EP1869687B1 - Safety switch for the safe disconnection of an electric consumer - Google Patents

Abstract

A safety switching apparatus for safe disconnection of an electrical load has at least one input for connecting a signaling device. The safety switching apparatus further has an evaluation and control unit and at least one switching element which can be controlled by the evaluation and control unit in order to interrupt an electrical power supply path to the load. The evaluation and control unit is designed to carry out functional tests at defined instances of time in order to check at least one switching function of the at least one switching element. Moreover, the at least one input for connecting the signaling device is further designed as an input for supplying a supply voltage required for operation of the at least one switching element.

Description

The present invention relates to a safety switching device for safely switching off an electrical load, in particular in an automated system, with at least one input for connecting a signaling device, with an evaluation and control unit, and with at least one switching element, which can be controlled by the evaluation and control unit is to interrupt a power supply path to the consumer, wherein the evaluation and control unit is adapted to functional tests at defined times perform to check a switching function of the at least one switching element.

Such a safety switching device is for example off DE 103 25 363 A1 known.

Safety switching devices according to the present invention are used to completely or partially shut down a technical system or a technical device, if this is necessary in order to avoid, for example, a hazard for operating personnel of the system or the device. The safety switching devices have on the input side one or more connections for connecting one or more signaling devices, such as emergency stop buttons, safety door switches or photoelectric sensors. On the output side, the safety switching devices have at least one switching element with the aid of which a power supply path to the system or the device can be interrupted. The evaluation and control unit is typically used to monitor the entire safety circuit including the connected signaling devices and possibly trigger a safety shutdown.

It is easy to see that the higher the respective security requirements, the greater the technical effort involved in implementing safety switching devices. For example, a safety switching device according to the present invention must still be able to switch off the system or the device if the output-side switching element of the safety switching device fails. For example, in the case of a relay, the contacts can be welded so that the relay can no longer be opened. A transistor can alloy and thereby cause a short circuit, which prevents interruption of the power supply path to the consumer. In order to control such errors, safety switching devices are generally constructed in a multi-channel-redundant manner, so that, for example, in the event of failure of a switching element, a redundant switching element arranged in series can interrupt the power supply path. However, a redundant implementation in itself does not guarantee absolute error safety if the functionality of the individual channels is not regularly tested.

The aforementioned DE 103 25 363 A1 discloses a safety switching device having an evaluation and control unit (referred to therein as a signal processing part), which performs regular shutdown tests in operation to check whether the output side switching elements are still able to interrupt the power supply path to the consumer. The evaluation and control unit has a two-channel redundant design to control any errors in the signal processing part of the safety switching device.

Another example of a two-channel redundant safety switching device is off DE 100 11 211 A1 known. Also in this case, the evaluation and control unit, which evaluates the input-side signaling devices and monitors and controls the switching elements, built two-channel redundant.

The two known safety switching devices are typical examples of implementations that meet the requirements of category 3 and even category 4 of the European standard EN 954-1 or comparable safety requirements according to ISO 13849-1 or IEC 61508. The continuous redundant structure of the known safety switching devices, however, is complicated and expensive.

The assignee of the present invention, under the name PNOZ® X1, offers an emergency stop switchgear which has redundant (in series with each other) relay contacts on the output side in order to interrupt the power supply path to a consumer. Incidentally, however, the PNOZ® X1 is single-channel and has no special diagnostic options. Therefore, the PNOZ® X1 is approved without additional measures only for applications up to safety category 2 of EN 954-1.

Against this background, it is an object of the present invention to provide a safety switching device of the type mentioned, with at least meet the requirements of category 2 of the European standard EN 954-1 (or comparable safety requirements), but which are realized more cost effective and kleinbauender can be used as previous safety switching devices that meet these requirements.

According to one aspect of the invention, this object is achieved by a safety switching device of the type mentioned, in which the at least one input for connecting the signaling device is also designed as an input for supplying a supply voltage, which is required for the operation of the at least one switching element.

