EP2616781A2

EP2616781A2 - Electrical or electronic safety module

Info

Publication number: EP2616781A2
Application number: EP11752142.7A
Authority: EP
Inventors: Roland Grozinger; Detlef Ramin
Original assignee: Endress and Hauser SE and Co KG
Current assignee: Endress and Hauser SE and Co KG
Priority date: 2010-09-15
Filing date: 2011-08-12
Publication date: 2013-07-24
Also published as: WO2012034796A2; CN103250034B; US20130250460A1; CN103250034A; WO2012034796A3; US9450399B2; DE102010040833A1

Abstract

The invention relates to a time‑controlled crowbar (11) which is designed such that it monitors the switched‑on period (t) of the at least one downstream electronic component (12) and the period length (T) of the clocking and hence the supply of power such that a maximum permissible surface temperature - prescribed in the area at risk of explosion - for the at least one downstream component (12) is not exceeded.

Description

Electrical or electronic safety module

The invention relates to an electrical or electronic safety module, which is connected via at least one supply line with at least one downstream in a hazardous area component and this protects by monitoring the power supply via the supply line in dependence on the required in the hazardous area Zündschutzart, the at least one downstream component is operated clocked such that their duty cycle is smaller than the period of the clocking.

Particularly in the field of automation technology, both factory and process automation technology, the type of protection of a device used in a potentially explosive area plays an important role. The type of protection should eliminate the risk that in one

explosive or potentially explosive atmospheres, an ignition source that can cause an explosion occurs. In the in the measuring and

Either the presence of the explosive atmosphere is prevented, e.g. by the device is protected by an encapsulation or a potting, or the occurrence of ignition sources is in principle prevented.

One of the most important types of protection in automation technology, especially in the chemical and petrochemical industries, is the

Type of protection Ex-i. Devices with type of protection Ex-i are intrinsically safe, i. Due to special design principles, it is ensured that even in the event of a fault, there is no risk of explosion in an explosive atmosphere. In intrinsically safe devices, the supplied current and the applied voltage and thus the supplied power are so small that a sparking during switching or in the event of a short circuit is not sufficient for the ignition of the explosive

Atmosphere is sufficient. The advantages of intrinsically safe devices are in it too see that here elaborate housing designs omitted and

Maintenance work can also be carried out during operation. It is a special feature of the type of protection Ex i that the explosion protection is usually implemented outside the Ex area. In particular, the lines leading into the Ex area are protected by so-called ex-barriers. The Ex-barriers limit current and voltage and are dimensioned such that the circuit is not ignitable and the downstream component to be protected is only supplied with a suitably limited power.

For intrinsically safe devices, it must also be ensured that the surface temperature of the components in contact with the explosive atmosphere is limited to specified maximum values. For electronics, this means that the surface temperature of the individual components or, if the electronics are potted, the surface temperature of the encapsulated electronics is limited. In order to meet this requirement, so far the performance of individual components or individual areas, to which several components can be combined, limited. In addition, adjacent components or regions are spaced apart, with the distance between them

Components and / or areas is dimensioned so that a mutual influence is excluded. The limitation of the surface temperature is ensured by correspondingly matched pre- or limiting resistances.

The above-described type of limiting the surface temperature has the fundamental disadvantage that the power must be severely limited depending on the Voroder limiting resistors of individual components or areas. Therefore, it is not possible under the

Type of protection Ex-i To operate components with high pre- or limiting resistance at high power requirement. In the known solutions, the same problem is given when the intrinsically safe device, in particular a field device, is operated clocked. Clocking in this context means that the duty cycle is less than the period of the clocking. In a clocked operated

Component it is possible to use the average power consumption of the device for the calculation of the surface temperature. The mean power P _{AV is} calculated to

P _AV = P _mix ^■ (duty cycle / period) + P ^* and is thus adjustable over the ratio of duty cycle to period duration. In the formula, P ^* denotes the sum of the powers that are transmitted via further connecting lines, such as signal, control and communication lines. The corresponding situation is shown in FIGS. 2a and 2b. Specifically, the timing is the

Possibility to transfer even very high amounts of energy into the hazardous area, if the ratio of duty cycle and period are designed accordingly. The invention has the object of proposing an electrical or electronic safety module, which ensures a correct power transmission in the hazardous area.

The object is achieved in that the electrical or electronic safety module is at least one time-controlled

Crowbar or a time-controlled short-circuit switch, wherein the Crowbar is configured so that it monitors the duty cycle of the at least one downstream electronic component and the period of the clocking and thus the power supply such that a predetermined in the hazardous area maximum allowable Surface temperature of at least one downstream component is not exceeded.

