EP2834826B1 - Safety switch device with switching element in an electric path comprising auxiliary contacts - Google Patents

Description

The present invention relates to a safety switching device for fail-safe switching on or off of a technical system. The safety switching device has a fail-safe control / evaluation unit with an input for receiving an input signal. The fail-safe control / evaluation unit is designed to process the input signal in order to generate an output signal for switching the technical system on or off depending on an output signal time. The fail-safe control / evaluation unit has a first output for transmitting the output signal to an electromechanical switch. The electromechanical switch has a normally open contact for switching a load circuit of the technical system and a positively driven auxiliary contact in an auxiliary contact current path, via which a current can be conducted at an applied defined voltage for checking the switching position of the normally open contact.

The invention further relates to a safety switching system with such a safety switching device and with a spatially separated switching device with the electromechanical switch.

The invention further relates to a method for operating a fail-safe control / evaluation unit of a safety switching device for fail-safe switching on or off of a technical system. The method includes the steps of receiving an input signal at an input of the fail-safe control / evaluation unit, processing the input signal to generate an output signal for turning on or off the technical equipment in response to an output signal timing, and, at a first Output of the fail-safe control / evaluation unit, transmitting the output signal to an electromechanical switch. The electromechanical switch has a normally open contact for switching a load circuit of the technical system and a positively driven auxiliary contact in an auxiliary contact current path, via which a current can be conducted at an applied defined voltage for checking the switching position of the normally open contact.

A safety switching device and a safety switching system of this type are made DE 10 2004 033 359 A1 and from DE 199 44 461 C1 known.

A safety switching device or a fail-safe control / evaluation unit in the sense of the present invention is any switching device or control / evaluation unit (for example CPU or microcontroller) which meets the required safety standards, in particular at least category 3, preferably even category 4, and / or a corresponding PL (Performance Level) according to the standard EN ISO 13849-1 and / or a corresponding SIL (Safety Integrity Level) according to EN / IEC 62061 or a comparable safety standard, for example the now no longer valid European standard EN 954-1. These include in particular switching devices, safety controllers, and sensor and actuator modules, which are used for the control and implementation of safety-critical tasks in the field of industrial production environments. In particular, switching devices are known which monitor the operating position of an emergency stop switch or a protective door or, for example, the functional state of a light barrier and depending on a machine or switch off a machine area. Failure of such safety switching devices can be life-threatening consequences for machine personnel, which is why safety switching devices may only be used if they are approved by the competent supervisory authorities (in Germany, for example, the professional associations).

The aforementioned DE 10 2004 033 359 A1 discloses an apparatus for securing an automated robot. The device includes a safety switching device that controls two external switching elements on the output side. On the input side, the safety relay receives one or more input signals from appropriately connected signal generators. The recorded input signals or signals are fed to an evaluation and control unit, which is preferably constructed mehrschuligredundant. In the preferred embodiment, the safety switching device includes two output-side relay whose switching position is determined by the evaluation and control unit. Each relay has a number of positively driven NO and NC contacts.

In safety engineering, the electromechanical switch, for example, a relay or contactor, usually a normally open contact, also called normally open contact, and a forcibly guided auxiliary contact, also called normally closed contact on. Forced means in this context that the normally open contact and the auxiliary contact are mechanically connected to each other so that always normally open contact and auxiliary contact can not be closed simultaneously. That is, the auxiliary contact (or normally closed contact) is closed when the normally open contact (or normally open contact) is open, and vice versa. The normally open contact is arranged in the load current path or circuit of the technical system so that it can switch the current to the technical system on or off. The auxiliary contact is arranged in a separate auxiliary contact current path or circuit, also known as feedback loop (RSK) (in English "feed back loop"). Due to the forced operation between the make contact and the auxiliary contact, the switching position of the normally open contact can be checked by a current or a signal in the auxiliary contact current path, for example by a read-back logic.

The electromechanical switch with the working and auxiliary contact can be arranged spatially separated from the safety switching device. Alternatively, however, the electromechanical switch can also be arranged inside the safety switching device or the housing.

For example disclosed DE 199 54 460 A1 a safety switching device for switching on and off safely an electrical load, in particular an electrically driven machine having a first and a second electromechanical switching element, the normally open contacts are arranged in series with each other between a first input terminal and an output terminal of the switching device. In addition, each of the two switching elements has an auxiliary contact, which is forcibly guided with the respective working contacts. The auxiliary contacts of the two switching elements are also connected in series with each other. With the help of a current that is passed through the auxiliary contacts, it is therefore possible to check the switching position of the normally open contacts of the switching elements, without interfering directly with the working group of the switching elements.

A safety switching device in the sense of the present invention may be, for example, a safety switching device for a configurable or programmable controller. It may be a safety switch for a configurable controller such as that sold by the assignee of the present invention under the trademark PNOZ®, or a programmable controller safety switch such as those assigned to the assignee of the present invention under the trademark PSS® sells, or one of these similar. Under configurable here is to understand the adjustment or setting of a hardware component of the controller, such as a wiring. Programmable here is to understand the adaptation or setting of a software component of the controller, for example by means of a programming language.

In the manual "PNOZmm0p, Configurable Control System PNOZmulti, Operating Manual - No. 1001274-EN-04" a safety switching device is disclosed which sells the assignee of the present invention under the trademark PNOZ®. At each safety output O0, O1, 02, 03 with extended fault detection For applications according to EN IEC 62061, SIL CL 3 two loads may be connected. The prerequisite for this is, inter alia, that a feedback circuit is connected to an input.

In the instruction manual "PSSuniversal, Programmable control systems PSS®, System Description - No. 21256-EN-04" a safety switching device is disclosed which markets the assignee of the present invention under the trademark PSS®. This device has a feedback circuit input (RFK input) and a feedback loop logic (RFK logic).

An issue with such safety switching devices is often to reduce or optimize energy consumption.

Against this background, it is an object of the present invention to provide a safety switching device, a safety switching system and a method of the type mentioned, the energy-saving or energy-efficient work.

