Safety control

Abstract

Safety controller (1) with a housing (2) with connections (3) for multiple outputs (4) and connections (3) for multiple inputs (5) and at least one display unit (6), characterized in that the housing (2) has at least two modules (7), wherein a first module (8) has a central safety control and evaluation unit (12) and a central processing unit (13) for display information and the display unit (6), wherein a second module (9) is an input / output module with a second control and evaluation unit (14) with the multiple inputs (5) and the multiple outputs (4), wherein the control and evaluation units (12, 14) of the modules (8, 9) are connected to each other at least via a communication bus (15), wherein the second module (9) has a shift register (16) to which the binary information of the second control and evaluation unit (14) is supplied,wherein the central processing unit (13) of the first module (8) and the shift register (16) of the second module (9) are connected to each other via a serial interface (17).

Description

The present invention relates to a secure controller according to the preamble of claim 1.In present-day automation of machining centers, in particular industrial installations, the requirement for safe monitoring and a safe reaction in the event of a hazardous situation is constantly increasing in order to protect the personnel at the machining centers and to ensure high operational reliability.Safety controls are used for this purpose, which monitor the machining centers and react in a predefined manner without errors when a danger signal is present. One such known application is the protection of hazardous working machines, such as automation cells, in particular robot working cells, presses or the like, which are immediately switched off or brought into a safe state when operating personnel approach the working machines in an impermissible manner or are located in their movement areas. To detect the hazardous situation, the safety controller receives signals from associated sensors, such as a light barrier, a light grid, a camera or the like, which are evaluated by the safety controller and a corresponding safety reaction is triggered by the safety controller.Modular safety controls, generally for switchgear cabinet operation, offer the great advantage that the user can dimension his control system according to the task to be solved. The number of necessary I / Os, network interfaces or other functions can be freely selected to some extent by plugging the corresponding modules together.The modules typically represent a stand-alone device and include all associated interfaces. A classic I / O module contains, for example, a spring terminal strip for connecting the sensors and actuators, a supply connection, a system interface for connecting to the rest of the control system, and a man-machine interface (HMI for short) in the form of predominantly LEDs in order to indicate the status of the inputs and outputs (I / OS for short), the fieldbus interfaces and the module in general.Appliances for switchgear cabinet operation require a low protection class, for example IP20, in accordance with DIN EN 60529 and have low requirements with respect to environmental influences, since the switchgear cabinet represents a protected area. This allows simple and inexpensive solutions for implementing modularity. A modular system for operating without switchgear cabinet in an industrial environment, e.g. a hall, e.g. on an autonomous vehicle or for example in exterior applications, is much more complicated to develop, which is why it makes sense to discard or restrict the modular approach and offer control systems as more or less monolithic devices.It is an object of the invention to provide a safety controller which can be used even under difficult environmental conditions, i.e. not in the switchgear cabinet, and which nevertheless can be easily developed and realized. In particular, the safety controller should be usable in autonomous vehicles and mobile units.The object is achieved according to claim 1 by a safety controller having a housing with connections for a plurality of outputs and connections for a plurality of inputs and at least one display unit. The housing has at least two modules, wherein a first module has a central secure control and evaluation unit and has a central processing unit for display information and has the display unit. A second module is an I / O module having a second control and evaluation unit with the plurality of inputs and the plurality of outputs, wherein the control and evaluation units of the modules are connected to one another at least via a communication bus. The second module has a shift register to which the binary information of the second control and evaluation unit is fed, wherein the processing unit of the first module and the shift register of the second module are connected to one another via a serial interface.According to the invention, a modular approach is maintained for realizing the safety control, since different variants of the safe control can be formed more easily therewith. In the single housing of the safety controller, different modules are combined in the production process or assembly process to form a saleable, inalterable control system. This integrated modularity is relevant to the user in that this modular approach provides for the scaling of secure control to different functional scopes.The central display unit can be used for the various modules, so that the individual modules themselves do not require a display unit. There is therefore no need for an independent display unit of individual modules to be provided in the firmware and the electronics of the modules. Only the first module comprises the display unit used according to the invention by the other modules.This is advantageous above all in the safety field, since changes to safety-relevant function groups are complicated. The control and evaluation units and the internal communication