WO2013087625A1

WO2013087625A1 - Apparatus for driving a switching device in a safety-oriented manner via an as-i system

Info

Publication number: WO2013087625A1
Application number: PCT/EP2012/075087
Authority: WO
Inventors: Ulrich Düsel; Rainer Lippert; Gordon Schumann
Original assignee: Siemens Aktiengesellschaft
Priority date: 2011-12-14
Filing date: 2012-12-11
Publication date: 2013-06-20
Also published as: DE102011088516A1

Abstract

The invention relates to an apparatus (4) for an AS-i system comprising an AS-i bus (27) and an AS-i safety monitor (24) connected to the AS-i bus (27), wherein the apparatus (4) comprises an AS-i connection (6) which can be used to connect the apparatus (4) to the AS-i bus (27), a processing unit (5), and an output (8) which switches in a safety-oriented manner, wherein the apparatus (4) can receive a secure message via the AS-i connection (6) and can drive a switching device (31) via the output (8) which switches in a safety-oriented manner. In order to improve evaluation of the feedback circuit inside an AS-i system, the apparatus (4) also comprises an input (3) via which the processing unit (5) can evaluate a feedback circuit of a switching device (31) connected to the input (3).

Description

description

Device for the safety-related activation of a

Switching device via an AS-i system

The invention relates to a device for an AS-i system, which comprises an AS-i bus and an AS-i safety monitor connected to the AS-i bus. The inventive ago ^¬ direction is integrated here in addition to the AS-i safety monitor within the AS-i system and represents a se ^¬ parate device unit to the AS-i safety monitor.

The AS-i system is an industrial fieldbus system at the lowest control level of an automation system that connects a large number of field device modules such as sensors, actuators and actuators, as well as motor starters and frequency converters, to a higher-level control unit. AS-Interface (AS-i = Actuator Sensor Interface) is a Moegli ^¬ cher communication standard for communication between a control device connected to the master module (AS-i master) and AS-i slave. Field device modules which are connected to an AS-i slave can thus be activated and / or read out. In the following, AS-i slave AS-i master and other devices that are ver ^¬ connected to the AS-i bus (for example, AS-i safety monitor Safe AS-i output), referred to as AS-i units. For a communication system designed in accordance with the AS-interface specifications (in accordance with EN 50295, IEC 62026-2), the AS-i master is the only one authorized to access the AS-i bus (fieldbus) without being requested to do so. The AS-i master sends cyclically to all AS-i slaves a request to exchange with the AS-i slave data over a serial transmission proto ^¬ koll with a data capacity of 4 bits. The AS-i slaves must not and can not wait for the fieldbus zugrei ^¬ fen and must on its own until it advertising asked by the AS-i master the. Each of the AS-i slaves is assigned a unique address for this purpose. Within an AS-i system maximum of 62 nodes can be connected to the AS-i master according derzei ^¬ term specification (3.0 Vers.). AS-i communication between the AS-i devices on the AS-i bus can be normal and ^secure . In normal AS-i communication via the AS-i bus, a normal AS-i telegram is transmitted. In the case of secure AS-i communication via the AS-i bus, a secure AS-i message or a secure protocol is transmitted from several telegrams (hereinafter generally referred to as safe AS-i message). The safe AS-i telegram contains additional safety information compared to the normal AS-i telegram so that secure communication between the participating AS-i devices can be guaranteed.

To monitor the secure communication, the AS-i system also includes an AS-i safety monitor, which is connected to the AS-i bus and in which evaluation mechanisms are stored, so that the secure communication can be monitored on the AS-i communication bus. The AS-i Si ^¬ cherheitsmonitor may be a standalone device, a modular unit or a part of a separate or modular unit. By means of the safety monitor, in particular the safe AS-i telegrams transmitted via AS-Interface (master call, response from the safe AS-i slave) are monitored. In particular, the safety information contained in the safe AS-i telegram is monitored. Known variants of the safety ^monitor are, for example, the AS-i safety monitor, the DP / AS-i F-Link, the modular safety system SIRIUS 3RK3 Advanced from Siemens AG.