According to the invention, therefore, a safety-related monitoring of a predetermined duty cycle for a given period of time takes place

Downstream clocked operated component. A timed crowbar is used for this.

Since according to the inventive solution no longer a voltage and current monitoring for the controlled power supply in the

explosion-prone area is performed, but since according to the invention, the observance of a predetermined maximum duty cycle or a predetermined minimum period is monitored, it is possible to temporarily transmit an increased power in the hazardous area. Since the crowbar monitors compliance with both time periods, there is no risk of a maximum surface temperature of the monitored downstream component being exceeded in the event of a fault. It is particularly advantageous in this context if the downstream component reacts relatively slowly to a temperature jump, that is, if the downstream component has a relatively high thermal inertia. This guarantees that a short-term increase in power transmission to the hazardous area is possible without exceeding the maximum permissible surface temperature. Incidentally, the course of the surface temperature accompanying the power supply is visualized in FIG. 2c.

The advantage of the solution according to the invention is the fact that a short-term increased power supply can take place in the potentially explosive area. For a short time, this means that the ratio of

Duty cycle and period is such that the maximum permissible surface temperature of the downstream component is not exceeded. Compliance with duty cycle and period is guaranteed over the timed Crowbar. For example, the microwave level gauges to be described in more detail below require briefly 1 watt for operation. With the time-monitored clocked

EnergeLeistungsversorgung this high performance can be made available even in hazardous areas. at

Field devices that require less operating energy can be increased via the inventive solution, the measurement rate and thus the measurement accuracy. The higher the thermal inertia of the

downstream component with or without encapsulation, the higher the pulsed power supply may be.

With regard to the invention, the following prerequisites must be taken into account: a) The thermal inertia of the downstream component or of the downstream area must be determined by suitable means

Temperature measurements can be detected in a type test.

On the one hand, the surface temperature of the

increase the downstream component or the downstream area only slightly during the duty cycle; On the other hand, the maximum permissible surface temperature may be the downstream one

Component or the downstream area are not exceeded. b) The monitoring of duty cycle and period is by at least one time-controlled crowbar or a timed

Short-circuit switch ensured. According to the invention

ensures that even if an error occurs in the

Timing, e.g. caused by the microprocessor, the allowed surface temperature on average is not exceeded.

According to an advantageous embodiment of the invention, an external control unit is provided, which via the at least one supply line transmitted and by the at least one timed crowbar

monitored power supply controls such that the duty cycle of the downstream component is maximum, while the period is minimal. Here, the timed Crowbar is not active, so the power is not turned off. Only in case of error, when the maximum allowed duty cycle is exceeded, does the Crowbar one

Short circuit, thus preventing the supply of an explosive power in the hazardous area. The crowbar can be both reversible and irreversible. An advantageous

Embodiment provides that the occurrence of an error case of the

Control unit is registered. Subsequently, an error message is generated, the z. B. the operator is displayed.

In particular, the crowbar is a safety assembly that is designed to limit intrinsic safety

Circuit including the highest type of protection, eg. B. the

Type of protection Ex ia, used.

In connection with the predicted, it is also considered advantageous or necessary if the crowbar is designed to be redundantly redundant, the number of redundant crowbars per

Supply line must be selected depending on the type of protection applicable in the potentially explosive area. At high

Security requirements are usually provided a triple redundancy per line to be secured.

An advantageous embodiment of the safety module according to the invention or the time-controlled crowbar according to the invention provides that the crowbar has a transistor or a thyristor, which has the property that it is low impedance at a voltage across the gate and source equal to zero between drain and source. Thus, the power consumption of the Crowbar is very low outside the error case. As particularly important it considers that the circuit can assume the safe state even at low operating voltage.

An advantageous embodiment of the inventive solution provides that the monitored downstream component or the monitored downstream components of a field device for determining and / or monitoring a physical or chemical process variable

assigned. Sensors such as level gauges, flowmeters, pressure and temperature measuring devices, pH redox potential measuring devices, conductivity measuring devices, etc., which record the corresponding process variables level, flow, pressure, temperature, pH or conductivity, are used to record process variables. To influence process variables are actuators, such as valves or pumps, via the flow of a liquid in a pipeline section or the level can be changed in a container. Field devices are in principle all devices that are used close to the process in a factory or process plant and that provide or process process-relevant information. In the context of the invention, field devices are therefore also understood to mean, in particular, remote I / Os, radio adapters or general devices which are arranged on the field level. A variety of such field devices is manufactured and sold by the company Endress + Hauser.

