A POSITIVE SAFETY CONTROL SYSTEM

Abstract: The positive safety control system includes two parallel channels each of which includes a power output SP connected to a control unit (1) associated with a logic unit (5) of a logic circuit (2) which is electrically insulated in the control unit with the logic circuits (2) being connected to a common clock (4) and including downstream of the logic unit (5) a conversion unit (9) connected to the clock (4) so as to convert into a pulsed signal a logic signal for activating the corresponding power output and a filtration and rectification unit (10) disposed between the conversion unit (9) and the corresponding control unit (1).

Description: A POSITIVE SAFETY CONTROL SYSTEM The present invention relates to a positive safety control system- It is known that in safety control systems it is necessary to be able to detect in a reliable manner any component failure and this must result in the immediate halting of the dangerous machine controlled. In order to ensure a positive safety operation generally speaking in the absence of a control or in the event of a control failure provision is made for the supply circuit of the dangerous machine to be automatically opened. In addition to prevent a failure of the control resulting in the closing of the supply circuit of the dangerous machine generally speaking provision is made for closing the supply circuit of the dangerous machine with two power outputs associated with two parallel channels of the control system. Each power output is connected to a control unit associated with a logic unit of an electrically insulated logic circuit of the control unit and the status of the control unit of each channel is transmitted to the logic unit of the other channel to effect the opening of the two control units in the event of a difference in their respective status. As a complementary measure provision is also made to carry out periodically a fine pulse test which consists of simulating very briefly a command for opening the supply circuit and for making sure that the power outputs have been suitably deactivated in response to this command with the duration of these commands being sufficiently brief so that the opening units of the supply circuit of the dangerous machine have no time to react. A problem with the existing control systems is due to the fact that far synchronisation reasons the logic units of the two channels are connected to a common clock. The logic units are themselves synchronous and the change in their status depends therefore directly on the operation of the clock. If the clock becomes defective the outputs thus continue to have the status which they had at the time when the clock was lost in such a way that the opening of the supply circuit of the dangerous machine can no longer be effected. A control system of the above-mentioned type is being proposed according to the invention in which downstream from the logic unit each logic circuit includes a conversion unit connected to the clock for converting a logic signal for activating the corresponding power output into a pulsed signal and a filtration and rectification unit is disposed between the conversion unit and the corresponding control unit. Consequently in the event of the failure of the clock the conversion unit no longer transmits a pulsed signal but a continuous signal which is stopped by the filtration unit. As the control of the power output can no longer be closed the user of the dangerous machine is therefore immediately given a warning of the failure of the clock- On the other hand if the clock functions satisfactorily the pulsed signal crosses the barrier of the filter and is then rectified and closes the corresponding control unit in the normal way so as to activate the power output. Moreover the logic units are generally supplied at a voltage less than the power outputs. Consequently a d.c. converter which is common to the two channels is generally fitted in parallel on the supply line of the power outputs. In the event of the failure of the converter there is a danger of an excess voltage of the logic units. An excess voltage of this type can cause a short circuit in certain components and generate signals which are the equivalent of the logic signals for activating the power outputs at the output of the logic units. There is no longer any assurance as to the safety of the opening of the supply circuits of the dangerous machine. According to an advantageous version of the invention the filtration and rectification unit operates in accordance with a voltage which is inverse to that of the supply voltage. Thus even if following a short circuit of different components of the logic circuit the supply voltage reaches the filtration and rectification units it cannot have any effect on the control units of the power outputs in such a way that the latter will be deactivated. Once again the user will be warned immediately of the failure of the control device. Other characteristics and advantages of the invention will be revealed as a result of reading the description which follows of a non-restrictive preferred embodiment of the invention with reference to the attached figures where: Figure 1 is a block diagram of the positive safety control system according to the invention; Figure 2 is a detailed diagrammatic representation of the filtration and rectificatio unit and Figure 3 is a schematic illustration of the signals at different points of the logic circuit. With reference to the figures the system according to the invention includes in a manner known in itself two parallel channels each one of which includes a power output SP connected to a control unit 1 which itself is connected to a source of d.c. voltage, for example a voltage source of 24 volts and associated with a logic circuit 2. The logic circuits 2 are supplied by a converter 3 which is common to the two channels and which supplies a voltage which is less than the supply voltage