Device and method for the fail-safe monitoring of a moving machine part

Abstract

Device (10) for fail-safe monitoring of a number of passages of a movable machine part (18) through a defined range of motion, with an input (32) for receiving a sensor signal which represents a motion parameter of the moving machine part (18), with a fail-safe evaluation unit (34) and with a first switching element (40) and a second switching element (42), wherein the fail-safe evaluation unit (34) is configured to determine, in a safety-relevant manner, a number of cycles of the movable machine part (18) through the defined range of motion and a direction of movement (94, 96) of the movable machine part (18) based on the movement parameter, and furthermore to provide a shutdown signal depending on the determined number of cycles and depending on the determined direction of movement, and wherein the device is further arranged to provide the shutdown signal depending on a switch position of the first and second switching element (40, 42).

Description

[0001] The present invention relates to a device for reliably monitoring a number of passages of a movable machine part through a defined range of motion.

[0002] Furthermore, the present invention relates to a method for reliably monitoring a number of passages of a movable machine part through a defined range of motion.

[0003] The present invention relates in particular to the field of machine and plant safety. In principle, the operation of modern machines and plants is integrated into a comprehensive safety concept, regardless of whether they are machine tools such as machining centers, presses, assembly lines, or robots. However, due to their rapid, highly automated processes, many machines and plants pose hazards to people, goods, and processes that are not immediately apparent. Therefore, there are a number of guidelines, standards, and laws that prescribe specific safety precautions that must be considered during the implementation of technical systems.

[0004] Relevant standards include EN ISO 12100:2010, the central standard for machine safety; EN ISO 13849-1 (successor to EN 954-1), the central standard for the design of safety-related control systems in the field of "machine safety"; and IEC 61508, which defines requirements for safety systems in plant safety, independent of the application. The present invention relates in particular to devices that have a Safety Integrity Level (SIL) rating of at least SIL-2 or a Performance Level greater than PL with regard to functional safety. c to achieve, where the Performance Level according to EN ISO 13849-1 describes the probability of a hazardous failure per hour.

[0005] Various safety aspects must be considered for automated technical systems. Firstly, it must be ensured that no unauthorized persons or goods enter the machine's designated operating area, or that, in such a case, the moving machine part is safely brought to a safe state. Furthermore, it must be ensured that the moving machine part itself does not leave its designated operating area, for example, by exceeding the endpoints of its axes of movement or otherwise breaking free from a predefined mechanical limit. This could result in the complete or partial damage or destruction of parts of the technical system or the moving machine part itself, potentially necessitating time-consuming and costly repairs.On the other hand, a movable machine part that escapes its area of ​​operation can pose additional dangers to people and goods that are not covered by the aforementioned access control.

[0006] Monitoring a technical system with moving machine parts that could pose a hazard typically requires two, often separate, monitoring systems. Firstly, area protection is implemented to restrict access by personnel or to monitor passageways or pass-through areas, usually employing walls, sturdy safety barriers, or electromechanical or optoelectronic protective devices. Secondly, the moving machine part itself must be monitored to ensure it remains within its designated area of ​​operation. This is generally achieved using position switches, light curtains, or camera-based protective devices that monitor the boundaries of the area of ​​operation and detect any deviation from it. Alternatively, the precise position of the moving machine part can be directly determined for safety purposes.

[0007] In large systems, such as automotive production lines, where numerous technical systems with moving machine parts need to be monitored, the monitoring and associated safety concept can become very complex and costly. This is especially true since safety-relevant, fail-safe monitoring is often implemented through redundant monitoring, which regularly doubles the number of protective devices used, particularly the sensor and actuator arrangements. It is therefore generally desirable to reduce the number of protective devices to a minimum while simultaneously ensuring standards-compliant safety.

[0008] Furthermore, monitoring the operating area of ​​a technical system is becoming increasingly complex due to the growing number of intelligent machines, such as computer-controlled, automated robots, as the operating area often can no longer be clearly defined. For complex subdivisions of the operating area, where even sub-areas within the operating area need to be monitored, the number of required sensors can therefore increase rapidly, especially if, as mentioned previously, every physical and every user-defined boundary must be monitored redundantly due to the required fault tolerance standards.