The new safety switching device is thus characterized by the fact that the input for connecting the signaling device at the same time is also the input for supplying the supply voltage, which is required for the operation of the at least one switching element. A signaling device is thus connected to the new safety switching device, that with the operation of the signaling device automatically the supply voltage for the at least one switching element is interrupted. This is particularly easy to implement for signaling devices having one or more Öffnerkontakte that are opened upon actuation of the signaling device. However, the invention is not limited to this and can be realized, for example, for signaling devices that provide a non-floating output signal.

In the new safety switching device, the information (signaling signal from the signaling device) and the energy for the operation of the at least one switching element run simultaneously and in the same way. The elimination of the supply voltage for the at least one switching element is identical to the information that a security request is present. In contrast, the supply voltage for the output-side switching elements is performed separately from the supply voltage for the output-side switching element in some conventional safety switching devices that meet higher safety categories. Since the information (signal from the annunciator) and the energy are then separated, relatively complex evaluation and control units are required to ensure an interruption of the power supply path to the consumer, as soon as the corresponding information (notification signal from the annunciator) is present. Since the evaluation of the message signal is a safety-critical task, the evaluation and control units of the known safety switching devices typically multi-channel redundant design. This effort is not required in the new safety switching device, which can therefore be realized significantly cheaper.

On the other hand, the new safety switching device has an evaluation and control unit, which is designed to perform functional tests in order to monitor the switching function of the at least one switching element. This distinguishes the new safety switching device from simple devices, such as the PNOZ® X1 mentioned above. Since the (in contrast to the PNOZ® X1) new evaluation and control unit according to the invention, however, is no longer solely responsible for the transmission of information from the signaling device to the output-side switching element, the evaluation and control unit can be single-channel and thus relatively inexpensive.

Overall, at least the requirements of category 3 of the European standard EN 954-1 (or comparable safety requirements) can be met with the new safety switching device, since both a redundant shutdown and defined functional tests of the switching elements are provided. On the other hand, the evaluation and control unit of the new safety switching device, which is responsible for carrying out the functional tests, can be realized much easier and cheaper than comparable safety switching devices.

The above object is therefore completely solved.

In one embodiment, the at least one input is also designed to supply a supply voltage, which is required for the operation of the evaluation and control unit.

In principle, it would be conceivable to supply the supply voltage for the evaluation and control unit via another (further) input. This would allow the evaluation and control unit remains in operation, even if the signaling device signals a security request and thus interrupts the supply voltage for the at least one switching element according to the present invention. However, the preferred embodiment is easier to implement. It also allows a realization with fewer terminals, so that, for example, the housing width of the new safety switching device can be reduced. In addition, this design has the consequence that the evaluation and control unit must be inevitably reinitialized after each security request, which can be used in an advantageous manner to subject the evaluation and control unit to a self-test.

In a further embodiment, the safety switching device includes a decoupling network, which is designed to decouple the supply voltage for the at least one switching element and the supply voltage for the evaluation and control unit from each other.

With this embodiment, a reaction from the load circuit to the evaluation and control unit is avoided. The evaluation and control unit is thus better protected against external interference and thus caused malfunctions.

In a further embodiment, the decoupling network includes a first timer to delay the supply voltage for the at least one switching element relative to the supply voltage for the evaluation and control unit.

In this embodiment, the supply voltages for the at least one switching element and the evaluation and control unit are not only decoupled from each other in terms of circuitry, but also separated from one another in terms of time. Since the evaluation and control unit receives its supply voltage according to this embodiment "earlier" than the at least one switching element, it is ensured that the evaluation and control unit can complete internal self-tests before it controls the at least one switching element. A faulty release of the power supply path to the consumer is thereby even better avoided.

In a further embodiment, the safety switching device includes a reset circuit, which is designed to bring the evaluation and control unit at each renewed return of the supply voltage in a defined start state.