According to a first aspect of the invention, this object is achieved by a safety switching device of the type mentioned above, with a switching element arranged in the auxiliary contact current path, wherein the fail-safe control / evaluation unit is designed to generate a switching signal at a switching signal time with a time interval to the output signal Time, and wherein the fail-safe control / evaluation unit has a second output for transmitting the switching signal to the switching element, which is designed to switch on receiving the switching signal, the current through the auxiliary contact current path.

According to a further aspect of the invention, this object is achieved by a method for operating a control / evaluation unit of a safety switching device of the type mentioned, comprising the steps of: generating a switching signal at a switching signal time with a time interval to the output signal time, and at a second output of the control / evaluation unit

Transmitting the switching signal to a arranged in the auxiliary contact current path switching element, which is designed to switch upon receiving the switching signal, the current through the auxiliary contact current path.

The new safety switching device thus uses an additional switching element in the auxiliary contact current path or circuit, which is controlled by the control / evaluation unit. The switching element is arranged in particular in series with the auxiliary contact. By corresponding, controlled by the control / evaluation, switching the switching element can be achieved so that only at certain times a current flows in the auxiliary contact current path, and not permanently. The current in the auxiliary contact current path can therefore only be switched on when needed. This leads to a lower power consumption and / or heat development in the auxiliary contact current path, for example via a load element. Thus, a more energy-efficient or energy-efficient safety switching device is provided.

In known safety switching devices, a current flows permanently in the auxiliary contact current path, for example via a load element for setting a defined current. This is particularly the case when the technical system is turned off for a long time, that is, the normally open contacts in the load circuit of the technical system are open and the positively driven auxiliary contacts are therefore closed. This permanent current leads to an increased power consumption or additional heat generation.

Overall, the new safety switching device, the new safety switching system and the new method therefore allow increased energy savings and energy efficiency.

In one embodiment, the fail-safe control / evaluation unit is designed, when it generates the output signal in the form of a switch-on signal for switching on the technical system at a first output signal time, the switching signal in the form of a switch-on signal for switching on the switching element a first switching signal timing, which is before the first output signal time to produce.

In this embodiment, a current through the auxiliary contact current path can flow only briefly to or before switching on the technical system. Thus, the current flows only when it is needed, as for checking the switching position of the normally open contact or switching on the technical system or dangerous machine. Only a used power consumption and / or heat generation when switching on the technical system is achieved. The switching element is in particular designed to switch on the current through the auxiliary contact current path upon receiving the switching signal.

In a variant of this embodiment, the fail-safe control / evaluation unit is designed to generate a further switching signal in the form of a switch-off signal for switching off the switching element to a further switching signal time, which is after the first output signal time.

In this variant, the switching element is switched off again after it is no longer needed. This leads to a further reduced power consumption and / or heat efficiency, in particular when still other elements are driven by the switching element, such as multiple auxiliary contact current paths of the plurality of electromechanical switches.

In an alternative or cumulative embodiment, the fail-safe control / evaluation unit is formed when it generates the output signal in the form of a switch-off signal for switching off the technical system at a second output signal time, the switching signal in the form of a switch-off signal for switching off the switching element to a second switching signal. Time, which is after the second output signal time to produce.

In this embodiment, a current can be supplied to the auxiliary contact current path only briefly to or after switching off the system. The current therefore flows only when it is needed, for example, to check the switching position of Working contact or read back after switching off the machine. There is thus provided a reduced power consumption and / or heat generation when switching off the machine. The switching element is in particular designed to switch off the current through the auxiliary contact current path upon receipt of the switch-off signal.

In a variant of this embodiment, the fail-safe control / evaluation unit is designed to generate a further switching signal in the form of a switch-on signal for switching on the switching element to a further switching signal time, which is before the second output signal time.

In this variant, the switching element is turned on again before it is needed again, so it is provided a further reduced power consumption and / or heat development, especially if other elements are controlled by the switching element, such as multiple auxiliary contact current paths of the plurality of electromechanical switches.

In a further embodiment, the fail-safe control / evaluation unit has at least two first outputs for transmitting in each case one output signal to one electromechanical switch, wherein in particular the switching element is arranged in each of the auxiliary contact current paths of the auxiliary contacts of the electromechanical switches.

In this embodiment, a single switching element is used for auxiliary contact current paths of a plurality of electromechanical switches. It provides a simple and inexpensive implementation. This embodiment can be used in particular in connection with the above-mentioned re-switching after the power is needed and / or the above-mentioned restarting when the power is needed again. In this case, even lower power consumption and / or heat efficiency is achieved.

In a further refinement, the fail-safe control / evaluation unit has at least two first outputs for transmitting an output signal in each case in each case an electromechanical switch, wherein in particular the safety switching device has at least two switching elements, which are each arranged in one of the auxiliary contact current paths of the auxiliary contact current paths of the auxiliary contacts of the electromechanical switch.

In this embodiment, one switching element is used for each auxiliary contact current path of each of a plurality of electromechanical switches. The power consumption or the energy can be lowered so maximally.

In a further embodiment, the safety switching device has a read-back logic with an input connected to the auxiliary contact current path for receiving a read-back signal for checking the switching position of the normally open contact.

In this embodiment, a check is possible by the read-back logistics, whether the electromechanical switch is working properly or welded, for example. There is thus provided an increased security. The read-back logic can be implemented in the control / evaluation unit or in a separate processing unit. Before the read-back logic, a read-back circuit may be connected, which has a voltage adjustment and / or a filter.

In a variant of this embodiment, the readback logic is designed to check the switching position of the normally open contact to a first readback time, which is before the first output signal time, in particular after the first switching signal time.

In this variant, a check of the electromechanical switch before switching on the technical system is possible. It can be checked whether the normally closed contact is or is switched on and, for example, not welded. In particular, the first readback time may lie between the first switch signal time and the first output signal time. It will be like that Period used in which the switching element is turned on, but the auxiliary contact is not yet open.

In an alternative or cumulative variant, the readback logic is designed to check the switching position of the normally open contact at a second readback time, which is after the second output signal time, in particular before the second switch signal time.