For safety-related applications, eg emergency stop of a load, the communication of the devices involved (eg AS-i slave, AS-i master, sensor, actuator, switching device) must be securely designed; ie it must comply with applicable safety regulations for the application. The communication Consequently, there must be secure telegrams between the participating AS-i devices on the AS-i bus. Furthermore, the control between the AS-i devices and the participating field device modules (eg sensor, actuator, switching device) of the safety-related application must be designed safely. This is bewerk ^¬ stelligt usually by means of a redundant construction. Furthermore, it must be checked whether the driving ^¬ de field equipment manufacturing group, in particular switching device, ordnungsge ^¬ Mäss works. For this purpose, the feedback ^{loop of} the field device ^{module to be} controlled is usually evaluated. Fi gur ^¬ 1 shows a schematic representation of the essential equipment of a safety application in which the evaluation of a feedback loop of a controlled switching device by means of a known system is the AS-i.

This technology requires it safe with safety Ap ^¬ complications, the feedback loop of each by an AS-i slave actuated switching device to the AS-i Safe ^¬ integrated monitor to transfer back. By parameterizing the AS-i safety monitor, the feedback circuit must be assigned to the respective enabling circuit. An AS-i slave with inputs, which must be connected to the AS-i bus for communication, is required to transmit the functional status of the switching device determined via the feedback loop. This AS-i slave needs to communicate a spe ^¬-specific within the AS-i system limited unique ad ^¬ ress. The assignment of the feedback circuits to the free ^¬ output circuits on the AS-i safety monitor is usually carried out by means of a parameterization software. When commissioning ei ^¬ ner such an application parameterization by a specialist is thus required.

An object of the present invention is to improve the evaluation of the feedback loop within an AS-i system.

This object is achieved by an apparatus according to claim 1. ^¬, that is, by an apparatus for an AS-i system, which comprises an AS-i bus and an AS-i safety monitor connected to the AS-i bus, wherein the device has an AS-i connection, via which the device can be connected to the AS-i bus, a processing unit, and a safety-switching output includes, wherein the device can receive a secure telegram on the AS-i connection and can control a switching device on the safety switching output, wherein the device further comprises an input, via which the processing unit, an evaluation of a feedback loop one with the input connected switching device can perform.

Advantageous developments of the invention are specified in the dependent claims 2 to 9.

The safety-related output can, for example, consist of two separate connections. Is a switching device, which comprises two controllable switching elements, connected to the safety-related switching output of the device, then by means of a switching signal at the certain standardized ^¬ directed switching output of the device,

Switching position of the two switching elements of the switching device determinable. In this case, a first switching element of the switching device would be assigned to the first terminal and a second switching element of the switching device assigned to the second terminal ^¬ . The device can thus, preferably by its processing unit, selectively control the corresponding switching element of the switching device. It is also conceivable that the safety-related switching output is already internally ver ^¬ switched on and is guided to a common terminal to which the two controllable switching elements of the Schaltge ^¬ rätes are connected together. About the respective switching element can one or more

Lines can be selectively opened or closed. For example, if a three-phase Ver ^¬ sorgungsstrang controlled to a consumer by means of the switching device, so can be interrupted or closed by the switching device, the three phases. It can thus be done via the supply line power supply to a consumer by means of the control of the switching device through the device. In a safety-related application, to achieve a certain level of security such control of the supply line must be done redundantly. In particular ^¬ sondere in the case of safety-related control the two switching elements of the switching device to be controlled pensionable strand same switching. For applications with low ^¬ rem security level, it is possible, instead of using the two re ^¬ dundanten switching elements only a single scarf Tele ^¬ ment. The switching elements can also be designed as elekt ^¬ ronic switching elements in a suitable form.

The controlled switching device can for detecting the vorlie ^¬ constricting switching position of its switching element, for example, for each switching element includes a positive-guided signaling contact (also called auxiliary contact) have. Using the signaling contact can be determined uniquely, the present shift position of his zugehö ^¬ engined switching element. For this purpose, the signaling ^¬ contact is usually geschal ^{¬ switched} simultaneously to the switching element. Consequently, if the input of the device is connected to the signaling contacts of the switching elements controlled via the outputs, an evaluation of the feedback circuit of the controlled switching device can take place by the device itself, and in particular by its processing unit. It can thus be obtained by the device a conclusion to the present switching position of / via the sicherheitsge- switching output driven switching element / switching elements of the switching device. ^{If there are} several switching elements to be monitored, then the signaling contacts are preferably connected in series between a voltage connection and the input of the device. By monitoring the input can be determined whether ei ^¬ ne closed or lost connection is present. If both switching elements of the consumer opened (the versor ^¬ supply strand is broken), so both have signal contacts Closed state, so that the connection between the voltage connection and the input is closed. If, for example, a defect in a switching element of the switching device occurs, eg one of the switching elements is welded and remains in the closed position, and the switching elements of the switching device must be open, at least one signaling contact would be in the open position. The connection between the voltage connection and the input would consequently be interrupted, which can be detected by an evaluation of the input by the processing unit. Since the processing unit is the known switching position of the switching elements of the switching device to be controlled, it can determine this defect. When a defect is detected by the device, a diagnostic signal is preferably output and / or a secure state is brought about for the application. Thus, a conclusion on the present switching position of the Schaltele ^¬ elements of the switching device can be obtained via the input. The feedback loop can thus be evaluated by the device itself, so that it can be controlled by the device itself, whether a proper functional state of the switching device to be controlled is present or not.

