Systems with multiple safety switches as well as safety switches

Abstract

The invention relates to a system with several safety switches, each having an input circuit with at least two channels and an output circuit with at least two channels, through which redundant binary switching signals can be output depending on the switching state of the safety switch, and with at least one bus master, which has an input circuit with at least two channels, wherein the safety switches are connected in series, in which the output circuit of one safety switch is connected to the input circuit of the next safety switch and the output circuit of the last safety switch in the series is connected to the input circuit of the bus master, wherein the bus master and one, several or all of the safety switches each have at least one data bus communication connection in addition to the input circuit and the output circuit.via which bidirectional data communication is possible between the respective safety switch and the bus master, which is controlled by the bus master, wherein the devices that have a data bus communication port are connected to each other for data communication via a data bus formed from at least one bus line.

Description

[0001] The invention relates to a system comprising a plurality of safety switches, each having an at least two-channel input circuit and an at least two-channel output circuit, via which redundant binary switching signals can be output depending on the switching state of the safety switch, and comprising at least one bus master having an at least two-channel input circuit, wherein the safety switches are connected to form a series circuit in which the output circuit of one safety switch is connected to the input circuit of the next safety switch and the output circuit of the last safety switch in the series circuit is connected to the input circuit of the bus master, wherein the bus master and one, several or all of the safety switches each have at least one data bus communication connection in addition to the input circuit and the output circuit,via which bidirectional data communication can be carried out between the respective safety switch and the bus master, which is controlled by the bus master, wherein the devices which have a data bus communication connection are connected to one another for data communication via a data bus formed from at least one bus line.

[0002] Such a system is known, for example, from EP 3 591 478 A1.

[0003] Safety switches have become widely used in the field of safety technology to monitor the operational safety of technical systems and minimize the hazards posed to humans by such systems. Safety switches can be used to monitor and indicate the closed state of access doors, the interruption of light curtains, the fill level of liquids, and many other aspects of the operating status of technical systems. In principle, all types of technical systems can be considered as systems to be monitored, for example, a single production machine or an entire production line, but also an elevator system or other technical system.

[0004] In order to be able to fulfil the above-mentioned tasks, the safety switch can have a control unit which is designed to detect the operating state of the system to be monitored and to distinguish at least between an inactive and an active operating state.

[0005] The safety switch is configured to assume an activated or deactivated state depending on the detected operating state of the system. The safety switch assumes an activated state when the safety switch detects an active operating state of the system. It assumes a deactivated state when the safety switch detects an inactive operating state of the system.

[0006] The operating status of the system can be detected using an external safety sensor connected to a safety signal input of the safety switch via a connecting cable. Such an external safety sensor can be, for example, a light barrier, a light grid, an actuator of a non-contact safety switch, which is attached to an access door to be monitored, an emergency stop switch, or another safety sensor used to detect the operating status of a system. However, the functionality of such a safety sensor can also be integrated into the safety switch, so that the safety switch is capable of detecting the operating status of the system without an external safety sensor.In addition, it is possible for the control unit of the safety switch to detect the operating state of the system based on an input safety signal received at the at least two-channel input circuit of the safety switch, which was output by another safety switch.

[0007] On this basis, the control unit is able to output an output safety signal to the at least two-channel output circuit of the safety switch, the signal state of which signals the detected operating state of the system—and thus also the state of the safety switch. A first signal state of the output safety signal, which signals an active operating state of the system, can be represented by a signal value from a first value range, and the second signal state, which signals an inactive operating state of the system, can be represented by a signal value from a second value range that differs from the first value range.

[0008] The invention is based on the object of further improving such a system in terms of functionality and safety. Furthermore, an advantageous safety switch for such a system is to be provided.

[0009] This object is achieved by a system with a plurality of safety switches, each having an at least two-channel input circuit and an at least two-channel output circuit, via which redundant binary switching signals can be output depending on the switching state of the safety switch, and with at least one bus master having an at least two-channel input circuit, wherein the safety switches are connected to form a series circuit in which the output circuit of one safety switch is connected to the input circuit of the next safety switch and the output circuit of the last safety switch in the series circuit is connected to the input circuit of the bus master, wherein the bus master and one, several or all of the safety switches each have at least one data bus communication connection in addition to the input circuit and the output circuit,via which bidirectional data communication can be carried out between the respective safety switch and the bus master, which is controlled by the bus master, wherein the devices which have a data bus communication connection are connected to one another for data communication via a data bus formed from at least one bus line, wherein each safety switch is configured to carry out unidirectional data communication towards the bus master by impressing additional data signals onto their switching signals output via the output circuit, and each safety switch which has a data bus communication connection is configured to carry out bidirectional communication with the bus master via the data bus communication connection upon request by the bus master.

[0010] Advantageously, the system thus has two independent data communication systems: on the one hand, the lines for transmitting the switching signals, which allow unidirectional data communication to the bus master, and on the other hand, the data bus, which enables bidirectional communication, so that the bus master can specifically address individual bus devices connected to the data bus in the form of safety switches. For example, unidirectional data communication can be used to transmit diagnostic information, e.g., about the switching status of the individual safety switch, via the data signals applied to the switching signals. The bus master can use the bidirectional data bus to optionally query additional data from the connected bus devices and / or send control commands to individual bus devices, e.g., to operate the respective actuators connected to the bus devices.In this way, the bus master can actively control the actuators on the individual bus participants, i.e. the safety switches with the data bus communication connection.

[0011] The safety switches can be configured, in particular, for purely unidirectional communication with the bus master via their output circuits. This means that it is not possible to conduct data communication from the bus master via the output circuits and the input circuits in the opposite direction. This allows the required data protocol for data communication via the output circuits to be kept simple. The hardware required for applying the additional data signals can also be minimized.

[0012] The additional data signals can be based on additional data, in particular diagnostic data and / or control data. In particular, in many cases, it is desirable for the safety switch to provide diagnostic data that facilitates diagnosis of the cause of the detection of an inactive operating state of the system. Such diagnostic data is particularly important when multiple safety switches are cascaded in series, thus forming a safety switch chain.

[0013] The signal value of the safety signal to which the additional data is applied can, in principle, be the value of any physical quantity suitable for representing a signal. In particular, the signal value can be, for example, the value of an electrical voltage or an electrical current.