In this variant, a check of the electromechanical switch after switching off is possible. It can be checked so that the normally open contact has risen or switched off and, for example, not welded. The second readback time may in particular be between the second output signal time and the second switch signal time. It is used as the period in which the switching element is turned on and the auxiliary contact is opened again.

In a further refinement, the safety switching device has a loading element arranged in the auxiliary contact current path for defining a defined current through the auxiliary contact current path when the defined voltage is applied.

In this embodiment, a defined current can be provided in the auxiliary contact current path, in particular corresponding to or exceeding a minimum current or a minimum power. Only when this minimum current or minimum power is present or exceeded can a low-resistance contact resistance of the auxiliary contact be guaranteed. There is therefore provided improved contact security. The minimum current or the minimum power is a property of the respective auxiliary contact, which can be specified by the manufacturer of the electromechanical switch, for example. The load element can in particular be dimensioned such that the minimum current and / or the minimum power is guaranteed. The power consumption and / or the thermal efficiency of the loading element is dependent on the selected load element. The loading element may in particular be a load resistance. It provides a simple and inexpensive way to define the defined current. Alternatively, however, can any other suitable loading element may be used, such as a current sink (eg electronic load).

In a further embodiment, the switching element is an electronic switching element, in particular a transistor.

With this configuration it is achieved that the switching element or the transistor switches much faster than the electromechanical switch. The time interval between the switching signal time and the output signal time can thus be much smaller than the maximum switching frequency of the electromechanical switch.

In a further embodiment, the safety switching device has the electromechanical switch.

In this embodiment, the electromechanical switch is part of the safety switching device. In particular, the electromechanical switch can be arranged within the housing of the safety switching device. For example, there may be an output terminal on the housing that can be connected to the load circuit of the technical system. It is thus an immediate switching on or off of the technical system allows. Therefore, a compact safety switching device can be provided. The safety switching device can be connected directly to the load circuit.

In a further embodiment, the safety switching device has a arranged on a housing of the safety switching device and connected to the first output output terminal for driving the electromechanical switch.

In this embodiment, the electromechanical switch is not part of the safety switching device or not disposed within the housing of the safety switching device. It will be an indirect on or off the technical facility allows. The electromechanical switch can be arranged in a separate from the safety switching device spatially separated or separate switching device. The safety switching device and the switching device then together form the safety switching system. The spatially separated switching device may comprise an input terminal arranged on a housing of the switching device for receiving the output signal. By using a spatially separated switching device so increased security is provided, especially at higher currents to be switched, as in the use of shooters.

It is understood that the features mentioned above and those yet to be explained below can be used not only in the particular combination given, but also in other combinations or in isolation, without departing from the scope of the present invention.

Fig. 1

eine vereinfachte Darstellung einer technischen Anlage mit einem Ausführungsbeispiel der Sicherheitsschaltvorrichtung,

Fig. 2

eine vereinfachte Darstellung eines ersten Ausführungsbeispiels der neuen Sicherheitsschaltvorrichtung,

Fig. 3

eine vereinfachte Darstellung eines zweiten Ausführungsbeispiels der neuen Sicherheitsschaltvorrichtung,

Fig. 4

Diagramme des zeitlichen Verlaufs von Zuständen verschiedener Elemente der Sicherheitsschaltvorrichtung nach einem Schaltschema,

Fig. 5

Diagramme des zeitlichen Verlaufs von Zuständen verschiedener Elemente der Sicherheitsschaltvorrichtung nach einem weiteren Schaltschema,

Fig. 6

eine vereinfachte Darstellung eines dritten Ausführungsbeispiels der neuen Sicherheitsschaltvorrichtung,

Fig. 7

eine vereinfachte Darstellung eines vierten Ausführungsbeispiels der neuen Sicherheitsschaltvorrichtung bzw. des Sicherheitsschaltsystems,

Fig. 8

eine vereinfachte Darstellung eines fünften Ausführungsbeispiels der neuen Sicherheitsschaltvorrichtung, und

Fig. 9

eine vereinfachte Darstellung eines sechsten Ausführungsbeispiels der neuen Sicherheitsschaltvorrichtung.

Embodiments of the invention are illustrated in the drawings and are explained in more detail in the following description. Show it:

Fig. 1

a simplified representation of a technical system with an embodiment of the safety switching device,

Fig. 2

a simplified representation of a first embodiment of the new safety switching device,

Fig. 3

a simplified representation of a second embodiment of the new safety switching device,

Fig. 4

Diagrams of the time course of states of various elements of the safety switching device according to a circuit diagram,

Fig. 5

Diagrams of the time course of states of various elements of the safety switching device according to a further circuit diagram,

Fig. 6

a simplified representation of a third embodiment of the new safety switching device,

Fig. 7

a simplified representation of a fourth embodiment of the new safety switching device or the safety switching system,

Fig. 8

a simplified representation of a fifth embodiment of the new safety switching device, and

Fig. 9

a simplified representation of a sixth embodiment of the new safety switching device.

In Fig. 1 is a technical system 10 with an embodiment of the safety switching device 1 for fail-safe switching on or off of the technical or dangerous system 10 is provided. In this exemplary embodiment, the system 10 includes, by way of example, a robot 12 whose movements during operation constitute a danger to persons who are in the working area of the robot 12. For this reason, the working area of the robot 12 is secured with a protective fence with a protective door 14. The protective door 14 allows access to the working area of the robot 12, for example for maintenance or set-up. In normal operation, however, the robot 12 may only operate when the protective door 14 is closed. Once the guard door 14 is opened, the robot 12 must be turned off or otherwise brought to a safe condition.

In order to detect the closed state of the protective door 14, a protective door switch with a door part 16 and a frame part 18 is attached to the protective door 14. The frame part 18 generates on a line 20 a protective door signal which is supplied via the line 19 of the new safety switching device 1.

