaluation and control unit and the at least one switching element for a defined period of time, measured from the application of the supply voltage.
• This embodiment also helps to prevent premature and / or faulty closing of the power supply path to the consumer, even if the at least one switching element is driven by a single-channel evaluation and control unit. In combination with the embodiments already described above, an even higher level of safety is achieved when commissioning the consumer.
• the new safety switching device includes at least two switching elements, which are arranged in series to redundantly interrupt the power supply path to the load, wherein the evaluation and control unit is adapted to a first dynamic control signal for a first of the at least two switching elements to generate, and a second, in particular static, control signal for a second of the at least two switching elements.
• This embodiment of the invention uses redundant switching elements in the load circuit in order to enable shutdown of the load even if one of the switching elements fails during the switching operation.
• the at least two redundant switching elements are still controlled in a diversified manner with respect to one another, that is, with two different control circuits. ersignalen. Malfunction of the new safety switching device is therefore even less likely.
• one of the control signals is a dynamic signal, while the other control signal is a static signal.
• both types of control signals can be generated very easily with a microcontroller or a comparable component, wherein, due to the different nature of the control signals, a simultaneous false control of the redundant switching elements is extremely unlikely.
• the at least one switching element is a changeover switch with at least two mutually alternative switching paths, wherein a first switching path is in the power supply path to the consumer, and wherein a second switching path leads to a monitoring unit.
• Figure 2 is a schematic representation of a first embodiment of the new safety switching device
• Figure 3 shows several timing diagrams for explaining the operation of an embodiment of the new safety switching device.
• FIG. 1 an automated system in which the new safety switching device is used is designated in its entirety by the reference numeral 10.
• the plant 10 here includes a robot 12 whose working space is secured by a protective fence with a protective door 14.
• the open or closed position of the protective door 14 is detected with a protective door sensor 16.
• the safety door sensor includes a first part 16a attached to the movable one
• the first part 16a includes a transponder, which can only be recognized and evaluated by the second part 16b (reading device) when the protective door is closed .
• the invention is not limited to this type of safety door sensors and moreover not to protective door sensors as signaling devices.
• the invention can be equally used with other signaling devices, especially emergency stop buttons, as well as speed sensors, light barriers and other.
• Reference numeral 18 denotes a safety switching device according to the present invention. It serves to switch off the robot 12 when the protective door 14 is opened.
• the system 10 is also shown here with an emergency stop button 20 as a further reporting device.
• the emergency stop button 20 is evaluated with another safety switching device 22 according to the present invention.
• the safety switching devices 18 and 22 have in the embodiment shown each potential-free outputs (will be explained in more detail below with reference to Figure 2), which are connected in series with each other to construct a logical AND operation.
• two contactors 24, 26 are arranged, whose normally open contacts are in series with each other in a power supply path 28 to the robot 12.
• the working voltage 30 is for example 24 volts and is looped in this embodiment via the series-connected output contacts of the safety switching devices 18 and 22 to the shooters 24, 26.
• the safety switching devices 18, 22 interrupt the current path via which the input circuits of the contactors 24, 26 are connected to the working voltage 30. As a result, the shooters 24, 26 fall off, the robot 12 is turned off.
• the contactors 24, 26 and (indirectly) the robot 12 are thus consumers in the context of the present invention.
• the system 10 is shown here in a simplified manner. In particular, only two simple safety circuits for switching off the robot 12 are shown here. In practice, there are typically more safety circuits available.
• the contactors 24, 26 typically still have positively-open contact contacts returned to at least one of the safety switching devices 18, 22 to prevent the robot 12 from turning on when one of the contactors 24, 26 is welded.
• an operation control (not shown) is typically provided which controls the normal operation of the robot 12.
• FIG. 2 shows the safety switching device 22 in further details.
• the safety switching device 18 can basically be constructed in the same way, or even have a two-channel evaluation and control unit and potential-free outputs of conventional design.
• the components of the safety switching device 22 are arranged in a conventional manner in a compact device housing 36.
• the housing 36 has connections, for example in the form of screw or spring terminals.
• two terminals are designated, which serve both for connecting the emergency stop button 20 and for supplying a supply voltage 42 for the safety switching device 22 here.
• the supply voltage 42 is shown here as a DC voltage, and it is connected via one NC contact of the emergency stop button 20 to the terminals 38, 40.
• the voltage 42 could in principle also be an alternating voltage.
• Reference numerals 46, 48 designate two further connection terminals, to which a series circuit comprising a start button 50 and two normally closed contacts 52, 54 is connected.
