control unit

Abstract

A control unit (1) for the fail-safe control of an electrical actuator (15) is proposed, comprising: a source (2) of electrical power; at least one power path from the source (2) of electrical power to an output terminal (3) for an actuator (15), in which power path at least one power section (4) is arranged, which power section (4) is configured to switch the polarity of a voltage applied to the output terminal (3) and / or to change the amount of electrical power provided at the output terminal (3); in which power path at least one power switching element (5) is additionally arranged, preferably a normally-open switching element, which power switching element (5) is configured to switch the electrical power provided at the output terminal (3) on and off;at least one sensor (7) arranged downstream of the power switching element (5) for determining the electrical power currently supplied at the output terminal (3); a first signal input for an enable signal (Safety ok2) for actuating the power switching element (5); a second signal input for a switching signal (Release) for supplying the electrical power at the output terminal (3) depending on a switching state of the enable signal (Safety ok2); at least one software-free electrical logic assembly (6a) in the form of a switching network, configured to perform logical operations between the switching state of the switching signal (Release) and the electrical power determined by the sensor (7), and consequently to generate at least one further enable signal (FGS2), which can act on the at least one power switching element (5).

Description

[0001] The invention relates to a control device for fail-safe control of an electrical actuator.

[0002] The invention also relates to claim 19, a system comprising a control device according to the invention and an actuator connected to the output terminal, in particular an electric motor for moving a machine part, preferably a braking or clamping element.

[0003] EP 2 845 072 B1 discloses a (compact) control unit and a system comprising such a control unit and an actuator for moving a machine part, in which the safety functions are provided via software or firmware and via a redundant microcontroller (µC) architecture.

[0004] A particular disadvantage is that there are no safety precautions implemented without the use of microcontrollers. This inevitably results in time losses due to dead times and program runtimes, because all switching signals pass through the microcontrollers. This can be a significant disadvantage for safety-critical applications. Furthermore, the source code used represents a source of errors that can lead to system failure, and internal system diagnostics (without microcontroller involvement) are not provided.

[0005] The invention is based on the object of providing a control unit and a system comprising such a control unit and an actuator that overcomes the aforementioned disadvantages and, in particular, operates more reliably and without time losses due to dead times and program runtimes. Furthermore, sources of error that could lead to failure of the device or system are to be avoided in order to enable or improve its use in safety-relevant applications.

[0006] This object is achieved according to the invention by a control device having the features of claim 1 and by a system having the features of claim 19 comprising such a control device and an actuator connected to an output terminal of the control device.

[0007] Advantageous further developments of these inventive objects are defined in the respective subclaims.

[0008] According to the invention, a control unit for fail-safe control of an electrical actuator has a source of electrical power. From the source of electrical power there is at least one power path to an output terminal for an actuator, in which power path at least one power component is arranged. This power component is designed to switch the polarity of a voltage applied to the output terminal and / or to change the amount of electrical power provided at the output terminal. In addition, at least one power switching element is arranged in the power path, preferably a normally-open switching element, which therefore interrupts the power path in its basic state. The power switching element is designed to switch the electrical power provided at the output terminal on and off.The control unit also includes at least one sensor arranged downstream of the power switching element for determining the electrical power currently provided at the output terminal. Furthermore, the control unit includes a first signal input for an enable signal for actuating the power switching element and a second signal input for a switching signal for providing the electrical power at the output terminal depending on a switching state of the enable signal. Furthermore, the control unit includes at least one software-free electrical logic module in the form of a switching network (see, for example, Grafendorfer, W. (1977). Switching devices and switching networks. In: Introduction to data processing for computer scientists. Physica paperback.Physica, Heidelberg, which is designed to perform logical operations between the switching state of the switching signal and the electrical power determined by the sensor means, and subsequently to generate at least one further enable signal. This further enable signal can be used to influence or affect the at least one power switching element.

[0009] A system according to the invention comprises a control device according to the invention and an actuator connected to the output connection, in particular an electric motor for moving a machine part, preferably a braking or clamping element.

[0010] The control unit according to the invention therefore provides for the implementation of safety-relevant functions without the significant use of a microcontroller with corresponding software / firmware, thereby avoiding the aforementioned disadvantages. By providing the enable signal, the switching signal, and the determination of the electrical power by the sensor means, along with the generation of at least one further enable signal based on logical links between the switching state of the switching signal and the determined electrical power, the proper functioning of the control unit can be verified quickly, permanently, and reliably, which is essential or at least highly advantageous for safety-relevant applications.

