EP3742466B1 - Switching assembly for secure switching of an electrical consumer according to a safety guideline - Google Patents

Description

The invention relates to a switching arrangement for switching an electrical load safely in accordance with a safety regulation, comprising: a first changeover relay, a first connection for a first safety switch, a second connection for an external restart switch, a third connection for an actuator, and a first internal restart switch, wherein a first excitation coil of the first changeover relay is connected to the first connection and to the internal restart switch in such a way that a current flow through the first excitation coil is only caused when the first safety switch is in a predetermined switching state and when the first internal restart switch undergoes a switching operation .

In the industrial sector, safety relays are used to safely switch electrical consumers on and off that pose a risk to people and material. Such electrical consumers are, for example, presses, milling tools, burners, etc. For this purpose, the power supply for the electrical consumers is controlled via actuator connections of the safety relay, which is used to fulfill the relevant safety regulations and certifications with regard to functional safety (EN ISO 13849, EN/IEC 61508, EN/IEC 61511, EN/IEC 62061 etc.).

Safety controls usually have a number of connections for the make contacts of a safety switch. In this context, a connection is understood to be any terminal arrangement that enables the switching state of the safety switch to be queried. This can, for example, also be a single terminal with defined potential levels for each switching state, but there are usually two terminals that are connected to one another via the safety switch. The safety switch can, for example, be an emergency stop switch, a position or position monitor, e.g. of a protective door, a light barrier, a safety mat, etc. The safety switch usually has a "safe" position to be determined depending on the application, e.g. light barrier not interrupted, i.e. No person in the danger area and a "not safe" position, e.g. protective door position open, i.e. danger. Typically, the power supply to the electrical consumer should be interrupted when the safety switching element is no longer in the "safe" position.

The standards mentioned above usually define certain levels (in EN ISO 13849: Performance Level) of safety, the necessity of which is determined depending on the application. This is done by evaluating the risk based on the extent of damage, frequency and length of stay and the possibility of avoiding the hazard. Depending on the required safety level, there are then corresponding ones for the safety relay Requirements to complete this level. At higher levels, it is necessary for the safety relay to be able to control a relay contact welding. In this case, it should not only be ensured that the electrical load is switched off safely despite the error mentioned, but also that the electrical load is in particular prevented from being switched on again.

In the past, so-called forcibly guided relays (also relays with forcibly guided contacts) were often used for this purpose. A forcibly guided relay has a make contact and a break contact which are mechanically connected to one another in such a way that make contact and break contact are prevented from being closed at the same time. As a result, one contact is available for the actual switching function, while the other contact can be used to check the switching status in conjunction with a suitable circuit.

Although such a forcibly guided relay is very reliable, it is technically comparatively complex. Efforts are therefore being made to carry out correspondingly testable circuits without forcibly guided relays, namely with ordinary changeover relays. From the EP 3051554 A1 it is known, for example, to switch the actuator connection via two changeover relays connected in series and to query the respective other path of the changeover relay. In the circuit disclosed there, precisely the effect described above is achieved, namely that the relays are prevented from being switched on again after the "reset switch" has been actuated if the query of the other path of the changeover relays determines that a relay is welded.

Although the circuit described there avoids the use of forcibly guided relays, microcontrollers are required for their implementation. The circuit described there comes at the price of a technical simplification on the mechanical side with greater complexity in terms of control, namely by switching to digital technology.

Furthermore, the reference discloses DE102005014125 A1 a switching arrangement for functionally safe switching of an electrical load, which corresponds to the preamble of claim 1.

Against this background, the object of the invention is to specify a switching arrangement of the type mentioned at the outset that is suitable for higher security levels and does not require mechanically complex or digital-electronic components.

This object is solved by the switching arrangement according to independent claim 1 . Advantageous configurations are the subject matter of the dependent claims.