[0014] In this context, it is advantageously possible to define a signal state by a lower threshold value and an upper threshold value, wherein the threshold values ​​form the limits of the value range assigned to the signal state. In this way, for example, a HIGH signal state can be defined as the first signal state, which is represented by a first value range, and a LOW signal state can be defined as the second signal state, which is represented by a second value range, wherein the signal values ​​of the first value range are without exception greater than the signal values ​​of the second value range, i.e., the value ranges are different from one another.

[0015] The safety switches connected to the data bus can each have a device-specific address, which can be used by the bus master to specifically contact them. The bus master can be configured to address individual bus devices specifically via their address. The bus device can also be configured to address several or all bus devices via a broadcast. The device-specific addresses can, in particular, be configured as unique values, e.g., with a data width of 24 bits.

[0016] The object mentioned at the outset is also achieved by a system with a plurality of safety switches, each having an at least two-channel input circuit and an at least two-channel output circuit, via which redundant binary switching signals can be output depending on the switching state of the safety switch, and with at least one bus master having an at least two-channel input circuit, wherein the safety switches are connected to form a series circuit in which the output circuit of one safety switch is connected to the input circuit of the next safety switch and the output circuit of the last safety switch in the series circuit is connected to the input circuit of the bus master, wherein the bus master and one, several or all of the safety switches each have at least one data bus communication connection in addition to the input circuit and the output circuit,via which bidirectional data communication can be carried out between the respective safety switch and the bus master, which is controlled by the bus master, wherein the devices which have a data bus communication connection are connected to one another for data communication via a data bus formed from at least one bus line, wherein the safety switches which have a data bus communication connection can be specifically addressed by the bus master by means of a device-specific address, wherein the system is designed to carry out an initialization phase during commissioning in which the device-specific addresses of the safety switches are automatically determined according to one or more predetermined schemes.

[0017] This eliminates the need for manual configuration of the system's address assignment, significantly reducing the effort, especially for systems with a large number of safety switches. Instead, the system can be equipped with identically designed safety switches, and the device-specific addresses are assigned automatically during the initialization phase.

[0018] According to an advantageous embodiment of the invention, the levels of the additional data signals impressed on the switching signals lie within the limits of the respective value range of the signal state of the switching signal, which is respectively output via the output circuit. Thus, such impressed additional data signals do not distort the transmission of the actual useful signal, namely the switching signal. Furthermore, it becomes possible for the additional data signals to be transmitted in both binary states of the switching signal, i.e., both at the high level and the low level. It is of course also possible to transmit the additional data signals in only one of the two binary states of the switching signal.On the receiver side, these additional data signals can then be filtered out again and further processed as data, or output unchanged via the received safety switch's own output circuit.

[0019] For example, the control unit can imprint additional data on the output safety signal, i.e., the switching signal output via the output circuit, by changing the signal value of the output safety signal within the limits of the value range associated with the currently output signal state. For example, if an output safety signal is currently being output that has the second signal state because the control unit of the safety switch has detected an inactive operating state of the system, the signal value of the output safety signal is changed depending on the additional data without exceeding the upper threshold value of the value range associated with the second signal state or falling below the lower threshold value of this value range.In the above example of an electrical voltage, the value range of the second signal state can, for example, be a value range from -3 V to +2 V, so that in this case the signal value is changed within the value range between -3 V and +2 V in order to imprint the additional data on the output safety signal.

[0020] In this way, additional data can be impressed on the output safety signal without changing the operating state signaled by the output safety signal. A unit connected to the at least two-channel output circuit of the safety switch, e.g. another safety switch connected in series, an evaluation unit, a display unit and / or a switching device, thus uses the output safety signal output by the safety switch to recognize the operating state of the system recognized by the safety switch, in the above-mentioned example an inactive operating state, which is signaled by the second signal state. In addition, the unit connected to the safety signal output can extract the additional data impressed on the output safety signal output by the safety switch, e.g. diagnostic data and / or control data.

[0021] In an analogous manner, it is possible according to the invention for additional data to be impressed on a currently output safety signal of the first signal state, which signals an active operating state of the system, by changing the signal value of the output safety signal within the limits of the value range assigned to the first signal state.

[0022] According to an advantageous embodiment of the invention, the bus master is configured to conduct at least one data communication with each safety switch connected via the data bus within a predetermined time frame. This ensures a high level of operational reliability of the system. The bus master ensures that all connected bus participants are capable of conducting data communication via the data bus. If the bus master detects that a bus participant is not conducting data communication or is at least not conducting data communication satisfactorily, the system can be transferred to a safe operating state by deactivating the safety switches.

[0023] According to an advantageous embodiment of the invention, the bus master is configured to query the device-specific identification data of all safety switches connected to the data bus and compare the identification data with a pre-stored list of connected safety switches. Further operation of the system is only enabled if the comparison result is positive. This also further increases the operational reliability of the system. In particular, tampering with the system by replacing safety switches is made more difficult.

[0024] According to an advantageous embodiment of the invention, each safety switch is configured to carry out unidirectional data communication towards the bus master by imposing additional data signals on the switching signals emitted via the output circuit, wherein the safety switches are configured to automatically execute the following scheme for determining their device-specific addresses: a) the first safety switch in the series circuit has a pre-stored start address as a device-specific address, which it transmits to the next safety switch via the output circuit using the additional data signals applied to its switching signals, b) the next safety switch receives the data signals and thus the address of the previous safety switch via its input circuit, and b1) if the next safety switch does not have a data bus communication connection, it transmits the received address via the additional data signals impressed on its switching signals via the output circuit to the next safety switch, b2) if the next safety switch has a data bus communication connection, it determines its device-specific address from the received address according to a predetermined algorithm and transmits this address to the next safety switch via the additional data signals impressed on its switching signals via the output circuit, c) step b) is repeated until the last safety switch in the series connection transmits its address, if it is a safety switch with a data bus communication port, or the received address, if it is a safety switch without a data bus communication port, to the bus master.

[0025] In this case, the alternative communication path to the data bus is used to determine the device-specific addresses. Accordingly, it is not necessary to address the bus devices with any preliminary address via the data bus. Advantageously, the address definition scheme can also be used in mixed systems in which both safety switches without a data bus communication connection and safety switches with a data bus communication connection are present. As a predefined algorithm for determining the respective device-specific address, for example, an upcounting or downcounting of the addresses by a predefined increment value, e.g., one, can be performed. A more complex algorithm for determining the device-specific address from the received address can also be used, which offers greater security against tampering.