bus or the internal communication interface are relevant to safety.In some cases, all the display information of a module of the respective control and evaluation unit is not known at all, since the display of electronic modules is directly controlled (for example. Ethernet Units). This display in the respective control and evaluation unit is not necessary according to the invention.The central processing unit may summarize and convert the obtained status information or display information in such a way that a conclusive and comprehensible display results which matches the concept of the formed safety controller which is composed of a plurality of modules. This also occurs with little feedback on the modules used. Instead of a respective display per module, according to the invention a common display unit is provided for all internal modules of the safety controller.The central processing unit is arranged separately from the safe control and evaluation units in the housing. The status information or display information is tapped and provided to the central processing unit via the serial interface. By means of the display unit connected to the central processing unit, the status information or display information is displayed. In particular, only non-secure information is transmitted via the serial interface. By contrast, safety-relevant information is transmitted via the communication bus. The serial interface is also easily expandable to further modules.The first module can optionally also have a plurality of inputs and a plurality of outputs.The safety controller is, for example, a safety controller having a performance level PL a to PL d according to EN ISO 13849-1. The performance level is defined according to the standard EN 13849 as a discrete level which specifies the ability of safety-related parts of a controller to execute a safety function under predictable conditions. Expressed simply, this means that: the performance level is a measure of the reliability of a safety function. The performance level is thereby measured on a scale from a (lowest PL) to e (highest PL).The performance level specifies the safety of a function or also of a component. The higher the performance level, the more secure and reliable the function under consideration. The indicated value for the performance level thus also has effects on where a specific component or a safety controller may be used, since the performance level must always be at least as high as the risk value at the location under consideration. If a risk value of c, for example, is thus obtained, the function must likewise have at least the performance level c or higher (i.e. c, d or e).Since the health and lives of persons depend on the functionality of the safety controller, the requirements for safety controllers used in safety technology are very stringent and standardized. Types for the necessary safety requirement of the respective application are defined here, for example the performance level or a safety level SIL in the standards for machine safety EN13849 or the EN62061 based on EN61508. Terms such as safety control, safe signals, safe connections or safe sensors are always to be understood in this description as safe in the sense of these relevant standards or corresponding specifications for permission to operate. Depending on the safety level or type, this includes requirements such as two-channel lines and connections, two-channel control and evaluation units or two-channel software, self-tests and the like.The control and evaluation units are, for example, two-channel. The control and evaluation unit is thus designed to be redundant, for example. If the two channels are formed differently, there is a diversity of two channels.The safety controller is configurable, for example. For example, it is possible to execute the configuration externally on a PC, notebook, PDA or mobile telephone and to play the found sensor combination and, if appropriate, parameter sets or a correspondingly compiled control program to the safety controller following the actual configuration steps.The safety controller preferably has at least one safe output, via which a safety-directed shutdown command can be issued as a function of, for example, an object detection signal formed. The central control and evaluation unit is itself secure or intrinsically safe, so that a secure object detection signal is generated.The modules are connected to one another via the communication bus. Control information is exchanged by the central secure control and evaluation unit or the control and evaluation units via a serial communication. This is also referred to as a so-called backplane bus ("backplane"). The other modules each have a control and evaluation unit in order to exchange the safety-directed information with the central safe control and evaluation unit so that the modules with, for example, the inputs and outputs can participate in the data exchange of the bus communication of the communication bus. The communication bus and the control and evaluation units of the individual modules are designed for a specific communication protocol.In particular, the controller is used in an autonomous vehicle or a mobile object. The mobile object or a movable machine or mobile machine can be, for example, a leadless vehicle, a leadless vehicle or autonomous vehicle, an autonomous guided vehicle (AGC), an automated mobile robot (AMR), an industrial mobile robot (IMR) or a robot with movable robot arms. The mobile machine thus has a drive and can be moved in various directions.In a further development of the invention, the housing is a dust-proof and watertight housing, in particular a housing at least according to the IP54 protection type, in particular IP67 according to DIN EN 60529.The term "IP protection type" (International Protection) is defined by IEC / EN 60529 "Protection types by Housings (IP code)". The standard describes the classification of protection types by housings for electrical operating means with rated