[0009] Furthermore, in some application areas, the use of simple position sensors at the limits of their operating range is simply not possible, for example, if a critical condition only occurs after a movement range has been traversed multiple times. In particular, with circular movements around an axis where several complete rotations are permitted, but a maximum number is specified, monitoring with simple position sensors is either impossible or can only be managed with additional evaluation devices, which themselves must be fail-safe.

[0010] DE 38 37 218 A1 discloses an electronic creep and rotation monitoring system for a protective device with normal or increased safety to meet requirements when a person is in the danger zone of a target system during special operation. DE 38 37 218 A1 discloses, among other things, a safe rotation monitoring system in which the movement of an axis to be monitored is limited to a maximum value, and exceeding this value leads to an immediate shutdown of the drive energy.

[0011] DE 44 32 768 A1 describes a method and a modular safety module for monitoring and controlling safety-relevant machine parameters and operating states, particularly in CNC machines and industrial robots. The concept combines the monitoring of rotary and translational movements with the control of machine room safety systems (e.g., safety doors, light curtains, foot-contact mats). The safety parameters are flexibly adjustable and can be retrieved from internal memory or external controllers. In the event of danger, the machine is brought to a safe stop by switching off the drive power and simultaneously braking.

[0012] WO 2007 / 068 607 A1 describes a method and a device for monitoring the motion of machines, in particular for the reliable detection of speed and position with only one sensor.

[0013] WO 99 / 29 474 A2 describes a monitoring and control device as well as a method for monitoring a technical system with increased safety requirements, especially for handling equipment such as robots.

[0014] EP 2 639 661 A1 describes a device for controlling an energy source that enables adaptive safety monitoring by analyzing several physical parameters such as position, speed, acceleration, torque and temperature of a driven body.

[0015] Against this background, it is an object of the present invention to provide a device and a corresponding method which enable the error-free monitoring of a movable machine part of a technical plant in a simpler, more cost-effective and more flexible manner, while avoiding the aforementioned disadvantages.

[0016] According to one aspect of the present invention, this problem is solved by a device according to claim 1.

[0017] According to another aspect of the invention, this problem is solved by a method according to claim 12.

[0018] The new device and method are based on the idea of ​​monitoring the movement range of a movable machine part by means of position monitoring of the movable machine part and, at least in the event that the movable machine part leaves its defined, permissible operating range, generating a fail-safe, preferably redundant, shutdown signal with which a technical system can be safely shut down if necessary. Advantageously, the new device and method require no or a reduced number of additional sensors to fully monitor the limits of a movement range in a safety-relevant manner. Monitoring a movement range is thus simplified, and costs for additional sensors, actuators, and their wiring are saved.

[0019] Furthermore, the new device and method allow for flexible selection of the motion ranges to be monitored. These ranges do not need to be defined by physical boundaries, but can be determined by the absolute or relative position of the moving machine part. For example, a motion range and its boundaries can be defined by a relative position in relation to a fixed rest point. This allows the new device to be quickly and flexibly adapted to specific conditions without requiring any structural modifications or changes to the sensor arrangements.

[0020] The flexible selection of the range of motion also offers the advantage that multiple traverses of the moving machine part through a physical range of motion can be accommodated, for example, by defining a range of motion that extends beyond the physical range. Using circular motion as an example, the range of motion can thus be determined by a specific number of revolutions. In this case, the rotational speed of the corresponding drive would be the relevant motion parameter, from which the number of revolutions can be determined directly or from a gear ratio of the drive. The encoder signal can, for example, originate from a fail-safe rotary encoder, so that the encoder signal itself is fault-tolerant. Alternatively, redundant acquisition of the motion parameter at the input of the inventive device is also possible. Advantageously, the motion can be acquired independently of the direction of movement or rotation.The movement can be rotational or translational.

[0021] The above procedure can therefore also be used for lateral movements. The necessary physical relationship between acceleration, velocity, and distance traveled is well understood. The velocity of a moving component can be calculated from the measured acceleration by integrating the recorded acceleration values ​​over time. Similarly, the distance traveled can be determined by integrating with respect to the velocity. However, to obtain the actual values ​​of velocity or distance, the velocity and position of the moving component at the beginning of the integration period must be known. This is not a problem for an automated, stationary system, as a defined rest state is usually present, at least after the system is switched on, or is assumed during an initialization process.

[0022] Furthermore, various encoder signals representing a motion parameter are advantageously already available in many technical systems with moving machine parts and can be reused by the new device. In this way, existing sensors can be used to provide the encoder signal, making area monitoring even more cost-effective. The aspect of reuse can also be relevant to the safety concept, as the new device can be advantageously combined with other sensors, such as area protection sensors, or conversely, replace them.