The safety switching device 1 in this embodiment has an I / O portion 24 having a plurality of terminals (or external or device terminals) 25. In some embodiments, the terminals 25a, 25b are terminals or field terminals mounted on a housing side of the housing 27 of the safety switching device 1 are arranged. For example, it may be spring terminals or screw terminals. In other embodiments, the terminals may be plugs or sockets that include a plurality of contact elements (pins), with one pin each forming a terminal. Frequently, five-pin M8 sockets are used to connect signaling devices or other field-level sensors. Accordingly, embodiments of the new safety switching device may be or include field devices located outside of a cabinet in close proximity to the robot 12.

The safety switching device 1 has a fail-safe control / evaluation unit 28. The safety switching device 1 has in this embodiment, two redundant signal processing channels. By way of example, two processing units or microcontrollers 28a, 28b are shown here, which are each connected to the I / O part 24 or the connections 25a, 25b. The microcontroller 28a, 28b process here redundant to each other at the inputs 34a, 34 b applied input signals that receives the safety switching device 1 to the device terminals 25a, 25b and inputs of the I / O portion 24, and they compare their results, which an arrow 29 is shown. Instead of two microcontrollers 28a, 28b, microprocessors, ASICs, FPGAs, and / or other signal processing circuitry may be used. Therefore, embodiments of the safety switching device 1 preferably have at least two mutually redundant signal processing channels which are each capable of making logical signal connections in order to generate an output signal at each output 36a, 36b depending thereon. This output signal is then used to drive a switching element 30a, 30b or an electromechanical switch 40a, 40b to switch off the technical system 10 or the robot 12. Such a safety switching device 1 can then be used for fail-safe (FS) shutdown of the system 10, here the robot 12.

In the case shown here, the safety switching device 1 has two redundant switching elements 30a, 30b, here electronic switching elements 30a, 30b in the form of a transistor. Each of these two switching elements is capable of switching on a high voltage potential V to a device connection 38a, 38b of the safety switching device 1 in order to enable a current flow to an electromechanical switch 40a, 40b or to interrupt this current flow. Thus, each of the switching elements 30 can switch off an electromechanical switch 40, such as a contactor.

The electromechanical switches 40a, 40b each have a normally open contact 42a, 42b. The normally open contacts 42a, 42b are arranged here in series with one another in a power supply path or load circuit 49 from a power supply 48 to the robot 12. The electromechanical switches 40a, 40b also each have an auxiliary contact 44a, 44b, which is forcibly guided to the corresponding normally open contact 42a, 42b. The auxiliary contacts 44a, 44b are arranged here in series with each other in an auxiliary contact current path 45 with an applied voltage V1. The voltage V1 of the auxiliary circuit may be 24 V, for example. The voltage of the load circuit can be higher. As soon as the safety switching device 1 switches off the electromechanical switches 40a, 40b, the working contacts 42 drop out and the power supply for the robot 12 is switched off. Those skilled in the art will appreciate that such a "radical" shutdown is exemplified herein. Deviating from this, in the case of a safety requirement, only parts of the robot 12 can be switched off, such as the dangerous drives, while other parts of the robot 12 remain functional. A delayed shutdown is also conceivable, so that the robot 12 may possibly be braked controlled before switching off the drives.

The safety switching device 1 controls the switching elements 30a, 30b here, for example as a function of the input signal of the safety door switch on the line 19 at the terminal or input 25a and in response to a further input signal from an emergency stop button 32 at the terminal or input 25b. Also, the emergency stop button 32 is connected via lines with device connections of the safety switching device 1. Preferably, each of the input signals can be redundant or two input and output lines or connections can be provided in each case be (in Fig. 1 not shown). In the in Fig. 1 Thus, for the emergency stop button 32, two input lines or inputs 25b may be provided, each providing an input signal from the emergency stop button 32. The same applies to the signal of the safety door switch.

In some embodiments, the safety switching device 1 generates output signals that are supplied to the individual signaling devices. By way of example, such an output signal is led via a line 33 to the frame part 18 of the safety door switch. The frame member 18 grinds the output signal of the safety switching device 1 from the line 33 to the line 19 when the door part 16 is in the vicinity of the frame part 18, that is, when the protective door 14 is closed. Therefore, the safety switching device 1 can monitor the safety door switch with the aid of the output signal on the line 33 and with the aid of the input signal on the line 19. In a comparable manner, the safety switching device 1 monitors the emergency stop button 32 here.

Deviating from the illustration in Fig. 1 In practice, two redundant output signals of the safety switching device 1 are often used, which are each guided via a separate signal line to a signaling device and are looped back to the safety switching device 1 via this signaling device. Exemplary of such a realization is on DE 10 2004 020 995 A1 which is incorporated by reference for details of such redundant monitoring of a reporting device. Also, the emergency stop button 32 is often monitored in practice with redundant input and output lines, as mentioned above.

Fig. 2 shows a simplified representation of a first embodiment of the new safety switching device 1, for example with reference to Fig. 1 described safety switching device. The fail-safe control / evaluation unit 28 has a first input 34 for receiving an input signal and is configured to process the input signal to generate an output signal A for switching on or off the technical system 10 in dependence thereon at an output signal time. For this purpose, the fail-safe control / evaluation unit 28 has a first output 36 for transmitting the output signal A to an electromechanical switch 40 Fig. 2 a corresponding connection or line between the first output 36 and the electromechanical switch 40 can be seen. The electromechanical switch 40 has a normally open contact 42 for switching a load circuit 49 of the technical system 10 and a positively driven auxiliary contact 44 in an auxiliary contact current path 45. A current can be conducted via the auxiliary contact 44 or the auxiliary contact current path 45 at an applied defined voltage V1 (eg 24 V) for checking the switching position of the normally open contact 42. This can be done, for example, by a readback logic which has a second input connected to the auxiliary contact current path 45 58 for receiving a readback signal for checking the switching position of the normally open contact 44 has. As in Fig. 2 For this purpose, a connection or line from the auxiliary contact current path 45 to the second input 58 is provided. It is possible to check whether the normally open contact 40 is working properly or welded. In the exemplary embodiment illustrated here, the readback logic is implemented in the control / evaluation unit 28. Alternatively, the readback logic may also be implemented in a separate processing unit.

