Secure electronic device

The invention relates to a safe electronic device which has multichannel logic circuitry, a single channel input device, an output device, and a storage device. Data items, each of which is associated with an input value, are stored in the storage device. The multichannel logic circuitry is comprised of a first control unit and a second control unit. The first control unit reads in an input value which has been input, and transmits the input value to the second control unit which actuates the output device for outputting of optical and/or acoustic information, in response to the input value which has been input. If the optical and/or acoustic information corresponds to the input value, the selected data item is released for further use.

FIELD

The invention relates to a safe electronic device which is capable of safely transmitting input values; and a method of fault-free configuration of a safe electronic device.

BACKGROUND

Safe switching devices capable of setting and/or changing, e.g., time parameters for delayed shutting off of a load, with use of a potentiometer are well known. In order to safely and reliably detect an inputted value, which is a value that has been input, two-channel potentiometers are used. A two-channel potentiometer is understood to be a potentiometer device whereby, depending on the setting of the potentiometer, two analog values are generated, which enable safe checking of the input value.

The present invention, remedies the deficiencies of other safe switching devices by devising an alternative safe electronic device which enables fault-free configuration and/or programming.

SUMMARY

The core concept of the invention, and the embodiments disclosed herein, may be described as providing a safe electronic device which is comprised of multichannel logic circuitry, a single-channel input device, an output device, and a storage device. Data items, each of which corresponds to a given input value, are stored in the storage device. The multichannel logic circuitry is comprised of a first and second control device (or control unit). The first control device reads in a first input value which has been input, and transmits the input value to the second control device, which actuates the output device, for outputting of optical and/or acoustic information, in response to the inputted value. If the optical and/or acoustic information corresponds to the input value, access to the selected data item is allowed, and the selected data item can be employed further.

The above-described technical problem is solved by the features of claims1and11.

According to another aspect of the invention, the input device is comprised of a plurality of manually actuatable switches, particularly DIP switches.

According to still another aspect of the invention, the safe electronic device is in the form of a multichannel safe switching device, for safe switching off of an electrical load (electrical consuming device).

These and other advantages will be apparent from the present application of the embodiments described herein.

The preceding is a simplified summary to provide an understanding of some embodiments of the present disclosure. This summary is neither an extensive nor exhaustive overview of the present disclosure and its various embodiments. The summary presents selected concepts of the embodiments of the present disclosure in a simplified form as an introduction to the more detailed description presented below. As will be appreciated, other embodiments of the present disclosure are possible utilizing, alone or in combination, one or more of the features set forth above or described in detail below.

While embodiments of the present disclosure are described herein by way of example using several illustrative drawings, those skilled in the art will recognize the present disclosure is not limited to the embodiments or drawings described. It should be understood the drawings and the detailed description thereto are not intended to limit the present disclosure to the particular form disclosed, but to the contrary, the present disclosure is to cover all modification, equivalents, and alternatives falling within the spirit and scope of embodiments of the present disclosure as defined by the appended claims.

DETAILED DESCRIPTION

Embodiments of the present disclosure will be described below in conjunction with exemplary safe electronic devices. Those skilled in the art will recognize the disclosed techniques may be used in creating any safe electronic device utilizing input values for data item management.

FIG. 1illustrates a safe electronic device10which may be in the form of, e.g., a safe switching device [(switching device with safety protections)].

The safe electronic device10has an input device40for inputting the input values, which device40is designed for single channel operation. This means that an input value which is input is passed to a first control device (or control unit)50without duplication or any other manner of splitting. The first control unit50is in the form of, e.g., a microcontroller.

According to an advantageous embodiment, the input device may have a plurality of first, manually actuatable switches42to46, which may be in the form of, e.g., DIP switches. With this arrangement, an input value is input by setting a corresponding binary code or bit pattern on the DIP switches42to46.

A second control device (or control unit)60, which also may be in the form of a microcontroller, is connected on its (device60's) input side to the first control unit50and is connected on its output side to an output device70, such that an input value can be processed in a two-channel mode. The second control device is designed to be able to control the output device70in response to an inputted input value, such that the output device70emits optical and/or acoustic information which (under conditions of lack of faults) corresponds to the input value.