This embodiment facilitates the realization of the evaluation and control unit with a (single-channel) microcontroller, microprocessor or the like. A reset, which is forced every time power is restored, ensures that the evaluation and control unit always starts from the same defined starting position. This ensures that the evaluation and control unit completes its self-tests each time before the power supply path to the Consumer is closed. Due to this, the evaluation and control unit can be easily realized with one channel.

In a further embodiment, the evaluation and control unit is designed as a single channel.

This embodiment benefits from the possibilities described above and enables a particularly cost-effective implementation of the new safety switching device.

In a further embodiment, the evaluation and control unit includes a microcontroller, which is designed to carry out the functional tests at the defined times, in particular before closing the power supply path to the consumer.

The term "microcontroller" is used here synonymously for comparable components whose functional scope can be determined at least by the manufacturer. It is therefore not limited to microcontrollers in the narrower sense, but also includes, for example, microprocessors with or without external memory or other programmable components. This embodiment allows a particularly simple and cost-effective implementation of the new safety switching device, wherein the respective range of functions can be set individually. As a result, for example, safety switching devices can be realized inexpensively, which are provided for different types of signaling devices and / or in connection with different types of switching elements.

In a further embodiment, the safety switching device includes a second timer, which is designed to block a connection between the evaluation and control unit and the at least one switching element for a defined period of time, measured from the application of the supply voltage.

This embodiment also helps to prevent premature and / or faulty closing of the power supply path to the consumer, even if the at least one switching element is driven by a single-channel evaluation and control unit. In combination with the embodiments already described above, an even higher level of safety is achieved when commissioning the consumer.

In a further embodiment, the new safety switching device includes at least two switching elements, which are arranged in series to redundantly interrupt the power supply path to the load, wherein the evaluation and control unit is adapted to a first dynamic control signal for a first of the at least two switching elements to generate, and a second, in particular static, control signal for a second of the at least two switching elements.

This embodiment of the invention uses redundant switching elements in the load circuit in order to enable shutdown of the load even if one of the switching elements fails during the switching operation. In addition, however, the at least two redundant switching elements are still driven in a diversified manner to each other, that is, with two different control signals. Malfunction of the new safety switching device are thereby even less likely. It is particularly preferred if one of the control signals is a dynamic signal, while the other control signal is a static signal. That is to say, both types of control signals can be generated very easily with a microcontroller or a comparable component, wherein due to the different nature of the control signals a simultaneous fault control of the redundant switching elements is extremely unlikely.

In a further embodiment, the at least one switching element is a changeover switch with at least two mutually alternative switching paths, wherein a first switching path is in the power supply path to the consumer, and wherein a second switching path leads to a monitoring unit.

This embodiment, which in itself represents an inventive development of known safety switching devices, allows a particularly cost-effective implementation of the new safety switching device, in particular with potential-free outputs. In this case, the use of a changeover switch makes it possible to use "simple" changeover relays instead of much more expensive and larger relays with positively driven make and break contacts. Therefore, this embodiment allows a particularly cost-effective and small-scale safety switching device, with which nevertheless at least Category 3 of European standard EN 954-1 or a comparable level of security can be achieved.

It is understood that the features mentioned above and those yet to be explained below can be used not only in the particular combination given, but also in other combinations or in isolation, without departing from the scope of the present invention.

Figur 1

einen Roboter als Beispiel für eine automatisiert arbeitende Anlage mit der neuen Sicherheitsschalt- vorrichtung,

Figur 2

eine schematische Darstellung eines ersten Aus- führungsbeispiels der neuen Sicherheitsschaltvorrich- tung, und

Figur 3

mehrere Zeitdiagramme zur Erläuterung der Funktions- weise eines Ausführungsbeispiels der neuen Sicher- heitsschaltvorrichtung.