[0011] In this way, the present invention also overcomes the lack of feedback information for diagnosing the functionality and accuracy of the power path, which is problematic for safety reasons in the prior art: Within the scope of the invention, a comparison of current flow or output power with a switching state of the control signal is possible without the use of a microcontroller. This advantageously ensures that no current flows or no power is output when no corresponding control signal is present.

[0012] By providing an enable signal separate from the switching signal, the control unit can be "switched off" by a higher-level control unit, e.g., a programmable logic controller (PLC). This overcomes an inherent disadvantage of the prior art, particularly according to EP 2 845 072 B1, where no such separation exists between the enable signal and the switching signal. Figuratively speaking, this is equivalent to a safety gate that simultaneously controls the robot. In the prior art, the control signal is directly connected to the power switching element, so errors in the control signal directly affect the control of the actuators.

[0013] Unlike the prior art, in the context of the present invention, a physical separation between the actuator (i.e. an actuator connected to the control unit) and the control unit can be established (by means of the power switching element) in order to increase operational reliability.

[0014] The following further developments of the basic inventive idea have proven to be particularly advantageous: In a further development of the control device according to the invention, the electrical power at the output terminal is only switched on or can be switched on if both the enable signal and the further enable signal each command a corresponding switching state of the power switching element, in particular a closing of the power switching element.

[0015] In this way, it can be avoided, for example, that power is output at the output terminal when the sensor means registers a current flow even though the enable signal does not have a corresponding switching state, which indicates a fault.

[0016] In another development of the control unit according to the invention, the power switching element is designed as at least one electromechanically, electrically, or purely mechanically active isolating element integrated into the power path, preferably with a redundant design. In particular, the isolating element can be designed as a contactor, relay, or semiconductor relay. It serves to interrupt a power supply to the output terminal. The at least one isolating element can be monitored with regard to its switching state or function from outside the control unit via at least one downstream sensor, in that the relevant sensor terminals are led out of the control unit.

[0017] This also contributes to a further increase in the functional reliability of the control unit.

[0018] In yet another development of the control unit according to the invention, it comprises at least one, in particular digital, evaluation unit (a microcontroller) designed to receive the switching signal and a corresponding switching time (i.e., a change in the state of the switching signal). The control unit is further designed to provide the power with a predetermined time profile at the output terminal and to generate at least one additional enable signal depending on an operating state of the evaluation unit. The additional enable signal can be used to act on the at least one power switching element.

[0019] It is important in this context that the integrated microcontroller only processes non-safety-relevant functions. It participates in the safety functionality solely with an (additional) enable signal in the power path.

[0020] To further increase operational reliability, a further development of the control unit according to the invention can provide that the electrical power at the output terminal is only switched on or can only be switched on if both the enable signal and the further enable signal, as well as the additional enable signal, each command a corresponding switching state of the power switching element. Therefore, the power output can only occur if the evaluation unit indicates its operational readiness.

[0021] In yet another development of the control unit according to the invention, the evaluation unit is designed to process exclusively non-safety-relevant functions, in particular with the aid of software and / or algorithms. Preferably, the functions implemented by software and / or algorithms can be deactivated at any time by removing the enable signal (i.e., setting the relevant signal to 0 (LOW)) and are thus irrelevant when considering functional system safety.

[0022] In this way, the basic advantages of the invention can be retained without completely foregoing the advantageous use of a digital evaluation unit with corresponding software / algorithms.

[0023] In yet another development of the control device according to the invention, the evaluation unit is designed to generate an additional release signal, in particular with the aid of software and / or algorithms, in order to signal operational readiness and / or, by switching off the power, error cases (e.g. by outputting a corresponding error signal).

[0024] This enables a type of "self-diagnosis" and the evaluation of certain sensor data, e.g., detecting defective position sensors for the actuator or a (machine) part moved by the actuator, an integrated temperature sensor to signal overtemperature, detecting a power supply failure (mains voltage), detecting faulty parameters in the software itself, e.g., no parameters programmed for a clamping unit, or displaying a maintenance notification. The error signal communicates the corresponding data externally to the user, while the aforementioned internal signal (the additional enable signal) enables corresponding "internal" communication within the control unit.

[0025] A corresponding development of the control unit according to the invention therefore provides that the evaluation unit is designed to generate at least one further signal, in particular with the aid of software and / or algorithms, and to provide it at a respective output in order to make any errors, such as a defective sensor, a maintenance condition, or condition monitoring, available outside the control unit. This was already mentioned above.