The invention is based on the consideration that the elimination of technically complex components such as forcibly guided relays while at the same time dispensing with microcontrollers could only be achieved if the desired goal of uncovering a welded relay was achieved in a different way than in the prior art. It was recognized here that the prior art is essentially always based on first detecting a welding of the relay by checking switching paths, and then, in response to this, detecting a welding appropriate safe shutdown. In complete contrast to this, the aim of the concept described here was to directly prevent the restart switch from being switched on again in the event of a welded relay. It was recognized that this is possible by using changeover relays and looping the signal path from the external restart switch via the changeover relay signal path, which is an alternative to the actuator switching path. If the relay is welded, the actuator switching path remains closed and the signal path of the restart switch remains interrupted. A restart is therefore impossible.

This switching arrangement also includes: a second changeover relay, which is connected in series with the first changeover relay, a fourth connection for a second safety switch, a second internal restart switch, an exciter coil of the second changeover relay being connected in this way to the fourth connection and to the second internal restart switch is that a current flow through the exciter coil is only caused when the second safety switch is in a specified switching state and when the internal restart switch undergoes a switching operation, with a changeover switch of the second changeover relay, on which the second exciter coil acts, in the current-carrying state of the second Excitation coil switches the third connection for the actuator conductive and in the de-energized state of the excitation coil an active connection between the second connection for the external restart switch and the second internal restart switch turns on. In other words, the switching arrangement includes a second safety circuit that is redundant to the first safety circuit and has its own safety circuit Safety switch and own switching relay. When the safety switches are triggered, this ensures in a particularly simple manner, even if one relay is welded, that the current flow at the actuator connection is interrupted in any case by the other relay being switched off. The fact that both relays interrupt the signal path to both internal restart switches ensures that neither of the two excitation coils can pick up again due to the welded relay and the signal path thus interrupted, since pressing the external restart switch has no effect.

In an advantageous embodiment, the changeover relays each have an input terminal, a working output terminal and a rest output terminal, with the changeover relays being designed such that when current is flowing through the respective excitation coil, a current path from the respective input terminal to the working output terminal is switched on and in the de-energized state of the respective excitation coil Current path from the respective input terminal to the idle output terminal is switched on.

In yet another advantageous embodiment, the changeover relays are connected to one another at their respective input terminals, and the respective work output terminals are connected to a current path of the third connection for the actuator, and the respective rest output terminals are connected to a current path of the active connection between the second connection for the external restart switch , as well as the first and the second internal restart switch.

Such an interconnection of two changeover relays enables a technically particularly simple and at the same time safe redundant switching of an actuator connection by means of ordinary, i.e. non-force-guided changeover relays.

The described interruption of the signal path from the external restart switch is particularly easy to ensure in terms of its effect on both safety circuits by the fact that the first and the second internal restart switch are connected in series on the control side. As a result, an interruption automatically prevents signaling to both internal restart switches.

According to the invention, the operative connection between the external restart switch and the first and second internal restart switch includes a feedback circuit in which the two changeover relays, the first and second internal restart switch on the control side and a power source are connected in series, the power source on the control side being connected to the second connection for the external restart switch is connected. Such a configuration combines all of the advantages described above in a particularly simple manner: a feedback circuit is created which feeds both internal restart switches, is driven by actuation of the external restart switch, and in which both changeover relays are connected in series. If only one of the two changeover relays fuses, the feedback circuit will be interrupted and restarting will be prevented.

Advantageously, the first and/or the second internal restart switch are designed in such a way that the control and switching sides are each galvanically isolated are. The first and/or the second internal restart switch are particularly advantageously designed as optocouplers. In the feedback circuit described above, the use of the changeover relays in the event of welding can result in the operating voltage of the actuator being fed into the feedback circuit of the operative connection between the external and internal restart switches. For this reason, the safety circuits are galvanically isolated from the feedback and output circuits. The galvanic isolation is used for electrical safety and is intended to protect the electronics of the safety circuits from damage.

For the same reason, the second connection for the external restart switch is advantageously also electrically isolated from the feedback circuit. This avoids the high voltage being applied to the terminals of the external restart switch.