[0023] Furthermore, the new device has the advantage that it is largely independent of the respective plant type and the safety concept used, and can therefore be used for a wide variety of different plants.

[0024] Overall, the present invention thus offers a cost-effective and flexible way to monitor the safety-relevant range of motion of a moving machine part.

[0025] Furthermore, the fail-safe evaluation unit is designed to determine the direction of movement of the moving machine part in a safety-relevant manner based on the movement parameter.

[0026] In addition to the number of cycles of a moving machine part, the direction of movement of the moving machine part is also determined in a safety-relevant manner. This has the advantage that the defined range of motion can further be defined depending on the relative position of the machine part and the direction of movement. In this context, "safety-relevant" means that an incorrect determination of the direction of movement is controlled; that is, the device is designed in such a way that, despite an incorrect detection of the direction of movement, the fail-safe shutdown signal is provided. The direction of movement can, in particular, be a direction of rotation.

[0027] In a further embodiment, the device also has a counter in which the number of cycles can be stored, wherein the counter is increased by a first defined amount when the movable machine part has completely traversed the defined range of motion in a first direction of movement and decreased by a second defined amount when the movable machine part has completely traversed the defined range of motion in a second direction of movement.

[0028] In this configuration, the range of motion is defined by a first and a second boundary. With each pass through the range in a defined direction, the counter is incremented, and with each pass through the range in the opposite direction, the counter is decremented by a specific amount. The counter thus indicates the relative position within the range of motion. In this way, a zero point can be defined, for example, the rest position of the moving machine part. The counter indicates the absolute value of the deviation from this rest position, and the indicator shows the direction of movement. Rotary movements can be monitored particularly easily using the counter, and the defined range of motion can also include multiple rotations and take forward and reverse movements into account.

[0029] In a preferred embodiment, the device has a memory in which at least one value representing a limit of the defined range of motion can be stored.

[0030] In this configuration, the limits can advantageously be changed manually by the user. This allows the device to be adapted particularly flexibly to specific circumstances. To change the monitored area, only the parameters for the limits of the movement range need to be modified in memory. In particular, this method also allows movement ranges to be defined and monitored that are not physically limited. The limits can be represented by different values, for example, by absolute and / or relative position values ​​or by rotation angles in the case of circular motion. Advantageously, the limits of the movement range are specified with respect to a rest position of the moving machine part, whereby a value for the rest position can also be stored variably in memory.

[0031] In a further embodiment, the evaluation unit is designed to provide an output signal that represents the first or second direction of movement.

[0032] In this configuration, an additional output signal can be provided, which reliably indicates the direction of movement. Advantageously, such a signal can be evaluated by a higher-level control system and integrated into the overall safety concept. In this way, other protective devices can be added and / or replaced if necessary.

[0033] In a further embodiment, the evaluation unit is designed to provide a warning signal when the number of passes of the moving machine part through the defined range of motion exceeds a defined value.

[0034] In this configuration, the new device can additionally provide a warning signal after a certain number of cycles have been completed. Such a warning signal can, for example, be picked up by a control system to intervene and make corrective adjustments before the device provides the shutdown signal to shut down the system. In this way, unnecessary downtime caused by avoidable shutdowns can be prevented.

[0035] In a further embodiment, the evaluation unit provides the shutdown signal when a first defined value of the motion quantity is exceeded.

[0036] In addition to monitoring the range of motion, this embodiment also allows for monitoring the magnitude of the movement itself. The device according to the invention can therefore advantageously be used for fail-safe speed monitoring and may, if necessary, completely or partially replace additional sensors.

[0037] In a further embodiment, the evaluation unit is designed to provide a release signal when the movement quantity falls below a second defined value or represents a standstill.

[0038] In this embodiment, the device according to the invention can provide a further signal, depending on which, for example, access to a system can be controlled. Particularly in the case of machines that continue to move even after the supply voltage has been switched off, access to the machine can be restricted using the enable signal until the machine under monitoring no longer poses a danger. In this way, the device according to the invention can implement further safety measures.

[0039] In a further embodiment, the device has a fail-safe signal generator for providing the transmitter signal with a first and a second measuring channel.

