SAFETY-RELATED SWITCHING DEVICE

Abstract

The invention relates to a safety-related switching device (10) which is equipped with an electromagnetic coil (12), a control unit (20) and a first switching means (22). The first switching means (22) is designed to activate and deactivate the electromagnetic coil (12). Moreover, the first switching means (22) is designed to receive a coil control signal (24), a monitoring signal (32) and a first higher-level control signal (26). The safety-related switching device (10) also has a receiver unit (40) for receiving an external control signal (29). The receiver unit (40) is designed to generate the first higher-level control signal (26) and a second higher-level control signal (28) from the external control signal (29). The control unit (20) is designed to receive the second higher-level control signal (28).

Claims

1. A safety-related switching device comprising: a magnetic coil; a controller; and a first switching device configured to: activate and deactivate the magnetic coil; and receive a coil control signal, a monitoring signal, and a first higher-level control signal, wherein the safety-related switching device has a receiver unit for receiving an external control signal, the receiver unit being configured to generate the first higher-level control signal and a second higher-level control signal from the external control signal, wherein for transferring the first higher-level control signal from the receiver unit to the first switching device, the receiver unit and the first switching device are directly connected together, and wherein the controller is configured to receive the second higher-level control signal and to initiate a sending of the coil control signal based on the received second higher-level control signal.

2. (canceled)

3. (canceled)

4. The safety-related switching device claim 1, wherein the safety-related switching device has a second switching device that forms a freewheeling circuit, the freewheeling circuit being connected to the controller and being configured to activate and deactivate the magnetic coil.

5. The safety-related switching device claim 1, wherein the first switching device is configured to deactivate the magnetic coil when a coil deactivation is prescribed at least by the first higher-level control signal, the coil control signal or the monitoring signal.

6. The safety-related switching device of claim 4, wherein the second switching device is configured to deactivate the magnetic coil when a current strength that is present in the freewheeling circuit differs in magnitude by more than a selectable tolerance value from a reference value.

7. The safety-related switching device of claim 1, wherein the first switching device comprises a semiconductor switch, at least one logic module, or the semiconductor switch and the at least one logic module.

8. The safety-related switching device of claim 1, wherein the coil control signal takes the form of a pulse-width modulation signal, the monitoring signal takes the form of an output signal of a watchdog that is connected to the controller, or a combination thereof.

9. The safety-related switching device of claim 4, wherein the second switching device comprises a semiconductor switch, at least one logic module, or the semiconductor switch and the at least one logic module.

10. The safety-related switching device of claim 1, wherein a load circuit carrying a power from 50 kW to 750 kW is interruptible by the magnetic coil.

11. An operating method for a safety-related switching device for switching a load circuit by a magnetic coil, wherein the safety-related switching device has a controller and a first switching device, the operating method comprising: receiving a first higher-level control signal at the first switching device; receiving a coil control signal at the first switching device, wherein sending of the coil control signal is initiated by the controller; receiving a monitoring signal at the first switching device, wherein the monitoring signal is sent by a watchdog that monitors the controller; sending a deactivation instruction from the first switching device to the magnetic coil when, in the receiving of the first higher-level control signal, the receiving of the coil control signal, the receiving of the monitoring signal, or any combination thereof, a signal that prescribes a deactivation of the magnetic coil is received; receiving, by the controller, a second higher-level control signal and initiating the corresponding coil control signal to the first switching device, wherein the first higher-level control signal and the second higher-level control signal are generated from an external control signal by a receiver unit, and wherein the first higher-level control signal is transferred directly from the receiver unit to the first switching device.

12. (canceled)

13. The operating method claim 11, further comprising: capturing a current flow through the magnetic coil by a measuring device after expiry of a selectable time duration; and sending a deactivation instruction to the first switching device, the second switching device, or the first switching device the second switching device to interrupt a power supply of the magnetic coil when the current flow captured in the capturing differs from a settable reference value.