voltages not above 72.5 kV.The first number 6 indicates the type of protection "dust-proof", according to which no penetration of dust into the housing takes place. The second number 7 indicates the protection against the effect of temporary immersion in water. The housing is thus watertight. Water must therefore not penetrate in an amount which causes a harmful effect when the housing is temporarily submerged in the water under standardized pressure and time conditions. In particular, the housing can also have higher types of protection such as IP68, IP69 or IP69K, in particular for extreme environmental conditions in which, for example, high-pressure and steam jet cleaning apparatuses are also used.The housing is formed in particular from a two-part shell, wherein, for example, a lower shell is formed from metal, in particular from die-cast aluminum or plastic, and an upper shell is formed from metal, in particular from die-cast aluminum. For example, the upper shell has cooling ribs for heat dissipation. The housing has, for example, fastening means, such as, for example, fastening openings. Furthermore, the connections are, for example, plug contacts for the inputs and outputs as well as for further interfaces and the connections for the energy supply.In a further development of the invention, the central processing unit receives the display information of all modules serially for the display information of the first module and processes the display information. This forms a very simple serial interface for transmitting the status information or display information between the internal modules.The central processing unit is configured to acquire the binary status information or display information of all modules within an internal modular system in series.In a further development of the invention, the central processing unit forms an aggregated data record of all display information of all connected modules for the display information and this aggregated data record is displayed by the display unit.The central processing unit is configured to process all status information or display information read in and forms an aggregated data record of status information or display information therefrom. The data record comprises, for example, a multiplicity of binary status information, for example organized into data bytes. The data record preferably has header information and subsequent payload data of the individual modules. The aggregated data record has the display information or status information of all modules. However, the data record can also have only user data of the individual modules.In a further development of the invention, the display unit is formed by a plurality of light-emitting diodes. For example, a plurality of light emitting diodes are compactly arranged in a row so that the display information can be read concentratedly at a location of the housing. The display unit is connected to the central processing unit.The central processing unit is configured to output the formed aggregated data set with binary status information or display information, which is used to drive the light-emitting diodes of the display unitThe display unit forms a centralized human machine interface (HMI) in the form of a plurality of LEDs for displaying the aggregated status information.In particular, the light emitting diodes are light emitting diodes that can display multiple colors, in order to be able to display different states and different information by means of different colors.In particular, the light-emitting diodes of the display unit are designed to blink at different visible frequencies in order to be able to display different information by means of different blinking frequencies.In a further development of the invention, the housing has at least one third module, wherein the third module is a gateway module having a third control and evaluation unit, wherein the third module has a shift register to which the binary information of the third control and evaluation unit is fed, wherein the shift register of the second module and the shift register of the third module are connected to one another via a serial interface.Integration into higher-level controllers is effected using gateway modules. The gateway module supports, for example, all common fieldbuses such as PROFINET or EtherNet / IP™.In a further development of the invention, the housing has at least one further module, wherein the further module has a further control and evaluation unit, wherein the further module has a shift register to which the binary information of the further control and evaluation unit is fed, wherein the further shift register of the further module and the shift register of an upstream module are connected to one another via a serial interface.The further module can be, for example, a further I / O module having a plurality of inputs and a plurality of outputs in order to further increase the number of available inputs and outputs.The further module can also be a further gateway module, for example.A wide range of modules is available for the further module. The further module can be, for example, various gateway modules, digital and analog input / output modules, motion control modules and relay modules.With the analog input module, sensors with analog output signal can be integrated by a standardized interface. Such sensors are suitable, for example, for use on AGVs for crash protection and monitoring of the speed of travel or for monitoring temperatures.With motion control modules, speeds and positions of motors can be monitored continuously, for example the drives of autonomous vehicles.In a further development of the invention, the modules are connected to one another via an additional data interface. A direct connection between the modules can thus optionally be established.In a further development of the invention, the shift register has a parallel-to-serial converter, wherein the binary information of the control and evaluation unit is supplied