• the normally closed contact 52 belongs to the contactor 24 from FIG. 1 and is forcibly guided with the normally open contacts of the contactor 24.
• the normally closed contact 54 is forcibly guided with the normally open contacts of the contactor 26.
• the safety switching device 22 is shown here with a total of four switching elements 56, 56 ', 58, 58'.
• the switching elements 56, 58 and 56 ', 58' are each arranged in series with each other, and they form two power supply paths, via which the two contactors 24, 26 can be excited.
• the second power supply path with the switching elements 56 ', 58' is shown only partially for reasons of clarity, namely without the details of the control of the switching elements 56 ', 58'.
• the control of the switching elements 56 ', 58' takes place in the same manner as the control of the switching elements 56, 58. For this reason, the following explanations apply equally to the switching elements 56 ', 58', unless stated otherwise.
• the switching elements 56, 58 are realized here as a changeover switch. Each switching element 56, 58 has three terminals 60, 62, 64, which are designated here only for switching element 56 for reasons of clarity.
• the three terminals 60, 62, 64 form two mutually alternative switching paths.
• a first switching path 66 extends between the terminals 62 and 64 (shown in dashed line in FIG. 2).
• a second, alternative switching path 68 extends from port 60 to port 64 (shown in solid line).
• the connection 64 thus forms a common root of the alternative switching paths 66, 68. Only one of the switching paths 66, 68 can be closed at a time. The other one is open in this case.
• the changeover switches 56, 58 in one embodiment of the invention are changeover relays, each with a contact that is switched between the terminals 60, 62. In further embodiments, however, the changeover switches can also be realized as or at least with the aid of semiconductor switching elements.
• the terminal 62 of the switching element 56 is connected to a terminal 70 on the housing 36 of the safety switching device 22.
• the terminal 66 of the switching element 58 is connected to an external terminal 72 of the safety switching device 22.
• the roots 64 of the two switching elements 56, 58 are connected in series with each other. This is the first one Switching paths 66 of the two switching elements 56, 58 a power supply path between the terminals 70, 72 of the safety switching device 22 ready, which may be closed or interrupted depending on the switching position of the switching elements 56, 58.
• the switching elements 56 ', 58' provide a second power supply path between terminals 74, 76 of the safety switching device 22.
• the contactors 24, 26 are connected in the application according to FIG.
• At the terminals 70, 74 is applied to the working voltage 30, which is possibly looped in the same manner as described here, by the safety switching device 18.
• the second switching paths 68 of all four switching elements 56, 56 ', 58, 58' are connected in series in this embodiment, and this series circuit is connected to a monitoring unit, which is designated in Figure 2 by reference numeral 78.
• the monitoring unit 78 may have two channels, which is indicated schematically in FIG. However, it is also possible to design the monitoring unit 78 in one channel.
• the task of the monitoring unit 78 is to feed a test signal 80 into the series connection of the second switching paths 68 of the switching elements 56, 58, 56 ', 58'. If the monitoring unit 78 can read back the test signal 80 via the said switching paths, this means that all the switching elements are in the switching position shown in FIG.
• the power supply paths to the shooters 24, 26 are therefore interrupted.
• the monitoring unit 78 is connected to a microcontroller 82, which is an evaluation and control unit in the sense of the present invention.
• a microcontroller 82 is an evaluation and control unit in the sense of the present invention.
• the microcontroller 82 is configured to adjust the switching position of the switching elements 56, 58, 56 ', 58'. He also performs in the manner described below, functional tests to check the switching function of the switching elements 56, 58, 56 ', 58'.
• the switching elements 56, 58 need to switch a supply voltage, which is applied to a line 84 and a capacitor 86.
• the supply voltage 84, 86 here corresponds largely to the supply voltage 42, which is applied to the terminals 38, 40 of the safety switching device 22.
• the voltage on the line 84 is passed through the input circuit of the switching elements 56, 58 and in each case one transistor 90, 92. With the aid of the transistors 90, 92, the microcontroller 82 can close or interrupt the excitation circuit to each switching element 56, 58. When the excitation circuit is closed and a supply voltage across the capacitor 86 and the line 84, which is higher than the starting voltage of the switching elements 56, 58, switch the changeover switch to the first switching path 66.
• Reference numeral 88 denotes a voltage and reset circuit. This includes a voltage regulator (not shown separately) which generates an individual supply voltage for the microcontroller 82 from the general supply voltage 42. In addition, the voltage and reset circuit 88 ensures that the microcontroller 38 after each voltage return to the terminals 38, 40 starts in a defined manner (reset function).
• the voltage and reset circuit still includes a pulse generator (not shown separately) connected to a reset input of the microcontroller 82.
• the supply voltages for the microcontroller 82 and for the switching elements 56, 58 are thus both generated from the supply voltage 42, which is applied to the input of the safety switching device 22.
• a decoupling network 94 is provided, which in the present embodiment includes a diode and a resistor 95, which together with the capacitor 86 form an RC element. The resistor 95 determines the charging time until fully charged the capacitor 86.