14. A switching system for switching a load circuit, the switching system comprising: a higher-level control entity configured to output a single-channel or dual-channel external control signal, wherein the switching system has a hardware fault tolerance of at least one and is connected to two safety-related switching devices, each of the two safety-related switching devices comprising a magnetic coil, a controller, and a first switching device, the first switching device being configured to activate and deactivate the magnetic coil and receive a coil control signal, a monitoring signal, and a first higher-level control signal, wherein the safety-related switching device has a receiver unit for receiving an external control signal, the receiver unit being configured to generate the first higher-level control signal and a second higher-level control signal from the external control signal, wherein for transferring the first higher-level control signal from the receiver unit to the first switching device, the receiver unit and the first switching device are directly connected together, and wherein the controller is configured to receive the second higher-level control signal and to initiate a sending of the coil control signal based on the received second higher-level control signal.

15. In a non-transitory computer-readable storage medium that stores instructions executable by a control unit of a safety-related switching device to operate a safety-related switching device for switching a load circuit by a magnetic coil, wherein the safety-related switching device has a controller and a first switching device, the instructions comprising: receiving a first higher-level control signal at the first switching device; receiving a coil control signal at the first switching device, wherein sending of the coil control signal is initiated by the controller; receiving a monitoring signal at the first switching device, wherein the monitoring signal is sent by a watchdog that monitors the controller; sending a deactivation instruction from the first switching device to the magnetic coil when, in the receiving of the first higher-level control signal, the receiving of the coil control signal, the receiving of the monitoring signal, or any combination thereof, a signal that prescribes a deactivation of the magnetic coil is received; receiving, by the controller, a second higher-level control signal and initiating the corresponding coil control signal to the first switching device, wherein the first higher-level control signal and the second higher-level control signal are generated from an external control signal by a receiver unit, and wherein the first higher-level control signal is transferred directly from the receiver unit to the first switching device.

16. The safety-related switching device of claim 7, wherein the first switching device comprises the semiconductor switch, the semiconductor switch being an IGBT or a MOSFET.

17. The safety-related switching device of claim 9, wherein the second switching device comprises the semiconductor switch, the semiconductor switch being an IGBT or a MOSFET.

Description

[0028] The invention is described in greater detail below with reference to individual exemplary embodiments, wherein:

[0029] FIG. 1 shows the structure of an embodiment of the inventive safety-related switching device;

[0030] FIG. 2 shows the sequence of an embodiment of the inventive operating method;

[0031] FIG. 3 shows the structure of an embodiment of the inventive switching system.

[0032] FIG. 1 schematically illustrates the structure of an embodiment of the inventive safety-related switching device 10, this being connected to a load circuit 50. The power supply of the safety-related switching device 10 is effected via a mains supply 11, which provides inter alia the current for the operation of the individual components in the safety-related switching device 10. The mains supply 11 is connected to a rectifier 18 and a multistage voltage level adjustment. The adjusted voltage levels are monitored by means of voltage measuring devices 17 and the measurement result is forwarded to a control unit 20. The mains supply 11 is further coupled to a voltage sensor 21, whose measurements are used to define the pulse width modulation of the coil control signal 24.

[0033] The safety-related switching device 10 has a magnetic coil 12, which is configured to perform an electromagnetic actuation of a mechanical coupling 15 to switching contacts 14, these being shown symbolically. The switching contacts 14 are part of the load circuit 50, in which a significantly higher current is carried than in the switching device 10 itself. The switching contacts 14 in the load circuit 50 interact with auxiliary contacts 16, which are used to report the switching state of the switching contacts 14. The magnetic coil 12 can be activated and deactivated via a first switching means 22, this comprising an IGBT 34. The first switching means 22 is connected to a signal generator 37, which can be triggered by the control unit 20. The control unit 20 is designed as a microcontroller and is suitable for outputting a signal 31 which is converted into the coil control signal 24 by the signal generator 37. The coil control signal 24 is a pulse-width modulated signal (PWM signal), by means of which it is possible to set the retention force generated by the magnetic coil 12. The first switching means 22 is configured to receive the coil control signal 24 and to register therefrom whether activation of the magnetic coil 12 is instructed or not. The first switching means 22 is also designed to receive a first higher-level control signal 26, which reaches the safety-related switching device 10 via a receiver unit 40. The higher-level control signal 26 is generated by a higher-level control entity 62 which is not illustrated in greater detail. Furthermore, the first switching means 22 is configured to receive a monitoring signal 32, this being sent by a watchdog 30. The watchdog 30 is coupled to the control unit 20. The monitoring signal 32 shows in a binary manner whether correct operation of the control unit 20 is present.