of the power outputs for example a voltage of + 5 volts and their operation is effected under the control of a clock 4 which is also common to the two channels . Each logic circuit includes in a manner which is also known in itself a logic unit 5 connected to logic sensors 6, for example detectors of a presence in the vicinity of a dangerous part of the controlled machine and at an input of a logic cell 7 having a second input connected to a test generator by fine pulse 8. Again in a manner known in itself each logic unit 5 is connected to the output of the control unit of the opposite channel. According to the invention the logic circuit of each channel also includes a conversion unit 9 disposed between the output of the logic unit 5 and the input of the corresponding logic cell 7 and a filtration and rectification unit 10 disposed between the logic cell 7 and the corresponding control unit 1 of a power output. The logic units provide in a conventional manner for a processing of the signals coming from the logic sensors and the output of the control unit of the opposite channel to supply a logic signal such as that shown at A in Fig. 3 so that the high level of the logic signal corresponds to an activation control of the power output whilst the low level corresponds to a deactlvation of the power output. The conversion units 9 are conventional units by means of which a continuous signal is converted into a pulsed signal as shown at B in Fig. 3. The structure of the conversion units 9 is known in itself and is therefore not illustrated in a detailed manner in the figures. The fine pulse generators 8 which are also of a structure known in itself give a periodical slot signal as illustrated at C in Fig. 3. The logic cells 7 provide a combination of the signals given by the conversion units 9 and the test generators by fine pulse according to a signal illustrated at D in Fig. 3. The detailed structure of a preferred embodiment of the filtration and rectification unit 10 is illustrated in Fig. 2. The filtration and rectification unit includes a supply input 11 and a logic input 12 connected to an amplifier stage 13 formed by two push-pull transistors. A capacitor 14 is connected to the output of the amplifier stage and effects a filtration of the continuous signals with only the pulsed signals being transmitted by the capacitor 14. In this connection it should be noted that it is of little importance that the continuous portions of the signal subjected to the filtration and rectification unit be of a high or low level. The pulsed signal transmitted beyond the capacitor 14 is a floating signal which is made negative by imposing a low positive limit for example 0.4 volts by means of a Schottky diode 15 connected to the capacitor 14 on the one hand and to earth on the other hand. The pulsed pulses for example at 500 kHz oscillate therefore between a voltage of -3.6 volts and + 0.4 volts which is therefore substantially reciprocal to the voltage supplied by the converter 3. The pulsed negative voltage which is obtained in this way is rectified by a capacitor 16 associated with a diode 17 connected in opposition to the diode 15 so as to prevent a direct discharge of the capacitor 16 in the amplifier stage 13. In this way a negative d.c. voltage is obtained in resistance 18 which is supplied to a coupling unit 19 with the control unit 1 of the power output which here consists of an optocoupler of which only the light-emitting diode is shown here. It should be noted that in the event of the failure of the clock 4 the signal coming from the logic unit 5 will not be converted into a pulsed signal and will therefore be stopped by the capacitor 14 in such a way that the optocoupler will not be activated and the switch associated with the corresponding power output will be opened. In addition in cases where following on a short circuit the output voltage of the converter 3 is brought to the optocoupler 19 this voltage would be a positive voltage which could not activate the optocoupler 19 so that the switch associated with the corresponding power output would also be kept open. Any component failure in the filtration and rectification unit including the short-circuiting of the capacitor 14 would thus involve the opening of the switch associated with the corresponding power output. The invention is of course not restricted to the embodiment described and variants to the embodiment can be introduced without departing from the framework of the invention. In particular although the feature of the invention according to which the filtration and rectification unit operates according to a voltage which is the reverse of the supply is described in conjunction with a system including a converter, this feature would also apply to a system in which the logic unit would operate at the same voltage level as the power outputs.

Claims: CLAIMS 1. Positive safety control system including two parallel channels each one including a power output (SP) and a control unit (1) associated with a logic unit (5) of an electrically insulated logic circuit (2) in the control unit with the logic circuits (2) being connected to a common clock (4), characterized in that downstream of the logic unit (5) each logic circuit includes a conversion unit (9) connected to the clock (4) so as to convert a logic activation signal of the corresponding power output into a pulsed signal and in that a filtration and rectification unit (10) is disposed between the conversion unit (9) and the corresponding control unit. 2. Control unit according to claim 1 characterized in that the filtration and rectification units (10) operate according to an inverse voltage of a supply voltage.

Inventors: PHILIPPOTEAU HELENE, PHILIPPOTEAU, HELENE
Applicants: FOX MALE NICHOLAS VINCENT HUMB, HONEYWELL SA, PHILIPPOTEAU HELENE, FOX-MALE, NICHOLAS, VINCENT, HUMBERT, HONEYWELL S.A., PHILIPPOTEAU, HELENE
Application year: 1999
Main classification: G05B19
IPC codes: G05B19