EP2060207A1 - Method for creating an operating unit from initial error-proof and error-proof control signals and a corresponding safety device for an electrically motor driven furniture drive - Google Patents

Abstract

The method involves monitoring and processing output signals of an operating unit (7) through a central processing unit (2). Initial error-proof and error-proof control signals are generated according to the processed output signals through the central processing unit. Two programmable controller devices (3,4), which are mutually monitored in parallel to each other, are provided for monitoring and processing the input signals. Independent claims are included for the following: (1) a safety device for creating an operating unit from initial error-proof and error-proof control signals for electrically motor driven furniture drive; and (2) a control arrangement for an electric motor furniture drive with a control device and a safety device.

Description

The invention relates to a method for generating first-fail-safe and fault-resistant control signals of at least one operating unit and a corresponding safety device of an electromotive furniture drive.

Such operating units for electric motor drives for furniture are known in different versions, such as in design as a manual control for beds. Such furniture has certain furniture parts, which are adjustable by one or more electric motor drives. The adjustment is activated and deactivated by operating the operating unit.

With beds, for example with a use in the care area, hospital and intensive care area, far more movement processes with different drives are to be controlled than with a bed in the private area. Furthermore, not all adjustments of the entire bed adjustment are available for the patient therein. For this purpose, the electromotive drive of such a bed as an operating unit, a so-called patient hand switch, assigned, which allows only a certain number of actuation functions for the patient. Such a patient's hand-held switch is arranged in the vicinity of the patient on or in the furniture. Such an operating unit for the patient is often installed in side rails of the bed and referred to, for example, as a side grid switch. Another operating device, which can only be reached by the nursing staff or actuated by the latter, is arranged outside the reach of the patient and is named, for example, as the nurse operating unit.

The nursing staff is able, by means of the nurse operating unit, to release or block certain functions of the patient operating unit for the patient. This is done with suitable switching means, such as rotary switches, which are used to lock and unlock functions. A possibility to block movements of individual drive components in a combination that can lead to a risk, describes the DE 196 03 318 A1 , Wherein the drives are equipped with absolute encoders for determining the respective drive position even after a power failure or mechanical adjustment, for example in an emergency.

In the medical and nursing sector, certain safety regulations and standards apply, whereby a so-called first-fault safety of, for example, switching elements of the operating units must be observed. This first fault safety is given manufacturer-specific proof of a mechanical switching reliability for certain types of switching element. For other switching elements without such proof their Erstfehlersicherheit must be ensured by additional measures. Such switching elements may be, for example, membrane keypads, which are used for side rails switch, since such membrane keypads are particularly easy to clean and disinfect, which is a common requirement in everyday hospital life.

Furthermore, demands are made with regard to a so-called fault resistance, which relates to a switching process during operation. That is, in a misoperation, such as by simultaneously pressing several keys or performing a non-logical operation sequence, the operating unit does not malfunction, which could be or cause harm to the patient.

Inadvertent actuation of switching elements by the patient on an operating unit, in particular on a side rail switch, must not lead to any danger.

The use of first fail-safe components on the one hand represents a certain cost, and on the other hand, it is not always possible to accommodate such devices in the available space. Furthermore, there is the disadvantage that extensive and costly measures may be necessary to incorporate such components in a system.

There is therefore a need to improve measures for the use of non-first-fail-safe components. Another need is to increase the safety of patient service units.

It is therefore the object of the present invention to provide a method for generating first-fail-safe and fault-proof control signals of operating units, which eliminates the disadvantages listed above and provides additional advantages.

Further objects of the present invention are to provide a corresponding safety device and a control arrangement.

These objects are achieved by a method having the features of claim 1, a safety device having the features of claim 11 and a control device having the features of claim 19.

A basic idea of the invention is that output signals of an operating unit are monitored and processed in parallel with two programmable, mutually monitoring controller devices for generating first-fail-safe and fault-proof control signals. A controller device is here a control device with a microprocessor or a microprocessor.

Thus, all initiated by control units switching operations can be monitored with non-first-fail-safe components, checked and forwarded error-first, in the case of errors no forwarding takes place or dangers are excluded.

