REDUNDANT SAFETY SWITCHING DEVICE FOR SWITCHING A LOAD

Abstract: Safety switching device for switching a load, comprising two switches connected in series. These switches are connected in series with the load in order to connect the latter to an excitation source or disconnect it therefrom. A control device is present, which is provided with two reciprocally decoupled control outputs for the transmission of control signals to the control inputs of the switches. The reciprocal connection point of the switches is connected to one of the terminals of the excitation source via a resistor which bypasses one of the switches. The control device comprises a sequence device, which, on activation, first switches the first control signal to the first control output, which controls the switch not bypassed by the resistor, and, a predefined period thereafter, feeds the second control signal to the second control output. A fault detector is connected via the resistor.

Description: Redundant safety switching device for switching a load The invention relates to a safety switching device for switching a load, comprising two switches connected in series which, in series with the load, connect the latter to an excitation source or disconnect it therefrom, and a control device, which is provided with two reciprocally decoupled control outputs for the transmission of control signals to the control inputs of the switches. A switching device of this type is known from German patent application laid open for inspection DE 3.517.030 Al. The known safety switching device is provided with a series connection of two switches in the form of transistors and with a control circuit which has two equivalent, reciprocally decoupled, outputs. These two decoupled outputs are connected via resistors to the base of both transistors. The bases of both transistors are thereby decoupled in such a way that the switching voltage reaches both bases, but, in the event of an impermissible defect, such as a bypassing of the electrodes of one transistor, the other transistor nevertheless does not become conductive. This prevents the entire switch from becoming conductive in the event of a short circuit of the electrodes of one transistor. Furthermore, the load, irrespective of a short-circuit of one of the transistors, may still be connected or disconnected and, in the absence of a switching voltage, the switch remains in the deactivated condition. The object of the invention is to provide a safety switching device of the aforementioned type, the control device of the switches being fail-safe during deactivation. It must be possible to disconnect the load despite defects such as faults in the control device components. Moreover, a reactivation facility must, if possible, be provided in the event of such faults. Furthermore, in the event of a fault in the control device, the latter must be switched to a safe condition, wherein the load is disconnected. In order to achieve these objectives, it must preferably be possible to signal faults in the control device promptly and reliably. The aforementioned objects are achieved according to the invention in that the reciprocal connection point of the switches is connected to one of the terminals of the excitation source via a resistor which bypasses one of the switches, in that the control device comprises a sequence device, which, on activation, first switches the first control signal to the first control output, which controls the switch not bypassed by the resistor, and, a predefined period thereafter, feeds the second control signal to the second control output, and in that a fault detector is connected via the resistor. The selected sequence of the control signals for the switches, in the event of activation when the switches are functioning correctly, produces a short pulse which corresponds to the switching time between the control signals. This pulse can then be used by an alarm circuit as the criterion for the correct functioning of the switches. It is clear that, if the switches are not functioning correctly, no pulse of the aforementioned duration will be generated. On disconnection of the load by the sequence device, first the second control signal and, a predefined period thereafter, the first control signal of the corresponding control outputs of the control device are preferably deactivated. In the case of this deactivation also, a corresponding pulse is then produced, provided that the switches are functioning correctly. The switches are thereby tested both on activation and deactivation. Preferred and complete embodiments are described in the further subclaims. The invention will be explained in detail below with reference to the drawings in which: Fig. 1 shows a circuit diagram of the safety device according to the invention; Fig. 2 illustrates diagrams of the voltage on the reciprocal connection point of the switches shown in Figure 1 under diverse circumstances; and Fig. 3 shows a preferred embodiment of the invention. Fig. 1 shows a safety switching device comprising the series connection of switches Ti and T 2 , said switches being controlled by the control signals U sl andU s2 respectively. The control of the switches is indicated schematically by a dotted line. The control device which generates these control signals U s ι and U s2 respectively is not shown. The series connection of the switches T \ and T is connected in series with the load B in order to connect the latter to the excitation source Uh or disconnect it therefrom, under the control of the control signals U s ι andU s2 . The criterion for fault detection is derived from the reciprocal connection point ki of the switches Tj and T 2 . This connection point ki is connected via the resistor Ri to one terminal of the excitation source, in the embodiment shown in Figure 1, to the bottom terminal of the excitation source. The switch T 2 is thus bypassed by the resistor Ri. It is clearly also possible to connect this resistor Ri to the top