• the RC element of the resistor 95 and the capacitor 86 forms a timer, which ensures that the supply voltage for the switching elements 56, 58 only with a certain delay, measured from the application of the supply voltage 42 to the terminals 38, 40, is reached.
• the reference numeral 96 denotes a so-called watchdog, which includes a second timer.
• the watchdog 86 serves on the one hand to monitor the function of the microcontroller 82 in a conventional manner. For this purpose, the watchdog 96 waits for regularly recurring pulses which are emitted by the microphone.
• the changeover switches 56, 58 do not go into the first switching position 66 despite excitation of the input circuit, but remain in the second default switching position 68.
• the monitoring unit 78 tests before closing the power supply path to the load. For this purpose, the monitoring unit 78 generates the test signal 80 and feeds it into the series connection of the second switching paths 68. If all connected changeover switches are in their de-energized default state, the monitoring unit 78 must be able to read back the test signal 80. In the next step, for example, the changeover switch 56 is switched over by the microcontroller 82. The test signal 80 may now no longer be read back if the switching of the changeover switch worked properly and no short circuit between the terminals 60, 62, 64 is present. If this test is passed, the monitoring unit checks in turn the other changeover switches.
• test signal 80 can be read back in one of the test cases, one of the abovementioned errors is present.
• the monitoring unit 78 informs the microcontroller 82 accordingly and closing the power supply path to the contactors 24, 26 is prevented. If, on the other hand, all changeover switches pass the test, the power supply path to the contactors 24, 26 can be closed. If a changeover switch does not switch to the first switching path 66, the connected consumers can not turn on. Despite the (untested) error so a safe state would be guaranteed.
• the uppermost time profile 110 shows the application of the supply voltage 42 to the safety switching device 22, either when switching on the entire system or when closing the N ⁇ t-off button 20. It is assumed that the emergency stop button 20 at a time t x is actuated, so that the supply voltage 42 is disconnected from the safety switching device 22.
• the second time course 112 shows the supply voltage for the microcontroller 82, which is generated with the aid of the voltage and reset circuit 88.
• the microcontroller 82 carries out internal functional tests, as is known from the operation of microcontrollers in safety switching devices.
• the third time profile 116 shows the course of the supply voltage to the excitation circuits of the switching elements 56, 58.
• the supply voltage increases here at the beginning slower, which is due to the timing of the RC element 95, 86.
• the dimensioning of the components is selected so that the supply voltage to the switching elements 56, 58 only fully applied when the microcontroller 82 has completed its internal self-tests.
• the fourth time profile 118 is the output signal at the watchdog 96. With this signal, the outputs 100, 104 of the microcontroller 82 are switched through to the transistors 90, 92 at the switching elements 56, 58. Only from the time t 2 , the microcontroller 82 is thus able to control the switching elements 56, 58.
• the fifth course shows the test signal 80, which is fed by the monitoring unit 78 into the circuit of the second switching paths 68.
• control signals 100 and 104 for the switching elements 56, 58 are shown.
• a control signal is respectively activated for a time period 120 or 122, wherein the time periods 120, 122 are offset from one another.
• the control signals in the periods 120, 122 at the same time as the test signal 80. If the test signal 80 can not be read back during the periods 120 and 122 of the monitoring unit 78, which is schematically indicated in Figure 3, was the switching of the corresponding Switching element 56, 58 successfully.
• the microcontroller 82 may switch the switching elements 56, 58 to their first switching position 66 and thereby close the power supply paths to the contactors 24, 26 (time t 3 ).
• the bottom diagram finally shows the course 124 of the
• the contactors 24, 26 can tighten from the time t 3 , the
• Robot 12 can go into operation. Is at time t x the
• the functionality of the monitoring unit 78 may be at least partially integrated into the microcontroller 82. It is preferred, for example, if the test signal 80 is coupled by the microcontroller 82 via an optocoupler, a capacitive or an inductive coupling in the monitoring circuit of the second switching paths.
• the part designated here as monitoring unit 78 can then contain, for example, the optocoupler or a transformer.
• embodiments of the invention may include that the changeover switches 56, 58 each have a plurality of parallel switch contacts. In this case, the readback paths of the monitoring unit 78 can be performed in parallel.
• the changeover switches 56, 58 have their own monitoring unit 78, which generates a test signal which is individual for the respective changeover switch.
• the plurality of monitoring units may then be connected to the microcontroller 82 to report the results of the functional tests to the microcontroller 82.
• the second switching paths of the changeover switches 56, 58 may be connected in series with each other, while the second switching paths of the changeover switches 56 ', 58' form a second series connection, the is formed separately from the series connection of the changeover switches 56, 58.
• the present invention can also be implemented with "conventional" switching elements at the output of the safety switching device 22, be it with forcibly guided relays or with semiconductor switching elements, as shown in DE 100 11 211 A1.