A method according to the invention for generating first-fail-safe and fault-resistant control signals of at least one operating unit of an electromotive drive for a piece of furniture with a control device and a safety device comprises the following method steps:
Monitoring and processing output signals of the at least one operating unit by means of a central unit; and
Generating first-fail-safe and fault-proof control signals on the basis of the processed output signals by means of the central unit,
wherein the monitoring and processing of the input signals is performed in parallel by at least two programmable controller devices which monitor each other.

Signal inputs of the controller devices can process serially encrypted signals, for example from a bus device, or even individual signals in the form of logical switching commands. This creates a large area of application.

A safety device according to the invention for generating first-fail-safe and fault-proof control signals of at least one operating unit of an electromotive drive for a piece of furniture with a control device has the following:
at least one input terminal for connecting at least one operating unit; and
a central unit for monitoring and processing output signals of the operating unit and for generating drive signals or for generating drive signals and checked forwarding of the output signals for generating the first-fail-safe and fault-proof control signals,
wherein the central unit has at least two programmable controller devices which are connected to each other via a communication link for mutual monitoring.

Each controller device generates after verification and mutual monitoring with the other controller means a corresponding logic drive signal at an output. These output signals are each fed to a switching unit in one embodiment, these switching units being connected in series and only then outputting the further control signal for executing the desired function when both controller devices have generated an output signal.

In an alternative embodiment, it is provided that the drive signals of a first controller device of a switching unit, for example for a control voltage of function switches such as relays for motor functions, are supplied, wherein the drive signals of the other controller device as tested output signals or forwarded output signals are fed to the respective control input of the corresponding function switch. Again, the output signals of the controller devices are mutually monitored.

Mutual monitoring of the two controller devices takes place in one embodiment via a hardware-based communication connection. The controller devices communicate with each other whether, in the presence of one or more input signals, they would give the same output signal for a corresponding action of an associated drive. At the same time their function is monitored at the same time. Furthermore, the given output signals are monitored in such a way that the signals provided actually occur at the associated output.

Each controller verifies the occurrence of input signals based on a pre-settable order and rank order or error weighting. If input signals occur at the same time, for example with an insufficient error resistance, which could cause a danger when the corresponding functions are executed, no output signals are generated. Even during the execution of a function, the generation of the output signals can be interrupted if in the course of pending input signals an insufficient first error safety or fault resistance is determined.

The memory may also store additional data and tables necessary for processing. Furthermore, programs and the like can be stored.

In a preferred embodiment, generating the drive signals is possible only after activation by means of at least one separate enable signal from an operating unit via a separate line for enabling the generation of the drive signals. This ensures that, for example, an erroneous operation or incorrect operation, does not lead to a function. It must be aware of an activation by the activation signal, for example, via a release element in the form of a key. For this purpose, a predetermined manner of operation may be used, for example, by releasing the release button within a certain time window in order to enable activation. Other modes of operation are of course possible. As a result, for example, continuous actuations of the release element are prevented by intentional blocking. A separate signal line for the enable signals provides additional security.

A major advantage of the activation, which is only functional for a predetermined period of time, is that it provides protection against a fault of the operating unit, for example a defective control panel or actuator.

In a further embodiment, it is provided that the generation of first-fail-safe and fault-proof control signals for freely selectable functions by means of a lock / unlock device can be disabled / unlocked. In this case, for example, a blocking / unblocking device is provided in an operating unit caregiver, whereby unauthorized movement functions for the patient can be blocked. Again, the central unit can be used advantageously. Also, a separate signal line can be used here, which provides additional security.

In a further embodiment, it is provided that the safety device has a message device for reporting an error and / or freedom from errors.

In one embodiment, the safety device has a separate input connection for connecting an operating unit with at least one enable element for activating the generation of drive signals. This creates additional security.

Locking / unlocking of freely selectable functions is also possible via this or one or more input connections by means of a suitable blocking / unblocking device if a keeper operating unit is connected for this purpose.

