Patent Application
20120229938
This application claims priority to German Patent Application No. DE 10 2011 013 720.3 filed Mar. 11, 2011, which is hereby incorporated by reference herein in its entirety.
The present invention relates to a safety-related communication system in particular for automation technology and a safety relay to safely switch on loads.
In automation technology, actuators are often controlled by digital outputs of a control device, for example a programmable logic controller (PLC). Apart from controlling automated processes, safety-related functions are also increasingly controlled by control devices and carried out by corresponding actuators. To avert damage to people, machines and the environment, increased requirements apply to such safety-related functions with regard to their functionality, i.e. in particular with regard to the reliability and availability of the executing controllers and the activated actuators.
The digital signal outputs of a safety-related control device may have a monitoring device, with which a respective signal output current circuit can be monitored for faults in the wiring and for disturbances in the input region of a connected actuator.
In particular when operating actuators that have to be supplied with electrical energy, the signal output current circuit of the digital signal outputs of a control device is often electrically isolated from the respective load current circuit of the actuator as the digital signal outputs can in general drive only limited currents. The decoupling of the signal output current circuit and the load current circuits takes place, for example, by means of coupling relays, which, depending on an input signal provided by the respective digital signal outputs, can switch at least one load current circuit. The switching elements or the relay contacts in the load current circuit of the coupling relay can be configured both as a break-contact element and in the form of a make-contact element, so an inverting or non-inverting switching function can be realised with the coupling relay.
The corresponding coupling relays that meet the requirements for operation on a safety-related control device are known as safety relays. Depending on the safety requirement, a safety relay suitable for safely switching on an actuator comprises up to three switching elements connected in parallel. The switching elements are redundantly activated by a control logic of the safety relay depending on an input signal provided by the digital signal outputs of the control device so the load current circuit can be redundantly switched on by means of the switching elements.
A substantial drawback in the decoupling between the signal output current circuit and the load current circuit by a safety relay is that the monitoring device of a safety-related control device can only monitor the input current circuit of the safety relay. Possible faults in the load current circuit, for example wiring faults and faults within the safety relay, for example in the form of a failure of the internal control logic or individual switching elements, however, cannot be detected by the monitoring device of the digital signal outputs of a safety-related control device.
In an embodiment, the present invention provides a safety-related communication system including a safety relay with at least two signal inputs of an input signal current circuit connecting the safety relay to a control device that is configured to monitor the input signal current circuit. The safety relay also includes at least two load outputs of a load current circuit that are configured to connect to a load. Activatable switching elements are connected in parallel and configured to switch the load current circuit on or off based on an activation signal at the input signal current circuit. A diagnostic device monitors faults in the load current circuit and/or the safety relay. A signaling device connected to the signal inputs is configured to provide an impedance for the input signal current circuit and tune the impedance to the control device during a fault-free state. The impedance is detunable upon detection of a fault so as to signal the detected fault, by the detuned impedance, to the control device via the input signal current circuit.
Exemplary embodiments of the present invention are described in more detail below with reference to the accompanying drawings, in which:
In an embodiment, the present invention provides safety-related monitoring of the load current circuit and safety relay by the monitoring device at the digital signal output of a safety-related control device.
This is achieved by a safety-related communication system including at least one safety relay and one control device. The safety relay has at least two signal inputs, which are in each case connected to a digital signal output of the control device and therefore form the input signal current circuit of the safety relay.
A positive voltage of an activation signal, which can be switched on and off depending on the state of the control device, may, for example, be provided for the input signal current circuit at a first connection of a digital signal output. The corresponding reference potential can be provided by a second connection of the digital signal output. The first connection of the digital signal output may be equipped with an internal voltage source or at least be electrically connected to a voltage source, which is configured with sufficient current to drive the safety relay connected between the first and second connection of the digital signal output.
The control device is configured to monitor the input signal current circuit.
The input signal current circuit can be monitored by an internal monitoring device of the control device, which is allocated, for example, to the first connection of the digital signal output. The safety relay represents a specific impedance for the input signal current circuit, it being possible to programme the monitoring device to the impedance or to train?? it to the impedance. The current flowing through the input signal current circuit can thus be measured when there is a switched-on output signal and can be compared for deviations with respect to an expected value. When there is a deviation of the measured current compared to an expected value, i.e. a value based on the known impedance, the monitoring device can infer a fault in the wiring or in the input of the safety relay. The monitoring device may furthermore comprise means which also allow line monitoring when an input signal current circuit is switched off as well as earth fault monitoring. The digital signal outputs may furthermore be testable, so their functionality can, for example, be monitored with the aid of test pulses.
