Operational unit and method for operating a plant using the operational unit - Patents.com

Abstract

To increase the safety level in the operation of plants or machines, to guarantee a safe lighting and safe non-lighting of an indicator light, above all, in the operation of the plant via an operating unit and, further, to achieve highest SIL / PL values.SOLUTION: An operating unit and a method for operating a plant with the operating unit are provided. The operating unit comprises: a communication port configured to provide communication between the operating unit and at least one plant; an indicator unit provided at the operating unit and configured to output a state of the plant; and safety electronics comprising at least one safe input and at least one safe output. The safety electronics are connected to the indicator unit via the at least one safe output and are connected to a detection element via the at least one safe input, the detection element detecting an output of the indicator unit.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS This application claims priority from Luxembourg patent application LU503513, filed February 17, 2023, the contents of which are incorporated herein by reference in their entirety.

[0002] The field of the invention relates generally to safety technology in mechanical engineering, and in particular to signal or indicator lights of operating units (human-machine interfaces). [Background technology]

[0003] Plants or equipment and (electrical) machinery may pose a risk with hazards to which humans and the environment must not be exposed under any circumstances. Where such hazards exist, the existing risks must be reduced to take into account the need for safety. Two variables can be used to quantify the risk reduction: safety integrity level (SIL) and performance level (PL).

[0004] The SIL is standardized in the international standards IEC61508 / IEC61511 and represents the probability that a safety-related function will fully fulfill the required safety function under all specific circumstances within a specific period of time. The SIL includes three individual stages, from the lowest risk reduction SIL1 to the highest risk reduction SIL3.

[0005] PL is a value that describes the ability of the safety-related parts of the controller to perform a safety function under specific circumstances, ranging from the lowest risk reduction PLa to the highest risk reduction PLe.

[0006] The relationship between SIL and PL is explained in the ISO13849-1:2006 standard: the higher the SIL or PL of a safety-related system, the lower the probability that the system will not perform the required safety function.

[0007] To achieve higher SIL or PL values ​​and therefore higher safety levels, so-called signal or indicator lights are frequently used in plant engineering or mechanical engineering. Such lights clearly indicate functional or dangerous states by means of various types of light with corresponding colours or colour combinations.

[0008] There are standards for such lights and their applications, such as the EN60073 standard, which defines the appearance and function using color significance. EN60073 is a European standard for the classification of electrical machines, which defines the requirements for the design, protection degree, and insulation class of electrical plants or electrical equipment or machines.

[0009] For this purpose, indicator lights are monitored, which will achieve a high safety standard (high SIL or PL) and therefore reduce the risk to life and limb. A maximum safety standard means, for example, that only one fault can occur without functional limitation, and that this fault will be detected reliably, i.e. 100 percent, by the safety-related system. The design of such safety-related systems includes a risk analysis in which multi-channel capabilities, reinforcement, degrees of redundancy, etc. are determined. This should allow the safety-related system to react to unexpected events or faults without jeopardizing the safety and reliability of the system.

[0010] The lights can be fixedly mounted on the machine or alternatively can be configured to be mobile, either wired or wireless.

[0011] Indicator lights visually indicate functions and dangers, which makes them of particular importance from the point of view of safety technology. They indicate possible dangers that can cause injuries or even death. Incorrect lighting can lead to fatal accidents in the case of the corresponding danger. Therefore, safe lighting or safe non-lighting with the corresponding color and pattern, such as flashing or pulsating, must be absolutely reliable in both cases to guarantee the safety of body and life.

[0012] A warning light column for visually indicating at least one operating state is known from German utility model no. 202020105750 (U1).

[0013] EP 1 233 316 A2 discloses a device for operating automated parts, in which available IT devices such as PDAs or mobile phones are used as simple HMI (human machine interface) to make operation more comfortable.

[0014] DE 102013220865 A1 discloses a method and system for remotely operating a machine tool by means of a mobile communication device.

[0015] US Pat. No. 6,167,464(A) discloses a mobile HMI for monitoring the operation of spatially distributed control systems in a factory or the like and providing position signals to a central processing unit.