[0026] In yet another embodiment of the control unit according to the invention, the evaluation unit is designed to act on the power section, in particular in accordance with the switching signal, in order to generate a time-dependent power by means of the power section for provision at the output terminal. This time-dependent power can preferably be used to transfer the actuator (or a machine part moved by the actuator) to at least one target position and to subsequently hold it in the target position.

[0027] The switching signal advantageously only has the values ​​0 (LOW) or 1 (HIGH) and thus signals a point in time at which the actuator or machine part is to be moved, e.g. a brake is to be opened or closed. The actuator or brake is then transferred to the desired state. This usually requires a relatively high level of power for a short time and then no power (brake is closed) or only a relatively low level (brake is held open). This means that the (required) power varies over time. In technical terms, the time during which the actuator is controlled with more power than it can permanently tolerate thermally is referred to as overexcitation. Example: To open a specific clamping unit from the applicant's range, a power of 2 kW is required for approximately 0.3 seconds to transfer the motor in question; thereafter, only approximately 5 W is required to hold the motor in the respective position.This time-dependent power can be achieved, in particular, by suitable, time-variable control of the power section via the evaluation unit (controller unit or microcontroller). Such time-dependent power or overexcitation can be provided independently of direction to move the actuator / motor to any desired target position and, in particular, also supports the demagnetization of the actuator. This active demagnetization enables controlled high-speed switch-off behavior of the brake(s) or other (safety-relevant) component acted upon by the actuator.

[0028] In yet another embodiment of the control unit according to the invention, at least one external connection is provided in operative connection with the evaluation unit, in order to program and / or parameterize the evaluation unit via the external connections, preferably with software support. This allows the time-dependent power to be adjusted, preferably in coordination with a connected actuator, in order to enable application-specifically adapted switching-on and switching-off behavior of the actuator, for example, with regard to required switching times.

[0029] This has already been explained above by way of example. Of course, the invention is not limited to such applications.

[0030] In yet another embodiment of the control unit according to the invention, at least one input connection is provided for reading and detecting a position signal. This position signal preferably indicates the actual position of the actuator in order to generate the aforementioned additional signal as a function of this. This additional signal can preferably be used for internal switching time evaluations, wear detection, and indicating the correct functioning of the (position) sensor system.

[0031] In yet another embodiment of the control unit according to the invention, at least two input connections are provided for reading and detecting two position signals. The two position signals or the corresponding position sensors present preferably redundantly indicate an actual position of the actuator. The evaluation unit is accordingly designed to generate the additional signal depending on a logical combination, in particular an XOR combination or an XNOR combination, of the switching states of the two position signals.

[0032] This makes it easy to monitor the proper functioning of the position sensors (Sensor1, Sensor2): If Signal(Sensor1) = 1 (HIGH), for example, Signal(Sensor2) must be 0 (LOW). If Signal(Sensor1) = 0 (LOW), Signal(Sensor2) must be 1 (HIGH). The sensors can therefore be identical, but they must always deliver opposite sensor values ​​(0 / 1 or 1 / 0). If both values ​​are 0 or 1, one of the sensors is defective, and an appropriate error message is issued. The same effect can also be achieved if both sensors are wired so that they always display the same value under normal conditions.

[0033] In another development of the control unit according to the invention, at least one external connection for tapping internally generated voltages for external analysis of a voltage supply and / or voltage conversion is present within the control unit.

[0034] This makes it possible to monitor whether the power supply and conversion are working correctly.

[0035] In another development of the control device according to the invention, the power section comprises an H-bridge circuit or a four-quadrant controller with semiconductor switches.

[0036] Such circuits are familiar to those skilled in the art. They generally consist of an electronic H-bridge circuit consisting of four semiconductor switches, usually transistors, that can convert a direct current into an alternating current of variable frequency.

[0037] In yet another development of the control device according to the invention, the power section for controlling a three-phase actuator is designed such that it comprises a triple H-bridge circuit or a triple four-quadrant controller with semiconductor switches.

[0038] In yet another development of the control device according to the invention, the power switching element is connected between the power section and the output terminal.

[0039] It serves in a simple way to enable or interrupt the power supply from the power unit to the output terminal.

[0040] In another development of the control unit according to the invention, it has a third signal input for a further switching signal for activating or deactivating the power unit.

[0041] In this way, the operational reliability of the control unit is further increased.

