DE102023106235A1 - Functionally secure release path - Google Patents

Abstract

A functionally safe release path (1), designed for the functionally safe switching of an electrical consumer (4) in accordance with a safety level of a standard, comprising a first relay (8) and a second relay (10), the working contacts of which are connected in series with the working contacts of the first relay (8), is intended to be suitable for higher safety levels and to manage without mechanically complex components. For this purpose, it comprises a first and a second detection circuit (20, 22), the first detection circuit (20) comprising the working contacts of the first relay (8) and the second detection circuit (22) comprising the working contacts of the second relay (10), a high-frequency signal source assigned to the first and the second detection circuit (20, 22), and a first high-frequency detection device assigned to the first detection circuit (20) and a second high-frequency detection device assigned to the second detection circuit (22).

Description

The invention relates to a functionally safe release path, designed for functionally safe switching of an electrical consumer according to a safety level of a standard, comprising a first relay and a second relay, the working contacts of which are connected in series with the working contacts of the first relay.

In the industrial sector, functionally safe release paths are used in safety relays and safety controls to safely switch electrical consumers on and off that pose a potential danger to people and materials. Such electrical consumers include presses, milling tools, burners, etc. To do this, the power supply for the electrical consumer is controlled via the functionally safe release path, which is designed to meet the relevant safety regulations and certifications with regard to functional safety.

The standards mentioned above generally define certain levels of safety, the need for which is determined depending on the application. This is done by assessing the risk based on the extent of damage, frequency and duration of exposure and the possibility of avoiding the hazard. Depending on the required level of safety, the safety relay or the safety controller with the release path must meet the corresponding requirements in order to meet this level. At higher levels, it is necessary to be able to control the welding of a relay contact. This should not only ensure that the electrical consumer is switched off safely despite the fault mentioned, e.g. through redundancy in the form of two relays connected in series, but also that the electrical consumer is prevented from being switched on again.

In the past, so-called force-guided relays (also: relays with force-guided contacts) were often used for this purpose. A force-guided relay has a normally open contact and normally closed contacts that are mechanically coupled to one another in such a way that the normally open and normally closed contacts are prevented from being closed at the same time. This means that one contact is available for the actual switching function, while the other contact can be used to check the switching state in conjunction with a suitable circuit.

Such a positively driven relay is very reliable, but technically relatively complex. There are therefore efforts to implement circuits that can be checked accordingly without positively driven relays.

Against this background, it is the object of the invention to provide a functionally safe release path of the type mentioned above, which is suitable for higher safety levels and does not require mechanically complex components.

This object is achieved according to the invention by a first and a second detection circuit, wherein the first detection circuit comprises the working contacts of the first relay and the second detection circuit comprises the working contacts of the second relay, a high-frequency signal source assigned to the first and the second detection circuit, and a first high-frequency detection device assigned to the first detection circuit and a second high-frequency detection device assigned to the second detection circuit.

The invention is based on the idea that the contact positions of normally open/closed contacts should be checked for their switching state using a potential-free test circuit, without affecting the signals on the load circuit, i.e. via the enable path. This can be done by coupling a high-frequency signal via the switches, which is generated by a high-frequency signal source and measured with separate high-frequency detection devices.

Advantageously, the safety level of a standard is SIL3 of EN IEC 62061 and/or PLe of EN ISO 13849-1, each in the version current on the filing date of this application. The definitions of these safety levels in the standards mentioned are incorporated into this application by reference. The safety levels SIL3 and PLe represent comparatively high levels. This means that if a single error occurs, the safety relay or control must not pose a danger to life and limb. Ideally, the error is detected and the device goes into the safe state. If an error is not detected, it must be ensured that there is no danger in the event of a second error. A particular advantage of using high frequency to detect contact positions is that the high levels PLe and SIL3 mentioned can be achieved - if necessary in conjunction with the other measures mentioned below.

In a further advantageous embodiment, the high-frequency signal source and high-frequency detection devices are capacitively decoupled from the working contacts of the relays. By suitable selection of the By using coupling capacitances, it is possible to achieve impermeability for the technical frequencies (DC, 16.7 Hz, 50 Hz, 60 Hz, 400 Hz) on the load circuit, but still couple in the high-frequency test signals in order to be able to check the contact positions. In other words: the coupling capacitance is advantageously chosen in such a way that its impedance X _c is greater than 1 MΩ for the technical frequencies on the load circuit, while it is less than 1 kΩ for the high-frequency signal.