The inventive device, the initial evaluation of the feedback loop of a connected Schaltgerä ^¬ tes hence can already be performed in the device itself. A transmission of the feedback loop to the AS-i safety ^¬ monitor is therefore not required, so that the otherwise additional required AS-i slave can be omitted. The correct assignment of the feedback loop to the outputs controlling the switching device is automatically given by the decentralized evaluation of the feedback loop in the device itself. This also eliminates the assignment of the feedback circuit to the enabling circuit in the AS-i safety monitor so that the required parameterization of the feedback loop can be omitted. Furthermore, an AS-i address can be saved by the decentralized evaluation of the feedback loop in the device itself compared to the AS-i safety monitor. since no additional AS-i slave with inputs is required. This releases system resources and reduces communication on the AS-i bus. Recognizes the feedback loop evaluation of the device a fault condition on the switching device, then preferably controls the device via its outputs via the switching device ge ^¬ controlled device in such a way that a safe status of the application is effected. Furthermore, the device preferably prevents an unsafe state of the device from being caused by a triggering of the switching device.

Is preferably carried out by the processing unit serving the evaluation of the feedback loop, as is the Auswer ^¬ i processing of received secure over AS-telegrams, in particular for the actuation of the received safety-related scarf ^¬ Tenden output telegram. As a result, the hardware costs can be kept low within the device.

Thus, in contrast to the previously existing applications, the evaluation of the feedback loop can already be carried out decentrally in the secure AS-i device by the device. The AS-i device comprises at least one safety-switching output and at least one input for detecting the feedback loop.

The resulting advantages are in particular that: - By the evaluation of the feedback loop in the device itself, the transfer of the feedback loop to the AS-i safety monitor is eliminated. This relieves communication on the AS-i bus and frees up the available capacity for other purposes (such as diagnostic information).

the correct allocation of the feedback loop is the output which drives the switching device by the distributed from ^¬ evaluation of the feedback loop automatically given. Of the Effort to correctly parameterize the feedback loop in the AS-i safety monitor can thus be eliminated. The parameterization of the AS-i safety monitor thus becomes simpler and less error-prone.

- If the assignment of outputs to enable circuits of the AS-i safety monitor changes, no change in the assignment of the feedback loops is required.

with superimposed control of the switching devices (by operational switching, on-site manual switch or other specifications) an adapted evaluation of the feedback loop can be done automatically in the device and unnecessary error messages can be avoided.

In an advantageous embodiment of the invention, the processing unit for evaluating the feedback loop can determine a present switching position of the switching device connected to the input. For this purpose, the input of the device is in particular with at least one signal contact of the

Switching device connected. By means of the determined switching position of the signaling contacts, a conclusion can be drawn about the switching positions of the switching elements of the switching device to be triggered via the ^{output of} the device. At the input of the device is thus preferably connected to a signaling contact of the controlled via the output switching device.

In a further advantageous embodiment of the invention, the processing unit is designed such that it checks before driving the switching device by means of an evaluation of the feedback loop, whether the switching device to be controlled has a safety-critical state. A safety-critical state exists when the switching positions of the to be controlled by the safety-related switching output switching contacts of the switching device does not correspond to the expect ^¬ ended proper switching state. This can be detected by an evaluation of the input. If such a safety-critical state is detected by an evaluation of the input of the device by the processing unit (evaluation of the feedback loop), then the Control of the switching elements of the switching device prevented. Preferably, a diagnostic signal is also output via the AS-i bus through the device, which can be detected, for example, by the AS-i safety monitor or a controller connected to the AS-i bus, so that further measures can be initiated.