[0040] The combination of a fail-safe, preferably redundant, evaluation unit with a fail-safe signal transmitter enables complete and redundant monitoring without additional components. Such a combination is therefore particularly advantageous and cost-effective compared to methods that require separate units to acquire the redundant input variables.

[0041] A particularly preferred fail-safe signal transmitter is a rotary encoder with an optical and a magnetic scanning unit on a drive shaft.

[0042] An optical and a magnetic scanning unit advantageously enable the creation of two fully functional measurement channels that operate independently of each other. In addition to redundancy, the safety criterion of diversity can also be implemented in this way through the two measurement channels. Preferably, both measurement systems have a synchronous serial interface (SSI) that can transmit the same data format. This allows the evaluation unit to evaluate both channels uniformly. Alternatively, rotary encoders with only optical or only magnetic scanning units can also be used.

[0043] The device has a first and a second switching element, wherein the shutdown signal is provided depending on the switch position of the first and the second switching element.

[0044] Two switching elements are particularly well-suited for generating a redundant and therefore fail-safe shutdown signal, ensuring continuous redundancy from the sensor inputs to the actuators. Advantageously, an operating voltage is supplied via the switching elements; the absence of this voltage at the outputs leads, either directly or indirectly, to the shutdown of the monitored system.

[0045] In a further embodiment, the fail-safe evaluation unit is designed with dual-channel redundancy.

[0046] A dual-channel, redundant evaluation unit is particularly well-suited to meeting the requirements of a fail-safe evaluation unit. Using a dual-channel evaluation unit ensures that even if one channel fails, the monitored system can still be shut down.

[0047] In a further embodiment, the evaluation unit has a first and a second processing unit, each generating an output signal that represents the shutdown signal, with the first and second processing units being designed to monitor each other.

[0048] This design allows for the particularly simple and reliable implementation of a redundant and therefore fail-safe evaluation unit. Mutual monitoring ensures not only that the system is safely shut down in the event of a fault in one channel, but also that a faulty channel can be reliably detected. Preferably, this monitoring also includes periodic testing of the individual channels by the evaluation unit and / or a higher-level control system.

[0049] It is understood that the features mentioned above and those to be explained below can be used not only in the combinations specified, but also in other combinations or on their own, without leaving the scope of the present invention.

[0050] Exemplary embodiments of the invention are shown in the drawing and are explained in more detail in the following description. They show: Fig. 1 a simplified, schematic representation of an embodiment of the new invention, Fig. 2 a block diagram of a preferred embodiment of the new invention, Fig. 3a an example of a movement range to be monitored of a moving machine part, Fig. 3b is another example of a movement range of a moving machine part to be monitored.

[0051] In the Fig. 1 is a preferred embodiment of the new device in its entirety designated by reference numeral 10.

[0052] The device serves here to monitor a technical system 12, which is represented by a robot 14. The robot 14 is arranged on a stationary base 16, onto which a movable machine part 18 is mounted, which can rotate completely about its longitudinal axis 20. A robot arm 22 is attached to the movable machine part 18, which can be moved in space by the rotational movement of the movable machine part 18. The operating area of ​​the technical system to be monitored is thus the operating area of ​​the robot arm 22 plus the area occupied by a moving load.

[0053] To safeguard the technical system 12, two safeguarding measures have been implemented in the case presented here. Firstly, it is monitored that no unauthorized access occurs to the area to be secured, and secondly, it is ensured that the technical system 12 itself operates within its predefined parameters and does not deviate from them. For the latter case, it is particularly important to monitor whether the robot arm 22, and thus the movable machine part 18, remains within its assigned range of motion. As will be explained in more detail below, in this preferred embodiment of the new invention, both safeguarding measures are implemented by the device 10 according to the invention.

[0054] The robot 14 is driven by an electric drive 24, which is coupled to the movable machine part 18 via a shaft 26. The coupling of the shaft 26 to the movable machine part is achieved, for example, via a gearbox (not shown) with a fixed gear ratio, so that the movement of the movable machine part 18 is proportional to the rotational speed 28 of the electric drive 24. The rotational speed 28 of the drive is detected by a signal transmitter and transmitted as a signal to the device 10 via line 30. Various methods for detecting the rotational speed 28 are possible; however, a safe rotary encoder (not shown in detail here) is preferably used. Its sensors are coupled to the shaft 26, and it is designed to determine the rotational speed of the shaft 26 in a safety-relevant manner and to generate a corresponding Gerber signal. The rotational speed 28 represents only one possible parameter for the motion.Alternatively or additionally, the acceleration of the wave or an absolute distance traveled can also be recorded by appropriate sensors. The device is therefore not limited to a specific motion parameter, but can preferentially use various motion parameters for evaluation, for example, to verify the plausibility of an evaluation result based on different individual measurements.