[0034] The first switching means 22 checks the incoming coil control signal 24, the first higher-level control signal 26 and the monitoring signal 32 in order to determine whether one of these signals prescribes a deactivation of the magnetic coil 12. The check is effected by means of a suitable logical association of the signals 24, 26, 32 in this case. If at least one of the signals 24, 26, 32 indicates that a deactivation of the magnetic coil 12 is required, a deactivation instruction 25 is sent from the first switching means 22 to the magnetic coil 12. Furthermore, the control unit 20 is designed to receive a second higher-level control signal 28. The first and second higher-level control signals 26, 28 belong to a dual-channel external control signal 29 that is sent by the higher-level control entity 62, which is not shown in greater detail but is connected to the safety-related switching device 10 via the receiver unit 40. By means of the receiver unit 40, the first and second higher-level control signals 26, 28 from the external control signal 29 are supplied in a suitable format for the safety-related switching device 10. The control unit 20 able to check the consistency of the present actuation status of the magnetic coil 12 using the external control instruction 29.

[0035] The control unit 20 is also connected to a measuring device 38 which sends measured data 39. The measured data 39 includes a variable which shows the operating state of the power supply of the magnetic coil 12. The corresponding variable in the measured data 39 is compared with a settable reference value in the control unit 20. The reference value is set by a data record 42 which includes a configuration data record and/or a parameter record. If the captured variable differs in magnitude by more than a selectable tolerance value from the settable reference value, the control unit 20 identifies an abnormal state in the power supply of the magnetic coil 12. The tolerance value can also be set via the data record 42. If an abnormal state of the power supply of the magnetic coil 12 is identified, the control unit 20 sends a cutoff instruction 27 to a second switching means 23. At the same time, the control unit 20 sends a corresponding cutoff instruction to the first switching means 22 in the form of a corresponding signal 31 to the signal generator 37. The captured variable is e.g. a current strength of the power supply of the magnetic coil 12. The second switching means 23 is arranged in a freewheeling circuit 33 and is suitable for switching the magnetic coil 12 to no-load. The second switching means 23 comprises a semiconductor switch 34 for this purpose. The isolation of the power supply of the magnetic coil 12 is effected by means of a deactivation instruction 25 from the second switching means 23.

[0036] Using the measured data 39 of the measuring device 38, the control unit 20 is able to verify the successful implementation of a deactivation instruction 25 that has been output by the first switching means 22. If after a deactivation instruction 25 has been output by the first switching means 22, a variable (e.g. the current strength) that is captured by the measuring device 38 indicates an actuation, i.e. an active state of the magnetic coil 12, the control unit 20 is designed to send a corresponding cutoff instruction 27 to the second switching means 23. In the second switching means 23, the cutoff instruction 27 from the control unit 20 is converted into a corresponding deactivation instruction 25, by means of which the magnetic coil 12 is switched to no-load. The freewheeling circuit 33 comprising the second switching means 23 therefore provides a fallback facility in the event that correct deactivation of the magnetic coil 12 cannot be guaranteed via the first switching means 22 alone. The safety-related switching device 10 alone offers a Safety Integrity Level of up to SIL2, a Performance Level of up to PLc and a Safety Category of up to 2. Furthermore, the SIL Claim Limit of the safety-related switching device 10 has a SIL Claim Limit of up to SIL CL2.

