Classifications

• • G—PHYSICS
  • G05—CONTROLLING; REGULATING
  • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
  • G05B19/00—Programme-control systems
  • G05B19/02—Programme-control systems electric
  • G05B19/04—Programme control other than numerical control, i.e. in sequence controllers or logic controllers
  • G05B19/042—Programme control other than numerical control, i.e. in sequence controllers or logic controllers using digital processors
  • G05B19/0428—Safety, monitoring
• • H—ELECTRICITY
  • H02—GENERATION; CONVERSION OR DISTRIBUTION OF ELECTRIC POWER
  • H02H—EMERGENCY PROTECTIVE CIRCUIT ARRANGEMENTS
  • H02H3/00—Emergency protective circuit arrangements for automatic disconnection directly responsive to an undesired change from normal electric working condition with or without subsequent reconnection ; integrated protection
  • H02H3/08—Emergency protective circuit arrangements for automatic disconnection directly responsive to an undesired change from normal electric working condition with or without subsequent reconnection ; integrated protection responsive to excess current
• • G—PHYSICS
  • G05—CONTROLLING; REGULATING
  • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
  • G05B2219/00—Program-control systems
  • G05B2219/20—Pc systems
  • G05B2219/24—Pc safety
  • G05B2219/24127—Disable, inhibit control signal in I-O interface if alarm status set
• • G—PHYSICS
  • G05—CONTROLLING; REGULATING
  • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
  • G05B2219/00—Program-control systems
  • G05B2219/20—Pc systems
  • G05B2219/24—Pc safety
  • G05B2219/24199—Recover from fault, malfunction, go to safe state, correct and set new sequence
• • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
  • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
  • Y02P—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN THE PRODUCTION OR PROCESSING OF GOODS
  • Y02P90/00—Enabling technologies with a potential contribution to greenhouse gas [GHG] emissions mitigation
  • Y02P90/02—Total factory control, e.g. smart factories, flexible manufacturing systems [FMS] or integrated manufacturing systems [IMS]