Embodiments of the invention are illustrated in the drawings and are explained in more detail in the following description. Show it:

FIG. 1

a robot as an example of an automated system with the new safety switching device,

FIG. 2

a schematic representation of a first exemplary embodiment of the new safety switching device, and

FIG. 3

several timing diagrams for explaining the operation of an embodiment of the new safety switching device.

In FIG. 1 is an automated system in which the new safety switching device is used, designated in its entirety by the reference numeral 10.

The plant 10 here includes a robot 12 whose working space is secured by a protective fence with a protective door 14. The open or closed position of the protective door 14 is detected with a protective door sensor 16. The safety door sensor includes a first part 16a attached to the movable one In one embodiment, the first part 16a includes a transponder, which can only be recognized and evaluated by the second part 16b (reading device) when the protective door is closed. However, the invention is not limited to this type of safety door sensors and moreover not to protective door sensors as signaling devices. The invention can be equally used with other signaling devices, especially emergency stop buttons, as well as speed sensors, light barriers and other.

Reference numeral 18 denotes a safety switching device according to the present invention. It serves to switch off the robot 12 when the protective door 14 is opened.

The system 10 is also shown here with an emergency stop button 20 as a further reporting device. The emergency stop button 20 is evaluated with another safety switching device 22 according to the present invention. The safety switching devices 18 and 22 have in the embodiment shown each potential-free outputs (hereinafter referred to FIG. 2 explained in more detail), which are connected in series with each other to construct a logical AND operation.

At one end of the logical chain, in this case at the output of the safety switching device 22, two contactors 24, 26 are arranged, whose normally open contacts are in series with each other in a power supply path 28 to the robot 12. In the normally open contacts of the two contactors 24, 26 are normally open contacts, which are therefore closed only when the input circuits of the contactors 24, 26 with a working voltage are excited, which is higher than the tightening or holding voltage of the contactors 24, 26. The working voltage 30 is for example 24 volts and is looped in this embodiment via the series-connected output contacts of the safety switching devices 18 and 22 to the shooters 24, 26. When opening the protective door 14 and / or upon actuation of the emergency stop button 20, the safety switching devices 18, 22 interrupt the current path, via which the input circuits of the contactors 24, 26 are connected to the working voltage 30. As a result, the shooters 24, 26 fall off, the robot 12 is turned off. The contactors 24, 26 and (indirectly) the robot 12 are thus consumers in the context of the present invention.

It is understood that the system 10 is shown here in a simplified manner. In particular, only two simple safety circuits for switching off the robot 12 are shown here. In practice, there are typically more safety circuits available. For example, the contactors 24, 26 typically still have positively-open contact contacts returned to at least one of the safety switching devices 18, 22 to prevent the robot 12 from turning on when one of the contactors 24, 26 is welded. Furthermore, an operation control (not shown) is typically provided which controls the normal operation of the robot 12.

FIG. 2 shows the safety switching device 22 in further details. The safety switching device 18 can basically be constructed in the same way, or even have a two-channel evaluation and control unit and potential-free outputs of conventional design.

The components of the safety switching device 22 are arranged in a conventional manner in a compact device housing 36. The housing 36 has connections, for example in the form of screw or spring terminals. The reference numerals 38, 40, two terminals are designated, which serve both for connecting the emergency stop button 20 and for supplying a supply voltage 42 for the safety switching device 22 here. The supply voltage 42 is shown here as a DC voltage, and it is connected via one NC contact of the emergency stop button 20 to the terminals 38, 40. Alternatively, the voltage 42 could in principle also be an alternating voltage.

Reference numerals 46, 48 designate two further connection terminals, to which a series circuit comprising a start button 50 and two normally closed contacts 52, 54 is connected. The normally closed contact 52 is part of the contactor 24 FIG. 1 and is forcibly guided with the normally open contacts of the contactor 24. In the same way, the opener contact 54 is forcibly guided with the normally open contacts of the contactor 26.