In a further advantageous embodiment of the switching arrangement, each excitation coil is assigned a capacitor and a charging switch, the internal restart switch assigned to the excitation coil being arranged in the charging circuit of the respective capacitor in such a way that the capacitor is charged when the internal restart switch is actuated, and the respective charging switch is arranged between the respective capacitor and the respective excitation coil for charging the excitation coil and is designed in such a way that it is opened when the respective internal restart switch is actuated and closed when the respective internal restart switch is not actuated. The embodiment described above is achieved in turn without a microcontroller that the Function of the restart switch can be implemented in a suitable manner. Insbondere it is achieved that an arbitrarily short actuation of the restart switch is not sufficient for a restart - the capacitor must first be charged so that the stored voltage is sufficient to provide enough current via the charging switch after the actuation of the restart switch has ended so that the exciter coil picks up .

The changeover relay of the respective excitation coil advantageously has a self-retaining function. This ensures in a simple manner that the short current pulse caused by the discharging of the capacitor causes current to flow permanently through the excitation coil. Various alternatives are possible for this in terms of switching technology. For example, the changeover relay could have a second switch which is actuated by the exciter coil and which turns on a supply path to the exciter coil. Alternatively, an optocoupler can be provided which is coupled to the exciter coil current on the control side, i.e. its optical transmitter is connected directly in series with the exciter coil, for example, and which also switches a supply path to the exciter coil on on the switching side. Appropriate wiring ensures that when the safety switch is actuated, the flow of current through the excitation coil is always interrupted.

In an advantageous embodiment, the safety regulation described is EN ISO 13849 or one of its successor standards. The standard provides safety requirements and guidance for the design and integration of safety-related parts of machine controls, including the development of software. It properties of these parts are defined that are necessary for the execution of the corresponding safety functions. It also specifies validation procedures, including analysis and testing, for the safety functions of the relevant parts of the controls. The standard thus defines technical parameters of the switching arrangement described here.

A safety relay for switching an electrical load safely in accordance with a safety regulation preferably comprises a switching arrangement as described.

The advantages achieved by the invention are, in particular, that by using ordinary changeover relays and simultaneously looping the signal from the restart switch via the quiescent current path of the changeover relay, restarting by actuating the restart switch in a safety relay is reliably avoided. In the redundant design described, the performance level PLd (single-fault-safe) of EN ISO 13849 can be achieved without having to resort to positively driven relays or microcontrollers.

FIG 1

ein Prinzipschaltbild einer einfehlersicheren Schaltanordnung, und

FIG 2

einen konretisierten Schaltplan einer spezifischen Ausführungsform einer einfehlersicheren Schaltanordnung gemäß FIG 1.

Embodiments of the invention are explained in more detail with reference to drawings. Show in it:

FIG 1

a basic circuit diagram of a single-fault-safe switching arrangement, and

FIG 2

according to a concretized circuit diagram of a specific embodiment of a single-fault-safe switching arrangement FIG 1 .

Identical parts are provided with the same reference symbols in all figures.

The FIG 1 shows a basic circuit diagram of a switching arrangement 1 in a safety relay. The switching arrangement has a first connection 2 for a first safety switch, a second connection 4 for an external restart switch, a third connection 6 (here consisting of two terminals) for an actuator and a fourth connection 8 for a second safety switch. The two safety switches can be any type of safety sensor, for example the two redundant channels of a two-channel emergency stop switch can be connected here. Alternatively, two individual switches can be connected or a position monitor, eg a safety mat or a light barrier.