The safety relay furthermore comprises at least two load outputs, a diagnostic device and a signalling device. The two load outputs form a load current circuit to connect an actuator, which may be an electrical load. The load outputs are connected to the diagnostic device, which is configured to monitor faults in the load current circuit and/or in the safety relay. The signalling device is connected to the signal inputs of the safety relay.
The load current circuit can be switched by at least two activatable switching elements connected in parallel, the switching on and off of the load current circuit taking place depending on an activation signal present at the input signal current circuit.
The signalling device is configured to provide an impedance which, in the fault-free state, is tuned to the control device for the input signal current circuit. This means that, when the safety relay is in the fault-free state, the impedance corresponds to the value programmed in the control device.
When a fault is detected, the impedance of the signalling device can be detuned in such a way that the detected fault can be signalled via the input signal current circuit to the control device by the detuned impedance.
The safety-related communication system allows the control device a complete monitoring of a safety-related signal chain, which may comprise a control device, a safety relay and an actuator. A particular advantage of this system is that a fault detected in the safety relay or in the load current circuit can be signalled to the control device via the input signal current circuit present. A separate safety-related wiring to signal a fault is unnecessary.
In an embodiment of the invention, the safety relay may comprise a long-range power supply unit which obtains, from a supply voltage for the load current circuit, auxiliary energy for the signalling device, the diagnostic device and for an internal control logic of the safety relay.
No external auxiliary energy power supply unit is therefore necessary to supply the internal electronics of the safety relay. The load current circuit may, if necessary, be operated by a direct or alternating voltage, for example in the range between 20 V and 25 V, it being possible to therefore supply the internal electronics indirectly from the same source as the connected actuator.
The diagnostic device for monitoring faults in the load current circuit and/or in the safety relay may be configured to monitor a supply voltage provided for the load current circuit.
The diagnostic device may furthermore be configured to impress a measuring current in the load current circuit and to monitor the switched-off load current circuit for a line short circuit and/or a line break.
Furthermore, the safety relay may have a measuring sensor to detect the current in the load current circuit, said measuring sensor preferably being connected to the diagnostic device. The measuring sensor may be configured to monitor the switched-on load current circuit for currents that are too high and too low and/or an incorrect phase angle.
A combination of a shunt sensor and/or a Hall sensor is particularly suitable as a measuring sensor in order to cover as wide a measuring range as possible.
The diagnostic device can be configured to couple a high frequency measuring voltage between the load current circuit and an earth potential and to monitor the load current circuit for an earth fault.
Furthermore, the diagnostic device may be configured to test the switching elements connected in parallel when the load current circuit is switched off and to detect a fault depending on the test result.
The safety relay for safely switching an actuator on can be tested and therefore configured in a safety-related manner and provides complete monitoring of the line, load and an earth fault for the load current circuit.
Depending on the possible monitoring results, the diagnostic device may in each case detect a fault, which can be signalled with the aid of the detunable impedance in the signalling device to the control device.
The signalling device may comprise a network of connectable resistances and/or inductances and/or capacitances and/or a connectable earth potential.
Advantageously, this makes it possible for a detected fault in the load current circuit to be correspondingly simulated in the signalling device and therefore in the input signal current circuit. In addition to the presence of a fault in the load current circuit, it is therefore also possible to signal the type of the respective fault to the control device.
The output current circuit for the activation signal from the control device 1 is electrically isolated from the load current circuit of the actuator 4 by the safety relay 2. The connections DO1 and DO2 of the digital signal output form the signal output current circuit to activate the safety relay and are in each case connected to one of the two input terminals IN1 and IN2.
The control device 1 comprises an internal monitoring device, not shown in
The signal inputs IN1 and IN2 are guided internally to a signalling device 210 in the safety relay 2. The signalling device 210 is reciprocally connected to the control logic 220 and provides the input signal current circuit for an impedance that can be varied by the control logic 220.
A load current circuit, which can be switched by the safety relay 2, to the adjacent actuator 4, is provided at the load outputs 25 and 26, the operating voltage for the load current circuit being provided by the voltage-carrying connection 24 for a direct or alternating voltage and the reference potential connection 27. The current path guided from the voltage-carrying connection 24 to the load output 26 can be switched on and off by at least two switching elements 251 and 252 connected in parallel. Depending on the safety requirement, three or more switching elements connected in parallel may also be provided at this point.