The safety switching device 22 is shown here with a total of four switching elements 56, 56 ', 58, 58'. The switching elements 56, 58 and 56 ', 58' are each arranged in series with each other, and they form two power supply paths, via which the two contactors 24, 26 can be excited. The second power supply path with the switching elements 56 ', 58' is shown only partially for reasons of clarity, namely without the details of the control of the switching elements 56 ', 58'. The control of the switching elements 56 ', 58', however, takes place in the same manner as the control of the switching elements 56, 58. For this reason, the following explanations apply equally to the switching elements 56 ', 58', unless stated otherwise.

The switching elements 56, 58 are realized here as a changeover switch. Each switching element 56, 58 has three terminals 60, 62, 64, which are designated here only for switching element 56 for reasons of clarity. The three terminals 60, 62, 64 form two mutually alternative switching paths. A first switching path 66 extends between the terminals 62 and 64 (in FIG FIG. 2 shown in dashed line). A second, alternative switching path 68 extends from port 60 to port 64 (shown in solid line). The connection 64 thus forms a common root of the alternative switching paths 66, 68. Only one of the switching paths 66, 68 can be closed at a time. The other one is open in this case.

The changeover switches 56, 58 in one embodiment of the invention are changeover relays, each with a contact that is switched between the terminals 60, 62. In further embodiments, however, the changeover switches can also be realized as or at least with the aid of semiconductor switching elements.

The terminal 62 of the switching element 56 is connected to a terminal 70 on the housing 36 of the safety switching device 22. Similarly, the terminal 66 of the switching element 58 is connected to an external terminal 72 of the safety switching device 22. The roots 64 of the two switching elements 56, 58 are connected in series with each other. This is the first one Switching paths 66 of the two switching elements 56, 58 a power supply path between the terminals 70, 72 of the safety switching device 22 ready, which may be closed or interrupted depending on the switching position of the switching elements 56, 58. Likewise, the switching elements 56 ', 58' provide a second power supply path between terminals 74, 76 of the safety switching device 22. To the terminals 72, 76 are in accordance with the application FIG. 1 the contactors 24, 26 connected. At the terminals 70, 74, the working voltage 30 is applied, which is possibly looped through the safety switching device 18 in the same manner as described here.

The second switching paths 68 of all four switching elements 56, 56 ', 58, 58' are connected in series in this embodiment, and this series circuit is connected to a monitoring unit, which in FIG. 2 designated by reference numeral 78. The monitoring unit 78 may be formed two-channel, which is in FIG. 2 is indicated schematically. However, it is also possible to design the monitoring unit 78 in one channel. The task of the monitoring unit 78 is to feed a test signal 80 into the series connection of the second switching paths 68 of the switching elements 56, 58, 56 ', 58'. If the monitoring unit 78 can read back the test signal 80 via the said switching paths, this means that all the switching elements in the in FIG. 2 are shown switching position. The power supply paths to the shooters 24, 26 are therefore interrupted.

The monitoring unit 78 is connected to a microcontroller 82, which is an evaluation and control unit in the sense of the present invention. In a preferred embodiment, only one microcontroller 82 is present, although the invention is not limited thereto. The microcontroller 82 is configured to adjust the switching position of the switching elements 56, 58, 56 ', 58'. He also performs in the manner described below, functional tests to check the switching function of the switching elements 56, 58, 56 ', 58'.