The high-frequency signal source is advantageously designed for galvanic isolation of a control circuit from the detection circuits. This serves to isolate the potential-free detection circuit, which is operated with comparatively low currents and voltages, from the comparatively high currents, voltages and potentials in the enable path. This can be done in particular by the high-frequency signal source comprising a transformer, i.e. the high-frequency signal is inductively coupled into the detection circuits.

Furthermore, the respective high-frequency detection device is advantageously designed for galvanic isolation of an evaluation circuit from the respective detection circuit. This also serves to separate the evaluation circuit, which is operated with comparatively low currents and voltages, from the comparatively high currents and voltages in the enable path. This can be done in particular by the respective high-frequency detection device comprising an optocoupler or transformer, i.e. the high-frequency signal is optically or inductively coupled out of the detection circuit.

The high-frequency signal source advantageously generates a high-frequency signal of 100 kHz or more in the detection circuits. Such high frequencies simplify the selection of suitable capacitances for the coupling as explained above and are unproblematic with regard to their effects on the actual function in the release path.

In a further alternative or additional advantageous embodiment, the second relay is designed as a changeover contact, and the second detection circuit comprises those working contacts of the second relay that form the changeover contact's alternative path to a switching path. In other words, the detection circuit is not closed when the relay is in the enable state of the enable path, i.e. the electrical consumer is switched on, but it is closed when the consumer is switched off and the enable path is interrupted. Such an embodiment enables the detection of a signal (i.e. a logical 1) in the detection circuit when the relay is switched off instead of when it is switched on. The advantage here is that it can be actively checked whether the enable path is actually interrupted.

It is particularly advantageous to combine this with a normally open contact as the first relay. This means that one of the relays is designed as a normally open contact and the other as a changeover contact. In the first relay, the first detection circuit is therefore closed when the first relay releases the current to the consumer, and in the second relay, the second detection circuit is closed when the second relay interrupts the current to the consumer. This results in different logical signals on the detection circuits (1 and 0 or 0 and 1) in the release state and in the interruption state. This makes it possible to test the function of the relays in every state.

For this purpose, the release path advantageously comprises a control device which is connected to the high-frequency detection devices and the control contacts of the relays and which is designed to evaluate the signals of the high-frequency detection devices independently of the current switching state of the relays. In other words, the test of the contact position of the relays should be completely independent of the current switching request (release or interruption).

Expected signals for the high-frequency detection devices are advantageously stored in the control device, and the control device is designed to output an error message and/or not to release a release request to the relays if the signals received from the high-frequency detection devices deviate from the stored expected signals. Expected - usually logical - signals are therefore stored in the control device, which should be output when the switching state is checked by coupling in the high frequency. These correlate with the error-free target state that the respective detection circuits should have in the currently requested switching state. If a deviation is detected, an error message is output, which can then be used accordingly. If necessary, the respective consumer can be transferred directly to a safe state automatically.

The advantages achieved with the invention are in particular that the arrangement of detection circuits in redundant relays and the supply of a high-frequency signal make it possible to check the contact switching state of the switches without the need for forced-guided relays must be used. The combination of normally open and changeover contacts makes it possible to achieve the highest safety levels of the relevant standards.

• FIG ein schematisches Blockschaltbild eines funktional sicheren Freigabepfades.

Embodiments of the invention are explained below with reference to a drawing.

• FIG shows a schematic block diagram of a functionally safe release path.

The release path 1 according to the FIG is part of a load circuit 2 for supplying power to an electrical consumer 4. It releases the power supply from a power source 6 to the electrical consumer 4. The electrical consumer 4 is such that it poses a potential hazard to people and materials, for example a press, a milling tool or similar. For this reason, the release path 1 in the exemplary embodiment is designed in such a way that it meets the safety level SIL3 of the Standard EN IEC 62061 and the security level PLe of the Standard EN ISO 13849-1 fulfilled.

