EP1307894B1 - Safety switch for safely switching off an electric consumer, especially an electrically driven machine - Google Patents

Abstract

The present invention relates to a safety switching device for safely switching off an electrical load such as an electrically driven machine. The safety switching device has a failsafe disconnection unit and a non-failsafe signaling unit, both of which are supplied with an external control signal. The disconnection unit fail-safely switches off the electrical load as a function of the control signal but with a first delay. The signaling unit produces an external reporting signal as a function of the control signal in a non-delayed and non-failsafe manner.

Description

The present invention relates to a safety switching device for safely switching off an electrical load, in particular an electrically driven machine, with a fail-safe shutdown unit and a reporting unit to which an external control signal can be fed together, wherein the shutdown failsafe the electrical load in response to a defined signal state of the control signal turns off, and wherein the annunciator generates an external message signal and deactivates it at the occurrence of the defined signal state without delay.

Such a safety switching device is off DE 40 33 800 A1 known.

Safety switching devices of the type mentioned are used primarily in the industrial sector to perform shutdown operations in fail-safe manner. "Fail-safe" means in this context that the switching device meets at least safety category 3 of the European standard EN 954-1. For example, such devices are used in response to the actuation of an emergency stop button or the opening of a protective door, a machinery from which poses a risk to shut down or otherwise in a safe state. Also, for performing maintenance or repair work, it is usually necessary to shut down a machine or machinery completely or at least partially fail-safe. Since a malfunction or failure of the safety switching device in such a situation has an immediate danger to people result, very high demands are made in terms of fault tolerance of such switching devices. This leads to a very large effort associated with high costs in the development and manufacture of safety switching devices.

In some applications, there is a need to shut down the machine or machinery before the actual shutdown, ie the removal of the supply voltage controlled. The machine is controlled by the machine control in a defined idle state transferred. This is particularly advantageous if the re-commissioning of the machine after an abrupt shutdown in the middle of the operation is associated with difficulties. Furthermore, will be by a controlled shutdown before the actual shutdown uncontrolled machine movements, for example due to inertial forces avoided.

In order to allow a controlled shutdown of a machine before the actual shutdown, it is known to use a delay element, the shutdown, i. to delay the interruption of the power supply for a first period of time. Before the expiration of this period, the reporting unit generates a change of state of the external message signal, whereby the control unit of the machine is caused to put them into the idle state.

In an earlier safety switching device of the Applicant, the reporting unit essentially comprises two mutually redundant relays which, in contrast to the relays of the disconnection unit, instantaneously drop when their control circuit is de-energized. By contrast, the relays of the disconnection unit are delayed-decay. The message unit is so, as well as the known safety relay in total, built fail-safe, and thus provides a fail-safe message. As already mentioned, however, such a safety switching device is complicated and expensive.

It is therefore an object of the present invention to provide a safety switching device of the type mentioned, which is cheaper to produce.

This object is achieved in the safety switching device mentioned above in that the disconnection unit has a first delay element, with the help of the shutdown of the consumer is delayed by a first time period, and that the reporting unit is a non-fail-safe unit that provides a non-failsafe message signal at an output of the switching device.

The solution according to the invention is based on the recognition that the generation of the message signal is a sub-process which, taken alone and in contrast to the overall process of switching off the machine, is not immediately safety-critical. A malfunction in the generation of the message signal is namely caught at the latest after the expiry of the first period by the then taking place interrupting the power supply. As a result, it is possible to make lower demands on the failure safety of the reporting unit, without reducing the overall fault tolerance of the safety switching device according to the invention. If one refrains from constructing the message unit consistently fail-safe, the effort is reduced considerably, so that the safety switching device according to the invention can be made overall simpler and thus more cost-effective.

In contrast to a complete abandonment of the reporting unit, the safety switching device according to the invention has the advantage that the machine to be shut down can normally be shut down in a controlled manner before switching off. This avoids difficulties in recommissioning.

According to the invention, the message unit deactivates the message signal when the defined signal state occurs without delay.

This means that the reporting unit causes a state change of the external message signal almost simultaneously with the occurrence of the defined signal state of the control signal. It is understood that an exact timing in practice can not be achieved due to technical signal propagation delays. "Delay-free" therefore means that beyond the unavoidable signal propagation times, there are no additional delays in the response of the reporting unit. The measure has the advantage that the operating control of the machine has a maximum time available to shut down the machine in a controlled manner. Conversely, the first time span can be made very small, which overall allows a fast response of the safety relay.