According to an advantageous embodiment, the output device70is in the form of a display device for outputting optical information. Preferably, the display device70has a plurality of monochrome display elements which can be actuated to be luminous,71to75, each of which elements is associated with one of the switches42to46. Each monochrome luminous element71to75contains an LED of a predetermined color. As illustrated inFIG. 1, for purposes of example, the following are associated (coordinated): DIP switch42is associated with LED display element71, DIP switch43is associated with LED display element72, DIP switch44is associated with LED display element73, DIP switch45is associated with LED display element74, and DIP switch46is associated with LED display element75.

As may be seen fromFIG. 1, the second control unit60, on its output side, controls each of the LED display elements71to75individually.

The safe electronic device10has a storage device80in which a plurality of predetermined data items are stored, each of which data items is associated with a respective input value. The input values may comprise a plurality of predetermined, i.e. admissible, input values, each of which is associated with a predetermined data content (data item). The data items may comprise, e.g.:parameter values, e.g. operating parameters and/or configuration parameters; [and/or]programs, e.g. subprograms and/or main programs;
which, e.g., control the operation of the safe electronic device10.

For example, stored configuration parameters may represent various delay times which may result in the control of delayed shutoff of an electrical load110. The storage device80may advantageously be in the form of a lookup table, capable of associating each stored data item with a unique input value. It is also conceivable for the storage device80to be integrated into the first microcontroller50and/or the second microcontroller60. The design and implementation aspects of the storage device80are not relevant to the invention.

The first control unit50and/or second control unit60are/is designed to control access to the predetermined data item which is associated with the input value which has been input, such control being in response to an actuating signal from the input device40.

In this connection, the input device40can be designed for input of a confirmation signal, i.e. for input of a confirmation which signals that an input value which has been input corresponds to the information which is being (or has been) output by the output device70. Advantageously, for this purpose, the input device40may have a second manually actuatable switch41which, upon actuation, supplies an actuating signal to the first control unit50and/or the second control unit60.

The first control unit50may advantageously be designed to read out an input value which has been input from the input device40, when the second switch41is in its first position, so as to initiate a configuration mode. Alternatively, or in addition, it can be designed to interpret the second position of the second switch41as indicating that the input value corresponds to the output information. It is also conceivable to provide a separate switch or button (key) for input of a confirmation signal (not shown).

Instead of the DIP switches, the input device40can also have at least one potentiometer (not shown). In this case, an input value which has been input is associated with a specific potentiometer position, which causes a corresponding analog input signal. In this case, an analog to digital converter (A/D converter) which is designed to convert an analog input value into a binary signal which can be processed by the control units50and60may be provided between the potentiometer and the first control unit50.

In order to be usable as a safe switching device (for example), the safe electronic device10may have four connections21to24, to which, e.g., a two-channel emergency shutoff device30may be connected. The emergency shutoff device30may be associated with, e.g., a security-critical process. In the Figure, the emergency shutoff device30is represented symbolically by two rigidly joined switches31and32. One of the switches31is connected to the input of the first control unit50, via the connections21and22, and the second switch32is connected to the input of the second control unit60, via the connections23and24. Additionally, the safe electronic device10may have a connection25to switch on a supply voltage. The supply voltage can, inter alia, be connected to a two-channel output stage, which has two switching relays90and100, which are also designated K2and K1in the Figure. The switching relays90and100have, e.g., respective contacts95and105, which can switch off or switch on the electrical load110, which may be e.g. a motor110. The time-related switching-off behavior is realized by delayed switching-off of the relays90and100.

The first control unit50actuates the switching relay100via the switch102, while the second control unit60actuates the switching relay90via the switch92. This creates a two-channel output stage.

The two control units50and60can be regarded as a two-channel logic circuit of the safe electronic device10, because the first control unit50assumes the task of inputting an inputted value at the input device40, and transferring said input value to the second control unit60, which assumes the task of actuating the output device70.

Below, the functioning of the electronic device10illustrated as an exemplary embodiment will be described in more detail.

Assume that when the emergency shutoff device30is actuated it is the task of the electronic device10to shut off the motor110within one second of time. E.g., an operator will be able to tell, from a table, that the related configuration parameter “delay time 1 second” has been stored in the storage device80, at the address 01101.

To initiate the configuration mode, as an example the DIP switch41is set to a first switch position provides a logic “high signal”. In response to the logic high signal, the first control unit50recognizes that a configuration mode has now been started, i.e. that an input value can be input.

