Method and safety circuit for safe limiting of electrical power consumption

Abstract

The invention relates to a method and to a safety circuit for safe limiting of consumption of electrical power in an electrical component of a field device. The consumption of the electrical power is controlled by separating the input path from a superordinated unit by the safety circuit according to a predetermined clocking, wherein the clocking is controlled by a control signal. In the case of no control signal, the power limiting is assured by separating the input path from the superordinated unit. In the case of a defective control signal, the power is limited by the safety circuit to a maximum power. Due to this type of control, the operating temperature of the electrical component remains always below a critical temperature. The field device may thus be used in explosion-endangered regions.

Claims

1. A method for a safe limiting of a consumption of electrical power in an electrical component of a field device, wherein the electrical component receives the electrical power via an electrical input path from a superordinated unit, the method comprising: controlling the consumption of the electrical power by separating the electrical input path from the superordinated unit by a safety circuit according to a predetermined clocking, wherein the clocking is controlled by a control signal sent to the safety circuit; in the case of no control signal, durably separating the electrical input path from the superordinated unit by the safety circuit; and in the case of a defective control signal, limiting the electrical power by the safety circuit by separating the input path from the superordinated unit for at least a predefined minimum off time, wherein the control signal is considered defective when it exceeds a predefined maximum clocking frequency and/or a predefined maximum on time.

2. The method as claimed in claim 1, wherein the control signal is a rectangular signal.

3. The method as claimed in claim 1, wherein the control signal is a periodic signal.

4. The method as claimed in claim 1, wherein the minimum off time is dimensioned such that a temperature of the electrical component remains below a critical temperature, above which an atmosphere in an explosion-endangered region can be ignited.

5. The method as claimed in claim 1, wherein the control signal is produced by the superordinated unit.

6. A safety circuit for a safe limiting of consumption of electrical power in an electrical component of a field device, wherein the electrical component receives the electrical power via an electrical input path from a superordinated unit, comprising: at least one switch arranged in the electrical input path for clocked separating of the input path from the superordinated unit; a signal input for a control signal; and a control circuit configured to control the at least one switch such that the at least one switch: separates the input path from the superordinated unit as a function of the control signal according to a predetermined clocking; in the case of no control signal, durably separates the electrical input path from the superordinated unit; and in the case of a defective control signal, limits the electrical power by separating the input path from the superordinated unit for at least a predefined minimum off time, wherein a superordinated unit is provided for producing the control signal.

7. The safety circuit as claimed in claim 6, wherein the switch and/or the signal input are/is implemented as one or more transistors.

8. The safety circuit as claimed in claim 7, wherein the control circuit includes: an amplifier connected as a comparator and having a first input for the control signal and an output via which the switch is controlled; and at least one capacitor, wherein the at least one capacitor is sized and connected between the signal input and the first input such that the minimum off time is dependent on the capacitance of the at least one capacitor.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

(1) The invention will now be explained in greater detail based on the appended drawing, the figures of which show as follows:

(2) FIG. 1 shows an arrangement of a safety circuit of the invention in a field device,

(3) FIG. 2 shows a circuit diagram of an embodiment of the safety circuit,

(4) FIG. 3 shows a clocked power limiting of safety circuit in the case of a rectangularly shaped control signal,

(5) FIG. 4 shows a clocked power limiting in the case of a defective rectangular signal having too much time per clock signal,

(6) FIG. 5 shows a clocked power limiting in the case of a defective rectangular signal having a clocking frequency that is too high, and

(7) FIG. 6 shows a temperature development of the electrical component to be made safe in the case of limiting of power consumption by the safety circuit.

DETAILED DESCRIPTION

(8) Based on FIG. 1, the necessity of a safety circuit 1 in a field device 3 and the approximate operation of the safety circuit of the invention 1 will first be illustrated:

(9) Frequently, the field device 3 is applied in explosion endangered regions. For this reason, its electronic components 2, 5 are embodied explosion safely corresponding to the standard, IEC/EN 60079, or the like, since without these safety measures they could potentially act as ignition sources.

(10) The field device 3 in FIG. 1 includes two electrical components 2, 5: on the one hand, it includes a superordinated unit 5, which can serve, for example, for measured value processing or also for communication with a process control system. The superordinated unit 5 does not have to be in direct contact with the explosion-endangered region and can, consequently, be protected by potting encapsulation (for example, according to IEC/EN 60079-18) and/or by a pressure-resistant housing (corresponding to IEC/EN 60079-1).