In one embodiment of the invention, the control signal includes an operating voltage of the switching device, wherein the defined signal state corresponds to an elimination of the operating voltage.

• In einer weiteren Ausgestaltung weist das Sicherheitsschaltgerät eine logische ODER-Verknüpfung auf, die die Betriebsspannung mit einem von außen zugeführten Abschaltsignal eines Auslöseelements verknüpft, wobei der definierte Signalzustand einem Wegfall der Betriebsspannung oder einem Betätigen des Auslöseelements entspricht.

In this way, additional security is generated because the safety switching device initiates the shutdown automatically when its own operating voltage is eliminated. If the safety relay fails, the monitored machine is automatically shut down and switched off fail-safe:

• In a further refinement, the safety switching device has a logical OR operation, which combines the operating voltage with a switch-off signal of a triggering element supplied from the outside, the defined signal state corresponding to an elimination of the operating voltage or an actuation of the triggering element.

With this measure, a two-channel control of the safety switching device is provided in a simple manner, whereby the error safety is increased again.

In a further embodiment of the invention, the reporting unit has a second delay element, with the aid of which the generation of the message signal when switching the switching device is delayed by a second period.

This measure has the advantage that the supply voltage for the machine is already stably applied before the reporting unit provides the external message signal and thus causes the operation control of the machine to start it up. In this case, this advantageous timing without additional external circuitry and timers is achievable, which simplifies the application and installation of the safety switching device according to the invention.

In a further embodiment of the invention, the turn-off unit has at least two mutually redundant switching means, which are arranged in series with each other.

With the help of this measure known per se, it is possible, the turn-off failsafe in the sense of the European Norm EN 954-1, so that the safety relay according to the invention can meet this standard in total.

In a further embodiment of the aforementioned measure, the switching means have at least one positively driven auxiliary contact, which is integrated in a monitoring circuit.

With this measure, an even higher failure safety is achieved because the shutdown unit can be monitored in this way in addition to their reliability.

In a further preferred embodiment of the invention, the disconnection unit and the reporting unit are arranged in a common switchgear housing.

This measure has the advantage that the safety switching device according to the invention is available as a compact device in itself, which considerably simplifies its installation in a machine system to be monitored. It is particularly advantageous that the control of the timings between the shutdown unit and the reporting unit is performed inside the device, which errors during installation and unwanted manipulations are avoided.

It is understood that the features mentioned above and those yet to be explained not only in the particular combination given, but also in other combinations or alone, without departing from the scope of the present invention.

Fig. 1

eine schematische Darstellung eines gattungsgemäßen Sicherheitsschaltgerätes, von dem die vorliegende Erfindung ausgeht;

Fig. 2

eine schematische Darstellung eines Ausführungsbeispiels des erfindungsgemäßen Sicherheitsschaltgerätes;

Fig. 3

ein erstes Ausführungsbeispiel für den Aufbau der Meldeeinheit bei dem Sicherheitsschaltgerät gemäß Fig. 2;

Fig. 4

ein zweites Ausführungsbeispiel für eine Meldeeinheit; und

Fig. 5

eine Darstellung der zeitlichen Zusammenhänge bei dem erfindungsgemäßen Sicherheitsschaltgerät; und

Fig. 6

eine schematische Darstellung eines zweiten Ausführungsbeispiels des erfindungsgemäßen Sicherheitsschaltgerätes.

Embodiments of the invention are illustrated in the drawings and are explained in more detail in the following description. Show it:

Fig. 1

a schematic representation of a generic safety switching device, from which the present invention proceeds;

Fig. 2

a schematic representation of an embodiment of the safety switching device according to the invention;

Fig. 3

a first embodiment of the structure of the reporting unit in the safety switching device of FIG. 2;

Fig. 4

a second embodiment of a reporting unit; and

Fig. 5

a representation of the temporal relationships in the safety switching device according to the invention; and

Fig. 6

a schematic representation of a second embodiment of the safety switching device according to the invention.

In Fig. 1 a generic safety switching device is designated in its entirety by the reference numeral 10.

The safety switching device 10 is installed in a compact device housing 12 having numerous externally accessible terminals. The terminals are formed in the present embodiment as screw terminals and are referred to in Fig. 1 in the usual manner in such switching devices way.