In a further advantageous embodiment of the invention, the processing unit can check by an evaluation of the recirculation loop, whether the particular controlled

Switching positions of the controlled switching device to the subsequently detected via the input switching position of the switching device fits. If an error is detected, it is preferably in front ^¬ a safe state of the switching device caused (for example, the switching position of the switching device is so ge ^¬ selected to avoid any danger by the controlled switching device with the consumer is present). Preferably, further, a diagnostic signal is output through the device via the AS-i bus

In a further advantageous embodiment of the invention, the device provides a separate device unit to a connected to the AS-i bus AS-i safety monitor is. Having Since the AS-i safety monitor gene a limited number of outputs or as well as spatially separated from a anzusteu ^¬ ernden Switching element can be arranged within an application, the use of egg ^¬ nes sure AS-i output may be required within an AS-i system. In particular, in such a scenario, by using the device as a secure AS-i output, several advantages can be achieved.

In a further advantageous embodiment of the invention, the device comprises the switching device and forms an appliance unit with the switching device. The apparatus comprises successfully ^¬ Lich the consumer switching the switching device. It can thus be ^{¬ provided} with a device unit, by means of which a secure control of a consumer can take place. As a result, in particular the wiring complexity and thus the risk of error is reduced.

In a further advantageous embodiment of the invention, the device can output a diagnostic signal via the AS-i bus, which characterizes a result of an evaluation of the feedback loop. The device may preferably send the diagnostic signal as a normal telegram to the AS-i bus. The device can thus receive secure AS-i telegrams and send status information via normal AS-i telegrams. Preferably, other error states of the device are transmitted by means of the Diagnosesig ^¬ Nals further. By transmitting the diagnostic signal to the AS-i bus, the diagnostic message of a feedback loop error is available both to a controller connected to the AS-i bus and to the AS-i safety monitor.

In a further advantageous embodiment of the invention, the device can also receive control signals via the AS-i connection by means of a normal AS-i telegram and

Send status signals. The device can thus also receive a control command for a switching device by means of a normal AS-i telegram and output a corresponding switching signal via its at least one output for a switching device to be controlled. Furthermore, the device can preferably evaluate the feedback ^{circuit of} the switching device by means of its input.

The switching device is preferably a contactor, relay, valve, inverter, motor starter, soft starter or circuit breaker.

In the following, the invention and embodiments of the invention will be described and explained in more detail with reference to the exemplary embodiments illustrated in the figures. Show it:

1 shows a schematic representation of the essential devices of a safety-related application, in which the evaluation of a feedback loop of a controlled th switching device by means of a known AS-i system, and

FIG 2 is a schematic representation of the essential equipment of a safety application in which the evaluation of a feedback circuit of a control is ^¬ th switching device according to the invention by means of an AS-i system is carried out. In FIG 1 and FIG 2, the same reference numerals have been used for the same devices and components.

1 shows a schematic representation of the essential devices of a safety-related application, in which the evaluation of a feedback loop of a controlled

Switching device 31 is effected by means of a known AS-i system. The illustrated AS-i system here comprises an AS-i master 30, a first AS-i slave 22 with inputs 23, an AS-i safety monitor 24 with an output 36, an AS-i device 25 with an output 28, a second one AS-i slave 26 with an input 29 and a voltage terminal 39, and an AS-i bus 27. The AS-i devices 22,24,25,26,30 are each connected to the AS-i bus 27. Also depicted is a sensor 20 (e.g., emergency stop device, button, photocell), the switching device 31 (e.g., a contactor combination), a load 21 (e.g., electric motor), and a power line 32 of the load 21. The return line for the output 28, 36 is not shown for simplicity of illustration.

If the consumer 21 is to be switched within the safety-related applications, for example by changing the state of the sensor 20, a safe input signal is first output to the first AS-i slave 22 by a change of state at the sensor 20 (eg pressing a push-button). This is done by means of in the example Redun ^¬ dant established connection (such as individual wiring) between the sensor 20 and the safe inputs 23 of the first AS-i slave 22nd

The first AS-i slave 22 detects the safe input signal via its safe inputs 23 and transmits the Informati ^¬ on, the actuation of the button 20, safe 24 to the AS-i safety monitor via the AS-i bus 27. The transfer of the safe AS -i message via the AS-i bus 27 is indicated by the dashed line ge ^¬ 40th The transmission of this information on the AS-i bus 27 takes place by means of a secure AS-i telegram.

