Method for operating a safety sensor

Abstract

Method for operating a safety sensor (1) having a switching output (A1) and a diagnostic output (A2) which are switched via two series-connected transistors (T1, T2), wherein the switching output (A1) outputs a switching enable signal (SFS) and the diagnostic output (A2) outputs a diagnostic enable signal (DFS) when the safety sensor (1) is functioning properly and a switching enable signal (SFS) is present at the switching output (A1), wherein the diagnostic output (A2) is controlled with a delay compared to the switching output (A1) by the safety sensor (1), and during a delay time (ΔT), cross-circuit detection takes place by reading the voltage signal at the diagnostic output (A2) back into the safety sensor (1), and when a cross-circuit is detected in the safety sensor (1), the control of the transistor (T2) is interrupted and thus no diagnostic enable signal (DFS) is present at the diagnostic output (A2), which signals a controller (PLC),that a facility must be brought into a safe condition.,

Description

[0001] The invention relates to a method for operating a safety sensor according to claim 1 and a safety sensor according to claim 4.

[0002] In many industrial sectors, systems or system components must be monitored for safety reasons, particularly to prevent any danger to people and machinery. Special safety sensors are used to detect safety-critical conditions in systems. These sensors meet the relevant safety standards, such as the European safety standard EN61508 or EN61496.

[0003] Safety sensors are typically connected to higher-level evaluation units or control systems (PLCs). The system or system component can only be operated or put into operation if the corresponding safety sensor issues a so-called enable signal.

[0004] Inductive safety sensors, in particular, are used for monitoring the end positions of moving machine parts. Various safety sensors (inductive, optical, etc.) are manufactured and distributed by the applicant.

[0005] Safety-related sensors are essential in many industrial applications to protect equipment and personnel. The state of the art includes various fault detection methods to ensure the reliability of these sensors. For example, DE 100 33 073 A1 describes a method in which test outputs are switched with a defined time delay to detect faults in the sensor connections. This method analyzes signal waveforms and time intervals to identify various types of faults. However, it requires complex signal waveform analysis and can result in additional components and increased system complexity.

[0006] Safety switches are often operated as 4-wire devices, with two connecting lines serving as power supply and two separate output lines for signaling. Especially when a valid signal is present (e.g., when the inductive sensor is damped in the release zone) and the safety switch is functioning properly, corresponding release signals are present at both outputs, which are forwarded to the control system via the two connecting lines. The release signals are current signals. They correspond to a logical "1."

[0007] In a preferred embodiment, the first output essentially outputs the switching signal of the inductive sensor. The second output outputs the diagnostic signal generated by a diagnostic unit.

[0008] If the sensor is not in the release state (e.g. in the undamped state with an inductive sensor), both outputs remain in the switched-off, de-energized state (logical “0”).

[0009] The safe state is the unswitched state of at least one of the outputs. If one of the safety sensor's outputs is switched off, the downstream safety-related control unit (PLC) must bring the entire system into the state defined as safe.

[0010] Cross-circuits between the two outputs or one of the outputs and the power supply can lead to incorrect signaling of the status of the safety sensor and the control unit may not switch the systems to the safe state.

[0011] The state of the art for cross-circuit detection is to briefly trigger the outputs with periodic shutdown pulses when a diagnostic enable signal is present, and to read the voltage at the diagnostic output back into a diagnostic unit to deactivate the still valid output if necessary. Controllers generally only react if the signal level at their inputs is present for longer than 1-5 milliseconds. Brief level changes are ignored by the controllers.

[0012] To ensure a fast response time in the event of a cross-circuit, the repetition rate of the shutdown pulses must be correspondingly high (approximately 80 milliseconds). Since some controllers also use such methods for cross-circuit detection using short shutdown pulses, a random "collision" of shutdown pulses can occur, which may result in an unintentional system shutdown.

[0013] Periodic shutdown pulses are also disruptive for other reasons (EMC, etc.).