The switching arrangement 1 should be designed according to EN ISO 13849. For this purpose, the function of the switching arrangement is as follows: The two safety switches must be in a defined state (closed in the exemplary embodiment). If the restart switch connected to the second connection 4 is then actuated for a predetermined period of time, ie closed for the period of time in the exemplary embodiment and then opened again, the power supply to the actuator via the third connection 6 is released. For this purpose, the terminals 6, 8 each act on a first and second safety circuit 10, 12, each comprising an exciter coil of a changeover relay 14, 16. The changeover relays 14, 16 are connected in series in the current path of the connection 6 for the actuator. If both changeover relays 14, 16 pick up, then connection 6 of the actuator is released. However, if only one of the If the safety switch changes its switching position, its associated excitation coil in the respective safety circuit 10, 12 (depending on the connection 2, 8) is de-energized and the respective changeover relay 14, 16 goes into the rest position. The series connection interrupts the current path of connection 6, and the actuator is therefore de-energized.

A previously described redundant circuit ensures that in the event of a typical error, namely a welding of a changeover relay 14, 16, due to the redundancy of the safety switches (they should normally switch simultaneously), the actuator can still be switched off safely.

However, it must also be ensured that in such a case restarting is impossible. Up to now, this has been achieved by checking using forcibly guided relays or microcontrollers.

According to FIG 1 a feedback circuit 18 is provided in the circuit arrangement 1 . This includes a power source 20, which is connected on the control side to the connection 4 for the restart switch. Activation of the restart switch thus generates a current in the feedback circuit 18. The feedback circuit 18 is connected in series through the respective quiescent current terminals of the changeover relays 14, 16, so that a current can only flow in the feedback circuit 18 when both changeover relays 14, 16 are in their rest position . If only one of the changeover relays 14, 16 is welded in the working position, the feedback circuit 18 is interrupted and thus the operative connection between the external restart switch at the second connection 4 and the likewise internal restart switches 22, 24 connected in series in the feedback circuit 18 are interrupted.

The internal restart switches 22, 24 each act on one of the safety circuits 10, 12 in the manner described above, i.e. only if the internal restart switch 22, 24 is actuated for a predetermined period of time and released again and the respective safety switch is in a defined state. the excitation coil is energized and the changeover relay 14, 16 assigned to the safety circuit 10, 12 is brought into the working position, i.e. the connection 6 is switched to the conducting state.

FIG 2 shows a concrete variant of a to FIG 1 circuit arrangement 1 described using a circuit diagram. In the embodiment of FIG 2 the functional parts are each connected to the working voltage VCC, +24 V DC in the exemplary embodiment. Alternatively, the circuit could also have a complementary structure, so that the functional parts are connected to ground GND. Mixed forms are also possible as exemplary embodiments, ie, for example, one safety circuit 10 is connected to working voltage VCC and the other safety circuit 12 is connected to ground GND. Those skilled in the art will understand what modifications to make to this.

In the embodiment of FIG 2 the first connection 2 comprises two terminals S11 and S12. The first terminal S11 is internally connected to the working voltage VCC, which is routed to the terminal S12 via the first connected safety switch S1 when the switching state is closed. The terminal S12 is connected to the field coil K1-A of the first changeover relay 14, which is arranged in the first safety circuit 10.

On the switching side, the internal restart switch 22 acts on the first safety circuit 10 FIG 2 is designed as an optocoupler. The structure and the function of the first safety circuit 10 are explained below.

When the switch S1 is closed--as described above--the working voltage VCC is applied to a connection of the excitation coil K1-A, to which a freewheeling diode D1 is connected in parallel. The other terminal of the excitation coil K1-A is connected via the diode D2 and the transistor Q1 to a negative pole of the capacitor C1, which is also connected to the working voltage VCC at its positive pole. The collector side of transistor Q1 faces excitation pulse K1-A. The base of the transistor is connected to the working voltage VCC via a resistor R2 and in parallel to the negative pole of the capacitor C1 via a resistor R4. A resistor R3 is connected in parallel with the capacitor C1. The negative pole of the capacitor can be connected to ground GND by closing the optocoupler K3 via a diode D3, a resistor R5 and the switching side of the optocoupler K3. This is the capacitor charging path.

