EP1738383B2 - Signaling device for a protective circuit - Google Patents

Abstract

A signaling device for a safety circuit has an input part for receiving an external state variable, at least one switching element and a control part. The control part controls the at least one switching element as a function of the external state variable, such that a signal applied to the input is communicated to the output. According to one aspect of the invention, the input of the switching element is internally connected to a fixed potential, preferably a fixed High potential. In a safety circuit for turning off a hazardous installation, such signaling devices are connected in series with one another to a safety controller. In such an arrangement, the control part of the downstream second signaling device also controls its switching elements as a function of the output of the first signaling device.

Description

The present invention relates to a sensor (other name: signaling device, signaling device) for a safety circuit, with an input part for recording an external state variable, with at least one switching element with an input and an output, and with a control part that is designed to To control the at least one switching element as a function of the external state variable in such a way that a signal present at the input is switched through to the output, ie appears at the output.

The invention also relates to a safety circuit for safely shutting down a hazardous system, with a safety controller that is designed to shut down the system in a fail-safe manner, and with a first and at least one second signaling device of the type mentioned above, which are connected in series to the safety controller .

Such a signaling device and such a safety circuit are off EP 1 363 306 A2 known.

The operating processes of modern technical systems, such as industrial production systems and production lines, transport and conveyor systems, fairground rides and the like, are increasingly being controlled fully automatically. An operating controller receives target and process variables of the system and, with the help of a specified control program, forms control signals from them that actuate the actuators of the system. In addition to controlling the planned operational sequence, safety aspects, ie the avoidance of danger to people who are in the area of the plant, are gaining increasing attention. For example, systems that carry out automated movements are generally shielded nowadays by protective fences, light barriers, safety mats and the like. Furthermore, it is known to equip technical systems with emergency stop buttons which, when actuated, should switch off the system (or at least part of it) or otherwise bring it into a safe state. Such safety-relevant signaling devices, which generate and provide status signals that are purely relevant for protecting the system, are generally not evaluated with the "normal" operational control of the system, but fed to a so-called safety controller or, in simpler cases, to a so-called safety switching device. For the sake of simplicity, no further distinction is made in the following between complex safety controller and simpler safety switching device, i.e. the term "safety controller" includes both simpler safety switching devices, such as those offered by the present applicant under the name PNOZ ^® , and complex safety controllers, such as the SPS-based PSS ^® of the applicant.

However, safety controllers differ from “normal” operational controllers in that they are designed to be inherently fail-safe using measures such as redundant signal processing channels, regular self-tests and the like. To a certain extent, simple operating controls also have error detection and error avoidance measures, but these are generally not sufficient to ensure that the system is shut down safely under all circumstances. To distinguish between "simple" controllers and "simple" signaling devices, the present invention relates to signaling devices, safety controls and safety circuits constructed therefrom, which meet at least Category 3 of European Standard EN 954-1, preferably the highest Category 4, or comparable safety requirements.

The one mentioned above EP 1 363 306 A2 describes a so-called safety switch, ie a signaling device, for monitoring the position of protective grilles, protective doors, machine paneling parts and similar protective devices. Such safety switches have an actuator with the help of which the open or closed position of the protective door can be determined in a fail-safe manner. To date, such safety switches have generally been constructed electromechanically in practice and the necessary function tests and fault monitoring, such as cross-circuit detection, are carried out by or at least with the help of the higher-level safety controller. Corresponding safety switches therefore usually only receive approval in accordance with EN 954-1 or comparable standards in combination with the safety controller.

In order to enable a higher safety category for the safety switch itself, the EP 1 363 306 A2 propose to integrate a safety logic in the safety switch, as is already known from light barriers, light grids and other "intelligent" signaling devices. In the exemplary embodiments described, the proposed safety switches have two mutually redundant electronic switching elements, which are controlled by a fail-safe control part. An external release signal is looped via the switching elements, which is ultimately fed to the higher-level safety controller. The enable signal can thus be suppressed by the control part, which signals to the safety controller that the monitored system is to be brought into a safe state. The release signal can also be looped through several safety switches connected in series, so that each of these safety switches can suppress the release signal.