terminal of the excitation source U b or to the connection point between the load B and the switch T \ . However, in this option, under diverse circumstances of the safety device, voltage levels arise on the reciprocal connection point of the switches Tj and T 2 which are the inverse of the levels which occur in the embodiment shown in Fig. 1. It is noted that the switches T \ and T 2 can be formed by relay contacts, transistors, field effect transistors or other controllable semiconductor switches. This safety device may, for example, be used for the safe switching of electric motors as the load. A voltage U Ch , which is fed to a fault detector, is produced over the resistor Fig. 2 shows the voltage forms of the reciprocal connection point ki of the switches T \ and T 2 . Line a shows the time diagram of the level of the connection point ki when the switches Ti and T 2 are functioning correctly. A control device not shown in Fig. 1 comprises a sequence device for feeding the control signals to the switches Ti and T 2 in accordance with a defined sequence. Before activation, the control signal U s ι is first fed to the switch Tj, which is not bypassed by the resistor Rj. The activation of this control signal U sl takes place at time . The second control signal U s2 is then fed to the switch T 2 at time t 2 . On the reciprocal connection point ki of the switches and T 2 , a pulse then occurs, the duration of which corresponds to the time period between the feed times of the control signals U s ι andU S2 - The occurrence of this pulse is an indication of the correct functioning of the switches Ti and T 2 . If the switches T 1 and T 2 are not functioning correctly, a pulse of this type with the aforementioned pulse duration will not occur. (See lines d-i in Figure 2). When the load B is disconnected, first the second control signal U s2 and, a predefined period thereafter, the first signal U sl are deactivated by the control outputs of the control device (not shown) and are therefore not fed at these times to the switches Ti and T 2 . This particular sequence again produces a pulse with a predefined duration which corresponds to the time between the deactivation times of the control signals U sl andU s2 . Line b in Figure 2 applies to a correctly functioning switch Ti and a defective, short-circuited switch T 2 . The level of the connection point k \ of the switches Tj and T remains low, irrespective of whether the control signals U s ι andU s2 are or are not supplied. When the switch Ti is functioning correctly, even though switch T 2 is defective and remains interrupted, the voltage pattern on line c in Figure 2 occurs on activation and deactivation of the control signals U sl and U S 2. The lines d, e and fin Figure 2 apply to a defective, short-circuited switch Tj and respectively a correctly functioning, short-circuited and interrupted switch T 2 . The lines g, h, and i in Figure 2 apply to a defective, interrupted switch Ti with diverse options of the switch T 2 . The voltage patterns in Figure 2 therefore show that, on activation and deactivation of the control signals U s ι andU s2 , only the pulses of a predefined duration shown on line a in Figure 2 occur when the switches Tj and T 2 are functioning correctly. Figure 3 shows a preferred embodiment of the safety switching device according to the invention, which is suitable for switching and controlling motors of, for example, pumps in a petrochemical factory. Operational security and safety often play a crucial role here. A microprocessor or microcontroller 1 is used in this embodiment. This imparts the safety device with a very high degree of flexibility, although, given the increased complexity, special measures must be taken to guarantee the safety of the user. Two types of fault are anticipated: - semiconductor faults in the control output stages. Generally, a semiconductor will short-circuit if it becomes defective. - a fault in the control processor. This entails a fault in the control software or a hardware fault. The microprocessor or microcontroller 1 generates a first control signal ac in the form of a pulse train and a control signal dc with a predefined fixed level, which are used respectively to control the switches designed as transistors Ti and T 2 . The pulse train ac is fed to the control input of the retriggerable monostable multivibrator 2, the output of which is fed via the resistors R 2 and R 3 to the base emitter circuit of the transistor The second control signal dc is fed via the resistors R» and R 5 to the base emitter circuit of the transistor T 2 . The reciprocal connection point ki of the transistors T \ and T 2 is connected via the resistor Rj to earth. The transistors Ti and T 2 connect and disconnect the load B. This load can be formed by a relay, possibly with upstream connection of a thermal cut-out. These options can be implemented by any normal person skilled in the art. The voltage over the connection point ki is fed via a voltage interface, comprising the resistor R 6 and the Zener diode Di and the diode D 2 to the microprocessor 1. The signal chk is an indication of the correct or incorrect functioning of the transistors Ti and T 2 . The signal chk also serves to verify whether the feed source or excitation source of the load is present. If first the signal ac and thereafter the signal dc are activated and, on disconnection of the load B, first the signal dc and thereafter the signal ac are deactivated, depending on the correct or incorrect functioning of the transistors and associated control circuits, voltage levels occur which correspond to the voltage patterns shown in Figure 2. If the pulse train ac appears, the output of the retriggerable monostable multivibrator will go high and the transistor T \ will be through-connected if the latter is functioning correctly. When, after a predefined period, the control signal dc is activated, the transistor T 2 is through-connected. Between the switching times of the control signals