[0055] Line 30 is further connected to an input 32 of the device 10, via which the encoder signal is forwarded to the fail-safe evaluation unit 34. The fail-safe design of the evaluation unit 34 is indicated here by two separate processing units 36, 38, which can preferably monitor each other. The device 10 is thus designed with dual-channel redundancy. As will be explained in more detail below, the fail-safe evaluation unit 34 determines, based on the motion parameter(s) transmitted with the encoder signal, the respective traverses through a defined movement range of the robot 14. The movement range is defined here by a complete rotation of the movable machine part 18, whereby the robot 14 can traverse this movement range multiple times, i.e., the robot can rotate multiple times around its own axis 20. As with regard to the Fig. 3a and Fig. As explained in more detail in section 3b, the defined range of motion is not limited to circular movements, but can also include lateral movements.

[0056] In the preferred embodiment of the invention shown here, the fail-safe evaluation unit 34 determines the actual number of rotations of the movable machine part 18 about its own axis 20 based on the rotational speed 28 of the electric drive 24. In other embodiments, the movement of the movable machine part 18 is determined alternatively or additionally by other motion variables. The motion variable need not be recorded directly at the drive 24, but can, for example, also be determined by acceleration sensors on the movable machine part 18 itself. Particularly preferably, various motion variables are recorded and evaluated to enable diverse monitoring. The movement can preferably also be recorded relative to a defined fixed point, for example, a rest position of the robot 14.In this way, the evaluation can be based on relative values, making it easier to compare and / or combine the values ​​of different sensors.

[0057] Depending on the evaluation, the fail-safe evaluation unit 34 provides a fail-safe shutdown signal if a defined threshold is exceeded by a certain number of cycles through the defined movement range. This threshold can also be set to 1, so that the fail-safe shutdown signal is generated after only one cycle through the defined movement range. In this context, fail-safe also means that the shutdown signal always ensures that a monitored system shuts down, even if parts of the safety function become inoperative. Therefore, a redundant shutdown signal is preferably used in this case as well, as indicated here by the two switching elements 40 and 42.A supply voltage, not shown in detail here, is fed to the outputs 44, 46 via the switching elements 40, 42, thereby operating the contactors 50 via the lines 48 in this embodiment. The contacts of the contactors 50 are connected in series in a known manner to a power supply 52 of the electric drive 24. The electric drive 24 is only supplied and ready for operation when the contactors are energized and thus energized. It follows that at least one of the contactors 50 drops out when one of the switching elements 40, 42 is opened, thereby reliably stopping the operation of the robot 14 due to the interruption of the power supply 52.

[0058] In the example shown, this can occur when the movable machine part 18 has completed a defined number of revolutions around its own axis 20, thus exceeding the defined threshold. A threshold could be defined by a physical limitation on the movable machine part's range of motion that does not arise directly from the type of drive. For example, a compressed air line 54 between the base 16 and the robot arm 22 is shown, which can only wrap around the robot a certain number of times. The device according to the invention ensures that the robot 14 is safely switched off as soon as the defined number of revolutions has been completed.It should be noted at this point that the monitoring is not limited to the embodiment shown, but is applicable to any monitoring of a number of passes through a movement area where a movement parameter can be used to determine the absolute or relative position.

[0059] The one in Fig. The embodiment shown in Figure 1 can, in addition to monitoring the number of passages through a defined movement area, also perform other safety measures, either wholly or partially. For example, to prevent unauthorized access to the robot 14's operating area, a safety fence 56 with a monitored door 58 is provided. The door 58 has a safety switch 60 with a sensor 62 and an actuator 64, wherein the safety switch 60 generates a release signal 66 only when the door 58 is properly closed. The release signal 66 from the safety switch 60 is received at the input 34 of the device 10 according to the invention and preferably processed as a binary signal by the evaluation unit 34, which controls the outputs 44 and 46 as described above, depending on the release signal 66.In a particularly preferred embodiment, the device 10 can, conversely, instruct the safety door switch 44 to lock the safety door until a corresponding safe state of the technical system 12 is reached. This state can be reached, for example, when the drive is stationary or the rotational speed has dropped below a defined value. Additionally or alternatively, the safety switch 60 can also have a locking mechanism, so that the door can only be opened when a corresponding release signal is received from the device 10.