[0026] According to an advantageous embodiment of the invention, it is provided that in the case of safety switches which have a data bus communication connection, this data bus communication connection has a first connection contact and a second connection contact which is separate from the first connection contact, wherein the safety switch has a connection switch by means of which a connection between the first and the second connection contact can be established or broken, wherein the bus line is not continuous, but rather the safety switches are connected to form a series circuit, in which the second connection contact of a safety switch is connected to the first connection contact of the next safety switch and the second connection contact of the last safety switch in the series circuit is connected to the data bus communication connection of the bus master.Neighboring bus devices are thus connected to each other via point-to-point connections via their data bus communication ports. However, the connection switch can be used to establish connections to additional bus devices, so that, at least when all connection switches are closed, a continuous bus connection is established across all bus devices up to the bus master. The connection switches can be used in an iterative process to establish the connection from the bus master to first one and then to subsequent bus devices, which can be advantageously used for implementing the subsequent scheme for determining device-specific addresses.

[0027] With safety switches designed in this way, bus termination of the data bus can be achieved by a corresponding circuit arrangement of the respective safety switch, e.g. depending on the switching state of the connection switch.

[0028] The safety switch located furthest away from the bus master in the series arrangement of the data bus communication connections can also be a safety switch without the second connection contact separated from the first connection contact and without a connection switch, since this safety switch does not have to switch a connection to a subsequent safety switch.

[0029] According to an advantageous embodiment of the invention, the safety switches are configured to automatically execute the following scheme for determining their device-specific addresses: a) first, the connection switches of all safety switches are open, b) the bus master carries out data communication via the data bus with the safety switch closest to it in the series connection, the connection switch of which is open, whereby the device-specific address of this safety switch is determined by the data communication, c) this safety switch then closes the connection switch, d) steps b) and c) are carried out until the device-specific address is defined for all safety switches that have a data bus communication connection.

[0030] In this way, the safety switches are successively programmed with a device-specific address as their distance from the bus master increases, and close their connecting switch accordingly. The device-specific address of the respective safety switch can be determined using a predefined algorithm, e.g. by counting up or down the addresses by a predefined increment value, e.g. one. A more complex algorithm can also be used to determine the device-specific address from the received address, which offers greater security against tampering. For the safety switch furthest away from the bus master in the series connection, a previously saved provisional address can also be adopted as the device-specific address, i.e. reprogramming is not necessarily required for this safety switch.

[0031] According to an advantageous embodiment of the invention, one, several, or all safety switches each calculate and store a unique serial number for identifying the safety switch according to a predetermined algorithm from production-specific data stored in the safety switch, in particular serial number, production batch, wafer number, coordinate on the wafer, and / or transmit it to the bus master. In this way, the safety switches can each independently or autonomously determine a unique identifier by which the safety switches can be identified. The calculated serial number can, for example, be stored in a parameter memory of the safety switch. The safety switch can, for example, transmit the serial number via the data bus upon request from the bus master.

[0032] According to an advantageous embodiment of the invention, it is provided that a) the binary switching signals have a first signal state or a second signal state, b) the safety switch is designed to detect an operating state of the system, which may be an active or an inactive operating state, and to output an output safety signal via the output circuit, the signal state of which signals the detected operating state, c) wherein the first signal state signals an active operating state of the system and is represented by a signal value from a first value range assigned to the first signal state, and the second signal state signals an inactive operating state of the system and is represented by a signal value from a second value range assigned to the second signal state, which is different from the first value range, d) wherein the safety switch is arranged to imprint the additional data signals on the output safety signal.

[0033] The safety switch can, for example, have a control unit which is connected to the input circuit and the output circuit and which is configured to detect an operating state of the system, which may be an active or inactive operating state, and to output it to the output circuit as an output safety signal, the signal state of which signals the detected operating state.

[0034] The system can be configured specifically to monitor the operational safety of a system. Individual safety switches can monitor a specific part of the system.

[0035] According to an advantageous embodiment of the invention, the safety switch is configured to imprint the additional data signals onto the output safety signal by varying the signal value of the output safety signal within the limits of the value range associated with the currently output signal state of the output safety signal, depending on the additional data to be imprinted. Thus, such imprinted additional data signals do not corrupt the transmission of the actual useful signal, namely the switching signal. Furthermore, it is possible for the additional data signals to be transmitted in both binary states of the switching signal, i.e., both at the high level and the low level.On the receiver side, these additional data signals can then be filtered out again and further processed as data, or output unchanged via the received safety switch's own output circuit.

[0036] According to an advantageous embodiment of the invention, the safety switch is configured to decode additional data impressed on the input safety signal from the input safety signal received via the at least two-channel input circuit. Accordingly, the safety switch can further process the decoded data and / or output it in modified or unmodified form via the output circuit.

[0037] According to an advantageous embodiment of the invention, it is provided that the additional data signals comprise diagnostic data relating to an identifier of the safety switch, a position of the safety switch, the operating state of the system detected by the safety switch, the type and / or cause of a detected inactive operating state and / or other diagnostic information.

[0038] According to an advantageous embodiment of the invention, it is provided that the additional data signals comprise control data which serve for the parameterization and / or remote control of a safety switch, an actuator, an evaluation unit and / or another device connected to the safety switch.

[0039] According to an advantageous embodiment of the invention, it is provided that the safety switch is configured to forward additional data signals in that the safety switch imprints additional data signals impressed on the input safety signal in unchanged or modified form on the output safety signal and / or imprints additional data impressed on the output safety signal in unchanged or modified form on the input safety signal.

[0040] According to an advantageous embodiment of the invention, it is provided that the safety switch is configured to generate diagnostic data depending on the received input safety signal and / or depending on the operating state of the system detected by the safety switch and to imprint it on the output safety signal as additional data.

[0041] According to an advantageous embodiment of the invention, it is provided that the safety switch is configured to imprint additional data signals on the output safety signal only if the output safety signal has the second signal state and / or to imprint additional data on the received input safety signal only if the input safety signal has the second signal state.

[0042] According to an advantageous embodiment of the invention, the system comprises one or more safety switches without a data bus communication connection and one or more safety switches with a data bus communication connection in the series connection of the safety switches. This advantageously allows for the implementation of a mixed system, allowing the user to optimally adapt the system to specific circumstances, thereby realizing cost savings.