Such a series connection of signaling devices has already been implemented in practice with electromechanical signaling devices, with the release signal in these cases being generated by the safety controller and looped back via the series-connected relay contacts of the individual signaling devices.

the inside EP 1 363 306 A2 described structure the safety switch enables the higher-level safety controller to react quickly, even if a large number of signaling devices are connected in series to the safety controller. On the other hand, looping through the enable signal limits the maximum spatial distribution of the signaling devices connected in series. In addition, from the point of view of the higher-level safety controller, the entire row is "dead" if one of the signaling devices suppresses the enable signal, either due to a change in the actuator (opening of the protective door or similar) or due to an internally detected functional error. The flexibility and performance of the safety switches described does not go beyond what has long been possible with comparable relay-based signaling devices.

DE 600 01 235 T2 discloses a signaling device and a safety circuit with a series connection of signaling devices, the signaling device being a proximity switch for monitoring a protective door. The proximity switch has a signal input to which a digital or pulsed input signal can be fed. It modulates a high-frequency carrier wave with the supplied input signal in an amplitude shift keying manner. The modulated carrier wave is used to excite an actuator which generates a second amplitude modulated radio frequency carrier wave at a different frequency. The proximity switch can receive the second amplitude modulated carrier wave when the actuator is close to the proximity switch. In this way he can monitor the presence of the actuator. When the proximity switch receives the second carrier wave, the digital or pulsed modulation signal is reconstructed using a rectifier circuit and made available via an inverter at an output of the proximity switch. The output signal of the proximity switch therefore corresponds to the inverted input signal if the actuator is close to the proximity switch.

DE 100 11 211 AI discloses a safety switching device system in which several safety switching devices are arranged in series with one another. EP 0 803 632 B1 discloses an arrangement with multiple sensors connected in parallel to a door controller. The sensors can transfer error information to the door control via the connecting cable. DE 102 16 226 A1 discloses a device for failsafe switching off an electrical consumer in industrial production plants. It has a first and at least a second safety switching device. The first safety switching device has a first evaluation and control unit, an output and an electronic switching element which, depending on the first evaluation and control unit, generates a potential-related switching signal at the output. The second safety switching device has a second evaluation and control unit and an input which is connected to the second evaluation and control unit and to the output of the first safety switching device. The first and the second safety switching device are connected to one another here via a single-channel connecting line and the second safety switching device has at least two input circuits, to which the potential-related switching signal of the first safety switching device is supplied redundantly to one another.

Against this background, it is an object of the present invention to specify a sensor of the type mentioned at the outset, which enables more flexible use, in particular in a series arrangement.

It is also an object of the invention to specify a safety circuit with a series arrangement of such sensors, which enables a more flexible reaction to a reporting event.

According to one aspect of the invention, these objects are achieved by a sensor according to claim 1 and a safety circuit according to claim 9.

In terms of circuitry, the new signaling device differs from the one EP 1 363 306 A2 known safety switch in that a release signal is no longer looped through the at least one switching element. Rather, the release signal is now generated anew in each signaling device. In this case, however, the control part of a second signaling device located downstream in a series connection takes into account the output signal of the signaling device located upstream in front of it. It is thus easily possible to emulate the looping of a release signal through several signaling devices in such a way that no difference can be seen from the point of view of the higher-level safety controller. On the other hand, however, the individual signaling devices in a series arrangement are not "dead" if an upstream signaling device has suppressed the enable signal. Due to the invention, it is possible for a signaling device located downstream to send a message to other subsequent signaling devices and/or the higher-level safety controller in the form of a data telegram or the like, which enables the entire safety circuit to react flexibly. The data telegram can be transmitted via the existing connections, ie the wiring effort is low despite increased flexibility.

Irrespective of this, each signaling device assumes a repeater function due to the new wiring, and considerably larger distances can therefore be realized between the signaling devices arranged in series with one another. This also enables more flexible system planning. Group disconnection can also be easily implemented due to the new functionality of the signaling devices, since each signaling device in the series arrangement can generate a signaling signal at its output independently of the signaling devices located upstream.

The stated task is therefore completely solved.

In one embodiment, the signal switched through to the output of the at least one switching element is fed to the control part of the signaling device.

In other words, the output signal of the switching element (and thus at least indirectly also the output signal of the signaling device) is fed back to the control part. The control section is thus able to detect device-internal functional errors. Taken by itself, this configuration is also complete EP 1 363 306 A2 and also known for a long time from light barriers and other "intelligent" signaling devices and safety switching devices. However, the advantages of this configuration only come into their own as a result of the present invention, since each signaling device in a series arrangement can pass on an internal malfunction independently of the status of signaling devices located upstream.