[0042] Finally, another development of the control device according to the invention provides that the input connection or the input connections are designed to duplicate the position signal of a respectively connected position sensor in order to make the duplicated position signal available to an external control unit.

[0043] In this way, the position signal(s) can also be evaluated and used in parallel by a higher-level controller (e.g. a programmable logic controller, SPS or PLC).

[0044] In addition, the position sensor data can also be evaluated internally for other purposes (e.g. lifetime counter, switching time analysis, etc.).

[0045] A corresponding advantageous development of the system according to the invention includes an external control unit, in particular a programmable logic controller (PLC), in operative connection with the control unit for providing the enable signal at the first signal input and the switching signal at the second signal input. The PLC can also be used or configured to provide a further (fourth) enable signal at the third signal input and / or to read the duplicated position signal(s). Further interactions between the PLC and the control unit are evident from the description of the figures.

[0046] The control unit according to the invention enables integrated switching state monitoring via inductance measurements in the connected actuators. This monitoring is enabled by the sensors present in the power path. A superimposed frequency (small signal) on the output voltage (at the output terminal) and the resulting frequency on the current signal (amplitude, phase shift) enable inductance measurements. Depending on the application and actuator, the inductance is stroke-dependent and allows statements to be made about the state of a connected actuator, e.g., about a brake state (open / closed). This information about the inductance is thus equivalent to the switching state information of the connected position sensor data and can be used accordingly for evaluation purposes.

[0047] Further features and advantages of the invention will become apparent from the following description of the figures based on the drawing. Fig. 1 shows a high-level circuit diagram of a control device according to the invention; Fig. 2 shows a more detailed circuit diagram of a control unit according to the invention with a connected actuator; Fig. 3 shows a more detailed circuit diagram of another control unit according to the invention with a connected actuator; and Fig. 4 shows a more detailed circuit diagram of yet another control unit according to the invention with a connected actuator.

[0048] In the Fig. Figure 1 shows a high-level circuit diagram of a control unit 1 according to the invention. The control unit is designated overall by the reference numeral 1 and symbolized by a dashed line (rectangle). It comprises a source of electrical power 2, which can be operatively connected to an external mains voltage (not shown). From the source of electrical power 2, there is at least one power path to an output terminal 3 for an actuator (in Fig. 1 not shown). In this power path, at least one power section 4 is arranged, which is Fig. 1 is designed, without limitation, as an H-bridge circuit 4a comprising semiconductor switching elements (semiconductor relays). This power section is designed to switch the polarity of a voltage applied to the output terminal 3 for the actuator and / or to change the amount of electrical power provided at the output terminal 3. At least one power switching element 5 is additionally arranged in the power path, which in this case is designed as a normally-open switching element, in particular as an electromechanical relay, which interrupts the power path in its basic state. The power switching element 5 is designed to switch the electrical power provided at the output terminal 3 on and off.

[0049] In addition, the control unit 1 comprises a monitoring circuit 6 and at least one sensor means 7, shown only symbolically, which, in contrast to the illustration in Fig. 1 can also be arranged behind the power switching element 5 to determine the electrical power currently provided at the output terminal 3 or a corresponding current flow.

[0050] In addition, the control unit 1 also includes a first signal input for an enable signal "Safety ok2" for actuating the power switching element 5 and a second signal input for a switching signal "Release" for providing the electrical power at the output terminal depending on a switching state of the enable signal. The switching signal is applied to the monitoring circuit 6, where it is compared in hardware with a sensor signal "lout" from the sensor means 7: If a current flows (lout > 0), i.e., power is output at the output terminal 3 even though the switching signal does not have the appropriate associated switching state, the monitoring circuit 6 detects an error and disconnects the output, i.e., the power switching element 5 disconnects the power section 4 from the output terminal 3.

[0051] The monitoring circuit 6 comprises at least one software-free electrical logic module in the form of a switching network (see, for example, the definition in Grafendorfer, W. (1977). Switchgears and switching networks. In: Introduction to data processing for computer scientists. Physica paperback. Physica, Heidelberg), cf. in particular Fig. 2. This is designed to perform logical operations between the switching state of the switching signal and the electrical power determined by the sensor means and, as a result, to generate at least one further enable signal. This further enable signal is in Fig. 1 is designated FGS2. This additional enable signal FGS2 can be used to act on the power switching element 5 via a switching device 8 (in this case, a transistor to which the enable signal is also applied).