[0043] For example, the safety switches without a data bus communication connection can be designed as safety sensors that have a pure sensor function and are therefore not designed to control actuators.

[0044] The bus master can be configured to modify the configuration of connected bus devices and / or change parameters in the respective bus devices through communication via the data bus. The bus master can be configured to change the operating states of bus devices by sending commands to them.

[0045] The bus master can have a higher-level system control component or be connected to such a system control component for communication. To further increase security, the bus master can be the only bus participant that can initiate communication via the data bus.

[0046] According to an advantageous embodiment of the invention, the bus master and the other bus participants, i.e., the connected safety switches, are configured to carry out safety-related data communication via the data bus. The individual data telegrams transmitted via the data bus can be protected for this purpose, for example, by means of a checksum.

[0047] In a configuration mode, the system can be set up, for example, to specify the coding level of the individual safety switches, to teach in actuators, to set a delay for the locking deactivation, to set an emergency runtime or to change the device-specific address of the bus participant.

[0048] The object mentioned at the outset is also achieved by a safety switch for a system of the type explained above, wherein the safety switch has at least two-channel input circuits and at least two-channel output circuits, via which redundant binary switching signals can be output depending on the switching state of the safety switch, wherein the safety switches can be connected to further safety switches to form a series circuit, in which the output circuit of one safety switch is connected to the input circuit of the next safety switch and the output circuit of the last safety switch in the series circuit is connected to the input circuit of a bus master, wherein the safety switch has at least one data bus communication connection in addition to the input circuit and the output circuit,via which bidirectional data communication can be carried out between the safety switch and the bus master, which is controlled by the bus master. The safety switch is configured to carry out unidirectional data communication towards the bus master by imposing additional data signals on the switching signals emitted via the output circuit. Upon request from the bus master, bidirectional communication with the bus master can be carried out via the data bus communication port. This also allows the previously explained advantages to be realized.

[0049] According to an advantageous embodiment of the invention, the levels of the additional data signals impressed on the switching signals are within the limits of the respective value range of the signal state of the switching signal which is respectively output via the output circuit.

[0050] According to an advantageous embodiment of the invention, the data bus communication connection has a first connection contact and a second connection contact separated from the first connection contact, wherein the safety switch has a connection switch by means of which a connection between the first and the second connection contact can be established or separated.

[0051] In a further aspect, the invention relates to a system with a plurality of safety switches and with at least one bus master, wherein the bus master and the safety switches each have at least one data bus communication connection via which bidirectional data communication can be carried out between the respective safety switch and the bus master, which bidirectional data communication is controlled by the bus master, wherein the data bus communication connections are connected to one another for data communication via a data bus formed from at least one bus line, characterized in that the data bus communication connection of the safety switches each has a first connection contact and a second connection contact separate from the first connection contact, wherein the respective safety switch has a connection switch by which a connection between the first and the second connection contact can be established or broken, wherein the bus line is not continuous,Instead, the safety switches are connected in series, with the second terminal contact of one safety switch connected to the first terminal contact of the next safety switch, and the second terminal contact of the last safety switch in the series connection connected to the data bus communication port of the bus master. Safety-related data communication can be implemented particularly reliably via such a bus system. In particular, the system is also suitable for directly transmitting the output safety signals of the safety switches via the data bus to the bus master or from one safety switch to another. Accordingly, the output safety signals can be transmitted via the data bus.

[0052] A first signal state of the output safety signal can signal an active operating state of the system and a second signal state of the output safety signal can signal an inactive operating state of the system.

[0053] In particular, it is possible for the output safety signals to be transmitted exclusively via the data bus. In this case, the safety switches can be implemented with simplified hardware, in particular without the aforementioned at least two-channel input circuit and without the at least two-channel output circuit, via which redundant binary switching signals can be output depending on the switching state of the safety switch.

[0054] The invention therefore also relates to a safety switch for such a system, wherein the safety switch has a data bus communication connection which has a first connection contact and a second connection contact separated from the first connection contact, wherein the safety switch has a connection switch by means of which a connection between the first and the second connection contact can be established or separated.

[0055] The invention is explained in more detail below using exemplary embodiments and drawings.

[0056] It shows Fig. 1 a system with several safety switches and a bus master, Fig. 2 shows another embodiment of a system with several safety switches and a bus master, Fig. 3 a safety switch, Fig. 4 a section of the series circuit according to Fig. 1 with further details, Fig. 5 a time course of a switching signal of a safety switch.

[0057] The Fig. 1 shows, by way of example, a system with a plurality of safety switches 1 and a bus master 5. The safety switches 1 each have an input circuit E with at least two channels and an output circuit A with at least two channels. The safety switches 1 are connected together to form a series circuit, which can also be referred to as a cascaded circuit or daisy chain, in that the output circuit A of the first safety switch 1 (far left) is connected to the input circuit E of the second safety switch, and this is continued in a corresponding manner for the further safety switches until the last safety switch 1 in the series circuit is connected with its output circuit A to an input circuit E of the bus master 5.

[0058] It can also be seen that the safety switches 1 are designed differently. Some safety switches 1 have a data bus communication port 9, while others do not. The bus master 5 also has a data bus communication port. The data bus communication ports 9 are interconnected via a data bus 10 having at least one bus line. The devices connected to the data bus 10 with their data bus communication ports 9 are hereinafter also referred to as bus devices. The bus devices can perform bidirectional data communication via this data bus 10.

[0059] The safety switches 1 can use the chain arrangement of the interconnected output circuit A and input circuit E as an additional communication path, in which a safety switch imprints data to be transmitted as additional data signals onto the switching signals emitted via its output circuit A, e.g., by modulation. In this way, unidirectional data communication can be carried out from the respective safety switch 1, optionally via the safety switches 1 arranged between them, to the bus master 5.