In a further refinement, the control part of the signaling device is designed to detect a device-internal functional error and, with the aid of the at least one switching element, to generate a data telegram at its output.

The particular advantage is that the new signaling device can transmit diagnostic data to the higher-level safety controller via the existing connections, i.e. no additional connections and cables need to be provided for the transmission of diagnostic data. The wiring is correspondingly simplified and space and costs for additional connections can be saved both in the signaling device and in the safety controller.

In preferred configurations, the data telegram is a pulse telegram, i.e. the control part switches the at least one switching element on and off in pulses.

In this way, messages with an information content of several bits can be transmitted very inexpensively and variably on the existing signal lines. This enables the efficient transfer of very detailed diagnostic information. In this embodiment, an address assigned to the signaling device can also be transmitted to the higher-level controller with little effort, so that the safety controller can individually identify each signaling device in a series connection.

In a further embodiment, each signaling device has at least two redundant switching elements, each with an input and an output, each of the at least two redundant switching elements being connected to the fixed potential on the input side.

In combination with the present invention, this configuration, which is already known per se from safety controllers, has the advantage that the signaling device can report an internal malfunction on the existing signal lines to the higher-level safety controller, even if one of the switching elements is the cause of the malfunction. The redundancy provided for safety reasons in the known safety switching devices also leads to greater availability here.

In a further refinement, the signaling device has an input for supplying an operating voltage, the operating voltage being supplied to the at least one switching element as a fixed potential.

This refinement is particularly advantageous with regard to the repeater function of the new signaling device described above. Since the at least one switching element is connected to the operating voltage on the input side, large distances between a number of signaling devices can be easily bridged.

In a further refinement, the signaling device contains a movable actuator which can be moved between a first and at least one second spatial position, the external state variable being a current spatial position. In a particularly preferred embodiment, the actuator is a transponder.

In this embodiment, the new signaling device is in particular a protective door switch, an emergency stop button, a limit or position switch, a sensor for a safety mat or a manually operated start or command button. The actuator can be integrated into the signaling device or also be designed separately from the signaling device, as is usual with safety door switches, for example. The actuator can be connected to the signaling device optically, inductively, capacitively or in any other way. This refinement is preferred because the signaling devices mentioned are relatively simple components which up until now have had practically no signal processing of their own. The extended range of functions is therefore particularly effective with these signaling devices. The use of the present invention in such "simple" signaling devices can also make the use of a higher-level safety controller superfluous for smaller applications, in that the signaling device activates an actuator via its outputs without an interposed safety controller.

It is therefore preferred in a further embodiment if the new signaling device has a readback input for supplying an external readback signal from an actuator.

The signaling device of this embodiment thus combines the hitherto separate functions of "detecting the state variable" (sensor) and "switching off the system" (signal processing). Small safety-related applications can thus be implemented very cost-effectively.

In a further refinement, the input part is designed to record a physical measured variable, in particular a speed, a voltage and/or a current, as an external state variable.

Sensors for recording such state variables are usually installed in a control cabinet, while emergency stop buttons, limit or position switches, protective door switches and similar signaling devices are usually installed on the system. However, the advantages mentioned above can also be transferred in the same way to such measuring sensors as signaling devices. For example, several speed monitors can be connected in series in the manner described here, so that several moving axes of a system can be monitored very cost-effectively in terms of safety.

It is understood that the above and the features still to be explained below can be used not only in the combination specified in each case, but also in other combinations or on their own, without departing from the scope of the present invention.

Fig. 1

eine vereinfachte Darstellung einer Anlage, bei der ein Meldegerät gemäß der vorliegenden Erfindung zur Absicherung eingesetzt wird,

Fig. 2

eine schematische Darstellung eines Ausführungsbeispiels des neuen Meldegerätes,

Fig. 3

eine Sicherheitsschaltung mit zwei Meldegeräten der in Fig. 2 gezeigten Art in einer Reihenanordnung,

Fig. 4

eine Zeitdiagramm mit Signalverläufen beim Initialisieren einer Sicherheitsschaltung gemäß Fig. 3, und

Fig. 5

ein weiteres Ausführungsbeispiel eines neuen Meldegerätes.

Embodiments of the invention are shown in the drawing and are explained in more detail in the following description. Show it:

1

a simplified representation of a system in which a signaling device according to the present invention is used for protection,

2

a schematic representation of an embodiment of the new signaling device,

3

a safety circuit with two signaling devices from the in 2 shown in a row arrangement,

4

according to a timing diagram with signal curves when initializing a safety circuit 3 , and

figure 5

another embodiment of a new signaling device.