[0014] The object of the invention is therefore to provide a method for cross-circuit detection in safety sensors which allows simple cross-circuit detection, ensuring a fast reaction time and avoiding unintentional plant downtimes, in particular due to collisions of shutdown pulses.

[0015] This object is achieved by a method having the features specified in claim 1 and by a safety sensor according to claim 4. Advantageous further developments of the inventions are specified in the subclaims.

[0016] The essential idea of ​​the invention is to control the diagnostic output and the signal output with the diagnostic enable signal in a safety sensor for cross-circuit detection with a time delay and to evaluate the voltage at the diagnostic output during this time interval in order to detect any cross-circuits that may be present.

[0017] Therefore, no periodic shutdown pulses are necessary and the reaction time is minimal, since a test for cross-circuits is carried out immediately before the diagnostic output is set to state 1 (diagnostic enable signal).

[0018] Advantageously, the delay time is approximately 300 microseconds or less.

[0019] Likewise, the switch-off delay can be inversely delayed to detect other cross-circuits

[0020] The invention is explained in more detail below using an embodiment shown in the drawing.

[0021] They show: Fig. 1 inductive safety sensor in schematic representation, Fig. 1a optical safety sensor in schematic representation Fig. 2 Block diagram of an inductive safety sensor according to the state of the art, Fig. 3 Signal curve for the switching output and the diagnostic output of an inductive safety switch according to the state of the art, Fig. 4 temporal signal curves for the switching output and the diagnostic output of an inductive safety switch according to the invention

[0022] Fig. Figure 1 shows an inductive safety sensor 1 connected to a controller, e.g., a PLC. A release zone F is schematically shown in front of the safety sensor 1. The switching state of the safety sensor 1 depends on a metallic damping element 5. If the damping element 5 is located in the release zone F, a release signal is output. Based on the release signal, the controller controls, for example, the motor of a press. Furthermore, there is a close-range zone 2 and the assured switch-off distance 4.

[0023] Fig. Figure 1a shows an optical safety sensor AOPD (Active Optoelectronic Protection Device) using the example of an active optoelectronic protective device AOPDDR (Active Opto-electronic Protective Device responsive to Diffuse Reflection) 1a, which is connected to a programmable logic controller (PLC).

[0024] The protective field is designated 3a. A first tolerance zone 2a is located in front of it, and a second tolerance zone 4a is located behind it. In this case, the test specimen 5a is located outside the protective zone, between the second tolerance zone 4a and the background 6a, which has an unfavorable reflection factor.

[0025] The protective field begins behind the first tolerance zone 2a and ends at the tolerance zone 4a, beyond which reliable detection is no longer guaranteed. The background 6a is located at a safe switch-off distance, i.e., it is positioned at a corresponding distance and has such an unfavorable reflection factor that it cannot be detected by the optical safety sensor 1a under any circumstances.

[0026] If a target 5a, an object with a sufficient reflection factor, enters the protective field 3a, a signal is sent to the PLC. Optical safety sensors typically stop a machine function. However, it is also possible, analogous to the inductive safety sensor discussed above, to issue an enable signal, for example, because a door or flap is closed. In this case, the protective field 3a becomes the enable zone.

[0027] Although the Fig. 2 refers to an inductive safety sensor, the following description is also applicable to optical safety sensors. Fig. 2 shows a block diagram of an inductive safety sensor designed as a 4-wire device according to Fig. 1.

[0028] Safety sensor 1 is supplied with voltage via two supply lines L+ and L-. Safety sensor 1 consists of an inductive sensor 10, a diagnostic unit 20, and a power supply unit 40 with interference suppression elements.

[0029] Two safe switching outputs, a switching output A1 and a diagnostic output A2, are used to signal the status of safety sensor 1. These outputs are switched via two transistors T1 and T2, respectively. Transistor T1 is connected to sensor 10. The switching signal SS (of sensor 10) is present at output A1. Transistor T2 is connected to diagnostic unit 20, whose output A2 carries the diagnostic signal DS. Transistors T1 and T2 actually symbolize switching output stages, also referred to as OSSD1 and OSSD2 (output signal switching device).