The switching elements 56, 58 need to switch a supply voltage, which is applied to a line 84 and a capacitor 86. The supply voltage 84, 86 here largely corresponds to the supply voltage 42, which is applied to the terminals 38, 40 of the safety switching device 22. The voltage on the line 84 is passed through the input circuit of the switching elements 56, 58 and in each case one transistor 90, 92. With the aid of the transistors 90, 92, the microcontroller 82 can close or interrupt the excitation circuit to each switching element 56, 58. When the excitation circuit is closed and a supply voltage across the capacitor 86 and the line 84, which is higher than the pull-in voltage of the switching elements 56, 58, the changeover switches to the first switching path 66. If either the supply voltage on the line 84 is missing (or if the voltage here drops below the holding voltage of the switching elements) or if the microcontroller 82 interrupts the exciter circuit with the aid of the transistors 90, 92, the switching elements fall back into their default switching position, in which the second switching path 68 is closed. The power supply paths to the shooters 24, 26 are then interrupted.

Reference numeral 88 denotes a voltage and reset circuit. This includes a voltage regulator (not shown separately) which generates an individual supply voltage for the microcontroller 82 from the general supply voltage 42. In addition, the voltage and reset circuit 88 causes the microcontroller 38 to start at each of the terminals 38, 40 in a defined manner after each voltage return (reset function). Therefore, in one embodiment, the voltage and reset circuit still includes a pulse generator (not shown separately) connected to a reset input of the microcontroller 82. The supply voltages for the microcontroller 82 and for the switching elements 56, 58 are thus both generated from the supply voltage 42, which is applied to the input of the safety switching device 22. For decoupling of the two internally separated supply voltages, a decoupling network 94 is provided, which in the present embodiment includes a diode and a resistor 95, which together with the capacitor 86 form an RC element. The resistor 95 determines the charging time until the capacitor 86 is completely charged. Therefore, the RC element comprising the resistor 95 and the capacitor 86 forms a timing element which ensures that the supply voltage for the switching elements 56, 58 does not arrive until after a certain delay, measured from the application of the supply voltage 42 to the terminals 38, 40, is reached.

The reference numeral 96 denotes a so-called watchdog, which includes a second timer. The watchdog 86 serves on the one hand to monitor the function of the microcontroller 82 in a conventional manner. For this purpose, the watchdog 96 waits for regularly recurring pulses from the microcontroller 82 must be delivered. In addition, the watchdog 86 is connected to a plurality of AND gates 98, by means of which it can prevent transmission of the control signals from the microcontroller 82 to the transistors 90, 92.

The control of the switching elements 56, 58 takes place in this embodiment diversified, that is, with mutually different control signals. The control of the switching element 56 (and the switching element 56 ') takes place here with a dynamic control signal (defined pulse train), which provides the microcontroller 82 at an output 100. The control signal 100 is fed via an AND gate and a capacitor 102 to the transistor 90. Transistor 90 only becomes conductive when microcontroller 82 generates the pulse train at output 100 at the intended frequency and amplitude, and when watchdog 96 switches this pulse train on to capacitor 102.

In contrast, the switching elements 58, 58 'are controlled by the microcontroller 82 with a static signal 104. Alternatively, the switching elements 56, 58 could also be respectively controlled with a dynamic or in each case a static signal, wherein it is generally preferred if the control signals 100, 104 differ from each other.

1. 1. Die Wechselschalter 56, 58 verbleiben in der angeregten (ersten) Schaltposition 66, obwohl der Eingangskreis entregt (nicht angesteuert) ist.
2. 2. Die Wechselschalter 56, 58 gehen trotz Anregung des Eingangskreises nicht in die erste Schaltposition 66 über, sondern verbleiben in der zweiten Default-Schaltposition 68.
3. 3. Es besteht ein Schluss zwischen allen Anschlüssen 60, 62, 64.

If the changeover switches 56, 58 according to IEC 62061 are considered for errors, the following errors must be taken into account:

1. 1. The changeover switches 56, 58 remain in the excited (first) switching position 66, although the input circuit is de-energized (not driven).
2. 2. The changeover switches 56, 58 do not go into the first switching position 66 despite excitation of the input circuit, but remain in the second default switching position 68.
3. 3. There is an end between all ports 60, 62, 64.