[0060] The data communication via the output circuit A to the bus master 5 can be used, for example, in an initialization phase of the system to determine the device-specific addresses of the safety switches 1, via which they can be addressed by the bus master 5 via the data bus 10. For example, at the beginning of the initialization phase, a pre-stored start address can be stored in all safety switches 1 as a device-specific address. The first safety switch 1 in the series connection, ie the one in Fig. Safety switch 1, located on the far left and furthest away from bus master 5, begins with its start address, e.g., address 1. This address is transmitted via output circuit A to the second safety switch 1. Since this second safety switch 1 does not have a data bus communication port, it cannot be addressed via the data bus. Accordingly, it ignores the transmitted address of the first safety switch 1 and passes it on unchanged to the next safety switch 1 via its output circuit A. The next (here the third) safety switch 1 has a data bus communication port 9 and therefore requires a device-specific address for data bus communication. The safety switch calculates its address from the received address using a predefined algorithm, e.g., by incrementing by the value 1, and in turn transmits its address via its output circuit A to the next safety switch 1.The next (here, the fourth) safety switch 1 performs the same process and transmits its address to the next and, accordingly, last safety switch 1 before bus master 5. This safety switch 1, in turn, has no data bus communication connection. It therefore ignores the received address and transmits it unchanged to bus master 5. Based on the received address, bus master 5 now knows how many safety switches are present as bus devices and in which address space their addresses are located. The initialization phase can now be completed, and the actual data communication via data bus 10 can begin.

[0061] Based on the Fig. 2 explains an alternative scheme for assigning addresses to the safety switches 1. In the simplified Fig. 2 only shows the connection of the safety switches 1 via the data bus 10, but the safety switches 1 can be connected as shown in Fig. 1 are also connected via their output circuits and input circuits to form a series circuit. However, in the embodiment of the Fig. 2 the allocation of addresses is not done via data communication via the output circuits A and the input circuits E, but directly via the data bus 10.

[0062] In a further embodiment of the system according to Fig. 2, the safety switches 1 cannot be connected in series via their input and output circuits. It is also possible that safety switches that do not have such input and output circuits are partially or exclusively used, as explained below.

[0063] For this purpose, the safety switches 1, at least with the exception of the safety switch 1 located furthest from the bus master 5, each have a data bus communication connection 9, which is divided into a first connection contact 9a and a second connection contact 9b. The first and second connection contacts 9a, 9b of a safety switch 1 are designed separately from each other and connected to a connection switch 8 of the respective safety switch 1. The connection switch 8 can, as in Fig. 2. In this case, there is no connection between the connecting contacts 9a, 9b. If the connecting switch 8 is closed, a connection is established between the connecting contacts 9a, 9b of a safety switch 1. Accordingly, the data bus 10 is not designed as a continuous bus line in this case, as in Fig. 1, but as a point-to-point connection from the bus master to the first safety switch and from there from one safety switch to the next safety switch.

[0064] The device-specific addresses can be defined in the initialization phase, for example, by initially storing an identical address in all safety switches 1, e.g., address 0, to signal that no address has yet been assigned for this safety switch 1. Since, due to the connection switch 8 being in the open position, the bus master 5 can initially only communicate via the data bus 10 with the safety switch 1 closest to it, its address is initially defined via such data communication, e.g., address 1. The safety switch 1 then switches the connection switch 8 to the closed state. The safety switch 1 can, if necessary, communicate this to the bus master 5 using an acknowledgment message. The bus master then communicates with the next safety switch 1 in the series.Here, the bus master 5 sets the device-specific address of this second safety switch 1, e.g., address 2. The safety switch 1 then closes its connection switch 8. The process continues until all safety switches 1 have been assigned a device-specific address by the bus master 5. Optionally, it is also possible to not specifically program the safety switch 1 furthest away from the bus master 5 with a device-specific address, but to retain its preprogrammed address for ongoing operation.

[0065] After the device-specific addresses have been defined, the individual safety switches 1 can be addressed by the bus master 5 via their device-specific address via the data bus 10. If the safety switches 1 are additionally connected in series via their output circuits A and input circuits E, as shown in Fig. 1, data communication can also take place by means of the additional data signals impressed on the switching signals emitted via the output circuit.

[0066] In an advantageous embodiment of the invention, however, the safety switches 1 are not connected in series via their output circuits A and input circuits E, or they do not have such output circuits and input circuits at all. In this embodiment, the output safety signals of the safety switches 1, which represent the active or inactive operating state of the monitored system, are transmitted exclusively via the data bus 10 to the bus master or, if necessary, to other safety switches. For monitoring components of the system, such safety switches then have at least one monitoring sensor and / or a monitoring input, for example in the manner described below with reference to the Fig. 3 and Fig. 4 is described.

[0067] The Fig. Figure 3 schematically shows the structure of a safety switch 1 according to the invention. The safety switch 1 has an at least two-channel input circuit E with two safety signal inputs 11, 12 for receiving an input safety signal and an at least two-channel output circuit A with two safety signal outputs 15, 16 for outputting an output safety signal. The safety switch 1 further comprises a control unit 13 connected to the two safety signal inputs 11, 12 and the two safety signal outputs 15, 16.

[0068] If it is a safety switch 1 that is to communicate via the data bus 10, the safety switch 1 additionally has a data bus communication port 9, which can be connected, for example, to an interface, for example a serial interface, of the control unit 13.

[0069] The control unit 13 is configured to detect the operating state of a system to be monitored and to output an output safety signal at the two safety signal outputs 14, 15, the signal state of which signals the detected operating state. Depending on the detected operating state, the safety switch 1 assumes an activated or deactivated state. An activated state exists when the control unit 13 has detected an active operating state of the system. A deactivated state exists when the control unit 13 has detected an inactive operating state of the system. In addition, the control unit 13 is configured to imprint additional data on a safety signal and to decode additional data from a safety signal.

[0070] The safety switch also has a display unit 14, which is connected to the control unit 13 and is configured to visually display the operating status of the system and additional data. In this embodiment, the visual display is provided by LEDs similar to a traffic light, in red, yellow, and green colors.

[0071] The Fig. 4 shows two safety switches 1a, 1b, which are connected in series and are part of the series circuit according to Fig. 1 or Fig. 2, wherein the first safety signal output 15 of the safety switch 1a is connected to the first safety signal input 11 of the safety switch 1b, and the second safety signal output 16 of the first safety switch 1a is connected to the second safety signal input 12 of the second safety switch 1b, each via a connecting line 3 for signal transmission. Furthermore, further safety switches 1, 1a, 1b, evaluation units, switching devices, actuators, and / or other devices can be connected to the safety signal outputs 15, 16 of the safety switch 1b—indicated here by connecting lines 3 drawn in dashed lines.

[0072] In this and the following embodiments, the signal transmission takes place redundantly via two parallel connecting lines 3. This has the advantage that the state signaled via the safety signal outputs 15, 16, in particular a deactivated state, can be reliably detected by another safety switch 1, 1a, 1b connected to the safety signal outputs 15, 16, an evaluation unit or the bus master 5, a switching device and / or another device even if the signal transmission via one of the two parallel connecting lines 3 is disrupted.