Definitions

• the present invention relates generally to a security arrangement and more particularly to an electrically related security arrangement.
• the present invention finds an advantageous application in any type of security arrangement in which a control unit pertaining to the security arrangement makes use of electronic circuits with controlled input and output gates.
• the present invention may find an application wherein one or several input functions, e.g. one closed or one open, one or several connectors, shall co-operate with a control unit and wherein each input function is adapted to be able to transmit to said control unit a first information item corresponding to a predetermined first setting, and where the control unit is adapted to, upon correct receipt of said first information item, initiate and/or accept exe- cution of a selected output function, said control unit also being adapted to, upon receipt of one or more other information items representative of a second setting, prevent initiation and/or acceptance of said selected output function.
• input functions e.g. one closed or one open, one or several connectors
• the present invention is based on such a security arrangement wherein said control unit is equipped with a computer and has a number of input gates and a number of output gates adapted to co-operation with at least said input functions, such as a closed or an open connector.
• One type is an electrically driven security arrangement, known and used for a long time, which is based on connection of a security loop.
• This security arrangement consists of an approved arrangement where critical "points" are each monitored by a connector, a normally closed connector, and with all connectors connected in series with each other in order to create a closed security loop that can be utilised to activate a selected output function. Such conditions are thus created that when one or several monitored points indicate "malfunction" the connector pertaining to the point opens and the series-connected security loop is broken, resulting in inactivation or blocking of the output function.
• Output functions of this type may be to permit activation of the drive criteria of an electrically driven apparatus or, in the event of malfunction, to create criteria to deactivate the drive.
• the drive in question is usually that of an electric motor, an elevator motor or the like.
• a security arrangement of this type may advantageously be allowed to connect a connector for switching on or off the function as a first connector in the series-connected security loop.
• a security loop of the above design requires extensive wiring to carry a control voltage from connector to connector serially around the whole lop and around the whole plant, or at least most of it.
• each connector can be connected to circuits and input gates belonging to the control unit.
• This integration may advantageously be achieved using some form of pro- grammable control.
• malfunctions in this type of switch may be that a control output may reveal a malfunction and thus be placed statically in such a position that the switch may get stuck in an ON position or OFF position as a result of certain malfunctions deriving, e.g. from short-circuiting in transistors or relay contacts that are welded together.
• a control circuit is described here by which criteria are created for restarting operation of a robot without needing to return to a start position, using pulses (7a,7b) via a pulse-generating circuit (6).
• a computer unit (3) with a bus arrangement (4) is used.
• a switching device is described here for monitoring the connection of a voltage source (1) to an electronic apparatus with a microprocessor (7), in which the voltage source (1) co-operates with a capacitor (3).
• a common connection point (P) for the voltage source (1) and a coil (2) are connected to an output for the microprocessor (7) which shall create a narrow voltage pulse.
• the common connection point (P) is simultaneously connected to an input
• Patent publications US-A-4 330 816 and SU-1818655 also constitute a part of the background art.
• the background art referred to above advocates that the pertinent software is executed in a whole and functioning processor circuit.
• control unit shall be activated to execute the functions corresponding to the information item obtained from said input device via one or more relevant input gate(s).
• the present invention is thus based on a security arrangement wherein one or several input functions or input devices, such as connectors, shall be able to co-operate with a control unit, each input function being adapted to be able to transmit to said control unit a first information item corresponding to a predeter- mined setting, and said control unit being adapted to, upon receipt of said first information item, initiate and/or accept a selected output function, said control unit also being adapted to, upon receipt of one or more second information items representative of a second setting, prevent initiation and/or acceptance of said selected output function.
• the security arrangement according to the invention is based on said control unit being equipped with a computer and having a number of input gates and a number of output gates, the former designed for co-operation with at least said input functions.
• the present invention advocates that an active output signal generated by the control unit, via an output gate, shall be directly generated via software, such as a test program, pertaining to a computer unit. Particularly advocated is that said output signal shall be inhibited in the event of malfunction of one or several internal circuits or functions activated by the software, and/or that said output signal shall be inhibited via internal functions assigned to the control unit, in the event of malfunction of the software.