These errors can be mastered by the monitoring unit 78 testing the switching function of the changeover switches 56, 58 together with the microcontroller 82 before the power supply path to the load is closed. For this purpose, the monitoring unit 78 generates the test signal 80 and feeds it into the series connection of the second switching paths 68. If all connected changeover switches are in their de-energized default state, the monitoring unit 78 must be able to read back the test signal 80. In the next step, for example, the changeover switch 56 is switched over by the microcontroller 82. The test signal 80 may now no longer be read back if the switching of the changeover switch worked properly and no short circuit between the terminals 60, 62, 64 is present. If this test is passed, the monitoring unit checks in turn the other changeover switches. If the test signal 80 can be read back in one of the test cases, one of the abovementioned errors is present. The monitoring unit 78 informs the microcontroller 82 accordingly and closing the power supply path to the contactors 24, 26 is prevented. If, on the other hand, all changeover switches pass the test, the power supply path to the contactors 24, 26 can be closed. If a changeover switch does not switch to the first switching path 66, the connected consumers can not turn on. Despite the (untested) error so a safe state would be guaranteed.

This operation is based on the timing diagrams in FIG. 3 shown again. The top course of time 110 shows the application of the supply voltage 42 of the safety switching apparatus 22, except when switching on of the system or during the closing of the emergency stop button 20. It is assumed that the emergency stop button 20 at a time t ₁ is actuated, so that the supply voltage 42 is disconnected from the safety switching device 22.

The second time course 112 shows the supply voltage for the microcontroller 82, which is generated with the aid of the voltage and reset circuit 88. During a first time period 114 after the supply of voltage to the microcontroller 82 (or after a reset), the microcontroller 82 performs internal functional tests, as is known from the operation of microcontrollers in safety switching devices.

The third time profile 116 shows the course of the supply voltage to the exciter circuits of the switching elements 56, 58. The supply voltage increases here at the beginning slower, which is due to the timing of the RC element 95, 86. The dimensioning of the components is selected so that the supply voltage to the switching elements 56, 58 only fully applied when the microcontroller 82 has completed its internal self-tests.

The fourth time course 118 is the output signal at the watchdog 96. With this signal, the outputs 100, 104 of the microcontroller 82 are switched through to the transistors 90, 92 at the switching elements 56, 58. Only from the time t ₂ , the microcontroller 82 is thus able to control the switching elements 56, 58.

The fifth course shows the test signal 80, which is fed by the monitoring unit 78 into the circuit of the second switching paths 68.

In the next two progressions, the control signals 100 and 104 for the switching elements 56, 58 are shown. First, a control signal is respectively activated for a time period 120 or 122, wherein the time periods 120, 122 are offset from one another. In addition, the control signals in the periods 120, 122 are at the same time as the test signal 80. If the test signal 80 can not be read back by the monitoring unit 78 during the periods 120 and 122, respectively, which is described in US Pat FIG. 3 is indicated schematically, the switching of the corresponding switching element 56, 58 was successful. Upon successful completion of the tests, the microcontroller 82 may switch the switching elements 56, 58 to their first switching position 66 and thereby terminate the power supply paths to the contactors 24, 26 (time t ₃ ).

The bottom diagram finally shows the curve 124 of the working voltage 30 at the input circuits of the contactors 24, 26. The contactors 24, 26 can be tightened from the time t ₃ , the robot 12 can go into operation. If at time t ₁ the emergency stop button 20 is actuated, falls (after a not considered here Discharge time for the capacitor 86), the supply voltage for the switching elements 56, 58 away. In addition, the control signals 100, 104 for the switching elements 56, 58 are omitted. Both events cause the power supply path to the contactors 24, 26 to be interrupted.

In further embodiments, the functionality of the monitoring unit 78 may be at least partially integrated into the microcontroller 82. It is preferred, for example, if the test signal 80 is coupled by the microcontroller 82 via an optocoupler, a capacitive or an inductive coupling in the monitoring circuit of the second switching paths. The part designated here as monitoring unit 78 can then contain, for example, the optocoupler or a transformer.