[0037] FIG. 2 schematically shows the sequence of an operating method 100 for a safety-related switching device 10 which is not illustrated in greater detail, said switching device 10 being configured to open or close a load circuit 50. In a first method step 110, a first higher-level control signal 26 that is sent from a higher-level control entity 62 is received by a switching means 22 in the safety-related switching device 10. In a further method step 120, which takes place essentially in parallel with the first method step 110, a coil control signal 24 that is generated by a control unit 20 of the safety-related switching device 10 is received by the first switching means 22. Furthermore, in a third method step 130, which takes place at essentially the same time as the first and second method steps 110, 120, a monitoring signal 32 is received by the first switching means 22. The monitoring signal 32 represents the report of function monitoring for the control unit 20. For this purpose, the control unit 20 is monitored by a watchdog 30 in order to determine whether it continues to function normally. The monitoring signal 32 shows in a binary manner whether a normal operating state of the control unit 20 is present. In a fourth method step 140 following thereupon, the available signals, i.e. the first higher-level control signal 26, the coil control signal 24 and the monitoring signal 32 are checked in order to determine whether at least one of them indicates that a deactivation of the magnetic coil 12 required. This is the case, for example, if isolation of the load circuit 50 is instructed by the first higher-level control signal 26. In addition or alternatively, deactivation of the magnetic coil 12 is required if an instruction from the control unit 20 prescribes an isolation of the load circuit 50 or if the monitoring signal 32 indicates that the control unit 20 is not working normally.

[0038] Depending on the result of the fourth method step 140, a first branch 145 of the operating method 100 takes place. If at least one of the signals 24, 26, 32 prescribes a deactivation of the magnetic coil 12, a deactivation instruction 25 is output to the magnetic coil 12 by the first and second switching means 22, 23 in a fifth method step 150. After the resulting isolation of the load circuit 50, a stable end state 200 is established.

[0039] If all signals 24, 26, 32 continue to require an activation of the magnetic coil 12, a sixth method step 160 takes place in which a current flow through the magnetic coil 12 is captured by means of a measuring device 38. In the sixth method step 160, the captured current flow is compared with a settable reference value. Depending on the result of the comparison between the settable reference value and the captured current flow, a second branch 165 of the inventive method 100 takes place. If an evaluation of the comparison in the step 160 reveals that the safety-related switching device 10 is operating correctly, the method returns 166 to the initial state in the first method step 110.

[0040] If the comparison in the sixth method step 160 reveals that the state of the switching device 10 is abnormal, a seventh method step 170 follows. In this step, the control unit 20 causes a deactivation instruction 25 to be output from the first and second switching means 22, 23 to the magnetic coil 12. An isolation of the load circuit 50 is produced thereby, resulting in a stable end state 200.

[0041] FIG. 3 illustrates the structure of an inventive switching system 60, having a higher-level control entity 62 which is used to open and close a load circuit 50. The load circuit 50 is shown by way of example as a three-phase power supply. The higher-level control entity 62 has a communication connection to two safety-related switching devices 10, these being designed to interrupt the load circuit 50 independently of each other. A computer program product 80 is stored in each of the safety-related switching devices 10, and is designed in each case to implement the inventive operating method 100 on the safety-related switching devices 10. The safety-related switching devices 10 are triggered separately by the higher-level control entity 62 via external control signals 29, said external control signals 29 comprising a first and a second higher-level control signal 26, 28 in each case. The external control signals 29 are received by a receiver unit 40, which supplies the first and second higher-level control signals 26, 28 to the safety-related switching devices in a suitable format in each case. In the safety-related switching devices 10, the switching state of the switching contacts 14 that open and close the load circuit 50 is reported back separately in each case by means of auxiliary contacts 16 to the higher-level control entity 62. By serially combining the two safety-related switching devices 10, a hardware-fault tolerance of one is achieved in the inventive switching system 60. The switching system 60 also has a Safety Integrity Level of up to SIL 3 and a Performance Level of up to PLe. Furthermore, the switching system 60 according to FIG. 3 has a Safety Category of 4.