The operating unit or a service unit carer can be part of the safety device. This makes it possible to design control units with non-first-fail-safe components so that these control units provide first-fail-safe output signals. But it is also possible that the security device Part of the control device is to which the control units are connected.

A control arrangement according to the invention of an electromotive drive for a piece of furniture with a control device has the above-described safety device for carrying out the method explained above.

As already described above, in one embodiment, the mutual monitoring of the two controller devices can take place via a hardware-based communication connection. In this case, each controller device has a program or a program section which applies a logic signal or a counter signal to the hardware-based communication connection. In this case, a counter signal in the simplest form can comprise the size of one byte, so that the order of magnitude is from 0 to 255. Furthermore, the program or the program section of the first controller device is designed such that the counter signal is formed in an up-counting sequence. The counter signal of the second controller device is then configured in an opposite order, so that a down-counting sequence is performed by the program or by the program section of the second controller device.

In an advantageous development, both controller devices are designed in conjunction with the respective program such that they can read, evaluate and monitor the counter signals of the respective other controller device. In this case, the time duration between each counting step is monitored. If, for example, the second controller device no longer receives any signals or counter signals within a time window from the first controller device, then there is an error as a result of which a switching unit is not activated and an optical or acoustic signaling device is activated.

According to an advantageous embodiment, 20 to 30 counts per second, so that the counting frequency is formed between 20 Hz and 30 Hz and, accordingly, the step size between the counts between 0.03 seconds and 0.05 seconds. According to this embodiment, the above-mentioned time window may be a width of two to five times the step size, for example 0.1 seconds.

The operating voltage of the controller device may be 24 volts, but may be dependent on other factors, such as the state of charge of an accumulator, even in a grid-independent operation. Advantageously, the operating voltage of the controller devices and / or the central unit is designed to be significantly lower than the operating voltage of the entire control device and is for example 5 volts. For this purpose, the controller device and / or the central device are preceded by voltage reduction means, for example in the form of voltage regulators or a transformer winding. Since at least the controller device and / or the central device has semiconductor components, at least one of these components is preceded by an overvoltage protection circuit which has, for example, a suppressor diode and a fuse.

Fig. 1

ein Blockschaltbild eines ersten Ausführungsbeispiels einer erfindungsgemäßen Sicherheitsvorrichtung;

Fig. 2

ein Blockschaltbild eines zweiten Ausführungsbeispiels der erfindungsgemäßen Sicherheitsvorrichtung;

Fig. 3

ein schematisches Schaltbild einer Motorschalteinheit;

Fig. 4

ein Blockschaltbild eines dritten Ausführungsbeispiels der erfindungsgemäßen Sicherheitsvorrichtung;

Fig. 5

ein Ausführungsbeispiel einer erfindungsgemäßen Schaltungsanordnung;

Fig. 6

ein beispielhaftes Möbel mit einer Bedieneinheit;

Fig. 7

ein Seitengitter des Möbels nach Fig. 6; und

Fig. 8

eine vergrößerte Darstellung eines Seitengitterschalters.

The invention will now be explained in more detail by means of embodiments with reference to the accompanying figures. Hereby shows:

Fig. 1

a block diagram of a first embodiment of a security device according to the invention;

Fig. 2

a block diagram of a second embodiment of the security device according to the invention;

Fig. 3

a schematic diagram of an engine switching unit;

Fig. 4

a block diagram of a third embodiment of the security device according to the invention;

Fig. 5

an embodiment of a circuit arrangement according to the invention;

Fig. 6

an exemplary piece of furniture with an operating unit;

Fig. 7

a side rail of furniture after Fig. 6 ; and

Fig. 8

an enlarged view of a side rail switch.

The same or similar functional units are provided in the figures with the same reference numerals.

Fig. 1 shows a block diagram of a first embodiment of a security device 1 according to the invention.

The security device 1 has a central unit 2 with two programmable controller devices 3 and 4. Furthermore, the security device 1 is equipped with two switching units 5 and 6, as well as a memory device 10, an acoustic signaling device 33 and an optical signaling device 34.