[0073] Both safety switches 1a, 1b each monitor the operational safety of a system 2. For this purpose, the safety switches utilize the functionality of external safety sensors 8, 9. The external safety sensor 9 is a light grid positioned near the system 2. It detects, based on an interruption in the light grid, whether a person or object enters a safety zone around the system 2 and thus poses a hazard. The light grid 9 is connected to the safety signal inputs 11, 12 of the safety switch 1a via two parallel connecting lines 3.If the light grid is interrupted and a hazard is thus detected, the light grid sends a safety signal, which signals an inactive operating state of the system, via the connecting lines 3 to the safety switch 1a, whose control unit 13 is thus enabled to detect the current operating state of the system 2.

[0074] In addition to the components of the safety switch 1a, which have already been described in connection with Fig. 3, the safety switch 1b has a communication unit 31 that is connected to the control unit 13 of the safety switch 1b and is configured to communicate with an external safety transmitter 32. The safety transmitter 32 is an actuator that is attached to a protective door 8. The protective door 8 serves to prevent dangerous and therefore prohibited access by a person to a safety area around the system 2 during operation of the system 2. Through the communication of the actuator 32 with the communication unit 31 of the safety switch 1b, an opening of the protective door 8 can be detected and this information can be made available to the safety switch 1b. In this way, the control unit 13 of the safety switch 1b is enabled to detect the current operating state of the system 2.

[0075] Alternatively or in addition to the embodiments of the safety switches 1a and 1b, the functionality of a safety transmitter can also be integrated into the safety switch, so that the safety switch is able to detect the operating state of the system 2 without an external safety transmitter 9, 32.

[0076] If both the light grid 9 is continuously operated and the protective door 8 is closed, the control units 13 of both safety switches 1a, 1b detect an active operating state of the system 2. In this case, both safety switches 1a, 1b have an activated state and both control units 13 of the safety switches 1a, 1b output a safety signal at the safety signal outputs 15, 16 of the respective safety switch, which has the first signal state and thus signals an active operating state of the system 2.

[0077] If a control unit 13 of at least one of the safety switches 1a, 1b detects an inactive operating state of the system 2, e.g. due to an interruption of the light grid 9 and / or due to an opening of the protective door 8, this safety switch 1a, 1b assumes a deactivated state and its control unit 13 outputs an output safety signal at its safety signal outputs 15, 16, which has the second signal state and thus signals an inactive operating state of the system.

[0078] The control unit 13 can detect the operating state of system 2 using an external safety sensor 9, 32 and / or using a safety sensor functionality integrated into the safety switch. The control unit 13 can also detect the operating state of system 2 based on the state of the input safety signal received at the safety signal inputs 11, 12.

[0079] If, for example, the safety switch 1b receives an input safety signal of the second signal state at one or both of its safety signal inputs 11, 12, the safety switch 1b assumes a deactivated state and outputs an output safety signal at both safety signal outputs 15, 16 of the safety switch 1b, which also has the second signal state and thus signals an inactive operating state of the system 2.

[0080] If, however, the safety switch 1b receives an input safety signal at both safety signal inputs 11, 12, which has the first signal state and thus signals an active operating state of the system 2, and if a closed protective door 8 is also reported to the communication unit 31 via the communication connection 33 by the actuator 32, the control unit 13 of the safety switch 1b outputs an output safety signal at the safety signal outputs 15, 16 of the safety switch 1b, which also has the first signal state and thus signals an active operating state of the system 2.

[0081] In addition, the safety switches 1a, 1b can indicate the respectively detected operating state of the system 2 with the aid of their display units 14, e.g. with the aid of a green LED in the case of an active operating state and with the aid of a red LED in the case of an inactive operating state.

[0082] The Fig. 5 shows an exemplary time profile of a safety signal, i.e., a switching signal that can be output and / or received by a safety switch 1, 1a, 1b, over time t. Such a safety signal can, for example, be an output safety signal that a safety switch outputs at its at least one safety signal output.

[0083] The safety signal has a signal value of 25, which in this and the other embodiments shown below is the value of an electrical voltage related to a reference potential of 0 V. The representations of the safety signals in this and the following embodiments are not to scale with regard to the value of the voltage, ie with regard to the signal value of 25.

[0084] The signal value 25 can have two different signal states, namely a first signal state 21 or a second signal state 22. The first signal state 21 is represented by a signal value 25, i.e., an electrical voltage, from a first value range 23 assigned to the first signal state 21, while the second signal state 22 is represented by a signal value 25 from a second value range 24 assigned to the second signal state 22, which is different from the first value range 23 and thus does not overlap.

[0085] The boundaries of the first value range 23 are formed by an upper threshold value 26 and a lower threshold value 27, while the boundaries of the second value range 24 are formed by an upper threshold value 28 and a lower threshold value 29. The lower threshold value 27 of the signal value 25 is formed by a voltage of, for example, +11 V, the upper threshold value 26 is formed by a voltage of, for example, +30 V, the lower threshold value 29 is formed by a voltage of, for example, -3 V, and the upper threshold value 28 is formed by a voltage of, for example, +2 V.

[0086] Over time, the safety signal initially exhibits the first signal state 21, which indicates an active operating state of the system. At time t1, the safety switch detects an inactive operating state of the system and therefore assumes a deactivated state. After time t1, the safety signal emitted by the safety switch therefore exhibits the second signal state 22, which indicates an inactive operating state of the system.

[0087] In the Fig. In the embodiment shown in Figure 5, the control unit of the safety switch imposes additional data signals on the output safety signal by slightly changing the signal value of the output safety signal depending on additional data. Fig. Figure 5 shows an embodiment in which additional data in the form of the bit sequences 10011 and 01001101 is imprinted on the safety signal. This can be, for example, control data and / or diagnostic data.

[0088] It can also be seen that, in order to impose the additional data signals, the signal value of the output safety signal is changed within the limits 26, 27, 28, 29 of the value range 23, 24 associated with the currently output first or second signal state 21, 22. For example, the additional data is imprinted on the output safety signal of the second signal state 22 without the voltage value falling below the lower threshold value 29 of -3 V or exceeding the upper threshold value 28 of +2 V. As a result, the safety signal signals an inactive operating state of the system without change, regardless of the additional data imprinted, so that a safety switch or other device receiving this safety signal receives unadulterated information about the detected operating state of the system.The imprinting of the additional data therefore has no influence on the signal state, which indicates the detected operating state of the system.