The solution according to the invention is also very suitable for securing the power supply in a potentially explosive area in the case of fully digital mobile radio transmissions. Mention should be made in this

Context explicitly the commonly used standard GSM - Global System for Mobile Communications. It goes without saying that the invention can generally be used when there is a clocked operation of a component in a potentially explosive area. The solution according to the invention is considered to be particularly advantageous in conjunction with a microwave radar measuring device. Known level gauges work according to a transit time method. Runtime methods exploit the physical law, according to which the running distance is equal to the product of transit time and propagation speed. In the case of level measurement, the running distance is twice the distance between the antenna and the surface of the medium. The useful echo signal, ie the signal reflected on the surface of the medium, and its transit time are determined by means of the so-called echo function or the digitized envelope, wherein the envelope reproduces the amplitudes of the echo signals as a function of the distance 'antenna - surface of the medium'. The level itself then results from the difference between the known distance of the antenna to the bottom of the container and by the measurement

certain distance of the surface of the medium to the antenna.

All known methods can be used which make it possible to determine relatively short distances by means of reflected measuring signals. If the measuring signals are microwaves, then both the pulse radar and the frequency modulation continuous wave radar (FMCW radar) can be used. Microwave measuring devices using pulse radar are marketed by the applicant, for example, under the name 'MICROPILOT'. A device type that works with ultrasound signals is offered by the applicant, for example, under the name 'PROSONIC'. In Fig. 1, a level gauge is shown in use.

A further development of the solution according to the invention provides that the microwave radar measuring device has an antenna unit, a high-frequency module and a sensor electronics, wherein the high-frequency module generates the high-frequency measurement signals, which emitted via the antenna unit, the high-frequency measurement signals or reflected on the surface of the medium high-frequency measurement signals are received, and wherein the sensor electronics based on the transit time difference between the emitted and the received high-frequency measurement signals determines the level of the contents in the container.

Here, the sensor electronics and the high-frequency module are spaced from each other, wherein the energy transfer from the sensor electronics to the high-frequency module via the at least one supply line. The communication data between the sensor electronics and the

High frequency module are transmitted via at least one signal line. Here, the sensor electronics is configured intrinsically safe.

An advantageous embodiment of the fill level measuring device according to the invention provides that the at least one supply line via at least one controlled Crowbar or via at least one controlled

Short circuit switch is secured while the remaining signal lines and possibly further transmission lines are limited via switched into the signal and transmission lines resistors with respect to a maximum line supply. It must be ensured that the maximum permissible mean power supply to the potentially explosive area is such that the criteria for the given

Type of protection are fulfilled.

The invention will be explained in more detail with reference to the following figures. It shows:

1 shows a schematic representation of a level gauge,

2a shows the course of the operating voltage on the supply lines 8 of FIG. 3,

FIG. 2b shows a performance curve corresponding to the course of the operating voltage (FIG. 2a), FIG. FIG. 2c shows a typical profile of the surface temperature of the component 13 shown in FIG. 3, FIG.

3 shows a schematic representation of the safety module, wherein in each case one inventive time-controlled crowbar is used per supply line, and

4 shows a block diagram of a timed control according to the invention

Crowbars.

Fig. 1 shows a schematic representation of a level measuring device 6, in which the solution according to the invention is preferably used. The filling material 2 is stored in the container 1. The filling level of the filling material 2 in the container 1 is determined by means of the filling level measuring device 6 via a transit time method. In the case shown, the antenna unit 10 with signal generating, transmitting and receiving unit is spatially offset from the control / evaluation unit 9. The data exchange and the power supply between the high-frequency module generating the signals 12 and the sensor electronics 9 via the connecting lines 7, 8. It goes without saying that in conjunction with the present invention as a level gauge 6, a compact device can be used.

The antenna unit 10 is mounted in the opening 5 in the lid 4 of the container 1. Measurement signals Tx, in particular microwaves, are radiated in the direction of the surface normal of the filling material 2 via the antenna unit 10. The reflected echo signals Rx are received in the antenna unit 10. Based on the duration of the measurement signals Tx / echo signals Rx determines the control / evaluation unit 9 u.a. the current level of the

Filling material 2 in the container 1. Fig. 2a shows the course of the pulsed operating voltage Vst on the

Supply lines 8 of Fig. 3. From the figure it can be seen that the duty cycle t is only a fraction of the period T. In Fig. 2b is the corresponding to the course of the operating voltage of Fig. 2a

Performance history shown. The P _{AV is} calculated to

P _AV = Ρ ^ ^■ (duty cycle t / period T) + P *

Here, P * corresponds to the sum of the powers that are transmitted via the signal, control and communication lines 7. This situation is illustrated in FIGS. 2a and 2b.