An operating unit 7 with a keyboard 8 is connected to a terminal e1 and connected to the central unit 2 with the first controller device 3 with an input terminal e31 and to the second controller device 4 with an input terminal e41. These connections can be either a bus line or a logical wiring. A release element 9 of the operating unit 7 with the central unit 2 is connected to an input terminal e32 of the first controller device 3 and an input terminal e42 of the second controller device 4 via a separate connection e2.

The controller devices 3 and 4 are interconnected via a communication link 31, which may include multiple lines. The first controller device 3 has an output terminal a31, which is connected to the first switching unit 5 via a control input St5. In the same way is an output terminal a41 of the second controller 4 is connected to the second switching unit 6 via a control input St6. A test connection Pr5 of the first switching unit 5 is connected to an input e33 of the first controller 3 and to an input e43 of the second controller 4. In the same way, a test connection Pr6 of the second switching unit 6 is connected to an input e44 of the second controller 4 and to an input e34 of the first controller 3.

The input terminal e1 is routed to an output terminal a1, and an output terminal a32, a42 of the controller devices 3, 4 is connected to an output terminal a2, a3 of the safety device 1, respectively.

Each switching unit 5, 6 has an input terminal E5, E6 and an output terminal A5, A6.

Now, the function of the safety device 1 will be explained.

An output signal generated in the keyboard 8 of the operating unit 7 by an actuated, non-first-malfunctioning switching element for performing a function, for example a drive of a hospital bed (see Fig. 6 ) is directed to both controller devices 3 and 4 of the central unit 2 of the security device 1. The output signal is checked on the basis of stored in the memory device 10 criteria and test programs from both controller devices 3, 4 and monitored pending output signals in their duration. If several output signals are pending at the same time, then their error resistance is checked on the basis of the data stored in the memory 10, that is, whether they are permitted in this combination or can cause a hazard.

At the same time, the controller devices 3 and 4 monitor each other via their communication link 31, for example, whether they would both give the same enable signal for the desired function at a pending output signal at their inputs. If there are no identifiable faults, each controller device 3, 4 generates for itself an enable signal at the respective output connection a31 and a41, which in each case independently of one another to the associated switching unit 5, 6 is passed. There it is routed to the respective test port Pr5, Pr6 again to the input terminal e33, e43 of the associated controller device 3, 4 and the other controller device 4, 3 for review. It is checked whether the output signal value also corresponds to the generated signal value, whereby additional security is provided.

If errors are detected during the switch-on period when the output signals are present, then the switching units and thus the already activated function are switched off again. A message can be made via the acoustic alarm 33 and / or by the optical signaling device 34, for example by a flashing lamp or an error message on a display.

The switching units 5, 6 may be connected in this first embodiment with their input terminals E5, E6 and output terminals A5, A6 so that they turn on the desired function only when both switching units 5 and 6 turned on by the drive signals at their control inputs St5, St6 have been.

Fig. 2 shows a second embodiment of the safety device 1 according to the invention, in which case the switching units 5 and 6 each have a transistor as the first and second switching element 15, 16. The switching units 5, 6 are connected in series here, that is, the emitter of the first switching element 15 is connected to the input terminal E5 and, for example, a control voltage V _ST , its collector is the output terminal A5 which is connected to the input terminal E6 of the second switching element 16 , the emitter of this transistor and connected to a resistor. The collector of the second switching element 16 is at the output A6 to a control voltage _terminal V _{11ST of} an engine _{switching unit} 11 (see Fig. 3 ) guided. At this collector, a light emitting diode as an optical signaling device 34 'is connected, which confirms a functional operation as "in order" by lighting.

If the output signals of the operating unit 7 have been regarded as faultless by the central unit 2, both switching units 5 and 6 each receive an enable signal from the controller devices 3 and 4, whereby both transistors, that is both Switching through switching elements 15 and 16, and thus switch the control voltage V _ST to the output terminal A6 to the control voltage terminal V11ST the motor switching unit 11. When the control voltage VST is present, the corresponding output signal of the operating unit 7, which is located at the same time at the inputs e31, e41 of the controller devices 3, 4 and at the output terminal a1, at control inputs St111, St112 of the motor switching unit 11 (see Fig. 3 ) _Switch on the motor of the drive with the desired function as long as the control voltage V _11ST is applied.