• said software shall be structured to evaluate selected functions including relevant input and/or output gates connected to external input functions and/or output functions, and when these have been found, by a test program utilised, to function in accordance with predetermined criteria the control unit shall be activated to perform the functions corresponding to data obtained from said input function.
• circuits pertaining to the control unit shall be adapted to, after the use of a test program or a part thereof that gener- ates a result in accordance with predetermined criteria, generate a pulse to an output signal activated via an output gate.
• the invention also proposes having said output signal connected to an AC-connected circuit transferring energy, such as a transformer circuit.
• the pulse shape assigned to the output signal is generated via structured software related to a processor unit pertaining to the control unit.
• the secondary side of the circuit be galvanically isolated from its primary side and the former be connected to a controlled function. Also advocated is for one end of a monitored input function to be driven by means of a signal on an output gate from the control unit.
• Figure 1 shows a first embodiment of an approved security arrangement of previously known type
• Figure 2 shows a second embodiment of a security arrangement of previously known type that makes use of a control unit provided with computer and which, due to the risk of errors in the control unit, does not fulfil the security requirements placed on approved security arrangements of the type in question
• Figure 3 shows a part of a security arrangement based on a control unit equipped with computer and supplemented in accordance with the invention in that the security arrangement will be able to fulfil sufficient and approved safety requirements
• Figure 4 shows a first embodiment of a security arrangement in accordance with the present invention, utilising a control unit as shown in fig. 3
• Figure 5 shows a second embodiment of a security arrangement in accor- dance with the invention
• Figure 6 shows a third embodiment of a security arrangement in accordance with the invention.
• One or several input functions serving as critical points are shown here, exemplified as a number of connectors 2a, 2b and 2c, in serial co-operation with a control unit 3.
• Each connector 2a, 2b or 2c is designed to transmit a "first" information item corresponding to a predetermined on position to said control unit 3, this setting consisting of one, or a row of closed contact functions.
• the control unit 3 is thus adapted to, upon receipt of said first information item, initiate and/or accept a selected function by activating circuits in the control unit so that the control unit on a cable 3a can send an acceptance signal to activate a selected output function.
• the control unit 3 is also adapted to, upon receipt of one or more "second" information items representative of a second setting, i.e. one or several connectors assume an open position, illustrated at connector 2b, prevent initiation and/or acceptance of said selected function and thus not to send any signal on the cable 3a.
• the control unit 3 may thus consist of a relay, the relay winding is connected in series with the connectors 2a, 2b, 2c and 2d and the relay contacts closing a circuit which gives a voltage "V" on the cable 3a.
• Figure 1 also illustrates that the connectors 2a, 2b and 2c, respectively, may be built into machines or the like and that a series-connected connector 2d may be arranged to serve as an emergency breaker or as an ON/OFF switch.
• Figure 1 illustrates that influence via one or several of the connectors 2a...2d offers the same function in the control unit 3 and that difficulties are obviously incurred in being able to evaluate which of the connectors has/have been brought to an open position and thus blocked the activation by disconnecting the voltage on cable 3a.
• FIG. 2 shows an embodiment in which said control unit 3' is equipped with a computer, and reveals a module with a number of input gates 31 , 32, 33. It is assumed here that input gate 31 is connected to the connector 2a, input gate 32 to connector 2b and input gate 33 to connector 2c.
• input gates 34, 35 and 36 are connected to other connectors, such as connector 2d.
• Figure 2 also shows that the control unit 3' has two output gates 37, 38 where signals appear in the form of voltage on or voltage off.
• connectors 2a, 2b and 2c, respectively, are adapted so that said control unit 3' can transmit a first information item corresponding to a predetermined setting and the control unit 3' is adapted to, upon receipt of said first information item, initiate and/or accept a selected function via signal on one or both output gates 37, 38, the control unit 3' also being adapted to, upon receipt of one or several other information items representative of a second setting, prevent initiation and/or acceptance of said selected function.
• the security arrangement V does not have the requisite security marginal since the input gates or the output gates could, due to internal malfunction, assume a position that is not representative of the connec- tor's temporary position and the control circuit 3' would be able to accept an information item corresponding to a predetermined first setting so that the control unit is adapted to, upon receipt of said information in the input gate, incorrectly indicate and/or accept a selected function.
• Modules of this type are known in several different forms. Besides output gates that can be assigned different potentials depending on internal circuits and functions, as well as the software used, output gates exist which offer an alternating voltage by internal circuits and functions and the software used.