[0016] To make known indicator lights visible, they are often mounted higher on the plant / machine. In this case, an operator or person in the machine's environment must actively look in the direction of the indicator light to obtain current information about the plant or machine's condition. In certain tasks, visibility may be limited, thereby increasing the risk of accidents. [Prior art documents] [Patent documents]

[0017] [Patent Document 1] German Utility Model No. 202020105750(U1) [Patent Document 2] European Patent Application Publication No. 1233316(A2) [Patent Document 3] German Patent Application Publication No. 102013220865(A1) [Patent Document 4] U.S. Patent No. 6,167,464(A) Summary of the Invention [Problem to be solved by the invention]

[0018] The object of the present application is to increase the safety level in the operation of a plant or machine. A further object of the present application is to ensure safe lighting and safe de-lighting of indicator lights, in particular in the operation of the plant by an operating unit. A further object of the present application is to achieve the highest SIL / PL values. [Means for solving the problem]

[0019] The object is achieved by an operating unit for operating at least one plant, installation, or machine from among a plurality of plants, installations, or machines, the operating unit comprising: a communication port for connecting the operating unit to the at least one plant, the communication port configured to realize communication between the operating unit and the at least one plant; an indicator unit, reporting unit, or signaling unit for outputting and for continuously repeated further outputs, the indicator unit being provided on the operating unit and configured to output a plant status; safety electronics for monitoring the indicator unit while outputting the at least one plant status, the safety electronics comprising at least one safety input and at least one safety output, the safety electronics connected via the at least one safety output to the indicator unit and via the at least one safety input to a detection element configured to detect the output of the indicator unit, the status including at least one of a functional status, a hazardous status, and a position status.

[0020] This has the advantage that the indicator unit is monitored by the safety electronics, so that the highest SIL values ​​(SIL3) or PL values ​​(PLe) can be achieved.A further advantage is that the indicator unit is located directly on the operating unit and is therefore always within the field of view of an operator who can walk around the plant.

[0021] According to a first aspect, the safety electronics is connected to the indicator unit for evaluation by means of a safety output, either single-channel or multi-channel, via feedback or recirculation, and to the detection element by means of a safety input, either single-channel or multi-channel.

[0022] As a result, the safety electronics can ensure that the connection and function of the indicator unit and the detection element are reliably monitored using the safety electronics, that the termination of the connection is detected, and thereby that the safe lighting and delighting of the indicator light can be guaranteed.

[0023] According to a further aspect, the indicator unit includes at least one signal converter.

[0024] As a result, feedback on the plant status can be output by the operating unit to the operator in real time, thereby increasing the safety level and thus achieving the highest SIL / PL values.

[0025] According to a further aspect, each of at least one of the signal converters is respectively connected to the safety electronics via at least one safety output.

[0026] Thereby, the connection to each individual one of the signal converters can be established safely, whereby the highest SIL value (SIL3) or PL value (PLe) can be achieved.

[0027] According to a further aspect, the at least one signal transducer includes at least one of a lamp or light source, an acoustic transducer, and a vibration transducer.

[0028] Thereby the plant status can be output to the operator by light, noise or vibration, either individually or in combination, in order to further increase the safety level and thus achieve the highest SIL / PL value.

[0029] According to a further aspect, the lamp comprises a single lamp or a multiple lamp.

[0030] All specifications from the plant system requirements and relevant standards regarding the lamp can be taken into account and implemented with this lamp.

[0031] According to a further aspect, the indicator unit outputs the functional, hazardous, and positional status of the at least one plant using one of illumination information, sound information, and vibration information.

[0032] The safety level is thereby increased and the highest SIL / PL values ​​can be achieved.

[0033] According to a further aspect, the detection element includes at least one signal detector, and the number of signal detectors can be different from the number of signal transducers.

[0034] Thereby, a single signal detector can detect the outputs of multiple signal converters, or multiple signal detectors can detect the output of one signal converter. The safety level can thus be adapted to the current environment, costs can be reduced if necessary, and a high safety level can be ensured.

[0035] According to a further aspect, the at least one signal detector includes at least one of a photoresistor, a photodiode, a phototransistor, an acoustic sensor, and a vibration sensor.

[0036] Thereby, the detection element can detect optical signals, acoustic signals, and vibration signals.

[0037] According to a further aspect, each signal detector is respectively connected to the safety electronics via at least one safety input.

[0038] Thereby, the connection of the detection element to each signal detector is reliably monitored, whereby the highest SIL value (SIL3) or PL value (PLe) can be achieved.

[0039] According to a further aspect, the operational unit may be a separate component of or part of at least one plant.

[0040] The power supply of the operating unit can therefore be supplied on the one hand by the plant, externally via a power cable, or autonomously by a battery.

[0041] According to a further aspect, the communication port communicates wirelessly or wired with the at least one plant.

[0042] This allows the operator of the operating unit, on the one hand, to move freely within the plant environment.