For better clarity shows Fig. 3 the motor switching unit 11 in an exemplary embodiment. A motor 14 of a drive can be connected via two function switches 12, 13 with a plus and minus connection V ₁₁₊ , V _11- a motor voltage V _M with plus line V _{M +} and minus line V _M- differently via circuit breaker 19, 20 (here relay), that it performs a left or right turn when the respective power switch 19 or 20 via a first or second function switching element 17, 18 is turned on. The function switching elements 17, 18 are here transistors, each having a control input St111, St112, which are connected to the output terminal a1 (here two pieces), at which the output signals of the operating unit 7 are present. If the control voltage V _{11ST is} present, the respective relay and thus the associated drive function of the motor M can be switched on with an applied output signal at one of the control inputs St111 or St112. If an error occurs, as described above, even if the output signal is applied, the control voltage V _{11ST is interrupted} via the switching _units 5, 6, and the respective motor function is switched off by dropping the relay switched on (circuit breaker 19 or 20).

A third embodiment will now be described in connection with Fig. 3 and Fig. 4 described. Fig. 4 shows the arrangement of Fig. 1 with only one switching unit 5, which with the first controller 3 as under Fig. 1 described is connected. In this case, however, the switching unit 5 is designed as a power switch, for example a relay. The input terminal E5 of the first switching unit 5 is connected to the minus line V _{M- of} the motor voltage V _M , and the output terminal A5 of the switching unit 5 is connected to the minus terminal V _{11- of} the motor switching unit 11 ( Fig. 3 ). The output terminal a42 (here 2 lines) is connected to the output terminal a2 of the safety device 1, which is connected to the control inputs St111 and St112 of the motor switching unit 11 is connected. Here, for reasons of clarity, only one line is shown, wherein this compound may consist of more than one line, as is easy to imagine.

When there is an error-free output signal of the operating unit 7, the first controller 3 generates an enable signal as described above, which activates the first switching unit 5. Thus, the negative terminal V _{11 of} the motor switching unit 11 is connected to the negative line V _{M of} the motor voltage V _M. At the same time, the second controller device 4 generates an enable signal which, according to the desired function of the pending output signal of the operating unit 7, is applied to the control input St111 or St112 and switches on the associated power switch 19, 20 of the motor switching unit 11 for the desired drive function. In the event of a fault, either the minus line V _{M- of} the motor voltage V _M , the enable signal at the control input St111 or St112 or both are interrupted.

In all embodiments according to Fig. 1 . 2 and 4 the generation of the release signals by the controller device 3, 4 released by the release element 9 of the control unit 7 for security reasons only for a certain period of time, that is activated. For this purpose, it is necessary to actuate the release element 9, for example for a pre-definable period of time, which is 1.5 seconds, for example, prior to actuation of the keyboard 8. If the release element 9 is released later or not at all, as may be done, for example, by a continuous operation by mistake or by deliberate manipulation, no activation of the keyboard 8 is triggered. This achieves a high level of security. The activation takes place only for a certain, pre-definable period of time, for example for 10 seconds. Even with a defective keyboard 8 with permanent contact this is automatically disconnected after the activation time.

This function is given by the fact that the release element 9 cooperates with the controller devices 3, 4 via a separate line. The interaction is based, for example, on the fact that, if the release signal of the release element 9 is not present, no drive signals are generated at the terminals a31, a41 of the controller devices 3, 4. The actuation duration and activation duration can be defined in the memory device 10.