In 1 An installation which is protected by means of the invention is denoted in its entirety by the reference numeral 10.

The system 10 here includes a robot 12 whose automated movements would be dangerous for a person (not shown here) who would be in the range of movement of the robot 12 . Therefore, the range of motion of the robot 12 is secured with a protective door 14 and protective fences, as is known per se. An actuator 16 is attached to the protective door 14 . A safety switch 18, more generally the fixed part of a signaling device according to the present invention, is located on a fixed frame against which the protective door 14 rests in the closed state. The safety switch 18 is connected to a safety controller 20 via a number of lines. The safety controller 20 controls two contactors 22, 24 on the output side, the contacts of which can interrupt the power supply 26 to the robot 12.

Plant 10 is shown here in simplified form. As is known to those skilled in the art, in practice the protective door 14 is usually equipped with at least two safety switches 18 and corresponding actuators 16, with one of the safety switches often being arranged in a concealed manner in order to make manipulation more difficult. In addition, such a system often contains other signaling devices, such as emergency stop buttons or other protective door switches (not shown here). Also, the necessary operational controls for the robot 12 are not shown here for the sake of simplicity. In order to enable restricted operation when the protective door is open, one or more speed monitors (not shown here) can be connected to the drives and/or the moving axes of the robot.

In a simple scenario, the safety controller 20 can be a safety switching device, as is offered by the applicant under the designation ^PNOZ® . However, if numerous safety-related signaling devices are required to protect the system 10, it is advantageous to use a more complex safety controller, such as the safety controllers marketed by the applicant under the name ^PSS® . At least in the last-mentioned case, the safety controller 20 usually has a fieldbus connection and other interfaces for communication with the operating controller (not shown here) and/or for communication with a higher-level master computer.

In the preferred embodiment according to 2 the safety switch 18 has a two-channel redundant design. Accordingly, the safety switch 18 has two redundant microcontrollers 30, 32 here, which monitor one another, which is represented by a double arrow between the microcontrollers. In preferred exemplary embodiments, the microcontrollers are different, ie the safety switch 18 has a diverse structure.

The reference numerals 34, 36 denote two electronic switching elements, which are shown here as field effect transistors. Alternatively, however, bipolar transistors or other, preferably electronic, switching elements can also be used.

The control connection (gate) of the switching element 34 is connected to the microcontroller 30 . The input 38 (source) is connected to a line 40 to which an operating voltage U _B is present when the safety switch 18 is in operation. The output 42 (drain) is connected to a connection 44 to which the safety switch 18 can be externally wired. The output 42 of the switching element 34 thus forms an output signal of the safety switch 18.

The second switching element 36 is connected to the microcontroller 32 at its control terminal (gate). Its input 38 is also connected to the operating voltage U _B via the line 40 . Its output 42 is fed to a second output connection 46 of the safety switch 18 .

The signals at the outputs 42 of the switching elements 34, 36 are fed back to the microcontrollers 30, 32 via two voltage dividers 48, 50. It is thus possible for the microcontrollers 30, 32 to monitor the respective switching state of the switching elements 34, 36.

Reference number 52 designates an input part, with the aid of which microcontrollers 30, 32 determine the current state of actuator 16, in this case its spatial position. In the preferred embodiment shown here, the actuator 16 is a Transponder with a signal generation circuit 54 and a transmitting and receiving coil 56. In the signal generation circuit 54 an individual coding 58 is stored. The input part 52 has a transmitting and receiving coil (shown here only symbolically) via which it emits an interrogation signal. As soon as the transponder 16 is in the vicinity of the input part 52 (safety door closed), the signal generation circuit 54 in the actuator 16 is activated. The actuator 16 then sends the stored code 58 back to the input part 52 . There, the coding 58 is demodulated from the received signal and made available to the microcontrollers 30, 32.

If, on the other hand, the protective door 14 is open, the actuator 16 is outside the transmission and reception range of the input part 52, which in 2 at position 16'. In this case, no communication takes place between actuator 16 and input part 52 . Consequently, the microcontrollers 30, 32 do not receive any coding, which is interpreted as an open protective door 14. If a second protective door switch or at least a second actuator (not shown) is present, a defect in the actuator 16 or in the input part 52 can also be detected.