The terminals A1 and A2 form an input via which the safety switching device 10 is supplied with a device-internal operating voltage U _B. Via external bridges 14 between the terminals S33 and S34 or Y1 and Y2, the operating voltage U _B when switching first to a series circuit 16, which is composed of the auxiliary contacts of four relays K1, K2, K4 and K5 and the control circuit of a release relay K3 is. The auxiliary contacts of relays K1, K2, K4 and K5 are normally closed contacts, which are closed in idle state. As a result, after switching on the safety switching device 10, first a current flows through the control circuit of the relay K3. Its working contacts 18, 20 then attract as well as its auxiliary contact 22. About the normally open contacts 18, 20 of the relay K3, the operating voltage U _B then passes to the control circuits of the already mentioned relays K1, K2, K4 and K5. Their normally open contacts 24, 26, 28, 30 form two output circuits of the safety switching device 10, which are accessible via the terminals 32, 33 and 34, 35.

With the tightening of the relays K1, K2, K4 and K5 open their auxiliary contacts in the series circuit 16, and the normally open contacts 24, 26, 28, 30 close. Furthermore, the two other auxiliary contacts 36, 38 are closed, which then the current flow through the control circuits of the relays K1, K2, K4 and K5 maintained regardless of the operating position of the relay K3. The relay K3 drops after the predetermined fallback delay time has elapsed.

After these operations, the normally open contacts 24, 26, 28, 30 are closed in the two output circuits of the safety switching device 10, so that a device connected to the safety switching device 10 (not shown here) is turned on. If the operating voltage U _{B is} removed at the input terminals A1, A2, all contacts fall back into their rest position shown in FIG. This has the consequence that the current path between the terminals 32 and 33 is interrupted almost simultaneously. The current path between the terminals 34 and 35 is in contrast interrupted with a delay time corresponding to the fallback time of the relays K4 and K5.

In practical operation, a machine to be switched off is supplied via the current path between the terminals 34 and 35, while the signaling signal is conducted via the current path between the terminals 32 and 33. As it follows, as many relays are needed here to generate the message signal, as for switching off the machine.

In Fig. 2, an embodiment of a safety switching device according to the invention is designated in its entirety by the reference numeral 40. The same reference numerals designate the same elements as in FIG. 1.

The safety switching device 40 has in its output circuit between the terminals 34 and 35 in turn arranged in series working contacts 24, 26 of the two relays K1 and K2. The Input circuits of the relays K1 and K2 are initially supplied via the normally open contacts 18, 20 of the relay K3, as in the case of the safety switching device 10 according to FIG. After tightening the relays K1 and K2, the relay K3 drops with a delay time, and the supply of the input circuits of the relays K1 and K2 via the closed at this time auxiliary contacts 36 and 38. The structure of the safety relay 40 corresponds to that of the safety relay 10th ,

In the described state after switching on, the current path is closed via the terminals 34, 35, and an electrical machine 42 is connected to the supply voltage U _v .

The reference numerals 44, 46 designate two capacitances which are connected in parallel to the control circuit of the relays K1 and K2. When switched on, the two capacitors 44, 46 charge. If one removes the input-side operating voltage U _B , the two capacitors 44, 46 discharge via the control circuits of the relays K1 and K2. Only after unloading the relays K1 and K2 fall off and open their normally open contacts 24, 26. Thus, the machine 42 with a delay time T ₁ , which corresponds to the discharge time of the capacitors 44, 46, turned off. The capacitors 44, 46 are thus first delay elements in the sense of the present invention.

The components of the safety switching device 40 described so far form a turn-off unit, which is designated in its entirety by the reference numeral 48 below. The shutdown unit 48 is constructed in a conventional manner two channels redundant, creating a fault tolerance in the sense European standard EN 954-1. In addition, each of the two relays K1, K2 has a positively driven auxiliary contact 50, 52 which is coupled to the relay K3 such that the safety switching device 40 can not be put into operation when one of the normally open contacts 24, 26 is fused. The auxiliary contacts 50, 52 are thus integrated into a monitoring circuit.

In contrast to the safety switching device 10 according to FIG. 1, however, the safety switching device 40 has a non-failsafe message unit 54 which provides a non-failsafe message signal 58 at an output terminal 56. The message signal 58 can thus be supplied to a control unit 60 for the machine 42 in a simple manner.