Then an operator (operating individual) at the DIP switches42to46inputs an input value in the form of a bit pattern by appropriately setting the DIP switches42to46. Let us assume that the bit pattern 01101, which corresponds to the decimal number 13, is set on the DIP switches42to46. This bit pattern corresponds to the address at which the configuration parameter “delay time 1 second” is stored in the storage device80.

The microcontroller50then reads out the bit pattern and transfers the input value which has been input, in the form of corresponding high and low signals, via its data interface, to the second control unit60. The second control unit60controls the LED display elements in such a manner that, e.g., the LED display elements71,73, and74light up, and the display elements72and75remain dark. It is also conceivable, e.g., that the display device70is a seven-segment display device, and that the second control unit60is designed to convert the received bit pattern into a control signal which causes the display device70to display the corresponding decimal number “13”.

In error-free operation, the operator recognizes by means of the LED display elements71to75that the bit pattern set on the DIP switches42to46has been correctly read in. The LED display elements71to75assume luminous states in accordance with the set bit pattern. Since the bit pattern which has been inputted corresponds to the optical information on the display device70, the operator switches the DIP switch41into a second switch position (a “confirming position”), so that a “low signal” is now generated by the input device40. The first control unit50interprets the “low signal” of the DIP switch41as a confirmation signal. Depending on the implementation, the first control unit50and/or the second control unit60can be configured to control access to the data content addressed by the inputted bit pattern, in response to the acknowledged confirmation signal. It is also conceivable that the first control unit50, when it recognizes the confirmation signal of the second control unit60, will allow access to the addressed data content and/or use of the data.

It should be noted that there is an erroneous processing of the input bit pattern when the bit pattern and the optical information displayed by the LED display elements71to75do not correspond. In this case, the configuration process should not be terminated, i.e. the second switch41should not be shifted to the second switch position. Thanks to the two-channel design of the electronic device10, possible faults in the input circuit, e.g. short circuits or interruptions in the input device40, or in the connection path between the input device40and the first control unit50, or a defective control unit50, or faults in the control circuit, such as short circuits or interruptions in the output device70, or faults in the connection path between the output device70and the second control unit60, or a defective control unit60, can be indirectly detected if the displayed values do not correspond to the input values.

In the presently supposed fault-free operation, both control units use the inputted bit pattern 10110 as an input value, which is associated with a delay time of 1 second, in order to read out and process the configuration parameter “delay time of 1 second”, if necessary.

Now let us assume that a fault has occurred in the safety-critical process and an operator has actuated the emergency shutoff switch30, i.e. the switches31and32have been opened. In response to the open switch31and the previously configured delay time stored in the storage device80, the first control unit50causes the external switches105of the switching relay100to be opened after 1 second. At the same time, the second control unit60, in response to the opened switch32and the configured delay time, causes the switches95of the switching relay90to be opened after 1 second. In this way, the motor110can be safely shut off within 1 second.

Thanks to the two-channel logic circuitry of the safe electronic device10, it can be reliably ascertained whether the two control units50and60have processed the same bit patterns.

FIG. 2illustrates an alternative safe electronic device10′ which differs from the safe electronic device10shown inFIG. 1only in the design of the output device70′ and the activation of the output device70′. The functioning of the two electronic devices10and10′ is substantially identical, so that only the differences of the electronic device10′ compared to the electronic device10will be described below.

According to an advantageous embodiment, the output device70′ is designed as a display device for outputting optical information. Preferably, the display device70′ has a plurality of multicolor display elements71′ to75′ which can be actuated to be luminous, each of which is associated with one of the switches42′ to46′ of an input device40′. The input device40′ advantageously has a configuration switch41′. Each multicolor display element71′ to75′ which can be actuated to be luminous contains two differently colored LEDs, for example a red LED and a green LED, which are disposed in a common housing. The DIP switch42[sic—i.e.42′] is associated with the display element71′, the DIP switch43′ is associated with the display element72′, the DIP switch44′ is associated with the display element73′, the DIP switch45′ is associated with the display element74′, and the DIP switch46[i.e.46′] is associated with the display element75′.