FIG. 2 c shows the typical profile of the surface temperature T of the component 14 shown in FIG. 3. In this case, 7 denotes the maximum permissible surface temperature of the component 14 in the potentially explosive area. The dashed line indicates the average surface temperature caused by the mean allowable power P _AV . For the maximum permissible surface temperature of the component 14, the maximum permissible electrical power P _AV and the monitored by the crowbar 1 1 maximum duty cycle t and the minimum period T is used. The crowbar 1 1 ensures compliance with the predetermined maximum duty cycle t or the minimum period T. If the sensor electronics 9 associated control unit faulty the

Duty cycle t too long or makes the period T too short, prevents the timed Crowbar 1 1 by a short circuit that the average allowable power P _AV or the permitted surface temperature 7 ^ be exceeded in the hazardous area.

FIG. 3 shows a schematic representation of the power limitation, wherein in each case an inventive time-controlled crowbar 1 1 per supply line 8 is provided. The sensor electronics 9 is limited Power supplied. The power limitation is via appropriate

Resistors realized in the terminal module or in an upstream, not shown separately in Fig. 3 electronics. The intrinsic safety of the interface 17 is via the resistors 15 of the interface 17th

guaranteed. In addition to the supply lines 8 are between the

Sensor electronics 9 and the RF module 12 six more lines 7 are provided. The two upper lines 7 are used to transmit the high-frequency signal HF and the intermediate frequency signal ZF. The four further lines 7 are control lines. The resistors 14 are designed according to high intrinsic safety in terms of intrinsic safety.

The switched in the two supply lines 8 Crowbars 1 1 monitor the timing of the power supply. The timing itself, i. the ratio of duty cycle t to period T, is specified by the control unit 9. The control unit 9 is an intelligence, usually a microprocessor 16, assigned. The Crowbars 1 1

monitor that the predetermined ratio of duty cycle t to period T is met. If an error occurs, and the

Microprocessor 16 makes the duty cycle t too long or the period T too short, the corresponding time-controlled crowbar 1 1 closes the

Supply line 8 short. Due to the short circuit, the power supply to the hazardous area is completely interrupted. The interruption by the crowbar 1 1 may be reversible or irreversible. Based on Fig. 4, the operation of a timed Crowbars 1 1 according to the invention is illustrated in the supply line 8. The energy is transferred from a potentially explosive area C4 to a hazardous area C6. About the control voltage Vst - it is in the case shown, a square-wave voltage - is immediately before the closing of the switch S, the crowbar 1 1 for the duty cycle t of the downstream components 12 connected to high impedance. The maximum power, which is transferred in the range C6, is calculated with a Limiting resistance Rbeg. = 5 ohms, a duty cycle of t = 2ms and a period T = 200 using the formula below to 22.5mW.

U ²

2 · Rbeg.

With a limiting resistor of 5 ohms, without the time-limited limit, it would have been only 2.25mW in the hazardous area C6. By means of the solution according to the invention, it is therefore possible to considerably increase the power transmitted to the potentially explosive area.

Under the boundary conditions that the components - with or without encapsulation - have a sufficiently high thermal inertia and that the

Duty cycle t to the period T over a Crowbar 1 1 is monitored safety technology, it is possible according to the invention to briefly supply a high power components without the maximum surface temperature is exceeded.

The operation of the crowbar 1 1 is described below: In the case shown, the transistor V is an N-channel depletion MOSFET. Depletion MOSFETs have the property that in the event that the connection between gate G and source S is zero, the voltage between drain D and source S are low-impedance. This feature ensures that the Crowbar 1 1 will always assume the safe state, right down to the lowest operating voltages.

As long as the crowbar 1 1 is in the low-resistance state, the control voltage Vst is in the HIGH state and the capacitor C charges via the resistors R1 and R2 to the HIGH voltage. In order for the

Switching duty cycle t into the high-impedance state, the

Control voltage Vst switched to zero or LOW (= 0 V). To the gate G of the transistor V is then connected via the diode D to the capacitor C, a negative voltage equal to the HIGH voltage minus the

Threshold voltage of the diode D applied. The transistor V is in the high-resistance state, namely until either the control voltage Vst returns to the high state, or until the

Capacitor C has discharged via the resistor R2 below the threshold voltage of the transistor V. This state corresponds to a safe state in the event that the switched by the control unit 16 duty cycle t exceeds the maximum allowable duty cycle. Since the resistor R1 is substantially larger than the resistor R2, it limits the charging of the capacitor C and thus prevents too short a period T. Thus, it is also ensured that the crowbar 1 1 responds when the of the

Control unit switched period T falls below the predetermined period T.