• control unit 30 comprises a processor unit supplemented and controlled by a specially structured software, a sort of test program, and internal circuits or functions.
• FIG. 3 is a block diagram showing some functions that are relevant for an understanding of the present invention. Other functions are omitted for the sake of clarity.
• Figure 3 thus illustrates a part of a security arrangement wherein one or several connectors 2a, 2b, 2c serving as input functions shall co-operate with a control unit 30 and, more specifically, a module 30' pertaining to the control unit 30, each connector being designed to co-operate with input gates 31', 32' and 33', respectively.
• the connector 2d shall be connected in similar manner to an input gate not shown in fig. 3.
• the connection of connector 2d and other corresponding connectors to input gates is not shown in fig. 3 solely for the sake of simplification.
• Each connector 2a, 2b, 2c is designed to be able to transmit a first information item corresponding to a predetermined first setting, shown in fig. 1 , to said control unit 30 via cables 2a', 2b', 2'c, respectively, pertaining to the connectors, and the control unit 30 is adapted to, upon receipt of said information item, initiate and/or accept a selected function by initiating a pulsed output signal 37a' on a ca- ble 37a on an output gate 37'.
• control unit 30 is adapted to, upon receipt of one or several second information items representative of a second setting, prevent initiation and/or acceptance of said selected function by inhibiting a pulsed output signal on the cable 37a on an output gate.
• the output signal 37a' generated by the control system is of dynamic nature, an activated output signal signifying the presence of periodically recurring pulses, whereas an inactive signal signifies lack of pulses.
• the control unit 30 in fig. 3 is thus equipped with a computer having a processor unit 40.
• the processor unit senses signals on the input gates 31', 32' and 33' and, in response thereto, determines the extent to which the control unit shall initiate and/or accept a selected function and generate said signal via the output gate 37'.
• the control unit 30 shall be capable of performing several functions.
• a first function when all internal circuits, functions, input gates and software are intact, and when a first information item is received on the input gates, is that a pulsed output signal 37a' is sent out from the output gate 37'.
• a second function when all internal circuits, input gates and software are intact, and when a second information item is received on one or several input gates, is that a pulsed output signal from the output gate 37' is inhibited and the output gate 37' assumes a stable high or low value.
• a third function when the software is faulty or disconnected, is that a pulsed output signal from the output gate 37' is inhibited and the output gate 37' assumes a stable high or low value.
• a fourth function when one or several of the internal circuits or functions is/are faulty, is that a pulsed output signal from the output gate 37' is inhibited and the output gate 37' assumes a stable high or low value.
• a fifth function when a test program entirely or partially indicates malfunction, is that a pulsed output signal from the output gate 37' is inhibited and the output gate 37' assumes a stable high or low value.
• the invention is based on the principle that a pulse-shaped output signal 37a' generated by the control unit 30 via an output gate 37', is directly generated via software 44, such as a specifically structured test program, pertaining to the processor unit 40.
• Said test program may be built into the software 44 to control a plurality of the functions in the control unit. However, for the sake of simplification, as well as for more practical reasons, it has been located outside as a separate test pro- gram, but still co-operates with the software 44 via the processor unit 40.
• Figure 3 exemplifies the test program 42, the program 44 having the processor 40 send out a signal on the output gates 21', 22' or 23' and, via cables 25, the signals are connected and transmitted via input functions 2a, 2b and 2c to the input gates 31', 32' and 33', respectively, whereupon these signals shall be sensed in the control circuit or function 41 and checked as to correctness in the processor unit 40 in co-operation with the test program.
• the test program 42 may be structured so that, at each test cycle, it sends out a selected potential on one, a number, or all output gates being tested and senses whether a corresponding potential appears on the relevant input gate.
• the test program may also be structured so that, within each test cycle, it sends out a zero-potential on one, a number, or all output gates being tested and senses whether a corresponding potential appears on the relevant input gate.
• the test program may also be structured so that, within each test period, it sends out a pulse sequence on one, a number, or all output gates being tested and senses whether a corresponding pulse sequence appears on the relevant in- put gate.
• the software (42, 44) shall initiate sending out a pulse on the cable 37a.
• control unit 30 When, by using a test program 44, 42, it has been ascertained that all functions are working in accordance with predetermined criteria, the control unit 30 is activated via the processor unit 40 to execute the functions corresponding to the information item(s) obtained from said input functions, such as connectors 2a, 2b, 2c.
• a pulse be generated, a positive pulse alternating with a negative pulse, in order to produce a pulse-shaped output signal 37a' that shall appear with a selected pulse frequency generated and initiated from the software 42.