in parallel to the parallel-to-serial converter and the binary information is converted to serial information and is transmitted into the shift register.By means of the parallel-to-serial converter on each module, an electronic connection to the serial interface for connection to the first module or the central master module and for the acquisition of status information takes place.For example, the level at an input or output of a module is fed to the parallel-to-serial converter and then fed to the serial interface for the transmission of the information or the data to the first module.In a further development of the invention, each shift register has an identification, wherein the identification is transmitted together with the user data to be transmitted via the serial interface.In addition to the binary status information or display information, an identification is also transmitted (for example, the first 4 bits of a shift register, for example, set via resistors), on the basis of which the central processing unit recognizes from what type of module this status information or display information comes (for example. I / O module, gateway module or a concrete other module type). This makes it possible for the processing unit to be able to assign status information or display information to specific functions and then to display it on the display unit via specific light-emitting diodes. In addition, it is possible for specific modules or status information to be prioritized or filtered out, for example.The invention is also explained below with regard to further advantages and features with reference to the attached drawing on the basis of exemplary embodiments. The figures of the drawing show in: FIGS. 1 to 5 each show a safety control.In the following figures, identical parts are provided with identical reference numerals.FIG. 1 shows a safety controller 1 having a housing 2 with connections 3 for a plurality of outputs 4 and connections 3 for a plurality of inputs 5 and at least one display unit 6, wherein the housing 2 has at least two modules 8, 9, wherein a first module 8 has a central secure control and evaluation unit 12 and has a central processing unit 13 for display information and has the display unit 6, wherein a second module 9 is an input / output module having a second control and evaluation unit 14 with the plurality of inputs 5 and the plurality of outputs 4, wherein the control and evaluation units 12, 14 of the modules 8, 9 are connected to one another at least via a communication bus 15, wherein the second module 9 has a shift register 16, to which the binary status information of the second control and evaluation unit 14 is fed, wherein the central processing unit 13 of the first module 8 and the shift register 16 of the second module 9 are connected to one another via a serial interface 17.In the single housing 2 of the safety controller 1, different modules 8, 9 are combined in the production process or assembly process to form a saleable, physically non-changeable control system.The central display unit 6 can be used for the various modules 8, 9, so that the individual modules 9 themselves do not require a display unit 6. Only the first module 8 comprises the display unit 6 which is used according to the invention by the other modules 9.The control and evaluation units 12, 14 and the internal communication bus 15 or the internal communication interface are relevant to safety.The central processing unit 13 may summarize and convert the obtained status information or display information in such a way that a conclusive and comprehensible display results which matches the concept of the formed safety controller 1. This also occurs with little feedback on the modules 9 used. Instead of a respective display per module 9, a common display unit 6 is provided for all internal modules 8, 9 of the safety controller 1.The central processing unit 13 is arranged separately from the safe control and evaluation units 12, 14 in the housing 2. The status information or display information is tapped and provided to the central processing unit 13 via the serial interface 17. The status information or display information is displayed by means of the display unit 6 connected to the central processing unit 13. In particular, only non-secure information is transmitted via the serial interface 17. By contrast, safety-relevant information is transmitted via the communication bus 15. The serial interface 17 is also easily expandable to further modules 11.The safety controller 1 is, for example, a safety controller 1 having a performance level PL a to PL d according to EN ISO 13849-1.The control and evaluation units 12, 14 are embodied, for example, in two channels. The control and evaluation unit 12, 14 is thus designed to be redundant, for example. If the two channels are formed differently, there is a diversity of two channels.The safety controller 1 is configurable, for example. For example, it is possible to execute the configuration externally on a PC, notebook, PDA or mobile telephone and to play the found sensor combination and, if appropriate, parameter sets or a correspondingly compiled control program to the safety controller 1 following the actual configuration steps.The safety controller 1 preferably has at least one safe output, via which a safety-directed shutdown command can be issued as a function of, for example, an object detection signal formed. In this case, the central control and evaluation unit 12 is itself designed to be secure or intrinsically secure, so that a secure object detection signal is generated.The modules 8, 9 are connected to one another via the communication bus 15. Control information is exchanged by the central secure control and evaluation unit 12 or the control and evaluation units 12, 14 via a serial communication. The other modules 9 each have a control and evaluation unit 14 in order to exchange the safety-directed information with the central safe control and evaluation unit 12 so that the modules 