[0052] Reference numeral 9 denotes an evaluation unit in the form of a microcontroller, which in particular receives the switching signal and controls the power unit 4 accordingly in order to provide power at the output terminal 3, preferably in a time-dependent manner, ie the power is dependent in terms of amount (and with regard to its “direction”, i.e. a polarity of the relevant voltage or current flow direction) on a period of time since the application of the “release” switching signal and is preferably variable over time.

[0053] The microcontroller 9 outputs another signal in the form of an error signal “Error” if, for example, the power source 2 is not ready for operation.

[0054] The “Safety ok1” signal is a further enable signal (here also referred to as the “fourth enable signal”) for activating or deactivating power unit 4.

[0055] Two, preferably identically designed, position sensors 11, 12 for an actuator, i.e., for detecting a position of the actuator, are operatively connected to the microcontroller 9 and, accordingly, to the control unit 1 via a connection terminal 10. The output signal of each position sensor 11, 12 is duplicated and output at reference numerals 11' and 12', respectively (as "Safety Sensor 1" and "Safety Sensor 2").

[0056] The additional sensor means 13, 14 are arranged behind the power section 4, in front of and behind the power switching element 5, respectively. They detect the presence of a voltage between the two output conductors 3a and 3b. In the present case, both sensor means 13, 14 are designed - without limitation - such that they are active when no voltage is present between 3a and 3b. Contrary to the illustration in Fig. 1 is also available outside the control unit 1. For this purpose, both sensor signals are preferably - without limitation - routed to the outside in a galvanically isolated manner via optocouplers.

[0057] The signal input to and output from control unit 1 can, in principle—without limitation—be carried out via photodiodes and phototransistors (optocouplers), as shown. This is known per se to those skilled in the art and need not be explained further here.

[0058] The control unit 1 described above is designed such that power is only output at the output terminal 3 when both the enable signal "Safety ok2" and the further enable signal FGS2, which is generated by the monitoring circuit 6 as a function of the switching signal ("release") and the current flow lout measured by the sensor means 7 through a logical combination, each command a corresponding switching state of the power switching element 5. In particular, the further enable signal FGS2 will not command such a switching state of the power switching element 5 if, despite the absence of a switching signal (e.g., release = 0 (LOW)), a current flow is measured by the sensor means 7 (lout ≠ 0). The enable signal FGS2 then ensures that the power switching element 5 remains open.

[0059] The switching or release signals “Release”, “Safety ok2” and “Safety ok1” preferably come from a higher-level control system (SPS / PLC), see. Fig. 2 and Fig. 3.

[0060] The Fig. The inventive solution shown in Figure 1 results in a system architecture for constructing fail-safe controllers or control units without the direct influence of software / firmware or microcontrollers. A three-stage, microcontroller-independent and thus software-free enable signal concept is introduced that serially monitors the control of an actuator, e.g., a clamping unit, for leaving a safe state and transitioning to an enabled and thus fundamentally unsafe state: A first stage comprises the blocking or enabling of a semiconductor relay (in the power section 4) by means of the (fourth) enable signal "Safety OK1." A second stage comprises the blocking or enabling of a switching relay (of the power switching element 5) by means of at least one enable signal ("Safety OK2" and / or FGS3). A third stage comprises the blocking or enabling of the switching relay depending on logical connections between the flowing current (measured by the sensor means 7) and the current switching signal by means of the further enable signal FGS2.

[0061] Fig. 2 shows a more detailed circuit diagram of the control unit 1 according to the invention from Fig. 1 with connected actuator (electric motor) 15 and a higher-level controller (PLC) 16. Otherwise, the same reference symbols in the figures designate the same or at least similarly acting elements.

[0062] In the following, only the essential features according to Fig. 2 discussed in more detail: Power source 2 is connected to a mains voltage (AC voltage) via terminal A. It generates various DC voltages VCC A , VCC B , VCC... (... = x, y, z) and outputs them, e.g. to supply the microcontroller 9 (with VCC y ). GND stands for ground.

[0063] The reference symbols B to P denote further connections of the control unit 1. In particular, the connections H and I correspond to the output connection 3 in Fig. 1 (connecting conductors 3a, 3b). The enable signal "Safety ok2" is present at terminal N (see Fig. 1). The switching signal “Release” is present at terminal O (see Fig. 1). The (fourth) enable signal “Safety ok1” is present at terminal P (see Fig. 1). All of the latter signals originate from the PLC / SPS 16.

[0064] A further isolating element 17 is arranged between the terminal P and the power section 4, which switches the power section 4 on or off (activates or deactivates) in accordance with the switching signal at the terminal P.