In the AS-i safety monitor 24, the safe AS-i message of the first AS-i slave 22 is reliably received and evaluated. Alternatively to the switching request shown on the first

AS-i slave 22 can also access the switching request via a different route into safety monitor 24 (for example, input terminals on safety monitor 24 or signal transmission via an internal device bus or via an additional external bus system). According to the safety-related

Parameterisation of the AS-i safety monitor 24 of the associated ^¬ associated release circuit of the load 21 is driven (switched on or off). In the present example, by means of the actuation of the pushbutton 20, the load 21 is to be switched to the energy supply line 32. The switching of the

The consumer 21 can be done by means of AS-i devices 24, 25, which comprise an output 36, 28 for switching devices. Such outputs can be present either centrally on the AS-i safety monitor 24 or decentrally on a special separate AS-i device 25. In this example, the AS-i safety monitor 24 and the AS-i device 25 each include a safety-switching output 36, 28. The power supply of the load 21 is controlled by the switching device 31. The switching device 31 is actuated via the safe output 28 of the AS-i device 25

AS-i safety monitor 24 the control command for the switching device 31 to the AS-i device 25 by means of a secure AS-i Te ^¬ legramms are output, so that the AS-i device 25 the Control signal for the switching device 31 via the safety-oriented switching output 28 can output.

Consequently, the AS-i safety monitor 24 must transmit the control command for the switching device 31 to the AS-i device 25, so that the latter receives the control signal for the switching device 31 via its two output connections of the safe output 28, which are connected to the switching device 31 (eg by means of a single wiring), can spend. Each of the two output terminals is associated with a switching element 33,34 of the Schaltge ^¬ advises 31, with which in each case via the Ener ^¬ gieversorgungsstrang 32 taking place energy supply to the load 21 can be interrupted or closed. The switching device 31 thus comprises two switching elements 33, 34. Since the load 21 in the present example is a three-phase three-phase motor, the power supply string 32 comprises three phases (LI, L2, L3). The two switching elements 33, 34 can respectively open and close the three phases (L 1, L 2, L 3) so that the power supply to the load 21 can already be interrupted by an actuation of a switching element 33, 34. In order to produce a power supply for the load 21, both switching elements 33, 34 must be closed. In the present example, the switching elements 33,34 are opened so that no energy supply for the load 21 is present through the power supply line 32.

Since this is a safety-related application, but it must be ensured to the switching device 31 before outputting the control signal that the switching device 31 functions ord ^¬ voltage according to. The state of the switching device 31 is hereby monitored by means of the so-called feedback loop of the switching device 31. The switching device 31 comprises here ^¬ for each switching element 33,34 a signal contact 35, which communicates with the associated switching element in operative connection 33,34. About the signal contact 35, the present switching position of the associated switching element 33,34 is uniquely determined. By monitoring the signal contacts 35 of the switching device 31 (the so-called monitoring of the feedback circuit), a conclusion on the present switching state of the Schaltele ^¬ elements 33,34 of the switching device 31 can be obtained. For monitoring the feedback loop, the switching device 31 is connected to the input 29 and the voltage terminal 39 of the second AS-i slave 26. The signaling contacts 35 are connected in series between the input 29 and the voltage terminal 39 of the second AS-i slave 26, so that via the input 29 of the second AS-i slave 26, a conclusion on the vorlie ^¬ ing switching position of the switching device 31 can be obtained , In particular, it can be monitored whether or not there is an expected proper switching of the two switching elements 33, 34 to be triggered. By evaluating the feedback loop, the switching state of the switching ^device 31 can thus be detected by means of the second AS-i slave 26, so that it can be checked whether both switching elements 33, 34 function properly or not. The second AS-i ve SLA 26 thus detects the present switching state of the switching device 31, and outputs the switching state detected by means of an AS-i telegram via the AS-i bus 27 to the AS-i Si ^¬ cherheitsmonitor 24 on. The transmission of the AS-i telegram of the second AS-i slave 26 to the safety monitor 24 via the AS-i bus 27 is indicated by the dashed line 41.

The AS-i safety monitor 24 receives this AS-i telegram and is thereby informed about the functional state of the Schaltgerä ^¬ tes 31st Only in the presence of a proper functional state of the switching device 31 transmits the AS-i safety monitor 24 via the AS-i bus 27, the command to control the switching device 31 to the AS-i device 25. Suppose there is a proper functional state of the Schaltgerä ^¬ tes 31 before , a corresponding secure AS-i telegram is sent via the AS-i bus 27 to the AS-i device 25. The transmission of the safe AS-i telegram of the AS-i safety monitor 24 to the AS-i device 25 via the AS-i bus 27 is indicated by the dashed line 42. The AS-i device 25 receives this safe AS-i telegram and switches ^¬ on its output 28, the switching elements 33,34 of the switching device 31, so that the power supply line 32 is closed. The consumer 21 is thus supplied with energy.