9 with, for example, the inputs 5 and outputs 4 can participate in the data exchange of the bus communication of the communication bus 15. The communication bus 15 and the control and evaluation units 12 of the individual modules 8, 9 are designed for a specific communication protocol.In particular, the safety controller 1 is used in an autonomous vehicle or a mobile object.For example, the housing 2 is a dust-proof and watertight housing, in particular a housing at least according to the protection type IP67 according to DIN EN 60529.The housing 2 is formed, for example, from a two-part shell, wherein, for example, a lower shell is formed from plastic and an upper shell is formed from metal, in particular from die-cast aluminum. For example, the upper shell has cooling ribs for heat dissipation. The housing 2 has, for example, fastening means, such as, for example, fastening openings. Furthermore, the connections 3, for example plug contacts for the inputs and outputs 4, 5 and for further interfaces and the connections 3 for the energy supply.For example, the first module 8 display information central processing unit 13 serially receives the display information of all the other modules 9 and processes the display information. This forms a very simple serial interface 17 for transmitting the status information or display information between the internal modules 8, 9.The central processing unit 13 is designed for serial acquisition of the binary status information or display information of all further modules 9 within an internal modular system.For example, the display information central processing unit 13 constitutes an aggregated record of all the display information of all the connected modules 8, 9, and this aggregated record is displayed by the display unit 6.The data record comprises, for example, a multiplicity of binary status information, for example organized into data bytes. The data record preferably has header information and subsequent payload data of the individual modules. The aggregated data record has the display information or status information of all modules 8, 9.For example, the display unit 6 is formed by a plurality of light emitting diodes 20. For example, a plurality of light emitting diodes 20 are compactly arranged in a row so that the display information can be read concentratedly at a location of the housing 2. The display unit 6 is connected to the central processing unit 13.The central processing unit 13 is configured to output the formed aggregated data set with binary status information or display information, which is used to drive the light emitting diodes 20 of the display unit 6The display unit 6 constitutes a centralized human-machine interface in the form of a plurality of light emitting diodes 20 for displaying the aggregated status information.Specifically, the light emitting diodes 20 are light emitting diodes that can display a plurality of colors to display different states and different information by different colors.In particular, the light-emitting diodes 20 of the display unit 6 are designed to blink at different visible frequencies in order to be able to display different information by means of different blinking frequencies.According to FIG. 2, the housing 2 has at least one third module 10, wherein the third module 10 is a gateway module having a third control and evaluation unit 18, wherein the third module 10 has a shift register 16, to which the binary information of the third control and evaluation unit 18 is fed, wherein the shift register 16 of the second module 9 and the shift register 16 of the third module 10 are connected to one another via a serial interface 17.Integration into higher-level controllers is effected using gateway modules. The gateway module supports, for example, all common fieldbuses such as PROFINET or EtherNet / IP™.According to FIG. 3, the housing 2 has at least one further module 11, wherein the further module 11 has a further control and evaluation unit 19, wherein the further module 11 has a shift register 16, to which the binary information of the further control and evaluation unit 19 is fed, wherein the further shift register 16 of the further module 11 and the shift register 16 of an upstream module 8, 9, 10 are connected to one another via a serial interface 17.The further module 11 can be, for example, a further input / output module with a plurality of inputs 5 and a plurality of outputs 4 in order to further increase the number of available inputs 5 and outputs 4.The further module 11 can also be a further gateway module, for example.A wide range of modules is available for the further module 11. The further module 11 can be, for example, various gateway modules, digital and analog input / output modules, motion control modules and relay modules.With the analog input module, sensors with analog output signal can be integrated by a standardized interface. Such sensors are suitable, for example, for use on AGVs for crash protection and monitoring of the speed of travel or for monitoring temperatures.With motion control modules, speeds and positions of motors can be monitored continuously, for example the drives of autonomous vehicles.For example, the modules 8, 9, 10, 11 are connected to one another via an additional data interface. A direct connection can thus optionally be established between the modules 8, 9, 10, 11.For example, the modules 9, 10 according to FIG. 4 each have a parallel-to-serial converter 21, wherein the binary information of the control and evaluation unit 14, 18 is supplied in parallel to the parallel-to-serial converter 21 and the binary information is converted into a serial information.By means of the parallel-to-serial converter 21 on each module 9, 10, an electronic connection to the serial interface 17 takes place for connection to the first module 8 or the central master module and for the acquisition of status information.For example, the level at an input or output of a module is supplied to the parallel-to-serial