As seen inFIG. 2, a first control unit50′ and a second control unit60′ individually control each of the display elements71′ to75′ on the output side. In the present example, the first control unit50′ actuates the red LEDs of the display elements71′ to75′, while the second control unit60′ actuates the green LEDs of the display elements71′ to75′. In other respects, the design and mode of operation of the first control unit50′ and of the second control unit60′ correspond to the design and mode of operation of the first control unit50and the second control unit60, respectively.

Further, similarly to the electronic device10illustrated inFIG. 1, the electronic device10′ may have connections21′ to24′ for switching on an emergency shutoff switch means30′, which is represented symbolically by two switches31′ and32′. Connection terminals25′ serve, e.g., to switch on a power supply. Also, a storage device80′ which essentially fulfills the task of the storage device80can be provided. Similarly to the electronic device10illustrated inFIG. 1, the electronic device10′ can have two switching relays90′ and100′ which can be switched on via a switch92′ or102′. Switch contacts95′ and105′, which are connected in series and which are associated with the switching relays90′ and100′, are associated with the electrical load110′.

Now let us assume that a logical value “1” is set on the DIP switch46′ of the input device40′, as an input value, which is read in by the first control unit50′ and is transmitted to the control unit60′ via a data interface (represented symbolically as a black arrow). In error-free operation, both control units50′ and60′ actuate the two-colored display element75′, in response to the input values respectively received, with the first control unit50′ actuating the red LED and the second control unit60′ actuating the green LED, of the display element75′. Accordingly, the display element75′ displays a luminous orange, which signals proper transmission of the input value. If one has a multicolored display element which can be actuated to be luminous, this is distinguished in that, with two LEDs, depending on the mode of actuation, the two LEDs can be caused to display, e.g., three different colors, e.g. red, green, or orange.

A fault in one of the two control units50′,60′, or in one of the two LEDs of the display element75′, or faulty data transmission via the data interface, would lead to a red or green display in the display element75′, depending on the fault. A red or green display in the display element75′ would be recognized by the user as an improper display.

These measures lead to the result that a proper display can be generated only if both of the control units50′ and60′ have recognized the identical input value.

The features (“aspects”) of the invention will now be summarized.

A safe multichannel electronic device such as illustrated inFIG. 1orFIG. 2is proposed, which has an input device for inputting of input values. The electronic device further has a first control unit, which is connected on its input side to the input device. Further, a second control unit is provided, which is connected on its input side to the first control unit and on its output side to an output device. The first control unit is designed to read in an input value which is input, and to transmit the input value to the second control unit. The second control unit is designed, in response to the received input value, to actuate the output device such that the output device outputs optical and/or acoustic information, which in error-free operation corresponds to the input value which has been input. Further, the electronic device has a memory device in which a plurality of predetermined data items are stored, each of which is associated with a respective input value. The input values advantageously may be selected from a plurality of predetermined admissible input values. The input device is further designed to generate a confirmation signal which signals that the input value which has been input corresponds to the information which is] outputted from the output device. For this purpose, a confirmation signal can be input, e.g. via a switch, into (or at) the input device. The first control unit and/or the second control unit are/is designed to release the predetermined data content, which is associated with the input value which has been input, for further use, in response to an actuating signal from the input device.

The predetermined data items stored in the memory device may contain (may comprise) parameter values, preferably operating and/or configuration parameters, and/or programs for controlling the electronic device, or other functionalities. Some of the configuration parameters may comprise different delay times.

According to an advantageous embodiment of the input device, a plurality of first, manually actuatable switches, in particular DIP switches, is provided. In this case, the input of an input value is effected by setting a corresponding binary code or bit pattern on the DIP switches.

The input device may be comprised of a second manually operable switch. In this case, the control unit can be designed to read the input value entered in [(via)] a first position of the second switch.

Accordingly, the first position of the second switch can be interpreted as a configuration mode. The first control unit can additionally or alternatively be designed to interpret the second position of the second switch as a confirmation signal.

Numerous other variants are conceivable, for generating a confirmation signal or for initiating or terminating the configuration mode.

Alternatively, or optionally, the input device may have at least one potentiometer. In this, the input value which is input corresponds to a predetermined analog input value. An A/D converter is provided which is designed to convert an analog input signal into a binary signal.

In order to be able to output optical information, the output device is in the form of a display device. Preferably, the display device comprises a plurality of monochrome LED display elements which can be actuated to be luminous, and each one of such elements is associated with one of the switches.