The safety switching device 1 includes a switching element 50 arranged in the auxiliary contact current path 45. The switching element 50 is arranged in series with the auxiliary contact 44. Therefore, the current in the auxiliary contact current path is interrupted as soon as either the auxiliary contact 44 or the switching element 50 is opened. The current in the auxiliary contact current path only flows when both the auxiliary contact 44 and the switching element 50 are closed. The fail-safe control / evaluation unit 28 is designed to generate a switching signal S at a switching signal time with a time interval to the output signal time. The fail-safe control / evaluation unit 28 has a second output 52 for transmitting the switching signal S to the switching element 50, which is designed to switch the current through the auxiliary contact current path 45 when the switching signal S is received. In Fig. 2 a corresponding connection or line between the second output 52 and the switching element 50 can be seen. The safety switching device 1 thus uses an additional switching element 50 in the auxiliary contact current path 45, which is controlled by the control / evaluation unit 28. By corresponding, controlled by the control / evaluation unit 28, switching of the switching element 50 can be achieved so that only at certain times a current in the auxiliary contact current path 45 flows, and not permanently. The time interval can in particular be small enough so that no delay of the switching operation of the electromechanical switch 40 occurs and / or be large enough so that a significant current in the auxiliary contact current path 45 can flow, such as required for checking the switching position of the normally open contact 42 and for a readback signal. The time interval between the switching signal time and the output signal time can be, for example, in the microsecond range, for example between 1 and 100 msec, in particular between 10 and 50 msec, in particular between 20 and 40 msec.

In the embodiment shown here, the switching element 50 is an electronic switching element in the form of a transistor. The transistor 50 can switch much faster than the electromechanical switch 40. The time interval between the switching signal timing and the output signal timing can thus be much smaller than the maximum switching frequency of the electromechanical switch 40. It will be understood by those skilled in the art Also, another suitable type of switching element can be used.

In the in Fig. 2 In the embodiment shown, the safety switching device 1 has a loading element 54 arranged in the auxiliary contact current path 45 for defining a defined current through the auxiliary contact current path 45 when the defined voltage V1 is applied. It is thus possible to provide or guarantee a minimum current or a minimum power of the auxiliary contact 44 in the auxiliary contact current path 45. Only when the minimum current or the minimum power is present or exceeded can a low-resistance contact resistance of the auxiliary contact 44 be guaranteed. The loading element 54 can in particular be dimensioned such that the minimum current and / or the minimum power is ensured. In the embodiment shown here, the loading element 54 is a load resistance. Alternatively, however, any other suitable loading element may be used, such as a current sink (eg, electronic load). For example, the loading element can also be realized in a read-back circuit. In this case, the read-back circuit would be designed to set the defined current or the minimum current or minimum power.

Fig. 3 shows a simplified illustration of a second embodiment of the new safety switching device. The second embodiment of the Fig. 3 is based on the first embodiment of Fig. 2 so that the comments on the embodiment of Fig. 2 also for the embodiment of Fig. 3 hold true. In the embodiment of Fig. 3 For example, transistor 50 is located in auxiliary contact current path 45 above or before auxiliary contact 44, and not below or after, as in FIG Fig. 2 , Those skilled in the art will appreciate that these arrangements of the switching element or transistor in the auxiliary contact current path are interchangeable.

In the embodiment of Fig. 3 Furthermore, a read-back circuit 56 is connected in front of the read-back logic (here in the control / evaluation unit 28). The read-back circuit includes, for example, a voltage adjustment for converting the voltage V1 of the auxiliary current path 45 into a voltage suitable for the input 58 of the read-back logic or the control / evaluation unit 28. The readback circuit also includes, for example, a filter such as a low pass filter for filtering a possible bounce of the auxiliary contact 44.

Fig. 4 shows diagrams of the time history of states of various elements of the safety switching device 1 according to a circuit diagram, in particular the previously with reference to Fig. 2 or Fig. 3 described safety switching device 1. In Fig. 4a the course over the time t of the switching state ST42 of the normally open contact 42 and the output signal A is shown. The term output signal A is to be understood here in particular as a change or an edge in the switching state ST42. In Fig. 4b the course over the time t of the switching state ST44 of the positively driven auxiliary contact 44 is shown. In Fig. 4c the course over the time t of the switching state ST50 of the switching element 50 or the switching signal S is shown. The term switching signal S is to be understood here in particular as meaning a change or an edge in the switching state ST50. In Fig. 4a-c The state 0 indicates the open state of the contact or switching element, respectively, and the state 1 respectively indicates the closed state of the contact or switching element. Furthermore, in Fig. 4d the course over the time t of the power loss P _V54 over the loading element 54 is shown.

The method for operating the control / evaluation unit 28 based on the Fig. 4 explained. The method includes first receiving the input signal at the input 34 of the fail-safe control / evaluation unit 28, processing the input signal to produce the output signal A for turning on or off the technical equipment 10 in response to an output signal time t1, t2, and, at the first output 36 of the fail-safe control / evaluation unit 28, transmitting the output signal A to an electromechanical switch 40. In the in Fig. 4a illustrated course of the output signal A, the output signal A in the form of a turn-on signal A1 for switching on the technical system is generated at a first output signal time t1. The switch-on signal is shown here in the form of a positive edge or a change from state 0 (open) to state 1 (closed). At the first output signal time t1, the normally open contact 42 is thus closed, as a result of which the positively driven auxiliary contact 44 is opened, as in the switching state ST44 Fig. 4b to see. The technical system is now turned on due to the closed by the contact 42 load circuit. In the in Fig. 4a illustrated course of the output signal A, the output signal A is then generated at a second output signal time t2 in the form of a switch-off signal A2 for switching off the technical system. The switch-off signal is shown here in the form of a negative edge or a change from state 1 (closed) to state 0 (open). At the second output signal time t2, the normally open contact 42 is thus opened again, as a result of which the positively driven auxiliary contact 44 is closed again, as in the switching state ST44 Fig. 4b to see. The technical system is now switched off again due to the opened by the normally open contact 42 load circuit.