For this purpose, the release path 1 comprises a first relay 8 and a second relay 10, whose working contacts are connected in series in the release path 1. In order to release the power supply to the consumer 4, both relays 8, 10 must be closed. On the control side, the relays 8, 10 are controlled by a microcontroller 12, whose signals are forwarded to the relays 8, 10 via a safety module 14. The safety module 14 only forwards a release request from the microcontroller 12 to the relays 8, 10 if the relays 8, 10 are functioning correctly.

To test the relays 8, 10 for errors, in particular welding of contacts, the release path 1 includes a high-frequency signal source that includes a signal generator 16. In the exemplary embodiment, this generates a sinusoidal signal with a frequency of 100 kHz. Microcontroller 12, safety module 14 and signal generator 16 are supplied with power from a low-voltage power source 18, in the exemplary embodiment with an operating voltage of 24 V.

The high-frequency signal is coupled into a first and a second detection circuit 20, 22. The first detection circuit 20 comprises the working contacts of the first relay 8, i.e. it is connected to the load circuit 2 before and after the first relay. The first detection circuit 20 also comprises the secondary side of a transformer 24, a first resistor 26 and the transmitter side of a first optocoupler 28. The last three components are connected to the load circuit 2 on each side via a capacitor 30, 32, i.e. they are only capacitively coupled.

The transformer 24 is part of the high-frequency signal source, its primary side is connected to the signal generator 16. The receiver side of the first optocoupler 28 is in turn connected to the safety module 14. In this way - provided the first detection circuit 20 is closed, which requires the first relay 8 to be closed - the safety module 14 can detect the signal generated by the signal generator 16 at the first optocoupler 28. The use of the transformer 24 and the optocoupler 28 serves to galvanically decouple the detection circuit 20, which is capacitively connected to the comparatively high currents and voltages in the load circuit 2, from all electronic components that are only supplied with the potential of the low-voltage power source 18 (enclosed in the FIG with a dash-dot line).

Furthermore, the release path 1 includes a second detection circuit 22, which is used to determine the contact position of the second relay 10. In contrast to the first relay 8, however, the second relay 10 is designed as a changeover contact. The second detection circuit 22 leads here via the alternative contacts to the release contacts of the second relay 10, so it is closed when the second relay 10 interrupts the load circuit 2.

Otherwise, the second detection circuit 22 is constructed analogously to the first detection circuit. It shares the path branching off between the relays 8, 10 with the capacitor 30 and the secondary side of the transformer 24 and also includes a transmitter side of a second optocoupler 36 connected via a further capacitor 34. The receiver side of the second optocoupler 36 is also connected to the safety module 14. The use of only one transformer 24 for both detection circuits 20, 22 simplifies the construction. In an alternative embodiment not shown, however, different transformers can also be used for each detection circuit 20, 22, which may also couple in different signals (e.g. different frequencies) so that the signals can be distinguished.

The function of the release path 1 shown, which is controlled by the microcontroller 12 and the safety module 14, is as follows: The microcontroller 12 controls the basic release request - if the electrical consumer 6 is to be supplied with power, the microcontroller 12 sends this release request to the relays 8, 10, which are both to switch to the release position. This However, the request is routed via the safety module 14, which only forwards the request if the relays 8, 10 are error-free.

The check for error-free operation is carried out using high-frequency signals. These are coupled into the detection circuits 20, 22 via the transformer and then activate the optocouplers 28, 36 when the respective detection circuit 20, 22 is closed. An error can be determined by comparing it with the setpoint values stored in the safety module 14, if necessary before switching on, cyclically during operation, or on other request.

In the state shown in the FIG, both relays, i.e. the enable path 1, are open, so the request situation corresponds to the logical signal: first relay 8: 0 - second relay 10: 0. In this case, the first detection circuit 20 should be open, while the second detection circuit 22 should be closed due to the use of a changeover contact and the arrangement of the second detection circuit 22. The detected logical signal should therefore be first optocoupler 28: 0 - second optocoupler 36: 1, and is also measured in the error-free state. In the state shown, the safety module 14 would therefore pass the request on to the relays 8, 10.