Disadvantages of this solution are, in particular, that in each case the feedback loop of an activated via a safe output 28 of an AS-i device 25 the switching device 31 must be confi ^¬ riert separately by the parameterisation on the AS-i safety monitor 24 and that distributed on the required transmission of the feedback loop information at Outputs 28 of an AS-i device 25 an additional AS-i slave 26 with an input 29 is required. This costs a particular to-additional limited AS-i address on the AS-i bus 27 and over ^¬ transmission capacity on the AS-i bus 27, which is no longer available for other data. Another disadvantage is that when changing the system configuration always the assignment of the feedback circuits must be changed. As a result, system changes or extensions are more complex.

2 shows a schematic representation of the essential devices of a safety-related application, in which the evaluation of a feedback loop of a controlled switching device 31 by means of an AS-i system according to the invention. The main difference to the figure 1 consists represents ^¬ in that the evaluation of the feedback loop already takes place in an AS-i device. 4 Thus, no separate AS-i slave with one input must be provided in the AS-i system. In this way, in particular an AS-i address is saved, the communication on the AS-i bus 27 can be reduced and also eliminates the required complex parameterization of the AS-i safety monitor 24. The illustrated AS-i system comprises an AS-i master 30, ei ^¬ nen first AS-i slave 22 with inputs 23, an AS-i safety monitor 24 with an output 36 and the device 4, with an AS-i port 6, an output 8, a processing processing unit 5, an input 3 and a voltage terminal 7. The AS-i devices 4,22,24,30 are each connected to the AS-i bus 27. Furthermore, a sensor 20 (eg emergency stop device, pushbutton, light barrier), the switching device 31 (eg a contactor or contactor combination), a load 21 (eg electric motor) and a power supply line 32 of the consumer 21 are shown.

The power supply of the consumer 21 is by the

Switching device 31 controlled. The control of the switching device 31 via the safety-switching output 8 of the device 4. Each of the two contacts 1,2 of the output 8 is a switching element 33,34 of the switching device 31 to ^¬ ordered, with which each of the over the power supply strand 32 takes place Energy supply to the consumer

21 can be interrupted or closed. The switching device 31 thus comprises two switching elements 33, 34. Since the load 21 in the present example is a three-phase three-phase motor, the power supply string 32 comprises three phases (LI, L2, L3). The two

Switching elements 33, 34 can each open or close the three phases (L 1, L 2, L 3) so that the power supply to the load 21 can already be interrupted by an actuation of a switching element 33, 34. In order to produce a power supply for the load 21, both switching elements 33, 34 must be closed. In the present example, the switching elements 33,34 are open, so that no Ener ^¬ gieversorgung for the consumer 21 is present through the power supply line 32nd

Target within the safety-related applications, for example, by a state change on the sensor 20 of the load 21 (a three-phase here electric motor) are turned on, so by a state change at the sensor 20 (for example, pressing a button) is first a secure A ^¬ input signal to the first AS-i slave 22 issued. This ge ^¬ schieht means of in the example redundantly configured connects tion (eg single wiring) between the sensor 20 and the safe inputs 23 of the first AS-i slave 22.

The first AS-i slave 22 detects the safe input signal via its safe inputs 23 and transmits the Informati ^¬ on, the actuation of the button 20, safely over the AS-i bus 27. 24 to the AS-i safety monitor the transmission of this information on the AS-i bus 27 by means of a Siche ^¬ ren AS-i signal. This transmission is indicated by the dashed line 40.

In the AS-i safety monitor 24, the signal of the first AS-i slave 22 is reliably received and evaluated. According to the safety parameter setting of the AS-i safety monitor 24 of the associated enabling circuit of the Ver ^¬ brauchers 21 is driven (switched on or off). In ahead ^¬ Example 20, the consumer is to be connected to the supply line 32 21 by means of pressing the button. The AS-i safety monitor 24 thus sends a control command for the switching device 31 to the device 4 by means of a secure AS-i telegram on the AS-i bus 27. The transmission of the safe AS-i telegram via the AS-i bus 27 is indicated by the dashed line 42. In the device 4, the information of the safety monitor 24 is reliably received via the AS-i connection 6 by means of a secure AS-i message on the AS-i bus 27 and evaluated from ^¬ . The evaluation of the secure AS-i telegram takes place in the processing unit 5 of the device 4. The device 4 consequently has the information that the switching device 31 is to be controlled by means of a control signal such that the power supply to the load 21 is established. Both switching elements 33,34 of the switching device 31 must therefore be closed. As an alternative to the switching request shown via the first AS-i slave 22, the

Switch request to the safety monitor 24 via another path (eg input terminals on the safety safety monitor or signal transmission via an internal device bus or via an additional external bus system).