The reference potential connection 27 is directly connected to the load output 26 by an internal current path in the safety relay 2. The switching elements 251 and 252 connected in parallel are redundantly activated by the control logic 220 depending on an activation signal, which is received from the signalling device 210 at the input signal current circuit of the safety relay. The switching elements connected in parallel can be activated by the control logic 220 via separate channels.
The safety relay 2 contains a diagnostic device 240, which is configured to monitor the load current circuit and can, in particular, detect wiring faults and faults in the input region of the connected actuator 4. The diagnostic device 240 inter alia has a first and second diagnostic connection 243 and 244, which are in each case connected to one of the two load outputs 25 and 26.
When the switching elements 251 and 252 are open, i.e. when an actuator 4 is switched off, a measuring current can be impressed via the first and second diagnostic connection 243 and 244 in the load current circuit, which is substantially below the threshold value necessary to activate the actuator 4. With the aid of the impressed and the measured currents and voltages, the diagnostic device is enabled to detect a possible line break and/or possible short circuits in the load current circuit.
When an actuator 4 is switched on by the closed parallel switching elements 251 and 252, the current flowing through the load current circuit is detected with the aid of at least one measuring sensor, which is connected to the diagnostic device 240. The measuring sensor, not shown in
The diagnostic device 240 comprises a third and a fourth diagnostic connection 245 and 246, which are used for an earth-fault monitoring shown in
As can also be inferred from
If the diagnostic device 240 detects a fault in the load current circuit and/or a fault in one of the redundant switching elements, this fault is signalled and communicated to the control device 1.
The communication of a detected fault takes place by means of the signalling device 210 and therefore by means of the input signal current circuit of the safety relay 2.
The signalling device 210 provides a circuit network with various impedances between the two signal inputs IN1 and IN2, which can be activated and varied in a targeted manner by the control logic 220. In the fault-free case, the impedance is tuned to the digital signal output with the connections DO1 and DO2 in such a way that the control device 1 detects an expected, i.e. a programmed or trained, impedance during the monitoring of the input signal current circuit and therefore detects a fault-free state in the input of the safety relay 2.
If the diagnostic device 240 detects a fault in the load current circuit or in the safety relay 2, the impedance of the signalling device 210 can be correspondingly detuned by the control logic 220, so a fault is also detected by the control device 1 by monitoring the input signal current circuit.
The circuit network in the signalling device 210 is able to switch the input signal current circuit with low resistance, high resistance, capacitively, inductively or to earth potential, in particular depending on a respective detected fault.
The auxiliary energy required for the control logic 220, the diagnostic device 240 and that necessary to activate the switching element 250 is obtained by means of a long-range power supply unit 230 from the operating voltage provided for the load current circuit. The long-range power supply unit 230 may, for example, be operated on the input side both with a direct voltage and with an alternating voltage between 20.4 V and 253 V and provides, for example, a 24 V direct voltage on the output side.
The circuit network in the signalling device 210 is configured in such a way that when the auxiliary voltage is not sufficient and with a control logic 220 which is therefore not ready for operation, a fault is compulsorily communicated to the control device 1. Furthermore, the diagnostic device 240 is configured to monitor the operating voltage for the load current circuit and, in the event of a deviation, to communicate a fault via the control logic 220 and the signalling device 210 to the control device 1.
Owing to the variable impedance in the signalling device 210, faults detected by the diagnostic device 240 in the load current circuit can be correspondingly simulated at the input signal current circuit of the safety relay 2. The control device 1, during the monitoring of the input signal current circuit, therefore also detects a corresponding fault via the two connections of the digital signal output DO1 and DO2.
Using the signalling device 210, a communication system for the control device 1 and the safety relay 2 is provided, which allows a safety-related, bidirectional communication between these two stations. The safety relay 2 including the load current circuit with an actuator 4 is completely testable by the control device 1, so faults both in the load current circuit, including the associated operating voltage, and also within the safety relay 2, can be detected. In the case of a fault, the control device 1 adopts a safe state.
While the invention has been particularly shown and described with reference to preferred embodiments thereof, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention.
| Number | Date | Country | Kind |
|---|---|---|---|
| 10 2011 013 720.3 | Mar 2011 | DE | national |