[0043] According to a further aspect, the operational unit includes at least one actuation element configured to actuate the operational unit and a display configured to display information about the state of the at least one plant and information about the state of the operational unit.

[0044] Thereby, the operator can operate the plant as a whole by means of the operating unit and have all relevant information of the plant and the operating unit displayed.

[0045] The above-mentioned object is further achieved by a method for operating at least one plant from a plurality of plants using the aforementioned operating unit, the method comprising the steps of: connecting the operating unit to the at least one plant by a communication port of the operating unit; outputting, by an indicator unit of the operating unit, a state of the at least one plant, including one of a functional state, a dangerous state, and a position state, as at least one of lighting information, sound information, and vibration information; operating the at least one plant by the operating unit; and further outputting, by the indicator unit, the state of the at least one plant, including one of the functional state, the dangerous state, and the position state, as at least one of lighting information, sound information, and vibration information, wherein the further outputting step is continuously repeated during the connection between the operating unit and the at least one plant, and the indicator unit is monitored by safety electronics of the operating unit during the further outputting step, whereby the safety electronics includes a safety input and a safety output, and the indicator unit is connected to the safety electronics via the at least one safety output.

[0046] According to one aspect, the method further comprises a step of informing the at least one plant by an indicator unit of the operating unit about the termination of the connection of the operating unit, and a step of independently transferring the at least one plant to a safe state upon termination of the connection of the at least one plant to the operating unit, the step of informing being performed using signals different from the signals indicating the functional state, the dangerous state and the position state of the at least one plant.

[0047] This provides the advantage that the operation of at least one plant is monitored, whereby the highest SIL values ​​(SIL3) or PL values ​​(PLe) can be achieved.

[0048] According to a further aspect, the connecting step is performed by wired or wireless communication.

[0049] As a result, the operating device can be used mobile in the sense that the operating device can easily connect to plants from among a plurality of plants.

[0050] According to a further aspect, the outputting step is monitored by safety electronics through control and feedback of a signal to an indicator unit.

[0051] Thereby, the highest SIL value (SIL3) or PL value (PLe) can be achieved.

[0052] According to a further aspect, the outputting step includes information including the operational unit leaving a locally permissible area for a connection between the operational unit and the plant.

[0053] Thereby it is ensured that the operator is located within a predetermined local tolerance area of ​​the plant to be operated in order to ensure safety of operation.

[0054] According to a further aspect, the method further comprises the step of monitoring the indicator unit via a safety output of the safety electronics of the operating unit.

[0055] By monitoring the indicator unit, high safety standards (high SIL or PL) can be achieved.

[0056] According to a further aspect, the method further comprises the step of signalling by means of the indicator unit about the establishment or termination of a connection between the operating unit and the at least one plant.

[0057] The above object is further achieved by the use of an operating unit as described above for at least one plant from among a plurality of plants.

[0058] Thereby, multiple plants in a manufacturing environment, such as a production hall, can be operated with an operating unit, which can increase productivity and reduce costs.

[0059] A more complete understanding of the present invention and its associated advantages will be readily attained when considered in conjunction with the following detailed description taken in conjunction with the accompanying drawings. [Brief explanation of the drawings]

[0060] [Figure 1] FIG. 2 is a schematic diagram of an operation unit corresponding to the first embodiment. [Figure 2] 2 is a diagram of a schematic structure of the operational unit 100 of FIG. 1 in communication with the plant; [Figure 3] FIG. 1 is a schematic diagram of the connection between the safety electronics and the indicator unit or sensing element. [Figure 4A] FIG. 1 is a schematic diagram of the connection between the safety electronics and the indicator unit. [Figure 4B] FIG. 1 is a schematic diagram of the connection between the safety electronics and the indicator unit. [Figure 4C] FIG. 1 is a schematic diagram of the connection between the safety electronics and the indicator unit. [Figure 4D] FIG. 1 is a schematic diagram of the connection between the safety electronics and the indicator unit. [Figure 5A] FIG. 1 is a schematic diagram of the connection between the safety electronics and the sensing element. [Figure 5B] FIG. 1 is a schematic diagram of the connection between the safety electronics and the sensing element. [Figure 6] 3 is a schematic diagram of the connection between the safety electronics and the indicator unit or sensing element according to the first embodiment; FIG. [Figure 7] FIG. 10 is a schematic diagram of the connection between the safety electronics and the indicator unit or sensing element according to a second embodiment. [Figure 8]1 is a flow diagram of a method of operating at least one plant. [Figure 9] 1 is another flow diagram of a method of operating at least one plant. DETAILED DESCRIPTION OF THE INVENTION

[0061] The present invention will now be described with reference to the drawings. It goes without saying that the embodiments of the present invention described herein are merely examples and do not in any way limit the scope of protection of the claims. The present invention is defined by the claims and their equivalents. It goes without saying that features of one embodiment of the present invention can be combined with features of another embodiment or other embodiment of the present invention, provided that they are not mutually inconsistent.