Furthermore, embodiments of the invention may include that the changeover switches 56, 58 each have a plurality of parallel switch contacts. In this case, the readback paths of the monitoring unit 78 can be performed in parallel.

Furthermore, it can be provided that the changeover switches 56, 58 have their own monitoring unit 78, which generates a test signal which is individual for the respective changeover switch. The plurality of monitoring units may then be connected to the microcontroller 82 to report the results of the functional tests to the microcontroller 82. In addition, the second switching paths of the changeover switches 56, 58 may be connected in series with each other, while the second switching paths of the changeover switches 56 ', 58' form a second series connection, the is formed separately from the series connection of the changeover switches 56, 58.

Finally, the present invention can also be implemented with "conventional" switching elements at the output of the safety switching device 22, be it with positively driven relays or with semiconductor switching elements such as those described in US Pat DE 100 11 211 A1 are shown.

Claims (10)

1. A safety switching apparatus for safe disconnection of an electrical load (24, 26), in particular in an automated installation (10), comprising at least one input (38, 40) for connecting a signaling device (16; 20), comprising an evaluation and control unit (82), and comprising at least one switching element (56, 58) which can be controlled by the evaluation and control unit (82) in order to interrupt an electrical power supply path to the load (24, 26), with the evaluation and control unit (82) being designed to carry out functional tests (120, 122) at defined instances of time in order to check a switching function of the at least one switching element (56, 58), characterized in that the at least one input (38, 40) for connecting the signaling device (16; 20) is further designed as an input for supplying a supply voltage (42) required for operation of the at least one switching element (56, 58).
2. The safety switching apparatus of claim 1, characterized in that the at least one input (38, 40) is further designed for supplying a supply voltage (42) required for operation of the evaluation and control unit (82).
3. The safety switching apparatus of claim 2, characterized by a decoupling network (94) which is designed to decouple the supply voltage (84) for the at least one switching element (56, 58) and the supply voltage for the evaluation and control unit (82) from one another.
4. The safety switching apparatus of claim 3, characterized in that the decoupling network (94) comprises a first delay element (86, 95) in order to delay the supply voltage (84) for the at least one switching element (56, 58) relative to the supply voltage for the evaluation and control unit (82).
5. The safety switching apparatus of one of claims 1 to 4, characterized by a reset circuit (88) which is designed to reset the evaluation and control unit (82) into a defined start state whenever the supply voltage (42) returns.
6. The safety switching apparatus of one of claims 1 to 5, characterized in that the evaluation and control unit (82) is a single channel evaluation and control unit.
7. The safety switching apparatus of one of Claims 1 to 6, characterized in that the evaluation and control unit (82) comprises a microcontroller which is designed to carry out the functional tests (120, 122) at the defined instances of time, and in particular prior to closing the electrical power supply path to the load (24, 26).
8. The safety switching apparatus of one of claims 1 to 7, characterized by a second delay element (96) which is designed to block a connection between the evaluation and control unit (82) and the at least one switching element (56, 58) for a defined time interval measured from the application of the supply voltage (42).
9. The safety switching apparatus of one of claims 1 to 8, characterized by at least two switching elements (56, 58) which are arranged in series with one another in order to interrupt the electrical power supply path to the load (24, 26) on a redundant basis, with the evaluation and control unit (82) being designed to produce a first dynamic control signal (100) for a first (56) of the at least two switching elements, and a second, in particular a static, control signal (104) for the second (58) of the at least two switching elements.
10. The safety switching apparatus of one of claims 1 to 9, characterized in that the at least one switching element (56, 58) is a changeover switch with at least two mutually alternative switching paths (66, 68), with a first switching path (66) being located in the electrical power supply path to the load (24, 26), and with a second switching path (68) leading to a monitoring unit (78).

Images