Since this is a safety-related application, but it must be ensured prior to issuing the control signal to the switching device ^¬ 31 that the switching device 31 functions ord ^¬ voltage according to. The state of the switching device 31 is hereby monitored by means of the so-called feedback loop of the switching device 31. The switching device 31 comprises here for each switching element 33,34 a signaling contact 35, which is in operative connection with the associated switching element 33,34. About the signal contact 35, the present switching position of the associated switching element 33,34 is uniquely determined. By monitoring the signal contacts 35 of the switching device 31 (the so-called monitoring of the feedback circuit), a conclusion on the present switching state of the Schaltele ^¬ elements 33,34 of the switching device 31 can be obtained.

For monitoring the feedback loop, the switching device 31 is connected to the input 3 and the voltage terminal 7 of Vorrich ^¬ device 4. The signaling contacts 35 are connected in series between the voltage terminal 7 and the input 3 of the device 4, so that via the input 3, a conclusion to the present switching position of the switching device 31 can be obtained. The evaluation of the feedback loop takes place here ^¬ by the processing unit 5, which can evaluate the signals of the input 3. In particular, the device 4 and in particular its processing unit 5 can monitor whether there is an expected proper switching of the two switching elements 33, 34 to be activated or not. Via an evaluation of the feedback loop through the device 4, the functional state of the switching device 31 can therefore be CONTROL ^¬ lines. In particular, it can be checked whether both switching elements 33, 34 function properly or not.

The device 4, in particular its processing unit 5, thus initially detects the present switching state of the switching device 31. Only in the presence of a proper Function state of the switching device 31, the device 4 outputs the switching signal via its output 8 to the switching device 31. Assuming that the evaluation of the feedback loop by means of the input 3 and the processing unit 5 shows that a proper functional state of the switching device 31 is present, the switching signal is output to the switching elements 33, 34 via the safety-switching output 8. The outputting of the switching signal is controlled by the processing unit 5. The switching device 31 receives the switching signal and then closes the switching elements 33,34. The power supply line 32 is thus closed by the switching device 31, so that the load 21 is supplied with energy. Via the input 3, the device 4 can monitor the conversion of the switched over the safety-switching output 8 ausgege ^¬ surrounded switching signal. By switching the

Switching elements 33,34 would have the signal contacts 35 to their stand to change ^¬. This can be detected via input 3. If no state change is detected via the input 3, an error must be present in the switching device 31, so that a secure state for the application can be brought about by the device 4. In the present example, the switching device 31 would be controlled by the device 4 such that the consumer 21 is turned off.

If the switching device 31 forms a decentralized unit, the input 3 and / or the output 8 are respectively arranged on the housing outer ^{¬ of} the device 4, so that in each case a connection, in particular a single wiring, can be done with the switching device 31.

It is likewise conceivable that the device 4 already comprises the switching device 31 for the safety-related switching of the consumption 21. When the driving command for switching the load 21 through the device 4 by means of a Siche ^¬ ren AS-i telegram on the AS-i bus 27 is received at ^¬ circuit 6 by means of the AS-i, verifies the integrated traceable circle monitoring the state of the two switching elements 33,34 of the integrated switching device 31. Are both switching elements 33,34 (main power contacts) open, the feedback loop is closed, and the load 21 is turned on. It is also conceivable that the device 4 already comprises the consumer 21 (eg motor, pump, reversing flap, etc.) in its housing.

Instead of the signaling contacts 35 connected in common to an input 3, it is likewise conceivable that the signaling contacts 35 are each read in separately via two separate inputs 3.

Instead of the switching elements 33, 34 and electronic switching elements can be used, wherein the alarm signal for the feedback circuit can also be forwarded electronically or via signaling contacts. Instead of two switching elements even a scarf Tele ^¬ ment can be used at a lower level of security.