(11) The situation is different for the case of a second electrical component 2, which includes, for example, pressure sensors for pressure measurement or an antenna unit for radar based fill level measurement and, consequently, must be in direct contact with the explosion-endangered region. Since, in such case, neither potting encapsulation nor pressure resistant encapsulation is possible, the electrical component 2 is embodied to be intrinsically safe (“Ex-i”). In such case, the provided intrinsically safe power P.sub.e can, for the case, in which the component 2 is a very small component, produce a strong heating in such a manner that the critical temperature T.sub.krit is exceeded. By limiting the supplied power P.sub.e by clocking, it is assured that the temperature of the component remains below a critical temperature T.sub.krit, above which an ignition of the atmosphere in the explosion-endangered region could occur.

(12) The electrical component 2 in the case of the field device 3 shown in FIG. 1 is supplied with electrical power P.sub.e by the superordinated unit 5, wherein the power consumption of the electrical component 2 occurs via an input path 4. In such case, the safety circuit 1 is arranged in the input path 4 between the superordinated unit 5 and the electrical component 2. According to the invention, the consumption of electrical power P.sub.e is controlled by separating the electrical input path 4 from the superordinated unit 5 according to a predefined clocking by the safety circuit 1, wherein the clocking is controlled by a control signal s.sub.c sent to the safety circuit 1.

(13) A central aspect of the method of the invention is that the power P.sub.e is at least limited or interrupted in the case of a defective superordinated unit 5. According to the invention, the electrical input path 4 is, consequently, interrupted by the safety circuit 1 in the case of no control signal s.sub.c. In the case of a defective control signal s.sub.c, the electrical power P.sub.e is limited by the safety circuit 1. In this way, it is assured that upon failure of the superordinated unit 5, in no case is more than a predefined maximum power P.sub.e,max transmitted.

(14) A possible implementation of the method of the invention in a corresponding safety circuit 1 is shown in FIG. 2. The safety circuit 1 shown there is based on a switch 11, which is arranged in the input path 4 and interrupts such according to a predefined clocking. The operation of this safety circuit 1 can best be explained, when a periodic rectangular signal with predefined clocking frequency f.sub.t and pulse length t.sub.t is applied as control signal s.sub.c, as shown in FIGS. 3 to 6. The operation of the safety circuit 1 of the invention is not, however, so limited. Rather, the operation can be equally effective, when the control signal s.sub.c is, for example, a corresponding periodic sawtooth- or sine signal, or an acyclically clocked rectangular- or other signal).

(15) The switch 11 in the illustrated embodiment is implemented as a pnp transistor or as a p-channel MOSFET and is opened and closed via an output 132 of an amplifier 13. The amplifier 13 is, in such case, connected as a comparator. The amplifier 13, in turn, is controlled via a first input 131 indirectly by control signal s.sub.c. In this way, the switch 11 is controlled by the clocking of the periodic control signal s.sub.c.

(16) The potential on the second amplifier input 133 is set via a voltage divider R.sub.3, R.sub.4. In this way, a limit voltage V.sub.T is established, which must be subceeded on the first input 131, in order that the output 132 of the amplifier 13 lies low enough and so closes the switch 11. In order that the switch 11 closes, when low potential is present on the first input 131 and so low potential is present on the output 132 of the amplifier 13, switch 11 is embodied as a bipolar pnp transistor or as a p-channel MOSFET (in the case of application of npn transistors, instead of pnp transistors, or n-channel MOSFETs instead of p-channel MOSFETs, correspondingly other level relationships would be used for circuit implementation).

(17) As can be seen from FIG. 2, the control signal s.sub.c is not applied directly to the first input 131 of the amplifier 13. Rather, the control signal s.sub.c controls the gate, or the base, of a signal input 12 embodied as a transistor. By making this transistor 12 conductive by means of the control signal s.sub.c, a first connection 141 of a capacitor 14 is drawn to ground, whereby at first in the case of completely discharged capacitor 14 likewise ground potential is present on the second connection 142 of the capacitor. In this way, the potential on the second connection 142, which is connected with the first input 131 of the amplifier 14, sinks for a short time below the limit voltage V.sub.T. To the extent that the transistor 12 is implemented as an npn transistor or n-channel MOSFET, the switch 11 is, thus, corresponding to the above described relationships, closed by each positive level of the periodic control signal s.sub.c (in the case of application of npn transistors instead of pnp transistors, or n-channel MOSFETs instead of p-channel MOSFETs, correspondingly other level relationships would be used for circuit implementation).

(18) After the transistor 12 becomes conductive, the potential rises with a time delay, which corresponds to a maximum on time t.sub.on,max, back above the limit voltage V.sub.T. The reason is that the capacitor 14 is charged via a resistor R.sub.2, which is arranged between the supply line P.sub.e and the second input 142 of the capacitor 14, and the first input 131 of the amplifier 13. The maximum on time t.sub.on,max is thus fixed by the time constant (R.sub.2*C) of the capacitor 14 and the resistor R.sub.2.