[0060] The device according to the invention can therefore also be used, in principle, for monitoring the motion parameter itself. For example, the new device enables the safe shutdown of the system even if the drive 24 has exceeded a defined maximum speed. Overall, the new device can thus be easily and flexibly integrated into existing safety concepts, or can preferably supplement or replace existing protective devices with the new device.

[0061] With reference to Fig. Figure 2 below shows a particularly preferred embodiment of the new device 10. The same reference numerals denote identical parts as in the Fig. 1.

[0062] The device 10 is structurally divided into three areas I, II, and III. In the first area I, a power supply 68 for the internal components of the new device 10 is located. The logic units and inputs are grouped together in the second area II. The third area III comprises the safety-related outputs 44 and 46 with the associated switching elements 40 and 42. The external interfaces are generally indicated by circles on the housing 70 of the new device, preferably spring-loaded terminals. The input 32 is designed as an RJ45 interface and is suitable for accommodating a multi-core patch cable.

[0063] In this embodiment, a signal is provided by a reliable signal transmitter. This is represented here by a dedicated measuring system 74, which is arranged on a drive of a movable machine part (not shown) and reliably determines a motion parameter of the movable machine part. The measuring system 74 is preferably a redundant, dual-channel system, for example, with an optical and a magnetic scanning unit arranged on a drive shaft, each providing a signal representative of the movement of the movable machine part. Alternatively or additionally, other motion parameters, for example, by acceleration sensors on the movable machine part, can also be detected by the measuring system 74.In this embodiment, the measured signals, which together represent the encoder signal, are transmitted independently of each other via one conductor each of a 6-core patch cable to input 32.

[0064] The evaluation of the encoder signal is performed by the fail-safe evaluation unit 34, which, in this embodiment, is also designed with dual-channel redundancy. For this purpose, the evaluation unit 34 comprises a first and a second processing unit 36, 38, for example, in the form of an FPGA, ASIC, or other microcontroller. In particularly preferred embodiments, the fail-safe evaluation unit 34 is not only redundant but also diverse, for example, by using functionally identical but structurally different microcontrollers from different manufacturers, as indicated here by the italicized labeling of the second processing unit 38. This design makes it possible to eliminate system-related manufacturing defects.

[0065] Depending on the encoder signal, the fail-safe evaluation unit 34 controls two switching elements 40, 41, each of which switches a signal path 76, 78 of the safe output 44, 46. Preferably, the contacts of the switching elements through which the signal paths are routed are each a normally closed and a normally open contact, which are positively guided to each other. As with the Fig. As already explained in section 1, a supply voltage is provided for external contactors, whereby the contactors drop out as soon as the associated signal path 76, 78 is opened.

[0066] As already mentioned previously in relation to the Fig. As described in Figure 1, the fail-safe evaluation unit 34 can determine the number of cycles of the movable machine part 18 through a defined range of motion based on the motion parameter transmitted with the encoder signal and provide a redundant shutdown signal via outputs 44 and 46. Furthermore, in this preferred embodiment, the fail-safe evaluation unit 34 is also configured to switch outputs 44 and 46 when the motion parameter itself exceeds a defined threshold. Thus, with the embodiment shown here, both the cycles of a movable machine part through a defined range of motion and the limit or maximum speed of the drive can be monitored simultaneously.

[0067] Furthermore, the device is preferably freely parameterizable, for example by storing values ​​for the defined range of motion or the threshold values ​​in a memory 80. In this way, the device can be flexibly adapted to the respective task. The memory 80 is particularly preferably a removable memory, e.g., a chip or memory card, so that a configuration can be easily created and modified on a separate device and then transferred to the device.

[0068] Advantageously, the device 10 according to the invention can perform further safety-related tasks in addition to the shutdown function. For this purpose, the device 10 has further outputs 82 via which the shutdown signal or other warning signals can be provided. Preferably, these are compact semiconductor outputs, unlike outputs 44 and 46. Additional warning signals can be provided via the semiconductor outputs; for example, if additional movement ranges are defined, exceeding these ranges can trigger a corresponding warning signal. The parameterization of the additional movement ranges and the threshold values ​​for the warning signals can also be stored in the memory 80.For example, a higher-level control 84 can be a programmable logic controller (PLC) that uses warning signals to control the system in order to prevent the device from shutting down the system completely.