Fig. 5 shows an embodiment of a circuit arrangement 30 according to the invention and has a housing 26, to which two operating units patient 23, two foot control units 25, two operating units caregiver 24, a light 29 and a control device 27 are connected. The housing 26 has the safety device 1 in this example. For example, according to the embodiment of Fig. 2 the terminals e1, e2 are connected to the operating units 23, 24, 25. A connection cable 28 to the control device 27 includes control lines of the output terminals (for example, FIG Fig. 2 ) a1, a2, a3, A6 and input terminal E5. An operating unit nurse 24 has the locking / unlocking device 249. All operating units patient 23 are equipped with keyboards patient 238 and all operating units nurse 24 are equipped with keypads nurse 248, with the operating units nurse 24 special keyboards caregiver 241, for example, to set lock / Unlock functions. All operating units 23 and 24 have interfaces 230 and 240 for a bus device. On a terminal block 271 drives (not shown) are connected. One of the operating units 23 (or both) may be formed as a side grid switch, as in Fig. 6 to 8 is shown and illustrated.

Fig. 6 shows an exemplary furniture 21, for example a hospital bed, with a control unit patient 23 mounted in a side rail 22 of the bed, such as FIGS. 7 and 8 as an enlargement of the area X in Fig. 6 to clarify even closer. The side rail switch has a keyboard 8 with 4 touch elements and a display 32. One of the key elements of the keyboard 8 or an additional, not shown, may have the function of the release element 9. Since the side rail switch, and hence the keyboard 8, is in the immediate vicinity of a patient in the bed, it is highly likely to be permanently actuated by the patient, for example during sleep by an arm. For this reason, the above-described activation via the enabling element 9 within a pre-definable time window and the limited activation duration is of great importance. In connection with the safety device 1 for generating first-fail-safe and fault-proof control signals, a high level of security is created.

The invention is not limited to the illustrated embodiment, but can be modified within the scope of the appended claims.

Of course, first-fail-safe control units can be connected to the security device 1, resulting in a higher security.

The motor switching unit 11 may also have power switches 19, 20 in the form of power semiconductors. It can also be constructed in other ways, as is easy to imagine.

Functions can also be locked or unlocked using the Keeper 24 control unit. For this purpose, the lock / unlock keyboard 249 may be connected to the central unit 2 similar to the release element 9, wherein the activation period for arbitrary functions for blocking, for example, to a time of 0 seconds is adjustable or the release signal of the release element 9 in this function to be blocked without Effect remains.

LIST OF REFERENCE NUMBERS

1

safety device

2

central processing unit

3

First controller device

4

Second controller device

5

First switching unit

6

Second switching unit

7

operating unit

8th

keyboard

9

release element

10

memory device

11

Motor Control Unit

12

First function switch

13

Second function switch

14

engine

15

First switching element

16

Second switching element

17

First functional switching element

18

Second functional switching element

19

First circuit breaker

20

Second circuit breaker

21

Furniture

22

side rails

23

Operation unit patient

24

Operating unit carer

25

Fußbedienungseinheit

26

casing

27

control device

28

connection cable

29

lighting

30

control arrangement

31

communication link

32

display

33

Signaling device acoustically

34

Signaling device optical

230

interface

238

Keyboard patient

240

interface

241

Special keeper keeper

248

Keyboard Keeper

249

Locking / unlocking device

271

terminal block

A1 ... 5

output terminals

a31 ... 32

Outputs first controller device

a41 ... 42

Outputs second controller device

e 1

Connection control unit

e2

Connection release element

E5 ... 6

Input connections Switching units

e31 ... 34

Inputs first controller device

e41 ... 44

Inputs second controller device

Pr5 ... 6

Test connections Switching units

St5, St6

Control inputs Switching units

ST111 ... 112

Control inputs Function switch

V _{M +}

Motor voltage, plus line

V _M-

Motor voltage, negative lead

V ₁₁₊

Motor switching unit, plus connection

V _11-

Motor switching unit, negative connection

V _11ST

Motor switching unit, control voltage connection

V _ST

control voltage

Claims (19)