[0062] 1 shows a schematic diagram of an operation unit 100 according to a first embodiment. The operation unit 100 is shown from the perspective of an operator who can use the operation unit 100 to operate a plant or equipment or machine 90. The operation unit 100 includes a display 10, a first operating element 5 and a second operating element 6, an indicator unit 30, and a communication port 80.

[0063] The indicator unit 30 is provided in the operation unit 100 and is configured to output a status of the plant 90. The status of the plant 90 includes at least one of a functional status, a dangerous status, and a position status. Furthermore, the indicator unit 30 can signal regarding a connection termination or communication termination of the operation unit 100 to the plant 90. A connection termination occurs when the communication port 80 loses connection / communication with the previously connected plant 90.

[0064] However, the indicator unit 30 can also provide information regarding the connection or communication establishment or pairing of the operation unit 100 with the plant 90. For this purpose, the indicator unit 30 can be used to provide feedback regarding the pairing to an operator who is operating at least one plant 90 via the operation unit 100. In this case, in a non-limiting example, the indicator unit 30 can provide a lighting that is coordinated with an indicator light (not shown) attached to the connected plant 90 to visually indicate a selected plant 90 from the multiple plants 90 to the operator. In a non-limiting example, the coordinated lighting can include flashing and / or a specific color pattern. In another non-limiting example, the operation unit 100 can indicate the pairing between the operation unit 100 and the plant 90 via the indicator unit 30.

[0065] The communication port 80 is configured to realize communication, connection, or pairing between the operational unit 100 and at least one plant 90. The communication is performed in real time or at intervals in the millisecond range. The communication port 80 can communicate with or be connected to the plant 90 via a wire or wirelessly. The connection of the operational unit 100 to the plant 90 includes the communication of the operational unit 100 with the plant 90. The operational unit 100 can also be an independent component of the plant 90 or a part of the plant 90. If the operational unit 100 is an independent component of the plant 90 and communicates / connects to the plant 90 wirelessly, the operational unit 100 can be considered a mobile operational unit in this example. In this example, the operational unit 100 can obtain power by a battery or via a power cable, which is connected to a different power source other than the plant 90. In another example, if the operational unit 100 communicates with / is connected to the plant 90 via a wire, the operational unit 100 may be considered a semi-mobile operational unit, and at least one of communication via the communication port 80 and power supply may be realized by a fixed line. In a further example, if the operational unit 100 is provided as part of the plant 90, the operational unit 100 may be considered a fixed operational unit. In this example, the operational unit 100 is fixedly attached to the plant and is powered by the plant 90. In this example, the communication of the fixed operational unit with the plant 90 may be implemented wirelessly or by a wire. For wireless communication, all known standards may be used, such as Wi-Fi, Zigbee, Thread, Bluetooth, LTE, 5G, etc.

[0066] The first actuating element 5 and the second actuating element 6 are configured to operate the operating unit 100. In particular, an operator of the plant 90 can operate the plant 90 by means of the actuating elements 5, 6 of the operating unit 100. The first actuating element 5 is, for example, one of an emergency stop, an emergency shutdown, and an emergency stop. Depending on the state of the plant 90, the operator can use the first actuating element 5 to shut down the plant 90 as quickly as possible, shut down the plant in normal operation, or switch off the power supply to the plant 90. The first actuating element 5 is thus a component known from the prior art. The second actuating element 6 is a component by means of which commands and settings on the display 10 can be selected and controlled. In an example where the second actuating element 6 is omitted, the display 10 includes a touchscreen. In a further example, the display 10 can be a component of a tablet (not shown), which can communicate with the plant 90 over its own communication path, for example, a LAN, a WLAN, etc. In this example, the plant 90 may be configured and operated with the tablet, but the tablet alone will not achieve the highest safety level and consequently the highest SIL / PL value.

[0067] 2 shows a schematic structure of the operational unit 100 of FIG. 1, which is connected to and communicates with a plant 90 from among a plurality of plants 90. The connection of the operational unit 100 with the plant 90 is performed by a communication port 80. The operational unit 100 can be used to connect to and communicate with one of the plurality of plants 90. The selection of which plant 90 from among the plurality of plants 90 the operational unit 100 should be connected to can be selected by the operational unit 100.