Alternatively, the display device may also have a plurality of multicolored display elements which can be actuated to be luminous, each of which display elements is associated with one of the switches, the first control unit and the second control unit being connected to each multicolored luminous display element, and being designed to control the multicolored luminous display elements in response to the received input value. Preferably, each multicolored luminous display element has two differently colored LEDs which are accommodated in a common housing of the respective display element.

The safe electronic device may be in the form of a safe switching device for safe switching off of an electrical consuming device (electrical load). In order to enable time-dependent shutting off of the electrical load, at least some of the data items stored in the storage device may represent various delay times.

Preferably, the first control unit and the second control unit are designed to cause the electrical load to shut off after the delay time has elapsed, in response to a trigger signal, which can come, e.g., from an emergency shutoff switch, and in response to the value of said delay time which value may be input into the input device.

In order to bring about, e.g., a fault-free configuration of the safe electronic device, a configuration mode is first initiated in the safe electronic device, in which an association table is stored, in which a plurality of defined data items, each of which is associated with one of the predetermined input values, are stored. An input value is now input to the safe electronic device, an inputted value. Under the control of a first control unit, the inputted value is read in and is transmitted to a second control unit. In response to the inputted value, optical and/or acoustic information is output, under the control of the second control unit.

On the safe electronic device it is now confirmed whether the inputted value corresponds to the output optical and/or acoustic information. If it does, the data item which is associated with said input value is released for further use.

It is also conceivable that the input values are selected from a plurality of admissible input values, wherewith first control unit may be designed to detect whether and inputted value is in fact an admissible input value. If it is not an admissible input value, the first control unit can request (command) the second control unit to output a corresponding fault report via the output device.

The safe electronic device has the advantage that it requires only a single-channel input device, which leads to savings in space and costs. Further, it enables fault-free retrieval of a large number of different data items which are stored in the storage device, by simple means, for operation of the electronic device.

Although the invention has been described with reference to exemplary embodiments, it is not limited thereto. Those skilled in the art will appreciate that numerous changes and modifications may be made to the preferred embodiments of the invention and that such changes and modifications may be made without departing from the true spirit of the invention. It is therefore intended that the appended claims be construed to cover all such equivalent variations as fall within the true spirit and scope of the invention.

The exemplary embodiments of this present invention have been described in relation to a railing system. However, to avoid unnecessarily obscuring the present invention, the preceding description omits a number of known structures and devices. This omission is not to be construed as a limitation of the scope of the present invention. Specific details are set forth by use of the embodiments to provide an understanding of the present invention. It should however be appreciated that the present invention may be practiced in a variety of ways beyond the specific embodiments set forth herein.

A number of variations and modifications of the present invention can be used. It would be possible to provide for some features of the present invention without providing others.

The foregoing discussion of the present invention has been presented for purposes of illustration and description. It is not intended to limit the present invention to the form or forms disclosed herein. In the foregoing Detailed Description, for example, various features of the present invention are grouped together in one or more embodiments, configurations, or aspects for the purpose of streamlining the disclosure. The features of the embodiments, configurations, or aspects may be combined in alternate embodiments, configurations, or aspects other than those discussed above. This method of disclosure is not to be interpreted as reflecting an intention the present invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment, configuration, or aspect. Thus, the following claims are hereby incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of the present invention.

LIST OF REFERENCE NUMERALS

10,10′ Safe switching device [(or more generally, safe electronic device)].21-24Connections for actuating an emergency shutoff switch.21′-24′ Connections for actuating an emergency shutoff switch.25,25′ Connecting terminals for switching on a power supply.30,30′ Emergency shutoff switch.31,32Switches which are components of the emergency shutoff switch.31′,32′ Switches which are components of the emergency shutoff switch.40,40′ Input device.41,41′ Configuration switch.42-46DIP switches.42′-46′ DIP switches.50,50′ First control unit.60,60′ Second control unit.70,70′ Output device.71-75Monochrome display elements which can be actuated to be luminous.71′-75′ Multicolored display elements which can be actuated to be luminous.80,80′ Storage device.90,90′ Switching relay.95,95′ Switch contacts.100,100′ Switching relay.92,102Switch for switching on the relay.92′,102′ Switch for switching on the relay.105,105′ Switch contacts.110,110′ Electrical load (electrical consuming device).

TRANSLATION OF LEGEND IN THE FIGURES