converter 21 and then supplied to the serial interface 17 for transmitting the information or the data to the first module 8.For example, each shift register 16 has an identification, wherein the identification is transmitted together with the user data to be transmitted via the serial interface 17.In addition to the binary status information or display information, an identification is also transmitted. For example, the first 4 bits of a shift register 16, for example set via resistors, are transmitted, on the basis of which the central processing unit 13 recognizes from what type of module this status information or display information comes (for example. I / O module, gateway module or a concrete other module type). This makes it possible for the central processing unit 13 to be able to assign status information or display information to specific functions and then to display it on the display unit 6 via specific light-emitting diodes 20. In addition, it is possible for specific modules 8, 9, 10, 11 or status information to be prioritized or filtered out, for example.FIG. 5 shows an example of a housing 2 with the connections 3 and the display unit 6.The display unit 6 can be arranged centrally or else, for example, can be arranged at a plurality of locations on the housing 2.Reference Number:1 Safety controller 2 Housing 3 Connections 4 Outputs 5 Inputs 6 Display unit 7 Modules 8 First module 9 Second module 10 Third module 11 Further modules 12 Central secure control and evaluation unit 13 Central processing unit 14 Second control and evaluation unit 15 Communication bus 16 Shift register 17 Serial interface 18 Third control and evaluation unit 19 Further control and evaluation unit 20 Light emitting diodes 21 Parallel-to-serial converterReferences included in the specificationThis list of documents cited by the applicant has been produced in an automated manner and is only included for the better information of the reader. The list is not part of the German patent application or utility model application. The DPMA does not take any adhesion for any faults or omissions.Cited Non-Patent LiteratureEN ISO 13849-1

[0059]

Claims

Safety controller (1) having a housing (2) with connections (3) for a plurality of outputs (4) and connections (3) for a plurality of inputs (5) and at least one display unit (6), characterized in that the housing (2) has at least two modules (7), wherein a first module (8) has a central safe control and evaluation unit (12) and has a central processing unit (13) for display information and has the display unit (6), wherein a second module (9) is an input / output module having a second control and evaluation unit (14) with the plurality of inputs (5) and the plurality of outputs (4), wherein the control and evaluation units (12, 14) of the modules (8, 9) are connected to one another at least via a communication bus (15), wherein the second module (9) has a shift register (16), to which the binary information of the second control and evaluation unit (14) is fed, wherein the central processing unit (13) of the first module (8) and the shift register (16) of the second module (9) are connected to one another via a serial interface (17).Safety controller (1) according to Claim 1, characterized in that the housing (2) is a dust-proof and watertight housing (2), in particular is a housing (2) according to the IP54 protection type in accordance with DIN EN 60529.Safety controller (1) according to one of the preceding claims, characterized in that the central processing unit (13) for display information of the first module (8) receives and processes the display information of all modules (8, 9) in series.Safety controller (1) according to any one of the preceding claims, characterized in that the central processing unit (13) for display information forms an aggregated data record of all display information of all connected modules (8, 9) and this aggregated data record is displayed by the display unit (6).Safety controller (1) according to one of the preceding claims, characterized in that the display unit (6) is formed by a plurality of light-emitting diodes (20).Safety controller (1) according to one of the preceding claims, characterized in that the housing (2) has at least one third module (10), wherein the third module (10) is a gateway module having a third control and evaluation unit (18), wherein the third module (10) has a shift register (16), to which the binary information of the third control and evaluation unit (18) is fed, wherein the shift register (16) of the second module (9) and the shift register (16) of the third module (10) are connected to one another via a serial interface (17).Safety controller (1) according to Claim 1, characterized in that the housing (2) has at least one further module (11), the further module (11) having a further control and evaluation unit (19), the further module (11) having a shift register (16) to which the binary information of the further control and evaluation unit (19) is fed, the further shift register (16) of the further module (11) and the shift register (16) of an upstream module (8, 9, 10) being connected to one another via a serial interface (17).Safety controller (1) according to one of the preceding claims, characterized in that the modules (8, 9) are additionally connected to one another via a further data interface.Safety controller (1) according to one of the preceding claims, characterized in that the shift register (16) has a parallel-to-serial converter (21), wherein the binary information of the control and evaluation unit (14) is supplied in parallel to the parallel-to-serial converter (21) and the binary information is converted to serial information and is transmitted into the shift register (16).Safety controller (1) according to one of the preceding claims, characterized in that each shift register (16) has an identification, wherein the identification is transmitted together with the user data to be transmitted via the serial interface (17).

Images