[0068] As shown in the figure, a schematic structure of an operating unit 100 is shown, which includes safety electronics 50, which are electrically connected to a display 10, a first operating element 5 and a second operating element 6, an indicator unit 30, and a detection element 40.

[0069] The indicator unit 30 includes at least one signal converter SG=SG1. The indicator unit 30 may also include two signal converters SG=SG1 and SG2, or multiple signal converters SG1, ..., SGn, where SGn indicates n times the number of signal converters. For example, the indicator unit 30 includes signal converters SG1, SG2, SG3, and SG4 in the case of n=4 signal converters. In a further example, the indicator unit 30 includes signal converters SG1, SG2, SG3, SG4, SG5, and SG6 in the case of n=6 signal converters.

[0070] At least one signal converter SG1, ..., SGn includes at least one of a lamp, an acoustic transducer, and a vibration transducer, and the lamp includes a single lamp or a composite lamp. The single lamp is, for example, a light or a single LED (light-emitting diode). The composite lamp is, for example, a plurality of integrated or grouped individual LEDs. The LEDs can emit light in various colors or reflect various colors (RGB LED). In this way, the indicator unit 30 can output the functional status, hazardous status, and position status of the plant 90 using one of lighting information, acoustic information, and vibration information. The indicator unit 30 is provided in the operation unit 100 and configured so that an operator of the operation unit 100 can clearly see the output of the indicator unit 30 as lighting information, clearly feel it as vibration information, and clearly hear it as acoustic information. In an example where the indicator unit includes three signal converters SG1, SG2, and SG3, and each of the three signal converters SG1, SG2, and SG3 is a lamp, the indicator unit 30 can output the status of the plant 90 by lighting information to indicate to an operator the status of the plant 90. In a further example where a lamp is provided as the first signal converter SG1 and an acoustic converter is provided as the second signal converter SG2, the indicator unit 30 can output the status of the plant 90 by lighting information and acoustic information to indicate to an operator the status of the plant 90. If a vibration converter is used as the signal converter of the indicator unit 30, vibration information can be output accordingly.

[0071] Each of the illumination information, sound information, and vibration information may be determined by the number of signal transducers SG1, ..., SGn and the safety electronics 50. The safety electronics 50 controls the indicator unit 30, for example, by adjusting the brightness and color of the lamps, the frequency and amplitude of the sound transducers, and the intensity of the vibration transducers, as will be described in more detail below.

[0072] The detection element 40 includes at least one signal detector SD=SD1. The detection element 40 can also include two signal detectors SD=SD1 and SD2 or multiple signal detectors SD1, ..., SDn, where SDn indicates the number of signal detectors (n times the number of signal detectors). For example, the detection element 40 includes signal detectors SD1, SD2, SD3, and SD4 for n=4 signal detectors. In a further example, the detection element 40 includes signal detectors SD1, SD2, SD3, SD4, SD5, and SD6 for n=6 signal detectors. The number of signal detectors SD1, ..., SDn can be different from the number of signal converters SG1, ..., SGn. Like the signal detectors SD1, ..., SDn, the detection element 40 includes any type of detector for detecting information or outputs output by the signal converters SG1, ..., SGn. As a non-limiting example, one of the signal detectors SD1, ..., SDn of the detection element 40 includes at least one of a photoresistor, a photodiode, a phototransistor, an acoustic sensor, and a vibration sensor. In an example where the signal converters SG1, ..., SGn output the lighting information using lamps, the detection element 40 may include an optical fiber cable LWL for transmitting the lighting information to the signal detectors SD1, ..., SDn via the optical fiber cable LWL. The detection element 40 is provided in the operation unit 100 and is configured to detect the output of the indicator unit 30. For this purpose, the detection element 40 may be provided within the operation unit 100 so that the operator cannot see the detection element 40.

[0073] 3 is a schematic diagram of the connection between the safety electronics 50 and the indicator unit 30 or the sensing element 40. The safety electronics 50 includes at least one safety input E1+, E1-, ..., En+, En- and at least one safety output A1+, A1-, ..., An+, An-, each of which includes a positive + strand and a negative - strand. En+, En- or An+, An- indicates n times the number of safety inputs or safety outputs. For example, for n=4 safety inputs, the safety inputs include E1+, E1-, E2+, E2-, E3+, E3-, and E4+, E4-. In a further example, the safety inputs include safety inputs E1+, E1-, E2+, E2-, E3+, E3-, E4+, E4-, E5+, E5- and E6+, E6- for a safety input of n=6. The same applies analogously to safety outputs A1+, A1-, ..., An+, An-.