If the optocoupler K3 is open, the base and emitter are at the same potential. Transistor Q1 is conductive, so capacitor C1 is discharged. On the other hand, if the optocoupler K3 closes, two things happen according to the arrangement described above: The base of the transistor Q1 is negatively biased, so that the transistor Q1 becomes non-conductive. At the same time, the charging circuit of the capacitor C1 is closed, so that the capacitor C1 is charged. The Dimensioning of the resistor R5 determines the speed of the charging process.

If the optocoupler K3 is opened again, the previous state is restored, i.e. the transistor Q1 becomes conductive again. The capacitor C1 is now charged (provided that the charging time is sufficient), so that the field coil K1-A is energized via the conducting transistor Q1 and the diode D2. If the charge of the capacitor was sufficient, the changeover relay 14 thus pulls and switches to the switching position. The changeover relay 14 has a changeover switch K1-B whose input contact is connected to ground GND via a resistor R1 and whose make contact is connected to the other end of the excitation pulse K1-A, so that the changeover relay 14 is latched. At the same time, the second changeover switch K1-C also goes into the working position (see below).

In an alternative, not in FIG 2 shown configuration is realized via an optocoupler. The switch K1-B is not an additional switch of the changeover relay 14 here, but the switch of an optocoupler, ie a phototransistor. On the control side, ie with its optical transmitter, this optocoupler is directly connected in series with the excitation coil K1-A. Such a configuration has the same effect: if the exciter coil K1-A is energized even briefly, the optical transmitter of the optocoupler emits light and the phototransistor closes—the changeover relay 14 is latched.

The second safety circuit 12 is completely identical and therefore redundant to the safety circuit 10 . The The description is therefore the same and can be omitted. The relevant components of the second safety circuit 12 are the terminals S21, S22 of connection 8 to which the safety switch S2 is connected, as well as capacitor C2, optocoupler K4, diodes D5, D6, D7, resistors R7, R8, R9, R10, R11, Transistor Q2 and excitation coil K2-A of the second changeover relay 16 with the first changeover switch K2-B.

The changeover switches K1-C and K2-C of the changeover relays 14, 16 are connected at their input contacts. The working contacts of the changeover switches K1-C and K2-C are each connected to a terminal 13 or 14. Mains voltage L1 (230V in the exemplary embodiment) is connected to terminal 13 via a fuse F1. If both changeover switches K1-C, K2-C are in the working position, this voltage is switched to the second terminal 14, which is connected to a neutral conductor N via a contactor K11. This serves as an actuator for switching the consumer.

The normally closed contacts of the changeover switches K1-C, K2-C, on the other hand, are connected to the feedback circuit 18. This follows according to the embodiment of FIG FIG 2 in series a resistor R6, the control-side part of the optocouplers K4 and K3 and the current source 20. The current source 20 comprises a coil of a transformer T1 provided with a filter consisting of a diode D4 connected in series and a diode D4 connected in parallel to both Capacitor C3 exists. As a result, the power source 20 provides a (nearly) direct voltage. On the control side, ie to the other coil of the transformer T1, a square-wave generator G1 is connected, which is connected to the terminal S34. This is part of connection 4 for the external restart switch S3. The connection 4 still has a Open terminal S33, which is connected to working voltage VCC. Closing the external restart switch thus activates the square-wave generator G1 and the current source 20 generates current.

So that this signal actually leads to the switching of the optocouplers K3, K4 as internal restart switches 22, 24, the feedback circuit must be conductive, ie both changeover switches K1-C, K2-C must be in the idle position. If only one of the relays is welded, it is not possible to restart and energize contactor K11.