ac and dc respectively, a pulse occurs on the connection point kj if the transistors Tj and T 2 are functioning correctly. After this pulse, the load B is connected to the excitation source U b - The signal chk indicates the status of the connection point ki between the two transistors T \ and T 2 . A fault detection function is implemented in the microprocessor 1. By means of this function, it is possible to establish whether the signal chk is a pulse of a predefined duration, so that a fault message can be transmitted to the retriggerable monostable multivibrator 2 if the signal chk is not a pulse of a predefined duration, which is an indication of a defectively operating transistor Ti or T 2 . The retriggerable monostable multivibrator 2 is then reset and, if the transistor Ti is functioning correctly, the latter will switch to the non-conductive condition, so that the load B is disconnected, even though the transistor T would form a short circuit due to a defect. The described reset circuit for the retriggerable monostable multivibrator 2 is not shown, but can be envisaged by any person skilled in the art. The retriggerable monostable multivibrator 2 and the pulse train ac are used as an additional verification of the correct functioning of the generation of the control signal by the transistor Tj. If the load B needs to be disconnected, first the control signal dc and only thereafter the control signal ac are deactivated. In the event of this deactivation, a pulse of a predefined duration, which corresponds to the time period between the deactivation times of the control signals ac and dc, is produced, if the transistors Ti and T are functioning correctly, on the connection point k ! of the transistors T \ and T 2 . The signal chk indicates the status of the connection point ki between the two transistors Ti and T 2 and is read in by the microprocessor. The fault detector implemented in the microprocessor tests the signal chk for the predefined duration and transmits a fault message if the defined conditions are not satisfied. In the embodiment shown in Figure 3, the microprocessor 1 is provided with a monitoring circuit, referred to as a "watchdog" circuit 3. Provided that the microprocessor is functioning correctly, the signal kick is generated. This is a pulse train with intervals such that the watchdog circuit 3 does not respond. If the signal kick is absent, the watchdog circuit activates the reset output reset, as a result of which the retriggerable monostable multivibrator 2 is also reset. The load is therefore also disconnected herewith. Finally, it is noted that the switching of the retriggerable monostable multivibrator with the associated pulse-shaped control signal and the reset signal can also be used if the aforementioned sequence of feeding and deactivation of the control signals is not used for the switches and T 2 . In this case, the microprocessor is tested for correct functioning.

Claims: Claims 1. Safety switching device for switching a load, comprising two switches connected in series which, in series with the load, connect the latter to an excitation source or disconnect it therefrom, and a control device, which is provided with two reciprocally decoupled control outputs for the transmission of control signals to the control inputs of the switches, characterized in that the reciprocal connection point of the switches is connected to one of the terminals of the excitation source via a resistor which bypasses one of the switches, in that the control device comprises a sequence device, which, on activation, first switches the first control signal to the first control output, which controls the switch not bypassed by the resistor, and, a predefined period thereafter, feeds the second control signal to the second control output, and in that a fault detector is connected via the resistor. 2. Safety switching device according to Claim 1, characterized in that, in the event of deactivation, the sequence device first deactivates the second control signal and, a predefined period thereafter, the first control signal of the corresponding control outputs. 3. Safety switching device according to Claim 1 or 2, characterized in that one of the control signals is a pulse train and the other control signal is a direct-current signal. 4. Safety switching device according to Claim 3, characterized in that the pulse train is fed via a retriggerable monostable multivibrator to the associated control input of the switch. 5. Safety switching device according to Claim 4, characterized in that a fault alarm signal transmitted by the fault detector is fed as a reset signal to the monostable multivibrator. 6. Safety switching device according to one of Claims 1-5, characterized in that a microprocessor or microcontroller is present, which performs at least one of the functions of the generation of the control signals and of the fault detector and which transmits a fault alarm signal if a fault occurs in one of the two switches. 7. Safety switching device according to Claim 6, characterized in that a monitoring circuit is provided, which is connected to an output of the microprocessor or microcontroller, on which a correct signal occurs if the microprocessor or microcontroller is functioning correctly, and in that the monitoring circuit output is connected to the reset input of the monostable multivibrator in order to reset the latter if the microprocessor or microcontroller is functioning incorrectly. 8. Safety switching device according to Claim 7, characterized in that, if a fault occurs in one of the two switches, the correct signal is not produced.

Inventors: LIMON EDWARD STANLEY, SCHASFOORT PETRUS JOHANNES PLE, LIMON, EDWARD, STANLEY, SCHASFOORT, PETRUS, JOHANNES, PLECHELMUS
Applicants: HOLEC HOLLAND NV, LIMON EDWARD STANLEY, SCHASFOORT PETRUS JOHANNES PLE, HOLEC HOLLAND N.V., LIMON, EDWARD, STANLEY, SCHASFOORT, PETRUS, JOHANNES, PLECHELMUS
Application year: 1999
Main classification: G05B19
IPC codes: G05B19