[0089] For example, a baseband transmission is used to imprint the additional data, whereby a Manchester code can be used for line coding of the data, which can be regarded as a special form of phase shift keying and a block code.

[0090] The Manchester code used in the illustrated embodiment provides that a binary 0 is encoded by a falling signal edge, i.e., a change from a higher signal level to a lower signal level, and a binary 1 is encoded by a rising signal edge. The use of the Manchester code has the advantage that at least one change in the signal level occurs per bit duration. This enables clock recovery from the received signal.

[0091] It is conceivable that additional data is only impressed on the safety signal if the safety signal has either the first or the second signal state 21, 22. In the Fig. In the embodiment shown in Figure 5, additional data is impressed on the safety signal both when the safety signal has the first signal state 21 and when the safety signal has the second signal state 22.

[0092] Until time t1, the safety signal has the first signal state 21. To imprint the additional data, the signal value of the safety signal is therefore changed within the limits 26, 27 of the value range 23 assigned to the first signal state 21. After the signal state changes to the second signal state 22 at time t1, the signal value of the safety signal is changed within the limits 28, 29 of the value range 24 assigned to the second signal state 22 to imprint the additional data.

[0093] The embodiment in Fig. 5 illustrates that imprinting additional data on an output safety signal and / or a received input safety signal is possible regardless of whether the currently output or received safety signal has the first or second signal state. QUOTES CONTAINED IN THE DESCRIPTION

[0000] This list of documents submitted by the applicant was generated automatically and is included solely for the convenience of the reader. This list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions. Cited patent literature

[0000] EP 3 591 478 A1

[0002]