[0065] Reference numeral 7 again denotes the already mentioned sensor means for monitoring the output current (shown here as an ammeter), which in this case is arranged behind the power switching element 5.

[0066] The additional signal (error signal) “Error” is output to the PLC / SPS at connection K, see. Fig. 1. The sensor signal of the sensor device 13 (voltmeter) is output at terminal L, and the sensor signal of the sensor device 14 (voltmeter) is output at terminal M, cf. Fig. 1.

[0067] The position sensors 11, 12 detect a position of the actuator 15. The respective position signals are duplicated and provided to both the microcontroller 9 and the PLC / SPS 16.

[0068] Explicitly shown in Fig. 2 shows a preferred embodiment of the monitoring circuit 6, which comprises at least one software-free electrical logic module 6a in the form of a switching network. This logic module 6a is designed to perform logical operations between the switching state of the switching signal (at terminal O) and the electrical power determined by the sensor means 7 or the associated current flow. The result of the operation is used to generate at least one further enable signal, FGS2, as already described. This further enable signal FGS2 can be used to act on the power switching element 5 via the switching means 8 (in this case, an arrangement of several transistors to which the enable signal from terminal N is also applied).

[0069] The logic module 6a comprises, by way of example and without limitation, the following elements (software-free logic gates): An element 6aa for determining whether the said current flow is > 0 A; two N / O gates 6ab, 6ac operatively connected to the element 6aa or the terminal O; an AND gate 6ad for the outputs of the two N / O gates 6ab, 6ac; and a NOR (Not-Or) gate 6ae for the output of the AND gate 6ad and the signal at the terminal O. Thus, FGS2 = 1 (HIGH) if the switching signal at the terminal O is also 1 (HIGH). If the switching signal at the terminal O = 0 (LOW), FGS2 is only HIGH if the sensor means 7 does not measure any current flow. If a current flows despite the switching signal at the terminal O = 0 (LOW), an error exists, and the power switching element 5 remains open (no power at 3).

[0070] It should be noted again here that none of the switching / release signals mentioned so far are processed by microcontroller 9. Furthermore, the release signals can advantageously enable a physical separation between the actuator (actuator 15) and control unit 1. Redundant feedback signals of the power path for monitoring it are also not affected by microcontroller 9. This integrated microcontroller 9 supplements the functionality exclusively with non-safety-relevant features, such as a service life analysis, wear (condition) monitoring, evaluation of switching times, etc.

[0071] The above-mentioned integration of a power path monitoring preferably includes a voltage detection behind the semiconductor relay or the power section 4 (sensor means 13, terminal L), a voltage detection behind the switching relay or the power switching element 5 (sensor means 14, terminal M) and a current measurement in the power path to the actuator (actuator 15) by the sensor means 7.

[0072] Fig. 3 shows a more detailed circuit diagram of another control device 1 according to the invention, again with connected actuator 15 and PLC / SPS 16.

[0073] In addition to the design in Fig. 2, the control unit 1 comprises a further signal connection (shown in dashed lines) between the microcontroller 9 and the switching means 8 (in this case an arrangement of three transistors, to which the enable signal from terminal N and the further enable signal FGS2 from the monitoring circuit 6 are also applied) which can act on the power switching element 5.

[0074] In the embodiment shown, the microcontroller 9 is designed to generate at least one additional enable signal FGS3 depending on its operating state, with which additional enable signal FGS3 can be applied to the power switching element 5 via the switching means 8. The electrical power at the output terminal 3 is only switched on if both the enable signal (at terminal N) and the further enable signal FGS2 and the additional enable signal FGS3 each command a corresponding switching state of the power switching element 5. This will not be the case, for example, if the microcontroller 9 is not ready for operation (because, for example, the voltage VCC y is not present).

[0075] The position sensors 11, 12 in the Fig. 1 to 3 are connected to the control unit 1 via two or four input connections BE. These connections are used to read and record two position signals, one per sensor 11, 12, whereby the two position signals redundantly represent an actual position of the actuator 15 (cf. Fig. 2 and Fig. 3) display.