[0074] The safety electronics 50 is connected to the detection element 40 via at least one safety input E1+, E1-, ..., En+, En-. The safety electronics 50 is connected to the indicator unit 30 via at least one safety output A1+, A1-, ..., An+, An-. The number of safety inputs E1+, E1-, ..., En+, En- may depend on the number of signal detectors SD1, ..., SDn of the detection element 40. The number of safety outputs A1+, A1-, ..., An+, An- may depend on the number of signal converters SG1, ..., SGn of the indicator unit 30.

[0075] 4A to 4D, an example of a system is depicted as to how safety outputs A1+, A1−, ..., An+, An− with feedback R1, R2 are provided by connection between the safety electronics 50 and the signal converters of the indicator unit 30 to achieve a higher safety level or a higher SIL / PL value. The safety outputs A1+, A1−, ..., An+, An− with feedback R1, R2 in this case represent outputs within the safety electronics 50 which ensure that in case of a fault, a signal comprising current and / or voltage is no longer output at the safety outputs A1+, A1−, ..., An+, An− to one of the signal converters SG1, ..., SGn. Thus, for example, in the event that a fault exists in one of the switches S1, S2 and a signal is no longer output to one of the signal converters SG1, ..., SGn via the safety outputs A1+, A1-, ..., An+, An-, the signal can be detected by the feedback R1, R2 and the safety electronics 50, thereby shifting the plant 90 to a safe state. The feedback R1, R2 can, for example, provide a signal, together with or in addition to the current and / or voltage, such as the switching time, time pulse, or voltage level of the "ON" or "OFF" switching of the switches S1, S2. This allows for safe monitoring of the output or non-output of at least one signal converter SG1, ..., SGn. This allows for avoiding damage or dangerous situations and thus increasing safety in terms of the SIL / PL value. The feedback R1, R2 can include anything from no information to any number of pieces of information, depending on requirements. For example, without any information, the switches S1, S2 are not monitored by the feedback R1, R2, so that high safety values ​​cannot be achieved.

[0076] The safety electronics 50 takes over control of at least one signal converter SG1, ..., SGn of the indicator unit 30 and monitors, by means of feedback R1, R2, the illumination, sound and / or vibration information of the outputs, such as the brightness and color of the lamps, the frequency and amplitude of the sound converters and the intensity of the vibration converters. The individual signal converters SG1, ..., SGn are controlled with the aid of the safety electronics 50 via the safety outputs A1+, A1-, ..., An+, An-, which control can take place single-channel or multi-channel using the channel K1.

[0077] Single-channel or multi-channel control by the safety electronics 50 describes the number of independent safety outputs A1+, A1-, ..., An+, An- used to control the individual signal converters SG1, ..., SGn. Single-channel control means that there is only a single safety output A1+, A1- for signal converter SG=SG1 to control the signal converter SG. On the other hand, multi-channel control means that there are multiple independent safety outputs A1+, A1-, ..., An+, An- assigned to each individual one of the signal converters SG1, ..., SGn. Overall safety can be further enhanced by additional monitoring and safety feedback R1, R2. Faults at the respective safety outputs A1+, A1-, ..., An+, An- can be detected by the safety outputs A1+, A1-, ..., An+, An- in combination with feedback R1, R2, and a safe and reliable reaction, such as safely switching off the plant 90, can be initiated in the event of a relevant fault. Greater flexibility is thus created and overall system reliability is increased because there are multiple redundant safety outputs that can control and monitor the system.

[0078] It should be noted that monitoring the voltage and / or current at at least one safety output A1+, A1-, ..., An+, An- alone cannot result in a guaranteed safe state with respect to the function of at least one signal converter SG1, ..., SGn. Thus, for example, if a voltage or current is applied to a lamp via at least one safety output A1+, A1-, ..., An+, An-, the lamp may not light up due to a fault. In a further example, if a voltage or current is applied to an acoustic transducer, the fault may not generate an acoustic signal, such as a warning sound. In a further example, if a voltage or current is applied to a vibration transducer, the fault may not generate a vibration signal.