Claims

[1] A system comprising a plurality of safety switches (1), each having an at least two-channel input circuit (E) and an at least two-channel output circuit (A), via which redundant binary switching signals (21, 22) can be output depending on the switching state of the safety switch (1), and comprising at least one bus master (5) having an at least two-channel input circuit (E), wherein the safety switches (1) are connected in series, in which the output circuit (A) of one safety switch (1) is connected to the input circuit (E) of the next safety switch (1) and the output circuit (A) of the last safety switch (1) in the series is connected to the input circuit (E) of the bus master (5), wherein the bus master (5) and one, several or all of the safety switches (1) each have at least one data bus communication connection (9) in addition to the input circuit (E) and the output circuit (A),via which a bidirectional data communication can be carried out between the respective safety switch (1) and the bus master (5), which is controlled by the bus master (5), wherein the devices which have a data bus communication connection (9) are connected to one another for data communication via a data bus (10) formed from at least one bus line, , characterized by that each safety switch (1) is designed to carry out unidirectional data communication in the direction of the bus master (5) by impressing additional data signals on the switching signals (21, 22) emitted via the output circuit (A), and each safety switch (1) which has a data bus communication connection (9) is designed to carry out bidirectional communication with the bus master (5) via the data bus communication connection (9) upon request by the bus master (5). [2] System according to claim 1, characterized bythat the levels of the additional data signals impressed on the switching signals (21, 22) lie within the limits of the respective value range (23, 24) of the signal state of the switching signal (21, 22) which is respectively output via the output circuit (A). [3] System according to one of the preceding claims, characterized by that the bus master (5) is designed to carry out at least one data communication with each safety switch (1) connected via the data bus (10) within a predetermined frame time. [4] System according to one of the preceding claims, characterized bythat the bus master (5) is set up to query the device-specific identification data of all safety switches (1) connected to the data bus (10) and to compare the identification data with a previously stored list of the connected safety switches, and to enable further operation of the system only if the comparison result is positive. [5] A system comprising a plurality of safety switches (1), each having an at least two-channel input circuit (E) and an at least two-channel output circuit (A), via which redundant binary switching signals (21, 22) can be output depending on the switching state of the safety switch (1), and comprising at least one bus master (5) having an at least two-channel input circuit (E), wherein the safety switches (1) are connected in series, in which the output circuit (A) of one safety switch (1) is connected to the input circuit (E) of the next safety switch (1) and the output circuit (A) of the last safety switch (1) in the series is connected to the input circuit (E) of the bus master (5), wherein the bus master (5) and one, several or all of the safety switches (1) each have at least one data bus communication connection (9) in addition to the input circuit (E) and the output circuit (A),via which a bidirectional data communication can be carried out between the respective safety switch (1) and the bus master (5), which is controlled by the bus master (5), wherein the devices which have a data bus communication connection (9) are connected to one another for data communication via a data bus (10) formed from at least one bus line, wherein the safety switches (1) which have a data bus communication connection (9) can be specifically addressed by the bus master (5) by means of a device-specific address, , characterized by that the system is designed to carry out an initialisation phase during commissioning in which the device-specific addresses of the safety switches (1) are automatically determined according to one or more predefined schemes. [6] System according to claim 5, characterized bythat each safety switch (1) is designed to carry out unidirectional data communication towards the bus master (5) by imposing additional data signals on the switching signals (21, 22) emitted via the output circuit (A), wherein the safety switches (1) are designed to automatically execute the following scheme for determining their device-specific addresses: a) the first safety switch (1) in the series circuit has a pre-stored start address as a device-specific address, which it transmits to the next safety switch (1) via the additional data signals impressed on its switching signals (21, 22) via the output circuit (A), b) the next safety switch (1) receives the data signals and thus the address of the previous safety switch (1) via its input circuit (E), and b1) if this safety switch (1) does not have a data bus communication connection (9), it transmits the received address via the additional data signals impressed on its switching signals (21, 22) via the output circuit (A) to the next safety switch (1), b2) if this safety switch (1) has a data bus communication connection (9), it determines its device-specific address from the received address according to a predetermined algorithm and transmits this address to the next safety switch (1) via the additional data signals impressed on its switching signals (21, 22) via the output circuit (A), c) step b) is repeated until the last safety switch (1) in the series connection transmits its address, if it is a safety switch (1) with a data bus communication port (9), or the received address, if it is a safety switch (1) without a data bus communication port (9), to the bus master (5). [7] System according to claim 5 or 6, characterized byin that, in the case of the safety switches (1) which have a data bus communication connection (9), this data bus communication connection (9) has a first connection contact (9a) and a second connection contact (9b) which is separate from the first connection contact (9a), the safety switch (1) having a connection switch (8) by means of which a connection between the first and the second connection contact (9a, 9b) can be established or severed, the bus line not being continuous, but rather the safety switches (1) being connected in series, the second connection contact (9b) of one safety switch (1) being connected to the first connection contact (9a) of the next safety switch (1) and the second connection contact (9b) of the last safety switch (1) in the series connection being connected to the data bus communication connection (9) of the bus master (5). [8] System according to claim 7, characterized bythat the safety switches (1) are configured to automatically execute the following scheme to determine their device-specific addresses: a) first, the connection switches (8) of all safety switches (1) are opened, b) the bus master (5) carries out data communication via the data bus (10) with the safety switch (1) closest to it in the series connection, the connection switch (8) of which is open, whereby the device-specific address of this safety switch (1) is determined by the data communication, c) this safety switch (1) then closes the connection switch (8), d) steps b) and c) are carried out until the device-specific address is defined for all safety switches (1) that have a data bus communication connection (9). [9] System according to one of claims 5 to 8, characterized bythat one, several or all safety switches (1) each calculate and store a unique serial number for identifying the safety switch (1) according to a predetermined algorithm from production-specific data stored in the safety switch (1), in particular serial number, production batch, wafer number, coordinate on the wafer, and / or transmit it to the bus master (5). [10] System with several safety switches (1) and with at least one bus master (5), wherein the bus master (5) and the safety switches (1) each have at least one data bus communication connection (9) via which a bidirectional data communication can be carried out between the respective safety switch (1) and the bus master (5), which is controlled by the bus master (5), wherein the data bus communication connections (9) are connected to one another for data communication via a data bus (10) formed from at least one bus line, characterized byin that the data bus communication connection (9) of the safety switches (1) each has a first connection contact (9a) and a second connection contact (9b) separate from the first connection contact (9a), wherein the respective safety switch (1) has a connection switch (8) by means of which a connection between the first and the second connection contact (9a, 9b) can be established or broken, wherein the bus line is not continuous, but the safety switches (1) are connected to form a series circuit, in which the second connection contact (9b) of a safety switch (1) is connected to the first connection contact (9a) of the next safety switch (1) and the second connection contact (9b) of the last safety switch (1) in the series circuit is connected to the data bus communication connection (9) of the bus master (5). [11] System according to claim 10, characterized bythat the system is set up to transmit the output safety signals of the safety switches (1), the signal state of which signals the detected operating state of the system monitored by the safety switches (1), via the data bus (10) to the bus master (5), in particular to transmit them exclusively via the data bus (10) to the bus master (5). [12] System according to one of the preceding claims, characterized by , that a) the binary switching signals (21, 22) have a first signal state or a second signal state, b) the safety switch (1) is designed to detect an operating state of the system, which may be an active or an inactive operating state, and to output an output safety signal via the output circuit (A), the signal state of which signals the detected operating state, c) wherein the first signal state signals an active operating state of the system and is represented by a signal value from a first value range assigned to the first signal state, and the second signal state signals an inactive operating state of the system and is represented by a signal value from a second value range assigned to the second signal state, which is different from the first value range, d) wherein the safety switch (1) is configured to imprint the additional data signals on the output safety signal. [13] System according to claim 12, characterized bythat the safety switch (1) is designed to impress the additional data signals on the output safety signal by changing the signal value of the output safety signal within the limits of the value range associated with the currently output signal state of the output safety signal as a function of the additional data to be impressed. [14] System according to one of claims 12 to 13, characterized by that the safety switch (1) is configured to decode additional data impressed on the input safety signal from the input safety signal received via the at least two-channel input circuit. [15] System according to one of the preceding claims, characterized bythat the safety switch (1) is designed to forward additional data signals in that the safety switch (1) imprints additional data signals impressed on the input safety signal in unchanged or modified form on the output safety signal and / or imprints additional data impressed on the output safety signal in unchanged or modified form on the input safety signal. [16] System according to one of the preceding claims, characterized by that the system has, in the series connection of the safety switches (1), one or more safety switches (1) without a data bus communication connection (9) and one or more safety switches (1) with a data bus communication connection (9). [17] Safety switch (1) for a system according to one of the preceding claims, characterized bythat the safety switch (1) has at least one two-channel input circuit (E) and one at least two-channel output circuit (A), via which redundant binary switching signals (21, 22) can be output depending on the switching state of the safety switch (1), wherein the safety switch (1) can be connected to further safety switches (1) to form a series circuit, in which the output circuit (A) of one safety switch (1) is connected to the input circuit (E) of the next safety switch (1) and the output circuit (A) of the last safety switch (1) of the series circuit is connected to the input circuit (E) of a bus master (5), wherein the safety switch (1) has, in addition to the input circuit (E) and the output circuit (A), at least one data bus communication connection (9) via which bidirectional data communication can be carried out between the safety switch (1) and the bus master (5),which is controlled by the bus master (5), wherein the safety switch (1) is configured to carry out unidirectional data communication towards the bus master (5) by impressing additional data signals on the switching signals (21, 22) emitted via the output circuit (A) and to carry out bidirectional communication with the bus master (5) via the data bus communication connection (9) upon request by the bus master (5). [18] Safety switch according to claim 17, characterized by that the levels of the additional data signals impressed on the switching signals (21, 22) lie within the limits of the respective value range of the signal state of the switching signal (21, 22) which is respectively output via the output circuit (A). [19] Safety switch according to claim 17 or 18, characterized byin that the data bus communication connection (9) has a first connection contact (9a) and a second connection contact (9b) separate from the first connection contact (9a), wherein the safety switch (1) has a connection switch (8) by means of which a connection between the first and the second connection contact (9a, 9b) can be established or severed. [20] Safety switch (1) for a system according to one of claims 10 to 11, characterized by that the safety switch (1) has a data bus communication connection (9) which has a first connection contact (9a) and a second connection contact (9b) separate from the first connection contact (9a), wherein the safety switch (1) has a connection switch (8) by means of which a connection between the first and the second connection contact (9a, 9b) can be established or severed. [21] Safety switch according to claim 20, characterized bythat the safety switch (1) is designed without an at least two-channel input circuit (E) and without an at least two-channel output circuit (A), via which redundant binary switching signals (21, 22) can be output depending on the switching state of the safety switch (1).

Images