• FIG. 4 shows a first embodiment of a security arrangement in accordance with the present invention wherein a control unit 30, shown in fig. 3, forms a significant part for generating AC signal only when all functions are correct.
• control unit 30 shown in fig. 3 is illustrated here, connected via a cable 37a to an electronic connection arrangement 52, operative and acti- vatable by means of the pulses 37a' generated by the control unit 30, but not operative upon occurrence or absence of solely a direct voltage or no voltage at all. Only in the event of pulse-generation from the control unit 30, a connector 53 is activated via a cable 52a, which influences a selected output function 54.
• Figure 5 shows that the output signal 37a', 52a, respectively, is connected to a transformer circuit 51 serving as an AC-connected energy transferring circuit.
• Said pulse-shape 37a' assigned to be output signal may also be con- nected to an electronic connection arrangement 52 connected to said transformer connection 51.
• the secondary side 51 b of the circuit is galvanically isolated from its primary side 51a and the secondary side 51b may be connected to a rectifier connection 53.
• the rectifier connection 53 if used, is directly connected to a controlled function 54.
• the invention also advocates, as shown in fig. 3, that one end of the monitored input functions 2a, 2b, 2c shall be driven by means of an output gate, designated 21', 22', 23' assigned to the input function, from the control unit 30, thus being able to evaluate that an exactly equivalent input signal will appear on these inputs 31', 32', 33', respectively, which are connected to the other end of the monitored input function.
• Figure 6 shows that, that via blocks 52, 52' and via transformers 51 , 51', respectively, the control unit 30 shall be able to influence a function 54, 54' to drive a motor 60 in one of two opposite directions of rotation, e.g. to drive an ele- vator up or down in an elevator shaft.
• input functions and transducers other than connectors may be responsible for incoming information. Neither need there be only two direct and distinct positions for this information.
• the software 44 and test program 42 used may be structured to sharply and logically determine a limit for one or several states, where one or several of these states must be able to rely on corresponding output functions really being OFF/in activated.
• This control is not usually performed for one or several outputs 37' designed for the output function 54 or equivalent output functions, since these can be reliably driven via the software 42, 44 and processor unit 40.
• the invention also points out that if an internal malfunction in the control circuit 30 should affect the output signal so that this is statically locked in a position, the output signal will be inactivated since pulses can no longer be generated via the output gate 37'.
• Figure 3 also shows that the output gates 21'. 22' and 23' shall be utilised to drive one side of the connector/input function 2a, 2b and 2c, in order to be able to determine whether a signal chain connected in parallel is intact or not.
• the possibility is activated of setting the output 37' in the position determined by the test program and inputs: logical ON or logical OFF.
• the invention advocates that a logical "OFF position” shall result in no pulse on the corresponding output and that a logical "ON position” shall result in a periodically repeated pulse on the corresponding output.
• the invention also advocates that this pulse shall be directly generated by the software 44 (test program 42) and shall under no circumstances make use of any automatic generating method in the internal circuits of the control system. However, this may be done if it can be shown that the pulse generation is com- pletely closed down if the software is prevented from performing its task.
• the invention advocates that this pulse 37a' on the output 37' of the control system shall be AC-connected to an energy converter, such as a transformer.
• the transformer in turn drives the equipment that is to control the position of the output function 54 to ON or OFF.
• no direct connection route shall exist between the controlled object 54 and the supply voltage (V+) to the AC-connected energy transformer. That is to say, galvanic isolation must prevail between the input and output of the transformer.
• the connecting element 52 shall be so designed that if it is not supplied with pulses having a predetermined frequency and/or amplitude, the output signal on the cable 52a will disappear.
• the connecting element 52 in question is also so designed (AC-connec- tion) that the output signal automatically disappears if one of the following faults occurs: the input signal ceases to show frequency-related pulses, or internal parts of the connecting element malfunctions.
• the principle of the invention is thus based on not allowing the use of finished circuit blocks to automatic pulse generating in a microcontroller or PLC, for instance.

Landscapes

• Physics & Mathematics (AREA)
• General Physics & Mathematics (AREA)
• Engineering & Computer Science (AREA)
• Automation & Control Theory (AREA)
• Test And Diagnosis Of Digital Computers (AREA)
• Safety Devices In Control Systems (AREA)
• Programmable Controllers (AREA)

Priority Applications (1)

Applications Claiming Priority (2)

Publications (1)

Family

ID=20282274

Family Applications (1)

Country Status (3)

Cited By (3)

Citations (4)

• 2000
  • 2000-12-15 SE SE0004684A patent/SE518024C2/sv not_active IP Right Cessation
• 2001
  • 2001-12-10 WO PCT/SE2001/002729 patent/WO2002050620A1/en not_active Application Discontinuation
  • 2001-12-10 AU AU2002221242A patent/AU2002221242A1/en not_active Abandoned

Patent Citations (4)

Also Published As

Similar Documents

Legal Events