[0079] In addition to monitoring the voltage and / or current at at least one safety output A1+, A1−, …, An+, An−, and therefore a comparison with the signal, is performed or monitored by at least one signal detector SD1, …, SDn so that a safe state can be achieved with respect to the function of at least one signal converter SG1, …, SGn. This can also ensure that at least one signal detector SD1, …, SDn detects the signal of at least one signal converter SG1, …, SGn and does not detect an external signal. In a non-limiting example, it is therefore ensured that acoustic signals of an external acoustic source do not affect the safe state with respect to the function of the acoustic converters of the operating unit 100.

[0080] 4A shows a first example of a connection between the safety electronics 50 and the indicator unit 30, where the indicator unit 30 includes only one signal converter SG1. The single signal converter SG1 is controlled by the safety electronics 50 in two channels using two switches S1 and S2 connected in series. For this purpose, the two switches S1 and S2 each include a monitoring feedback R1 and R2, respectively. The safety outputs A1+ and A1− according to this first example are thus defined by providing two switches S1 and S2 in series and monitoring the switches S1 and S2 in the positive strand A1+ (of the safety output) by the feedback R1 and R2. In this first example, the output signal including the voltage and / or current is fed back to the signal converter SG by the feedback R1 and R2, thereby monitoring the feedback circuits or readbacks of the switches S1 and S2. In this example, if an earth fault occurs (An− falls to earth), it can still be switched off in two channels.

[0081] 4B shows a second example of the connection between the safety electronics 50 and the indicator unit 30, which likewise includes only one signal converter SG=SG1. Unlike in FIG. 4A, in this example switches S1 and S2 are provided on the positive and negative strands A1+ and A1-, respectively, and are monitored by feedbacks R1 and R2, respectively. In this example, an earth fault (An- falling to earth) can no longer switch off the two channels.

[0082] 4C shows a third example of a connection between the safety electronics 50 and the indicator unit 30. To ensure a guaranteed safe state regarding the function of at least one signal converter SG1, ..., SGn and thus the safety outputs of the indicator unit 30, multi-channel signal converters SG1, ..., SGn, i.e., with at least two channels, can be used in one example. In this third example, the indicator unit 30 includes a two-channel signal converter SG1 with two channels SG1.1 and SG1.2. Each of the two channels SG1.1 and SG1.2 is controlled and monitored by the safety electronics 50 via its own safety outputs A1+, A1- and A2+, A2-. Monitoring of the safety outputs A1+, A1- and A2+, A2- occurs in each case via the positive twisted wire A1+, A2+ and in each case via two feedback loops R1, R2 in series.

[0083] 4D shows a fourth example of a connection between the safety electronics 50 and the indicator unit 30, which includes two signal converters SG1, SG2. In this example, the switches S1, S2 are monitored in the same way as in the second example according to FIG.

[0084] Further examples and embodiments of the connection between the safety electronics 50 and the indicator unit 30 are possible, resulting from the combination of single-channel or multi-channel signal converters SG1, ..., SGn with the safety outputs A1+, A1-, ..., An+, An- of the safety electronics 50. The choice of the connection between the safety electronics 50 and the indicator unit 30 can be made according to the SIL / PL value to be achieved or desired.

[0085] 5A and 5B show examples of systems in which the safety inputs E1+, E1-, ..., En+, En- are provided in single or multi-channel form by connections between the safety electronics 50 and the signal detectors SD1, ..., SDn of the detection element 40 in order to achieve higher safety levels or higher SIL / PL values.

[0086] 5A shows the connection of the safety electronics 50 to the detection element 40, including a signal detector SD=SD1 with two-channel monitoring of the safety inputs E1+, E1−. The signal detector SD1 is connected to the safety inputs E1+, E1− by a positive strand E1+ and a negative strand E1−, which are split into two channels K1 and K2 (two channels). Higher reliability and safety are thereby achieved, since faults in the safety electronics 50 can be reliably detected. Possible faults of the signal detector SD1, related to the signal converters SG1, ..., SGn and their functions, can thus be detected. In a non-limiting example, the connection corresponds to a single-channel solution of the signal detector SD1 and a two-channel solution of the safety electronics 50.

[0087] 5B shows the connection of safety electronics 50 to the detection element 40, which includes two signal detectors SD1 and SD2. The two signal detectors SD1 and SD2 are connected by two channels to the safety inputs E1+, E1− and E2+, E2− of the safety electronics 50. Each of the two signal detectors SD1, SD2 is monitored independently of the other by a single channel. This corresponds to a continuous two-channel system of signal detectors SD1, SD2 and the safety electronics 50, by which substantially higher safety can be achieved.