[0069] In addition to the additional outputs, the preferred embodiment according to Fig. 2 Additional inputs are also provided, for example for a reset / start unit 86 and / or a readout unit 88. A push button (not shown here) can be connected to the reset / start unit 86, enabling a safe start of the system by manual release. This manual release ensures that restarting the machine requires confirmation by a person. The device 10 can thus be reset via the reset / start unit if it has been shut down.

[0070] The readout unit 88 preferably allows the switch positions of the safe outputs 44, 46 and / or the contactors to be read back, enabling the device 10 to check its own functionality. In preferred embodiments, the device continuously tests its own functionality via the readout unit 88.

[0071] The device is preferably arranged in a housing 70 and is preferably suitable for mounting on a standard DIN rail. The housing can be mounted in a control cabinet or itself be designed for a protection rating of at least IP54, preferably IP67.

[0072] With regard to the Fig. 3a and Fig. 3b below, two movement ranges to be monitored, which can preferably be monitored with the new device 10, are explained as examples.

[0073] Fig. Figure 3a shows a preferred embodiment for monitoring a circular motion. A movable machine part (not shown in detail) is driven via a gearbox with a spur gear 90 and an internally toothed gear 92. The spur gear 90 is connected to a drive shaft 26, which itself is coupled to a drive (not shown). The drive shaft 26 transmits a rotational speed 28 of the drive to the spur gear 90, which in turn drives the internally toothed gear 92 and thus the movable machine part. The movable machine part is therefore rotated proportionally to the rotational speed 28 in a ratio determined by the gearbox.

[0074] The range of motion can be defined here by one complete revolution of the internally toothed gear 92. One pass through the defined range of motion would thus correspond to one complete revolution of the internally toothed gear 92. The required number of revolutions of the drive shaft 26 can, in turn, be determined via the gear ratio of the transmission, which can itself be calculated from the rotational speed, the angular velocity, and / or the angular acceleration in a manner known per se. Thus, angular acceleration, angular velocity, and / or rotational speed can all be considered motion parameters within the meaning of the present invention.

[0075] Furthermore, the number of cycles through the defined range of motion depends on the direction of movement of the drive. In the illustrated embodiment, the direction of movement is determined by the direction of rotation of the drive, which allows the movable machine part to move through the defined range of motion in a first direction 94 and a second, opposing direction 96. Therefore, in addition to the movement itself, the new device must also reliably determine the direction of movement 94, 96 from the motion parameter. Preferably, the reliably determined direction of movement can be provided as a further signal via a separate output of the device for other applications.

[0076] Since the defined range of motion is largely determined by the magnitude of the movement, ranges of motion that cannot be directly confined to mechanical limits, such as partial rotations, can be easily defined. Thus, the device according to the invention allows these partial ranges to be monitored reliably and ensures safe shutdown if a partial range is exceeded. No additional safety-related sensors or actuators are required for this purpose.

[0077] With regard to the Fig. Figure 3a shows various areas in a diagram, where the integer values ​​represent the corresponding number of cycles through the defined range of motion. The number of cycles is referenced to a fixed point 98, which, for example, represents a rest position of the moving machine part. Starting from this fixed point 98, a first and a second area 100 and 102 are defined, respectively, and a warning is triggered in each area if the number of cycles exceeds the limit of either area. The warnings can preferably be provided as a separate signal via additional outputs of a higher-level controller. A third area 104 marks the shutdown area. If the moving machine part leaves this area, the device provides a fail-safe shutdown signal, which, for example, reliably and safely stops the drive of the moving machine part.Preferably, the areas are freely parameterizable, so that the device can be easily adapted to changing conditions.

[0078] The present invention is not limited to the monitoring of circular movements, as in the Fig. 3a shown, limited. With reference to the Fig. Figure 3b illustrates the monitoring of a translational movement. A spur gear 90, driven via a drive shaft 26, engages a rack 106, which is coupled to a movable machine part (not shown). The rotation of the spur gear 90 is thus converted into a translation. As previously described using circular motion as an example, one or more defined movement ranges within the physical limits 108, 110 of the rack 106 can be defined and reliably monitored by the device according to the invention.

Images