[0030] According to the invention, both transistors T1 and T2 are connected in series and each connected to the supply line L+ or via a resistor R to the supply line L-.

[0031] The output A2 is connected to the internal diagnostic unit 20 via a readback line RL.

[0032] The function of a cross-circuit detection according to the state of the art is described below using the Fig. 2 and Fig. 3 explained.

[0033] If a damping element 5 approaches the release zone, the sensor unit 10 controls the transistor T1 when the damping element 5 reaches the release zone F.

[0034] The switching output of sensor 10 switches, and output A1 is at positive potential "1" (switching enable signal). This state remains as long as the damping element is in the release zone F.

[0035] If the diagnostic unit 20 does not detect a sensor error, it activates the transistor T2 and the output A2 is also at positive potential, “1” (diagnostic enable signal)

[0036] To detect cross-circuits, diagnostic unit 20 briefly interrupts the control of transistor T2 via corresponding periodic shutdown pulses AI while the switching enable signal is present. This briefly sets output A2 to negative potential "0." However, this only occurs if there is no cross-circuit from A2 to A1 or A2 to L+. The voltage at output A2 in diagnostic unit 20 is checked via the readback line RL.

[0037] If a cross-circuit occurs, the voltage at output A2 deviates from the expected voltage level, which is registered in diagnostic unit 20. In this case, the control of transistor T2 is interrupted, and the diagnostic enable signal is no longer present at output A2. This causes the control system to enter the safe state.

[0038] The reaction time until a cross-circuit is detected is given by the interval T. As the Fig. As shown in Figure 3, several switch-off pulses AI are generated within an interval in which the safety sensor issues a switching release signal.

[0039] According to the invention, the diagnostic enable signal DFS is output with a delay time ΔT relative to the switching enable signal SFS. During this time interval, cross-circuit detection occurs. The voltage signal at the diagnostic output is read back and evaluated in the diagnostic unit 20 ( Fig.4).

[0040] If no cross-circuit is detected within the interval ΔT, the diagnostic unit 20 switches the transistor T2 on.

[0041] The activation of transistor T2 is therefore delayed compared to the activation of transistor T1. The time delay ΔT is approximately 300 microseconds. Likewise, transistor T2 can be delayed at a

[0042] Safety requirement must be switched off to detect other cross-circuits.

[0043] The invention eliminates the need for periodic shutdown pulses AI, as the cross-circuit is detected at the latest when a safety request is triggered, and the response time in the event of a cross-circuit is significantly reduced. The safety sensors according to the invention comply with the SILII standard (Safety Integrity Level).

Claims

[1] Method for operating a safety sensor (1) having a switching output (A1) and a diagnostic output (A2) which are switched via two series-connected transistors (T1, T2), wherein the switching output (A1) outputs a switching enable signal (SFS) and the diagnostic output (A2) outputs a diagnostic enable signal (DFS) when the safety sensor (1) is functioning properly and a switching enable signal (SFS) is present at the switching output (A1), wherein the diagnostic output (A2) is controlled with a delay compared to the switching output (A1) by the safety sensor (1) and a cross-circuit detection takes place during a delay time (ΔT) by reading the voltage signal at the diagnostic output (A2) back into the safety sensor (1), and when a cross-circuit is detected in the safety sensor (1), the control of the transistor (T2) is interrupted and thus no diagnostic enable signal (DFS) is present at the diagnostic output (A2), which signals to a controller (PLC),that a facility must be brought into a safe condition., [2] The method of claim 1, wherein the delay time ΔT is about 300 microseconds or less. [3] Method according to claim 1, wherein the diagnostic signal (DS) is generated by a diagnostic unit (20) which controls the transistor (T2) connected to the diagnostic output (A2). [4] Safety sensor (1) arranged to carry out a method according to one of the preceding claims.

Images