Reference List

1

switching arrangement

2, 4, 6, 8

Connection

10, 12

Safety circuit

14, 16

changeover relay

18

feedback loop

20

power source

22, 24

internal restart switch

Claims (10)

1. A switching arrangement (1) for functionally safe switching of an electrical load in accordance with a safety regulation, comprising:

   a first changeover relay (14), a

   first terminal (2) for a first safety switch,

   a second terminal (4) for an external restart switch,

   a third terminal (6) for an actuator, and

   a first internal restart switch (22),

   wherein a first excitation coil of the first changeover relay (14) is connected to the first terminal (2) and

   to the internal restart switch (22) such that current flow through the first excitation coil is effected only when the first safety switch is in a predetermined switching state and when the first internal restart switch (22) undergoes a switching operation,

   a second changeover relay (16) connected in series with the first changeover relay (14),

   a fourth terminal (8) for a second safety switch a second internal restart switch (24),

   wherein an excitation coil of the second changeover relay (16) is connected to the fourth terminal (8) and

   to the second internal restart switch (24) such that current flow through the excitation coil is effected only when the second safety switch is in a predetermined switching state and when the second internal restart switch (24) undergoes a switching operation,

   wherein a changeover switch of the first changeover relay (14), on which the first excitation coil acts, switches the third terminal (6) for the actuator on when the first excitation coil is in the energized state, and a changeover switch of the second changeover relay (16) on which the second excitation coil acts switches the third terminal (6) for the actuator on when the second excitation coil is in the energized state,

   characterized in that the changeover switch of the first changeover relay (14), on which the first excitation coil acts in the de-energized state of the first excitation coil, conductively switches an operative connection between the second terminal (4) for the external restart switch and the first internal restart switch (22), and in that the changeover switch of the second changeover relay (16), on which the second excitation coil acts, in the de-energized state of the excitation coil conductively switches an operative connection between the second terminal (4) for the external restart switch and the second internal restart switch (24), the

   active connection between the external restart switch and the first and second internal restart switches (22, 24) comprising a feedback circuit (18) in which the two changeover relays (14, 16), the first and second internal restart switches (22, 24) and a current source are connected in series on the control side, the current source being connected on the control side to the second connection (4) for the external restart switch.
2. A switching arrangement (1) according to claim 1, in which the changeover relays (14, 16) each have an input terminal, a working output terminal and a resting output terminal, the changeover relays (14, 16) being designed in such a way in that, in the energized state of the respective excitation coil, a current path is switched conductively from the respective input terminal to the operating output terminal and, in the de-energized state of the respective excitation coil, a current path is switched conductively from the respective input terminal to the resting output terminal.
3. A switching arrangement (1) according to claim 2, wherein the changeover relays (14, 16) are interconnected at their respective input terminals, and the respective working output terminals are connected into a current path of the third terminal for the actuator, and the respective resting output terminals are connected into a current path of the operative connection between the second terminal (4) for the external restart switch, and the first and second internal restart switches (22, 24).
4. A switching arrangement (1) according to any one of the preceding claims, in which the first and/or the second internal restart switch (22, 24) are designed in such a way that the control side and the switching side are each electrically isolated.
5. A switching arrangement (1) according to any one of the preceding claims, wherein the first and/or the second internal restart switch (22, 24) are designed as optocouplers.
6. A switching arrangement (1) according to any one of the preceding claims, wherein the second terminal (4) for the external restart switch is electrically isolated from the feedback circuit (18).
7. A switching arrangement (1) according to one of the preceding claims, in which each excitation coil is assigned a respective capacitor and a charging switch, the respective internal restart switch (22, 24) assigned to the excitation coil being arranged in the charging circuit of the respective capacitor in such a way that the capacitor is charged when the internal restart switch (22, 24) is actuated, and wherein the respective charging switch is arranged between the respective capacitor and the respective excitation coil for charging the excitation coil and is formed such that it is opened during an actuation of the respective internal restart switch (22, 24) and is closed during a non-actuation of the respective internal restart switch (22, 24).
8. The switching arrangement (1) according to claim 7, wherein the changeover relay (14, 16) of the respective excitation coil has a latching function.
9. A switching arrangement (1) according to any one of the preceding claims, wherein the safety regulation is EN ISO 13849 or one of its subsequent standards.
10. Safety relay for functionally safe switching of an electrical load in accordance with a safety regulation, comprising a switching arrangement (1) according to any one of the preceding claims.

Images