If, for example, after an emergency stop request, the consumer 4 resets the enable signal (the switching elements 33, 34 are to be opened), the consumer 4 issues a control command via its output 8 to the switching element 31, so that the two switching elements 33, 34 be opened. Is a switching element welded, for example, 33,34, the feedback loop remains even after disconnection of the load 21 geöff ^¬ net. This is detected by the processing unit 5 (feedback loop monitoring) via the input 3 and a reconnection of the consumer 21 is prevented.

This embodiment shows an AS-i version for si ^¬ direct direct start of a motor 21. Similarly, other embodiments (including reversing start and star-delta start) realized by ^¬ the inventive method. If diagnostic information is desired, the device 4 can output a diagnostic signal via the AS-i connection 6 via the AS-i bus 27. It is also conceivable that the device 4 in addition to the safe AS-i telegrams via the AS-i bus 27 also normal AS-i Tele ^¬ programs via the AS-i bus can receive 27 and on the basis of a normal AS-i telegram a control command for can output a switching device. In this case, using the integrated 5 Verarbeitungsein- done as an evaluation of the feedback loop of the controlled on ^¬ ground of a normal AS-i telegram Schaltge ^¬ rätes. This ensures that the voltage ord ^¬ proper function of the switching device (eg, power Schütting ^¬ ze) is monitored correctly both in secure as well as normal (regular operating) switching is ensured. As a result, a conditional by a normal switching failure of a switching device is detected regardless of the requirement and a corresponding reaction (immediate shutdown of the consumer ^¬ chers, outputting a diagnostic signal / warning signal, etc.) is possible.

The safety-related switching output 8 may be running on ver ^¬ different manner, for example shown as a two-fold out guide ^¬ ter Contact 1,2 each with its own terminal, as in the PRESENT embodiment. Likewise, further embodiments of the safety-switching output 8 are conceivable, for example, two-way, series-connected contact with a common terminal or versions with electronic switching elements instead of contacts.

The safety monitor 24 can be a standalone device or a device with further functions that contains the evaluation functionality of a safety monitor 24 in a suitable manner (for example, the modular safety system MSS, the safe Simatic PLC with AS-i connection).

Claims

claims

1. Device (4) for an AS-i system, which comprises an AS-i bus (27) and an AS-i bus (27) connected to the AS-i safety monitor (24), wherein the device (4 ) an AS-i connection (6), via which the device (4) can be connected to the AS-i bus (27), a processing unit (5) and a safety-switching output (8), wherein the device (4 ) can receive a secure telegram via the AS-i connection (6) and can control a switching ^device (31) via the safety-related switching output (8),

d a d u r c h e c e n c i n e s that

the device (4) further comprises an input (3), via which the processing unit (5) evaluates a

Return circuit of a connected to the input (3) Schaltge ^¬ advises (31) can perform.

2. Device (4) according to claim 1, wherein the processing unit (5) for evaluating the feedback loop a vorlie ^¬ constricting switching position of the input (3) can determine associated switching device (31).

3. Device (4) according to any one of the preceding claims, wherein the processing unit (5) is designed such that it checks before driving the switching device (31) by means of egg ^¬ ner evaluation of the feedback loop, whether the to ^¬ controlling switching device (31) having a safety-critical to ^¬ stand.

4. Device (4) according to one of the preceding claims, wherein the processing unit (5) can check by an evaluation of the feedback loop, whether the issued switching ^¬ position of the controlled switching device (31) to the subsequently by means of the input (3) detected Switching position of the switching device (31) fits.

5. Device (4) according to one of the preceding claims, wherein the device (4) is a separate device unit to ei ^¬ nem on the AS-i bus (27) connected AS-i safety monitor (24).

6. Device (4) according to one of the preceding claims, wherein the device (4) comprises the switching device (31) and with the switching device (31) forms a device unit.

7. Device (4) according to one of the preceding claims, wherein the device (4) via the AS-i bus (27) can output a diagnostic signal which characterizes a result of an evaluation of the feedback loop.

8. Device (4) according to one of the preceding claims, wherein the device (4) can also receive normal telegrams via the AS-i connection (6).

9. Safe AS-i system with one AS-i bus (27), one AS-i safety monitor (24), one switching device (31) and one

Device (4) according to one of claims 1 to 8, wherein the AS-i safety monitor (24) and the device (4) are each connected to the AS-i bus (27) and the switching device (31) to the output (8 ) and the input (3) of the device (4), wherein the feedback circuit of the switching device (31) can be evaluated directly by the device (4).