Furthermore, a switching signal S is generated at a switching signal time t3, t4 at a time interval Δt3, Δt4 at the output signal timing t1, t2, as in FIG Fig. 4c shown. At the second output 52 of the control / evaluation unit 28, the switching signal S is then transmitted to the arranged in the auxiliary contact current path 45 switching element 50, which is designed upon receipt of the switching signal S to switch the current through the auxiliary contact current path 45. In Fig. 4 If the output signal A is generated at the first output signal time t1 in the form of the turn-on signal A1, then the switching signal S in the form of a turn-on signal S1 for turning on the Switching element 50 at a first switching signal time t3, which is before the first output signal time t4 generated. The switching element 50 switches off the current through the auxiliary contact current path 45 upon receipt of the switch-off signal S1. The time interval between the first switching signal time t3 and the first output signal time t1 is marked Δt3. Thus, the current in the auxiliary contact current path flows only between the first switching signal time t3 when the switching element 50 is closed when the auxiliary contact 44 is closed and the first output signal time A1 when the auxiliary contact 44 is opened. The current through the auxiliary contact current path can thus flow only briefly to or before switching on the technical system. A power dissipation P _V54 across the loading element 54 can therefore only occur between the first switching signal time t3 and the first output signal time t1, as in FIG Fig. 4d to see.

On the other hand, when the output signal A in the form of the turn-off signal A2 is generated at the second output timing t2, the switching signal S is turned off in the form of a turn-off signal S2 to turn off the switching element 50 at a second switching signal timing t4 after the second output timing t3 is generated. The switching element 50 turns on receiving the turn-on signal S2, the current through the auxiliary contact current path 45 a. The time interval between the second output signal time t2 and the second switching signal time t4 is designated Δt4. Thus, the current in the auxiliary contact current path flows only between the second output signal time t2 when the auxiliary contact 44 is closed when the switching element 50 is closed, and the second switching signal time t4 when the switching element 50 is opened. The current over the auxiliary contact current path can thus flow only briefly to or after switching off the technical system. A power dissipation P _V54 across the loading element 54 can therefore only occur between the second switch-off time t 2 and the second switch signal time t 4, as in FIG Fig. 4d to see.

Fig. 5 shows diagrams of the time history of states of various elements of the safety switching device according to another circuit diagram. The circuit diagram of Fig. 5 based on the wiring diagram of Fig. 4 , so that the comments on the wiring diagram of Fig. 4 also for the circuit diagram of Fig. 5 hold true. In Fig. 5a is the course over the time t of the switching state ST42 of the normally open contact 42 and the output signal A, and in Fig. 4b the course over the time t of the switching state ST44 of the positively driven auxiliary contact 44 is shown. In Fig. 5c the readback times t _{RL of} the readback logic are shown. In Fig. 5d the course over the time t of the switching state ST50 of the switching element 50 or the switching signal S is shown, and in Fig. 5e the course over the time t of the power loss P _{V54 is shown} over the loading element 54.

In Fig. 5 is another switching signal S in the form of a switch-off signal S2 for switching off the switching element 50 at a further switching signal time t5, which is after the first output signal time t1 generated. The time interval between the first output signal time t1 and the further switch signal time t5 is designated Δt5. The switching element 50 is turned off again after it is no longer needed. In Fig. 5 Furthermore, a further switching signal S in the form of a turn-on signal S1 for turning on the switching element 50 at a further switching signal time t6, which is before the second output signal time t2 generated. The time interval between the further switching signal time t6 and the second output signal time t2 is marked Δt6. The switching element 50 is turned on again before it is needed again. In the circuit diagram of Fig. 5 Thus, the switching element 50 is switched off after switching on the system, and turned on again before the system is turned off. Thus, the switching element 50 is turned off in the period between the further switching signal time t5 and the further switching signal time t6. This circuit diagram with the further switching signal times t5, t6 is particularly advantageous when other elements are actuated by the switching element 50, such as a plurality of auxiliary contact current paths in a plurality of electromechanical switches, as with respect to Fig. 8 will be explained in more detail.

As in Fig. 5c can be seen, the switching position ST42 of the normally open contact 42 is checked by the Rückleselogik to a first readback time t _RL1 , which is before the first output signal time t1. It is possible to check the electromechanical switch 40 or the normally open contact 42 before switching on the technical system. It can be checked whether the normally open contact 42 is turned on or turned on and, for example, not welded. The first Readback time t _RL1 is also after the first switching signal time t3. In other words, the first readback time t _{RL1 is} between the first switching signal time t3 and the first output signal time t1. The period in which the switching element 50 is turned on and the auxiliary contact 44 is not yet open, is used for reading back. In order to allow an even more accurate check of the normally open contact 42 when the system is switched on, the switching position ST42 can additionally be checked by the readback logic at a further readback time t _RL3 , as in FIG Fig. 5c shown. It can thus be ensured that the switching position ST42 has actually changed or a positive edge is present.

As in Fig. 5c Furthermore, the switching position of the normally open contact 42 is checked by the read-back logic at a second readback time t _RL2 , which lies after the second output signal time t2. It is possible to check the electromechanical switch 40 or the normally open contact 42 after switching off the technical system. It can be checked so that the normally open contact 42 has risen or turned off and, for example, not welded. The second readback time t _RL2 is also before the second switching signal time t4. In other words, the second readback time t _{RL2 is} between the second output signal time t2 and the second switching signal time t4. The period in which the switching element 50 is turned on and the auxiliary contact 44 is opened again, is used for read-back.

It is understood by those skilled in the art that with reference to Fig. 5c explained possibilities of readback times not only in connection with the specific scheme of the Fig. 5 but can be realized independently. Furthermore, the readback logic can be designed for cyclically checking the switching position ST42 of the normally open contact. For example, a read back time may occur at least once per cycle. The switching state of the normally open contact can thus be detected at least once per cycle. This may in particular be found when the safety switching device 1 is used for a programmable controller, such as that sold by the assignee of the present invention under the trademark PSS®. In such a programmable logic controller (PLC) the communication can be cyclical.