In other embodiments, the input portion 52 may be configured for other types of actuators. In this case, the actuator can also be integrated in the safety switch 18 . For example, the safety switch 18 could be an emergency stop button and the actuator would be the plunger of the button in this case. In further exemplary embodiments, the input part 52 contains inductive, capacitive, optical or other sensors for determining a current position of a mechanically movable actuator. In addition, the invention can in principle also be used with light barriers and other signaling devices that differentiate between at least two states. In further exemplary embodiments, the input part is designed to record a physical state variable by measurement, as will be seen further below figure 5 is explained in more detail.

On the input side, the safety switch 18 has three connections 60, 62, 64, which are each designed as safety inputs and are redundantly connected to the two microcontrollers 30, 32. External enable signals can be supplied redundantly to the microcontrollers 30, 32 via the connections 60 to 64. In addition, a connection 66 for supplying an operating voltage U _B and a ground connection 68 are present in a manner known per se. It goes without saying that the connections mentioned are each accessible on the outside of a housing 70 of the safety switch 18 .

In 3 a safety circuit with two of the described safety switches 18 is denoted in its entirety by reference number 80 . Otherwise, the same reference numerals denote the same elements as before. The two safety switches are labeled 18a and 18b for mutual differentiation.

The safety switch 18a is connected at its terminals 60, 62 to outputs of the safety controller 20, at which two clock signals of different frequency and/or phase are present, so that cross-circuit detection is possible both in the safety switch 18a and (by reading back, not shown here) in the safety controller 20 is possible. In addition, the safety switch 18a is connected to the terminals 66, 68 with the operating voltage U _B and ground. On the output side, the connections 44, 46 of the safety switch 18a are routed to the connections 60, 62 of the following safety switch 18b. The two safety switches 18a, 18b are therefore arranged in series with one another. In the arrangement shown, the safety switch 18b also receives operating voltage from the safety switch 18a. As an alternative to this, however, the safety switch 18b could also be connected to another source for the operating voltage U _B .

The two output signals of the safety switch 18b, ie the signals present at its terminals 44, 46, are fed to safety inputs of the safety controller 20. On the output side, the safety controller 20 is connected between the power supply 26 and a drive 82 to be switched off, for example an actuator of the robot 12 . In addition, it is shown here schematically that the safety controller 20 is connected via a field bus 84 to an operating controller 86 for the robot 12 and/or a higher-level master computer. For reasons of clarity, the actuators belonging to the safety switches 18a, 18b are shown in 3 Not shown.

The functioning of the safety circuit 80 is as follows:

After start-up, the safety controller 20 generates two clock signals 88, 90 at its outputs, which are fed to the safety switch 18a as release signals. The microcontrollers 30, 32 of the safety switch 18a use the input part 52 to monitor the current status of the associated actuator. If the actuator is in the area of the input part 52 and the enable signals 88, 90 are received correctly, the microcontrollers 30, 32 generate two output signals with the aid of the switching elements 34, 36, which enable signals 88, 90 are simulated. However, they could also differ from the clock signals 88, 90, for example with regard to their frequency. The second safety switch 18b receives the simulated release signals and, for its part, simulates them at the output if it also detects a closed protective door and proper functioning. Safety controller 20 receives the simulated release signals via lines 92, 94.

Now, when the safety switch 18a detects the opening of the protective door assigned to it, ie when the associated actuator changes its state, the microcontrollers 30, 32 open the switching elements 34, 36. The downstream safety switch 18b consequently no longer receives the simulated release signals. This is recognized by the microcontrollers in the safety switch 18b and reported to the safety controller 20 by switching off the switching elements 34, 36. This can then switch off the drive 82 .

The signal flow occurs in the same way if the safety switch 18a detects a functional error, for example a cross circuit at the input or output connections, a breakdown of one of the switching elements 34, 36 or another functional error. After a short waiting time, which is stored in the microcontrollers of all safety switches 18a, 18b and the safety controller 20, the safety switch 18a generates a data telegram 96 on at least one of its output lines by pulsing at least one of the switching elements 34, 36 and opening it again. The downstream safety switch 18b receives this data telegram and forwards it to the safety controller 20 in the same way. If required, he can also integrate further information into the data telegram 96.