Method for generating first-fail-safe and fault-proof control signals of at least one operating unit (7, 23, 24) of an electromotive drive for a piece of furniture (21) having a control device (27) and a safety device (1), the method comprising the following method steps: (I) monitoring and processing of output signals of the at least one operating unit (7, 23, 24) by means of a central processing unit (2); and (ii) generating first error-proof and error-proof control signals on the basis of the processed output signals by means of the central unit (2), wherein the monitoring and processing of the input signals is performed in parallel by at least two programmable controller means (3, 4) which monitor each other. A method according to claim 1, characterized in that when generating the first fail-safe and faulty control signals one of the at least two programmable controller devices (3) generates drive signals for a first switching unit (5), the other of the at least two programmable controller devices (3) drive signals for a second switching unit (6), wherein the first switching unit (5) and the second switching unit (6) are connected in series, and a forwarding of the output signals of the operating unit (7, 23, 24) takes place as control signals. Method according to Claim 1, characterized in that, when the first error-proof and fault-proof control signals are generated, one of the at least two programmable controller devices (3) generates drive signals for a first switching unit (5) and the other of the at least two programmable controller devices (3) generates the output signals of the operating unit (3). 7, 23, 24). Method according to one of the preceding claims, characterized in that during mutual monitoring of the at least two programmable Controller devices (2, 3) takes place a mutual monitoring of the first fail-safe and fault-proof control signals. Method according to one of the preceding claims, characterized in that the mutual monitoring of the at least two programmable controller devices (2, 3) takes place via a communication connection (31). Method according to one of Claims 2 to 5, characterized in that, in the event of a first fault or an insufficient fault resistance, no generation of drive signals is carried out by the central unit (2) in the case of the corresponding function. A method according to claim 6, characterized in that when an occurrence of a first error or an insufficient error resistance as a function of a predeterminable error weighting generating generating signals is interrupted or no generation is performed. Method according to one of claims 2 to 7, characterized in that generating the drive signals after activation by means of at least one separate enable signal from an operating unit (7, 24) via a separate line for enabling the generation of the drive signals. Method according to claim 8, characterized in that the release signal is generated by means of at least one separate release element (9) in a predetermined time window and by a previously determinable mode of operation for a pre-definable period of time. Method according to one of the preceding claims, characterized in that the generation of first error-proof and error-proof control signals for arbitrary functions by means of a lock / unlock device can be disabled / unlocked. Safety device (1) for generating first-fail-safe and fault-proof control signals of at least one operating unit (7, 23, 24) of an electromotive drive for a piece of furniture (21) having a control device (27) comprising: - At least one input terminal (e1) for connecting at least the at least one operating unit (7, 23, 24); and - A central unit (2) for monitoring and processing of output signals of the operating unit (7, 23, 24) and for generating drive signals or for generating drive signals and forwarding the output signals for generating the first fail-safe and fault-proof control signals, wherein the central unit (2) has at least two programmable controller devices (3, 4) which are connected to each other via a communication link (31) for mutual monitoring. Safety device (1) according to claim 11, characterized in that the safety device (1) further comprises at least two switching units (5, 6) for unlocking or blocking functions of the electromotive drive in response to the drive signals of the central unit (2), wherein one of at least two switching units (5) are connected to one of the at least two programmable controller devices (3) and the other of the at least two switching units (6) is connected to the other of the at least two programmable controller devices (4). Safety device (1) according to claim 12, characterized in that the at least two switching units (5, 6) are connected in series. Safety device (1) according to one of claims 11 to 13, characterized in that the safety device (1) further comprises a memory device (10) for storing program data and further data values. Safety device (1) according to one of claims 11 to 14, characterized in that the safety device (1) further comprises a signaling device (33, 34) for reporting an error and / or freedom from error. Safety device (1) according to one of claims 11 to 15, characterized in that the safety device (1) has a separate input terminal (e2) for connecting an operating unit (7, 24) with at least one release element (9) for activating the generation of drive signals , Safety device (1) according to one of claims 11 to 16, characterized in that the operating unit (7) is part of the safety device (1). Safety device (1) according to one of claims 11 to 17, characterized in that the safety device (1) is part of the control device (27). Control arrangement (30) of an electric motor drive for a piece of furniture (21) having a control device (27) and a safety device (1), wherein the safety device (1) is designed according to one of Claims 11 to 18.

Images