Fig. 6 shows a simplified representation of a third embodiment of the new safety switching device 1, and Fig. 7 shows a simplified representation of an alternative, fourth embodiment of the new safety switching device 1. The comments on the aforementioned figures also apply to the embodiments of Fig. 6 or Fig. 7 to. In the embodiment of Fig. 6 includes the safety switching device 1, the electromechanical switch 40. The electromechanical switch 40 with its normally open contact 42 and auxiliary contact 44 is thus part of the safety switching device. The electromechanical switch 40 is, as in Fig. 6 to be seen, disposed within the housing 27 of the safety switching device 1. There is an output terminal 64 on the housing 27, which can be connected to the load circuit 49 of the technical system 10. It is thus an immediate switching on or off of the technical system allows. The safety switching device 1 can be connected directly to the load circuit 49.

In the alternative embodiment of the Fig. 7 the safety switching device 1 has arranged on the housing 27 of the safety switching device 1 and connected to the first output 36 output terminal 38 for driving the electromechanical switch 40. The electromechanical switch 40 is therefore not part of the safety switching device 1 or not within the housing 27 of the safety switching device 1 arranged. In the embodiment of Fig. 7 is the electromechanical switch 40 with its normally open contact 42 and auxiliary contact 44 in a spatially separated from the safety switching device 1 arranged switching device 60. It is thus an indirect switching on or off of the technical system by the safety switching device 1 allows. The safety switching device 1 and the switching device 60 together constitute the safety switching system. The spatially separated switching device 60 has a arranged on a housing 67 of the switching device 60 input terminal 61 for receiving the output signal A and the resulting voltage potential V from the device port 38 of the safety switching device 1. The switching device 60 further includes the loading element 54. It should be understood that the loading element can alternatively also be arranged in the safety switching device 1. The safety switching device 1 has in this embodiment, an input 39 for receiving the switched by the auxiliary contact 44 voltage potential V1.

Although in the previous embodiments of the Fig. 2 to 7 the fail-safe control / evaluation unit 28 is shown as a unit, it should be understood that the control / evaluation unit 28 may generally also include at least two processing units or microcontrollers 28a, 28b that can redundantly process the input signal with respect to each other Fig. 1 explained. The safety switching device 1 then has two redundant signal processing channels. Accordingly, each control / evaluation unit 28 then has two first outputs 36a, 36b for transmitting an output signal A to an electromechanical switch 40a, 40b, respectively. In this case, the normally open contacts 42a, 42b of the electromechanical switches 40a, 40b are usually connected in series with each other in a load circuit 49, and the auxiliary contacts 44a, 44b are connected in series with each other in an auxiliary contact current path 45, as in reference to FIG Fig. 1 explained. The electromechanical switches 40a, 40b are therefore driven redundantly to each other. This is done via the redundant outputs 36a, 36b of the control / evaluation unit. Alternatively or cumulatively, however, the outputs of the control / evaluation unit can also be two logically separate outputs, as described below with reference to FIG Fig. 8 or Fig. 9 explained.

Fig. 8 shows a simplified representation of a fifth embodiment of the new safety switching device 1, and Fig. 9 shows a simplified representation of a sixth embodiment of the new safety switching device 1. The comments on the aforementioned figures also apply to the embodiments of Fig. 8 or Fig. 9 to. In the embodiment of Fig. 8 or Fig. 9 the failsafe control / evaluation unit 28 has at least two first outputs 36a, 36b for transmitting in each case one output signal Aa, Ab to respectively one electromechanical switch 40a, 40b. The first outputs 36a, 36b are in the embodiment of Fig. 8 or the Fig. 9 two logically separated outputs. In this case, the normally open contacts 42a, 42b and the auxiliary contacts 44a, 44b are not connected in series with each other. Each auxiliary contact 44a, 44b is here arranged in a separate auxiliary contact current path 45a, 45b, as in FIG Fig. 8 or Fig. 9 to see. Each normally open contact 42a, 42b is arranged in a separate load circuit. In Fig. 8 or Fig. 9 the working contacts 42a, 42b are checked individually or independently. For this purpose, second inputs 58a, 58b of the read-back logic or the control / evaluation unit 28 are provided. The second inputs 58a, 58b each receive a readback signal for checking the switching position of one of the normally open contacts 42a, 42b.

In the in Fig. 8 In the embodiment shown, the switching element 50 is arranged in each of the auxiliary contact current paths 45a, 45b of the auxiliary contacts 44a, 44b of the electromechanical switches 40a, 40b. In other words, the switching element 50 is arranged both in the first auxiliary contact current path 45a with the first auxiliary contact 44a and in the second auxiliary contact current path 45b with the second auxiliary contact 44b. Thus, a single switching element 50 is used for the two auxiliary contact current paths 45a, 45b of the two electromechanical switches 40a, 40b. The switching element 50 is arranged here between the defined voltage V1 and the two auxiliary contacts 44a, 44b. This embodiment of the Fig. 8 can in particular in connection with the circuit diagram of the switching state ST50 and the switching signal S of the Fig. 5 be used in which the switching element 50 is turned off after switching on the system, and is turned on again before the system is turned off. It is thus ensured that in the period between the further switching signal time t5 and the further switching signal time t6, in which the switching element 50 is turned off, no element in another auxiliary current path can consume energy.

In the alternative embodiment of the Fig. 9 On the other hand, the safety switching device 1 has two switching elements 50a, 50b which are respectively arranged in one of the auxiliary contact current paths 45a, 45b auxiliary contact current paths 45a, 45b of the auxiliary contacts 44a, 44b of the electromechanical switches 40a, 40b. In other words, the first switching element 50a is disposed in the first auxiliary contact current path 45a with the first auxiliary contact 44a, and the second switching element 50b is disposed in the second auxiliary contact current path 45b with the second auxiliary contact 44b. Thus, one switching element 50a, 50b is used for each auxiliary contact current path 45a, 45b of each of the two electromechanical switches 40a, 40b.