In the simplest case, the output terminal 56 is connected directly to the operating voltage U _B for generating the signaling signal 58. However, preferred embodiments of the reporting unit 54 are described with reference to the following figures.

In Fig. 3, the reporting unit 54 includes an amplifier circuit consisting of two transistors T1 and T2 and a number of resistors R1 to R6. The signaling signal 58 is tapped via the resistor R6 at the collector of the transistor T2, which in the circuit shown has the consequence that the message signal 58 in the active state corresponds approximately to the operating voltage U _B , while it has a de-energized, high-impedance state ,

In the preferred embodiment according to FIG. 4, the circuit of the reporting unit 54 is supplemented by an additional capacity 62, which has the consequence that the message signal 58 assumes its active signal state only after the capacitor 62 has largely charged. As a result, the provision of the signaling signal 58 when switching on the safety switching device 40 is delayed by a second time period determined by the capacity 62.

In Fig. 5, the timing of the safety switching device 40 are shown again graphically. At the time t ₀ , the operating voltage U _{B of} the safety switching device 40 is turned on. Draw nearly the same time doing the work contacts 24, 26 of the relays K1 and K2, so that the supply voltage U _v is applied to the machine 42nd In contrast, the message signal 58 assumes its active state only after expiry of the second time interval T ₂ , which corresponds approximately to the charging time of the capacitor 62.

If the operating voltage U _{B of} the safety switching device 40 is removed at time t ₂ , the signaling signal 58 returns to its deactivated, high-impedance state practically at the same time. However, the normally open contacts 24, 26 of the relays K1, K2 remain closed until the capacitances 44, 46 are discharged. As a result, the machine 42 is separated from its power supply U _v only after the expiration of the period T ₁ . The control unit 60 of the machine 42 therefore has enough time to shut down the machine 42 before disconnecting the supply voltage U _v .

In Fig. 6, another embodiment of a safety switching device according to the invention is designated in its entirety by the reference numeral 70. The safety relay 70 differs from the safety switching device 40 of FIG. 2 mainly by a logical AND operation, which is designated in FIG. 6 by the reference numeral 72. The output of the AND operation 72 is fed to the reporting unit 54. At a first input, the AND gate 72 receives the switch-off signal of a two-channel triggering element 74 in this case, which by way of example here is a two-channel emergency stop button. At its second input, the AND gate 72 receives a signal derived from the operating voltage U _B. The defined signal state, in the presence of which the safety switching device 70 initiates the switch-off process for the machine 42, thus corresponds both to an elimination of the operating voltage U _B and an actuation of the trigger element 74 or even both.

Claims (7)

1. A safety switching device for safely switching off an electrical load (42), in particular an electrically driven machine, having a failsafe disconnection unit (48) and a signaling unit (54), to both of which an external control signal (U_B; U_B, 74) can be supplied jointly, with the disconnection unit switching off the electrical load (42) in a failsafe manner as a function of a defined signal state of the control signal (U_B; U_B, 74), and with the signaling unit (54) producing an external reporting signal (58; U_M) and deactivating this without any delay when the defined signal state occurs, characterized in that the disconnection unit (48) has a first delay element (44, 46), by means of which the process of switching off the load (42) is delayed by a first time interval (T₁), and in that the signaling unit (54) is a non-failsafe unit which produces a non-failsafe reporting signal (58; U_M) at one output (56) of the switching device (40).
2. The safety switching device of claim 1, characterized in that the control signal includes an operating voltage (U_B) for the switching device (40), with the defined signal state corresponding to absence of the operating voltage (U_B).
3. The safety switching device of claim 1 or 2, characterized in that the control signal includes an output signal from a tripping element (74), with the defined signal state corresponding to operating the tripping element (74).
4. The safety switching device of any of claims 1 to 3, characterized in that the signaling unit (54) has a second delay element (62), by means of which the production of the reporting signal (58; U_M) is delayed by a second time interval (T₂) when the switching device (40) is switched on.
5. The safety switching device of any of claims 1 to 4, characterized in that the disconnection unit (48) has at least two mutually redundant switching means (K1, K2; 24, 26), which are arranged in series with one another.
6. The safety switching device of claim 5, characterized in that the switching means (K1, K2) have at least one positively-guided auxiliary contact (50, 52), which is included in a monitoring circuit.
7. The safety switching device of any of claims 1 to 6, characterized in that the disconnection unit (48) and the signaling unit (54) are arranged in a common switching device enclosure (12).

Images