[0076] The microcontroller 9 is designed to generate a further signal (error signal), which is output at terminal K, as already mentioned. This can occur depending on a logical combination, in particular an XOR combination or an XNOR combination, of the switching states of the two position signals (at B, C or D, E). In this way, it can be checked during switching whether one of the position sensors 11, 12 is defective. If, for example (without limitation), the signal from sensor 1 (reference numeral 11) = 1 (HIGH), it can be provided that the signal from sensor 2 (reference numeral 12) must be 0 (LOW). Conversely, if sensor 1 = 0 (LOW), then sensor 2 must be 1 (HIGH). The position sensors 11, 12 are therefore preferably identical, but must always deliver the opposite values ​​(0 / 1 or 1 / 0).If the case occurs that both values ​​are 0 / 0 or 1 / 1, one of the position sensors 11, 12 is defective and a corresponding error signal is output at K.

[0077] Fig. Figure 3 thus shows the optional extension of the invention to a 4-stage enable concept: The integrated microcontroller 9 participates in the safety path with an additional (dedicated) enable signal FGS3 in the power path. This can be used, for example, to signal a safe startup or the general operational readiness of the microcontroller 9. However, the microcontroller 9 is still not involved in safety-relevant functions.

[0078] In general, the integrated microcontroller 9 only processes non-safety-relevant functions within the framework of Industry 4.0, communication, generation of the mentioned error signal at K through further SW analyses as well as output and communication in the event of an error, e.g. in the event of a power failure.

[0079] Fig. 4 shows basically the same design of the control unit as the Fig. 3, with the exception of the additional external connectors Q and R. Connector Q is operatively connected to microcontroller 9, for example, for programming or parameterizing it. Connector Q is, for example, a USB connector (preferably USB-C), but other connector types are also possible, such as a COM port (Sub-D-9).

[0080] Terminal R supplies the control unit (microcontroller 9) with a voltage of preferably 24 V or signals the functionality of the control unit via a corresponding voltage signal. The voltage VCC c at terminal R is preferably not directly connected to the microcontroller 9, but the microcontroller 9 is supplied with a voltage VCC y of 5 V or 3.3 V, ie with a voltage of VCC cderived voltage. The external terminal R is therefore also used in particular to tap internally generated voltages for external analysis of a voltage supply and / or voltage conversion within control unit 1. QUOTES CONTAINED IN THE DESCRIPTION

[0000] This list of documents submitted by the applicant was generated automatically and is included solely for the convenience of the reader. This list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions. Cited patent literature

[0000] EP 2 845 072 B1 [0003, 0012]