To make sure that they are put to the safety module

Safety requirements even then apply if the Crowbar 1 1 shown in detail in Fig. 4 fails, the Crowbar 1 1 is redundant. In the case shown, the backup over the Crowbars 1 1 triple redundant executed.

LIST OF REFERENCE NUMBERS

1 container

2 contents

3 Surface of the product

4 lids

5 opening

6 Level gauge / field device

7 connection line

8 connection line / supply line

9 control / evaluation unit / sensor electronics

10 antenna

1 1 crowbar

12 Downstream component / RF module

13 transistor

14 resistance / resistors for power limitation

15 resistors for intrinsic safety of the interface

16 microprocessor

17 interface

Claims

claims

1. Electrical or electronic safety module (1 1), via at least one supply line (8) with at least one in one

hazardous area downstream component (12)

is connected and this protects by monitoring the power supply via the supply line (8) in dependence on the required in the hazardous area Zündschutzart, wherein the at least one downstream component (12) is operated clocked such that their duty cycle is smaller than the period the clocking,

characterized,

in that the electrical or electronic safety module (11) is at least one time-controlled crowbar or a time-controlled short-circuit switch, the crowbar (11) being designed such that it controls the on-time of the at least one downstream electronic component (12) the period of the clocking and thus the

Power supply monitored such that a predetermined in the hazardous area maximum surface temperature of the at least one downstream component (12) is not exceeded.

2. Electrical or electronic safety assembly according to claim 1, characterized in that

an external control unit (9) is provided which controls the power supply transmitted via the at least one supply line (8) and monitored by the at least one time-controlled crowbar (11) such that the switch-on duration of the downstream component (12) is at a maximum during the period is minimal, without the timed Crowbar (1 1) is active and turns off the power supply.

3. Electrical or electronic safety assembly according to claim 1, characterized in that wherein the Crowbar (1 1) is a safety assembly, which serves to limit an intrinsically safe circuit including the highest type of protection, eg the type of protection Ex ia.

4. Electrical or electronic safety assembly according to claim 1, 2 or 3

characterized,

that the crowbar (1 1) is designed to be multiple redundant, wherein the number of redundant crowbars (1 1) is selected depending on the type of protection in the hazardous area.

5. Electrical or electronic safety assembly according to one of claims 1 -4,

characterized,

in that the crowbar (11) has a transistor (13) or a thyristor which has the property that it has a low resistance at a voltage across gate (G) and source (S) equal to zero between drain (D) and source (S) is.

6. Electrical or electronic safety assembly according to one of claims 1 -5,

characterized,

wherein the monitored downstream component (12) or the

Downstream monitored components associated with a field device (6) for determining and / or monitoring a physical or chemical process variable.

7. Electrical or electronic safety assembly according to claim 6, characterized

in that the field device (6) is a microwave radar measuring device which in particular determines the fill level of a filling material (2) in a container (1) via a transit time method.

8. Electrical or electronic safety assembly according to claim 6 or

7,

characterized,

in that the microwave radar measuring device (6) has an antenna unit (1 1), a high-frequency module (12) and sensor electronics (9), wherein the high-frequency module (generates the high-frequency measurement signals, wherein the high-frequency measurement signals via the antenna unit (1 1) emitted or on the surface (3) of the medium (2) reflected high-frequency

Measuring signals are received, and wherein the sensor electronics (9) based on the transit time difference between the emitted and the received high-frequency measurement signals determines the level of the filling material (2) in the container (1).

9. Electrical or electronic safety assembly according to one or more of the preceding claims,

characterized,

in that the sensor electronics (9) and the high-frequency module (12) are spaced apart from one another, that the energy transfer from the sensor electronics (12) to the high-frequency module (9) takes place via the at least one supply line (8), and that communication data between the sensor electronics (9) and the high-frequency module (12) via at least one signal line (7) are transmitted.

10. Electrical or electronic safety assembly according to one or more of the preceding claims,

characterized,

that the sensor electronics (9) is designed intrinsically safe.

1 1. Electrical or electronic safety assembly according to one or more of the preceding claims,

characterized, in that the at least one supply line (8) is controlled via at least one controlled crowbar (11) or via at least one controlled one

Short-circuit switch is secured, and that existing signal lines (7) and possibly other transmission lines via in the signal and

Transmission lines (7) resistors (15) are limited in terms of a maximum line supply, the maximum power in the hazardous area is sized so that the criteria for the given type of protection are met.