In one embodiment, the data telegram 96 is implemented as in an asynchronous, serial interface, i.e. it begins with a defined start bit and ends with a defined stop bit. There is an arbitrary or fixed number of data bits in between. In another exemplary embodiment, each data telegram 96 contains a fixed number of pulses with a defined pulse duration. The meaning of each pulse depends on the protocol established between the safety switches 18 and the safety controller 20.

In the same way, the safety switch 18b generates its own data telegram 96 when it detects a functional error. In contrast to the known arrangement, the safety switch 18b can generate its data telegrams independently of whether the safety switch 18a has opened or closed the switching elements 34, 36.

Here, the data telegrams of the safety switches 18a, 18b contain address information that identifies the safety switch that wants to report information to the higher-level safety controller 20. The respective address can be assigned to the safety switches 18a, 18b in various ways. For example, each safety switch 18a, 18b can be provided with a multi-level address selection switch (not shown here), at which the associated address is set. In another exemplary embodiment, the safety switches 18a, 18b each use the coding 58 of the actuator 16 assigned to them as the address.

In a further exemplary embodiment, an address is assigned to the series-connected safety switches 18a, 18b in an initialization mode after the safety circuit 80 has been put into operation. A preferred method of doing this address assignment is by using 4 shown.

4 shows the signal diagrams for this initialization mode. The top pulse sequence 100 is the switching on of the operating voltage U _B for all components of the safety circuit 80. The signal at the first clock output of the safety controller 20, ie the signal on the line 88, is shown at reference number 102. Reference number 104 shows the signal at the second clock output of the safety controller 20, ie the signal on line 90. FIG. After the operating voltage U _B is switched on, the first safety switch 18 therefore receives a permanent high at its input 60 and a single pulse at its input 62 . As soon as it recognizes this, it emulates the signal present at its connection 60 (permanently high) at its output 44 (reference number 106). After a waiting time T, it then generates two pulses at its output 46, as shown at reference numeral 108. The waiting time T is used to identify whether further pulses are received on the input side.

The second safety switching device 18b receives the signals 106, 108 at its inputs 60, 62 and reproduces them at its outputs 44, 46. In doing so, it adds a further single pulse to the single pulses 108 which it receives at connection 62 . Consequently, the pulse sequences that are represented by the reference numerals 110, 112 are present at the outputs of the second safety switch 18b. In the same way, further safety switching devices 18c, 18d etc. (in 3 not shown) emulate a continuous high on one signal line (reference number 114) and a pulse train on the second signal line, and each safety switch would increase the pulse train by one pulse.

At the end of the chain, the safety controller 20 receives the signals according to the reference numerals 114, 116. The safety controller 20 recognizes from the signal 114 that the wiring of the channel A is correct. The safety controller 20 recognizes from the pulse sequence 116 that the wiring of channel B is correct. In addition, it can determine the number of safety switches 18a, 18b etc. arranged in series from the number of pulses (minus 1). In the same way, each safety switch 18a, 18b can recognize its address from the number of pulses received. In this way, when the safety circuit 80 is switched on, an individual address can be automatically assigned to each safety switch arranged in series. If the safety circuit 80 is changed later, a new and correct address assignment to the then existing configuration takes place automatically when the device is switched on again.

The flexibility of the new signaling devices is further increased here by the input connection 64, which has not been explained up to now. This connector can be used to connect an external feedback signal feed into the safety switch 18. This makes it possible, for example, for the safety switch 18 to control a contactor with forcibly guided contacts independently, ie without a previously customary safety switching device or a corresponding safety controller. It is sufficient if the forcibly guided break contact of the contactor is routed to the feedback input 64 of the safety switch 18.

In further exemplary embodiments, signaling devices, such as the safety switch 18 shown, have a further input connection for applying a start signal. This makes it possible to implement a monitored restart of the system without the safety controller that has been customary up to now.

Furthermore, the respective function of the signaling devices 18 can be parameterized via the input connection 64, as is the case, for example, in DE 100 16 712 A1 is described. In addition, parameters can be set externally using different transponder codes.

figure 5 shows an embodiment of a new signaling device 100 as a speed monitor. The same reference symbols designate the same elements as before.

The reporting device 100 differs from the reporting device 18 2 essentially in relation to the input part 102, which, in contrast to the input part 52, is designed here for the metrological detection of a speed. In this exemplary embodiment, the rotational speed is detected without sensors, in that the input part 102 picks up the motor voltages of a rotary drive 104 and evaluates them with regard to their frequency. In a special embodiment, the signaling device 100 is designed as a standstill monitor, ie it monitors when a speed of zero is reached and maintained. This can be done in that the input part 102 picks up and monitors the generator voltages generated by the decelerating rotary drive 104, as is known per se from standstill monitors for safety-related applications.