Claims

[1] Control device (1) for fail-safe control of an electrical actuator (15), comprising: a source (2) of electrical power; at least one power path from the source (2) of electrical power to an output terminal (3) for an actuator (15), in which power path at least one power part (4) is arranged, which power part (4) is designed to switch the polarity of a voltage applied to the output terminal (3) and / or to change the amount of electrical power provided at the output terminal (3); in which power path at least one power switching element (5) is additionally arranged, preferably a normally-open switching element, which power switching element (5) is designed to switch the electrical power provided at the output terminal (3) on and off; at least one sensor means (7) arranged behind the power switching element (5) for determining the electrical power currently provided at the output terminal (3); a first signal input (N) for an enable signal (Safety ok2) for actuating the power switching element (5); a second signal input (O) for a switching signal (release) for providing the electrical power at the output terminal (3) depending on a switching state of the release signal (Safety ok2); at least one software-free electrical logic module (6a) in the form of a switching network, which is designed to carry out logical links between the switching state of the switching signal (release) and the electrical power determined by the sensor means (7) and consequently to generate at least one further release signal (FGS2), with which further release signal (FGS2) can act on the at least one power switching element (5). [2] Control device (1) according to claim 1, wherein the electrical power at the output terminal (3) is only switched on when both the enable signal (Safety ok2) and the further enable signal (FGS2) each command a corresponding switching state of the power switching element (5). [3] Control unit (1) according to claim 1 or 2, wherein the power switching element (5) is designed as at least one isolating element, in particular a contactor, relay or semiconductor relay, which is integrated into the power path and is preferably redundant and is effective electromechanically, electrically or purely mechanically, for interrupting a power supply to the output terminal (3), wherein the at least one isolating element can be monitored with regard to its switching state from outside the control unit (1) via at least one downstream sensor means (14), in that the relevant sensor terminals are led out of the control unit (1) to the outside. [4] Control device (1) according to one of claims 1 to 3, with at least one evaluation unit (9), in particular a digital one, which is designed to receive the switching signal (release) and a corresponding switching time for providing the power with a time profile at the output terminal (3) and to generate at least one additional release signal (FGS3) depending on an operating state of the evaluation unit (9), with which additional release signal (FGS3) can act on the at least one power switching element (5). [5] Control device (1) according to claim 4, wherein the electrical power at the output terminal (3) is only switched on when both the enable signal (Safety ok2) and the further enable signal (FGS2) and the additional enable signal (FGS3) each command a corresponding switching state of the power switching element (5). [6] Control device (1) according to claim 4 or 5, in which the evaluation unit (9) is designed to process exclusively non-safety-relevant functions, in particular with the aid of software and / or algorithms, wherein preferably the functions implemented by software and / or algorithms can be deactivated at any time by removing the enable signal (Safety ok2). [7] Control device (1) according to one of claims 4 to 6, in which the evaluation unit (9) is designed to generate the additional release signal (FGS3), in particular with the aid of software and / or algorithms, in order to signal operational readiness and / or, by switching off the power, error cases. [8] Control unit (1) according to one of claims 4 to 7, in which the evaluation unit (9) is designed to generate at least one further signal (error), in particular with the aid of software and / or algorithms, and to provide it at a respective output (K) in order to make any errors, for example a defective sensor means (7, 11, 12, 13, 14), a maintenance condition or a condition monitoring, available outside the control unit (1). [9] Control device (1) according to one of claims 4 to 8, in which the evaluation unit (9) is designed to act on the power part (4), in particular in accordance with the switching signal (release), in order to generate a time-dependent power for provision at the output terminal (3) by means of the power part (4), which time-dependent power can preferably be used to transfer the actuator (15) into at least one target position and to subsequently hold it in the target position. [10] Control device (1) according to claim 9, with at least one external connection (Q) in operative connection with the evaluation unit (9) in order to program and / or parameterize the evaluation unit (9) via the external connection (Q), preferably software-supported, and thus to adjust the time-dependent power, preferably in coordination with a connected actuator (15), in order to enable an application-specifically adapted switching-on behavior and switching-off behavior of the actuator (15), for example with regard to necessary switching times. [11] Control device (1) according to one of claims 1 to 10 with reference back to claim 8, with at least one input connection (BE) for reading in and detecting a position signal which indicates an actual position of the actuator (15) in order to generate the further signal (error) as a function thereof. [12] Control device (1) according to claim 11, with at least two input terminals (BE) for reading in and detecting two position signals, wherein the two position signals redundantly indicate an actual position of the actuator (15), in which the evaluation unit (9) is designed to generate the further signal (error) as a function of a logical combination, in particular an XOR combination or an XNOR combination, of switching states of the two position signals. [13] Control unit (1) according to one of claims 1 to 12, with at least one external terminal (R) for tapping internally generated voltages for external analysis of a voltage supply and / or voltage conversion within the control unit (1). [14] Control device (1) according to one of claims 1 to 13, wherein the power section (4) comprises an H-bridge circuit (4a) or a four-quadrant controller with semiconductor switches. [15] Control device (1) according to one of claims 1 to 14, wherein the power section (4) for controlling a three-phase actuator comprises a triple H-bridge circuit or a triple four-quadrant controller with semiconductor switches. [16] Control device (1) according to one of claims 1 to 15, wherein the power switching element (5) is connected between the power part (4) and the output terminal (3). [17] Control device (1) according to one of claims 1 to 16, with a third signal input (P) for a fourth enable signal (Safety ok1) for activating or deactivating the power unit (4). [18] Control device (1) according to one of claims 1 to 17 with reference to claim 11 or 12, in which the input terminal or the input terminals (BE) are designed to duplicate the position signal of a respectively connected position sensor (11, 12) in order to make the duplicated position signal available to an external control unit (16). [19] System comprising a control device (1) according to one of claims 1 to 18 and an actuator (15) connected to the output terminal (3), in particular an electric motor for moving a machine part, preferably a braking or clamping element. [20] System according to claim 19, with an external control unit (16), in particular a programmable logic controller, in operative connection with the control device (1) for providing the release signal (Safety ok2) at the first signal input (N) and the switching signal (Release) at the second signal input (O), and preferably and with reference to claim 17 for providing the fourth release signal (Safety ok1) at the third signal input (P) and / or preferably and with reference to claim 18 for reading out the duplicated position signal(s). [21] System according to claim 19 or 20, which is designed by sensor means (7, 13, 14) present in the power path to carry out an integrated switching state monitoring via inductance measurements in the connected actuator (15) by using a superimposed frequency on an output voltage at the output terminal (3) and a resulting frequency on an associated current signal for inductance measurements.

Images