Claims (15)

1. A safety switching apparatus (1) for switching on or off a technical installation (10) in a failsafe manner, comprising a failsafe control/evaluation unit (28) having an input (34) for receiving an input signal, the failsafe control/evaluation unit (28) being designed to process the input signal in order to produce, in dependence thereon, an output signal (A) for switching on or off the technical installation (10) at an output signal time (t1, t2), wherein the failsafe control/evaluation unit (28) has a first output (36) for transmitting the output signal (A) to an electromechanical switch (40), wherein the electromechanical switch (40) has an operating contact (42) for switching a load circuit (49) of the technical installation (10) and has a positively guided auxiliary contact (44) in an auxiliary contact current path (45), which auxiliary contact can be used to carry a current for checking the switching position of the operating contact (42) by a defined voltage (V1) being applied, wherein the safety switching apparatus (1) comprises a switching element (50) arranged in the auxiliary contact current path (45), wherein the failsafe control/evaluation unit (28) is designed to produce a switching signal (S) at a switching signal time (t3, t4) which has a time gap (Δt3, Δt4) relative to the output signal time (t1, t2), characterized in that the failsafe control/evaluation unit (28) has a second output (52) for transmitting the switching signal (S) to the switching element (50), which is designed to switch the current through the auxiliary contact current path (45) when the switching signal (S) is received.
2. The safety switching apparatus according to Claim 1, wherein the failsafe control/evaluation unit (28) is designed so that, when it produces, at a first output signal time (t1), the output signal (A) in the form of a switch-on signal (A1) for switching on the technical installation (10), it produces the switching signal (S) in the form of a switch-on signal (S1) for switching on the switching element (50) at a first switching signal time (t3), which is before the first output signal time (t1).
3. The safety switching apparatus according to Claim 2, wherein the failsafe controt/evaluation unit (28) is designed to produce a further switching signal (S) in the form of a switch-off signal (S2) for switching off the switching element (50) at a further switching signal time (t5), which is after the first output signal time (t1).
4. The safety switching apparatus according to one of Claims 1 to 3, wherein the failsafe control/evaluation unit (28) is designed so that, when it produces, at a second output signal time (t2), the output signal (A) in the form of a switch-off signal (A2) for switching off the technical installation (10), it produces the switching signal (S) in the form of a switch-off signal (S2) for switching off the switching element (50) at a second switching signal time (t4), which is after the second output signal time (t2).
5. The safety switching apparatus according to Claim 4, wherein the failsafe control/evaluation unit (28) is designed to produce a further switching signal (S) in the form of a switch-on signal (S1) for switching on the switching element (50) at a further switching signal time (t6), which is before the second output signal time (t2).
6. The safety switching apparatus according to one of Claims 1 to 5, wherein the failsafe control/evaluation unit (28) has at least two first outputs (36a, 36b) each for transmitting a respective output signal (Aa, Ab) to a respective electromechanical switch (40a, 40b), wherein the switching element (50) is arranged in each of the auxiliary contact current paths (45a, 45b) of the auxiliary contacts (44a, 44b) of the electromechanical switches (40a, 40b).
7. The safety switching apparatus according to one of Claims 1 to 5, wherein the failsafe control/evaluation unit (28) has at least two first outputs (36a, 36b) each for transmitting a respective output signal (Aa, Ab) to a respective electromechanical switch (40a, 40b), wherein the safety switching apparatus has at least two switching elements (50a, 50b) which are respectively arranged in one of the auxiliary contact current paths (45a, 45b) of the auxiliary contacts (44a, 44b) of the electromechanical switches (40a, 40b).
8. The safety switching apparatus according to one of Claims 1 to 7, comprising a read-back logic unit having an input, connected to the auxiliary contact current path (45), for receiving a read-back signal for checking the switching position of the operating contact (42).
9. The safety switching apparatus according to Claim 8, wherein the read-back logic unit is designed to check the switching position of the operating contact (42) at a first read-back time (t_RL1), which is before the first output signal time (t1), and in particular is after the first switching signal time (t3).
10. The safety switching apparatus according to one of Claims 8 and 9, wherein the read-back logic unit is designed to check the switching position of the operating contact (42) at a second read-back time (t_RL2), which is after the second output signal time (t2), and in particular is before the second switching signal time (t4).
11. The safety switching apparatus according to one of Claims 1 to 10, comprising a load element (54), arranged in the auxiliary contact current path (45), for achieving a defined current through the auxiliary contact current path (45) when a defined voltage (V1) is applied.
12. The safety switching apparatus according to one of Claims 1 to 11, wherein the switching element (50) is an electronic switching element, particularly a transistor.
13. The safety switching apparatus according to one of Claims 1 to 12, comprising the electromechanical switch (40).
14. A safety switching system comprising a safety switching apparatus according to one of Claims 1 to 13, and comprising a switching device (60), which is arranged separately and has the electromechanical switch (40).
15. A method for operating a failsafe control/evaluation unit (28) of a safety switching apparatus (1) for switching on or off a technical installation (10) in a failsafe manner, the method comprising the following steps:

    - receiving an input signal at an input (34) of the failsafe control/evaluation unit (28),

    - processing the input signal in order to produce, in dependence thereon, an output signal (A) for switching on or off the technical installation (10) at an output signal time (t1, t2), and

    - transmitting, from a first output (36) of the failsafe control/evaluation unit (28), the output signal (A) to an electromechanical switch (40), wherein the electromechanical switch (40) has an operating contact (42) for switching a load circuit (49) of the technical installation (10) and has a positively guided auxiliary contact (44) in an auxiliary contact current path (45), which can be used to carry a current for checking the switching position of the operating contact (42) by a defined voltage (V1) being applied,

    - producing a switching signal (S) at a switching signal time (t3, t4) which has a time gap (Δt3, Δt4) relative to the output signal time (t1, t2), and

    - transmitting, from a second output (52) of the control/evaluation unit (28), the switching signal (S) to a switching element (50) which is arranged in the auxiliary contact current path (45) and which is designed to switch the current through the auxiliary contact current path (45) when the switching signal (S) is received.

Images