Landscapes

• Safety Devices In Control Systems (AREA)
• Keying Circuit Devices (AREA)
• Electronic Switches (AREA)
• Cookers (AREA)
• Electrical Discharge Machining, Electrochemical Machining, And Combined Machining (AREA)

Applications Claiming Priority (2)

Publications (2)

Family

ID=36481341

Family Applications (1)

Country Status (9)

Families Citing this family (18)

Family Cites Families (13)

• 2005
  • 2005-03-22 DE DE102005014122A patent/DE102005014122A1/de not_active Withdrawn
• 2006
  • 2006-03-03 ES ES06723180T patent/ES2353971T3/es active Active
  • 2006-03-03 DE DE502006008279T patent/DE502006008279D1/de active Active
  • 2006-03-03 WO PCT/EP2006/001935 patent/WO2006099935A1/fr active Application Filing
  • 2006-03-03 CN CN2006800177749A patent/CN101203930B/zh active Active
  • 2006-03-03 AT AT06723180T patent/ATE488023T1/de active
  • 2006-03-03 JP JP2008502270A patent/JP4903779B2/ja active Active
  • 2006-03-03 EP EP06723180A patent/EP1869687B1/fr active Active
• 2007
  • 2007-09-21 US US11/859,290 patent/US7439639B2/en active Active
• 2008
  • 2008-05-29 HK HK08106033.8A patent/HK1111262A1/xx not_active IP Right Cessation

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events