(19) If the transistor 12 becomes non-conductive before expiration of the maximum on time t.sub.on,max, then a higher potential than V.sub.T returns to the first input 131 of the amplifier 13. For this case, the time relationship between a periodic rectangular signal (with a clocking frequency f.sub.t and a pulse length t.sub.t) as control signal s.sub.c and the on time t.sub.on at the switch 11 is shown in FIG. 3. Corresponding to the above described relationships, it can be seen that at a small clocking frequency f.sub.t and a small pulse length t.sub.t below the maximum on time t.sub.on,max, the on time t.sub.on agrees with the pulse length t.sub.t. In this case, the power P.sub.e, which is transmitted to the electrical component, is correspondingly
P.sub.e=P.sub.on(f.sub.t*t.sub.on).

(20) P.sub.on is, in such case, the electrical power, which is instantaneously supplied in the case of short-circuited switch 11. Possible power fractions, which, in given cases, reach the electrical component 2 via peripheral inputs, for example, signal inputs r.sub.x/t.sub.x, are not taken into consideration here.

(21) As shown in FIG. 4, the situation is different, when the transistor 12 becomes non-conductive after expiration of the maximum on time t.sub.on,max, i.e. when the pulse length t.sub.t of the control signal s.sub.c because of a defective control by the superordinated unit 5 is longer than the maximum on time t.sub.on,max. In this case, the switch 11 is, indeed, closed with the frequency f.sub.t, however, only for the maximum on time t.sub.on,max. Thus, the transferred power P.sub.e is correspondingly limited
P.sub.e=P.sub.on(f.sub.t*t.sub.on,max).

(22) FIGS. 3 and 4 also make clear that the electrical input path 4 is interrupted by the safety circuit 1 in the case of no control signal s.sub.c (or a defectively constant, direct voltage type, control signal s.sub.c), since the control signal s.sub.c then has no clocked positive level or a static level and the switch 11 then separates the signal input 4 durably from the superordinated unit 5.

(23) A further error on the part of the superordinated unit 5 can occur, when it produces the control signal s.sub.c defectively with a clocking frequency f.sub.t, which is higher than a predefined maximum clocking frequency f.sub.t,max. In this case, the electrical component 2 would consume prohibitively greater than a pre-known maximum power P.sub.e,max. In this way, it would be possible that the electrical component 2 would be heated to above the critical temperature T.sub.krit, so that a potential ignition source would be present in the explosion-endangered region.

(24) FIG. 5 shows that the safety circuit 1 of FIG. 2 also limits the power P.sub.e in the case of such a defective control signal s.sub.c. The limiting is successful, in that the switch 11 of the safety circuit 1 separates the input path 4 from the superordinated unit 5, in this case, with at least a minimum off time t.sub.off,min. The switch 11 is, in this case, indeed, always still clocked with the clocking frequency f.sub.t of the control signal s.sub.c. With rising clocking frequency, however, the on time t.sub.on lessens increasingly (toward the extreme case t.sub.on=0), because of the minimum off time t.sub.off,min, which remains constant, whereby the transferred power is, in turn, limited:
P.sub.e=P.sub.on(1−f.sub.t*t.sub.off,min)

(25) With reference to the safety circuit 1 shown in FIG. 2, the minimum off time t.sub.off,min results, in turn, from the arrangement of the capacitor 14 within the safety circuit 1: In the case, in which the clocking frequency f.sub.t of the control signal s.sub.c is higher than the maximum clocking frequency f.sub.t,max, the capacitor 14 is no longer completely discharged. In this way, the potential on the second connection 142 of the capacitor 14, or on the first input 131 of the amplifier 13 exceeds the limit voltage V.sub.T prematurely after switching of the transistor 12. The maximum clocking frequency f.sub.t,max results, in this case, from the time constant ((R.sub.1+R.sub.2)*C) of the capacitor 14.

(26) FIG. 6 shows schematically how the clocked limiting of power P.sub.e affects the temperature of the electrical component 2: By clocking with, at most, the maximum on time t.sub.on,max, or with the minimum off time t.sub.off,min (to the extent that the maximum clocking frequency f.sub.t,max is exceeded), the electrical component 2 cools during the time when the safety circuit 1 has separated the signal input 4 from the superordinated unit 5. In this way, the temperature of the electrical component 2 always remains below the critical temperature T.sub.krit, above which the component 2 ignite could the atmosphere in an explosion-endangered region.