In the release state (logical signal 1 - 1 in the request), however, the detected logical signal of the optocouplers 28, 36 should be 1 - 0. In addition to these possible tests during operation, it is also possible to test each switching contact individually using the series connection of normally open and changeover contacts shown when load path 1 is open. In this case, the request 0 - 1 (only the second relay 10 is activated and closed) would lead to an expected logical signal 0 - 0 at the optocouplers 28, 36 on the safety module 14, the request 1 - 0 (only the first relay 8 is activated and closed) would lead to an expected logical signal 1 - 1 at the safety module 14. Any deviation of the measured signal from the expected signal outlined represents an error and causes the safety module 14 to output an error and transfer the electrical consumer 6 to a safe state, i.e. relay release is prevented and the contacts of the relays 8, 10 are switched off and open.

The embodiment makes it possible to check the contact positions of relay contacts with a potential-free detection circuit 20, 22 for their switching state, without affecting the signals on the load circuit. The coupling capacitances of the capacitors 28, 30, 32 shown are selected so that the high frequency of 100 kHz or higher used has no influence on the technical frequencies in the load circuit 2. The impedance of the coupling capacitance is in the double-digit MΩ range for the technical frequencies, whereas at the test frequency of 100 kHz used, these capacitances have an impedance of < 1 kΩ. The combination of normally open and changeover contacts shown makes it possible to implement circuits that can correspond to a high safety level SIL3/PLe.

List of reference symbols

1

Release path

2

Load circuit

4

electrical consumer

6

Power source

8

first relay

10

second relay

12

Microcontroller

14

Safety module

16

Signal generator

18

Low voltage power source

20

first detection circuit

22

second detection circuit

24

transformer

26

first resistance

28

first optocoupler

30

capacitor

32

capacitor

34

capacitor

36

second optocoupler

QUOTES INCLUDED IN THE DESCRIPTION

This list of documents listed by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA accepts no liability for any errors or omissions.

Cited non-patent literature

• Standard EN IEC 62061 [0020]
• Standard EN ISO 13849-1 [0020]

Claims (10)

Functionally safe release path (1), designed for functionally safe switching of an electrical consumer (4) according to a safety level of a standard, comprising a first relay (8), a second relay (10), whose working contacts are connected in series with the working contacts of the first relay (8), a first and a second detection circuit (20, 22), wherein the first detection circuit (20) comprises the working contacts of the first relay (8) and the second detection circuit (22) comprises the working contacts of the second relay (10), a high-frequency signal source assigned to the first and the second detection circuit (20, 22), and a first high-frequency detection device assigned to the first detection circuit (20) and a second high-frequency detection device assigned to the second detection circuit (22). Functionally safe release path (1) according to the preceding claim, in which the safety level of a standard is SIL3 of EN IEC 62061 and/or PLe of EN ISO 13849-1, each in the version current on the filing date of this application. Functionally safe release path (1) according to one of the preceding claims, in which the high-frequency signal source and high-frequency detection devices are capacitively decoupled from the working contacts of the relays (8, 10). Functionally safe release path (1) according to one of the preceding claims, in which the high-frequency signal source is designed for a galvanic isolation of a control circuit from the detection circuits (20, 22), in particular in that the high-frequency signal source comprises a transformer (24). Functionally safe release path (1) according to one of the preceding claims, in which the respective high-frequency detection device is designed for a galvanic isolation of an evaluation circuit from the respective detection circuit (20, 22), in particular in that the respective high-frequency detection device comprises an optocoupler (28, 36). Functionally safe release path (1) according to one of the preceding claims, wherein the high frequency signal source generates a high frequency signal of 100 kHz or more in the detection circuits (20, 22). Functionally safe release path (1) according to one of the preceding claims, in which the second relay (10) is designed as a changeover contact, and the second detection circuit (22) comprises those working contacts of the second relay (10) which form the path of the changeover contact which is alternative to a switching path. Functionally safe release path (1) according to the preceding claim, in which the first relay (8) is designed as a normally open contact. Functionally safe release path (1) according to one of the preceding claims, further comprising a control device (14) which is connected to the high-frequency detection devices and the control contacts of the relays (8, 10) and which is designed to evaluate the signals of the high-frequency detection devices independently of the current switching state of the relays (8, 10). Functionally safe release path (1) according to the preceding claim, wherein expected signals for the high-frequency detection devices are stored in the control device (14), and the control device (14) is designed to output an error message and/or not to release a release request to the relays (8, 10) in the event of a deviation between the signals received from the high-frequency detection devices and the stored expected signals.

Images