In further exemplary embodiments, the input part 102 detects a voltage, a current or another physical variable by measurement and the microcontrollers control the switching elements 34, 36 depending on the detected variable, in particular depending on the detected variable complying with a predetermined setpoint.

Claims (10)

1. A sensor for a safety circuit, comprising an input part (52) for receiving an external state variable, comprising at least one switching element (34, 36) having an input (38) and an output (42), and comprising a control part (30, 32) designed to control the at least one switching element (34, 36) as a function of the external state variable, such that a signal applied to the input (38) is communicated to the output (42), wherein the input (38) of the switching element (34, 36) is internally connected to a fixed potential, preferably a fixed High potential (U_B), further comprising a redundant safety input (60, 62) for an external enable signal (88, 90) which is supplied to the control part (30, 32), the control part (30, 32) also controlling the at least one switching element (34, 36) as a function of the enable signal (88, 90), and wherein the control part (30, 32) is designed to detect a device-internal fault condition and to use the at least one switching element (34, 36) to produce a data message (96) at its output (42).
2. The sensor of claim 1, characterized in that the signal communicated to the output (42) of the at least one switching element (34, 36) is supplied to the control part (30, 32).
3. The sensor of claim 1 or 2, characterized in that the data message is a pulse message.
4. The sensor of one of claims 1 to 3, characterized by at least two redundant switching elements (34, 36) each having a respective input (38) and a respective output (42), with each of the at least two redundant switching elements (34, 36) having the fixed potential applied to its input.
5. The sensor of one of claims 1 to 4, characterized by an input (66) for supplying an operating voltage (U_B), the operating voltage being supplied to the at least one switching element (34, 36) as the fixed potential.
6. The sensor of one of claims 1 to 5, characterized by a moveable control element (16) which can move between a first and at least one second spatial position (16'), particularly a transponder, the external state variable being a present spatial position of the control element (16).
7. The sensor of one of claims 1 to 6, characterized in that the input part (52) is designed to pick up a physical measured variable, particularly a rotational speed, a variable voltage and/or a variable current, as external state variable.
8. The sensor of one of claims 1 to 7, characterized by a feedback input (64) for supplying an external feedback signal from an actuator (22, 24).
9. A safety arrangement for safely turning off a hazardous installation (10), comprising a superordinate safety controller (20) designed to turn off the installation (10) in a failsafe fashion, and comprising an upstream first and at least one downstream second sensor (18a, 18b) which are connected in series with one another to the superordinate safety controller (20), with each sensor (18a, 18b) comprising an input part (52) for receiving an external state variable, at least two redundant switching elements (34, 36) each having an input (38) and an output (42), and a control part (30, 32) designed to control the at least two switching elements (34, 36) as a function of the external state variable, such that a signal applied to the input (38) is communicated to the output (42), wherein the input (38) of the at least two switching elements (34, 36) in each sensor is internally connected to a respective fixed potential, preferably a High potential, wherein the control part (30, 32) of the first sensor (18a) is supplied with two clock signals from the superordinate safety controller (20) as enable signals (88, 90), wherein the control part (30, 32) of the first sensor (18a) controls the at least two switching elements (34, 36) of the first sensor (18a) also as a function of the two enable signals (88, 90), wherein the respective output (42) of the at least two switching elements (34, 36) in the first sensor (18a) is supplied to the control part (30, 32) of the second sensor (18b), and wherein the control part (30, 32) of the second sensor (18b) also actuates the at least two switching elements (34, 36) of the second sensor (18b) as a function of the first sensor (18a), wherein looping of the enable signals (88, 90) through a plurality of sensors (18a, 18b) to a safety controller (12) is reproduced, such that it is not possible to tell any difference from the point of view of the superordinate controller (20), not by looping the enable signals (88, 90) through the switching elements (34, 36), but producing them again in each sensor (18a, 18b), wherein the control part (30, 32) of the second sensor (18b) takes into account the output signals from the first sensor (18a).
10. The safety arrangement of claim 9, characterized in that the control part (30, 32) in each sensor (18a, 18b) is designed to detect a device-internal fault condition and to use at least one of the switching elements (34, 36) to produce a data message (96) at its output (42).

Images