[0088] Further examples and embodiments of the connection between the safety electronics 50 and the sensing element 40 are possible, resulting from the combination of the safety inputs E1+, E1−, ..., En+, En− with single-channel monitoring or multi-channel monitoring. The choice of the connection between the safety electronics 50 and the sensing element 40 can be made according to the SIL / PL value to be achieved or desired.

[0089] The monitoring of the indicator unit 30 and the sensing element 40 by the safety electronics 50 thus represents a diagnostic function that is highly responsible for increasing the SIL / PL value.

[0090] 6 is a schematic diagram of a portion of the operating unit 100, showing the connection between the safety electronics 50 and the indicator unit 30 or the detection element 40, corresponding to the first embodiment. In this embodiment, the indicator unit 30 includes a single signal converter SG1, which is a lamp. The detection element 40 includes a single signal detector SD1, which is a photodiode. The photodiode detects the lighting of the lamp. In a further example, the operating unit 100 may include multiple signal converters SGn and multiple signal detectors SDn.

[0091] The signal converter SG1 is connected to the safety electronics 50 via safety outputs A1+, A1- in a single channel. In this example, the safety electronics 50 monitors the current of the signal converter SG1 at the safety outputs A1+, A1- using a first measuring device M1 and the voltage at the safety outputs A1+, A1- using a second measuring device M2. The first measuring device M1 and the second measuring device M2 form a feedback R1. The feedback R1 may include at least one further signal together with or in addition to the current and / or voltage. The signal detector SD1 is connected to the safety electronics 50 via safety inputs E1+, E1- in a single channel.

[0092] When the signal converter SG1 outputs one of the functional state, hazardous state, and position state, or a change of state, as lighting information by the safety electronics 50, this lighting information is detected by the signal detector SD1 and returned or fed back as a signal including a current and / or a voltage to the safety electronics 50 via the safety inputs E1+, E1−. Through this embodiment, the output of the signal converter SG1 by the signal detector SD1 and therefore the signal converter SG1 itself is additionally monitored, together with the safety monitoring of the signal to the signal converter SG1 via the safety outputs A1+, A1− and the safety monitoring of the signal from the signal detector SD1 via the safety inputs E1+, E1−. Thereby, it can be ensured with the highest safety level that the signal converter SG1 and therefore the indicator unit 30 have safely output the state of the plant 90 to the operator, or that the indicator unit 30 has not safely output (false) information to the operator. Since the indicator unit 30 is mounted on the operating unit 100 so that the operator always has the signal converter SG1 in his field of vision, he can immediately recognize changes in the state of the plant 90 and can react quickly, if necessary. In particular, in the case of an imminent danger, reported for example as a red light by the signal converter SG1, the reaction time can be significantly reduced, thereby significantly increasing the overall plant safety. In this embodiment, the highest safety level, and consequently the highest SIL / PL value, can be achieved in this way.

[0093] FIG. 7 shows a schematic diagram of a portion of an operating unit 100, in which the connection between the safety electronics 50 and the detection element 40 is formed in accordance with the second embodiment. The structure of the operating unit 100 corresponding to the second exemplary embodiment differs from the structure of the operating unit 100 corresponding to the first exemplary embodiment of FIG. 6 only in that the detection element 40 includes a fiber optic cable LWL and a signal detector SD1. The output of the indicator unit 30, as lighting information, is transmitted via the fiber optic cable LWL to the signal detector SD1, which detects the signal or output of the indicator unit 30. This allows the signal detector SD1 to be arranged at any position on the operating unit 100, thereby allowing the shape and size of the operating unit 100 to be individually adapted. Identical components are identified by the same reference numerals and, for the sake of brevity, will not be described in detail again.

[0094] In a first example, the signal converter SG1 can output the operating status of the operating unit 100. When the operator selects the plant 90 from the multiple plants using the second actuation element 6 or the touchscreen of the display 10, the signal converter SG1 can output the connection establishment and connection status. When the operating unit 100 and the plant 90 are connected, the signal converter SG1 can output the functional status, hazardous status, or position status of the plant 90. The output of the signal converter SG1 as a lamp is provided as lighting information, which, in non-exhaustive examples, includes flashing, pulsating, and changes in brightness and color. As a result, the lighting information serves as an indicator of a specific status of the operating unit 100 and / or the plant 90 and attracts attention. In one example, if the indicator unit 30 outputs a hazardous status using the signal converter SG1, the operator can reliably shut down the plant 90 using the actuation element 5 or the safety electronics 50 in response to the hazard. In another example, when the operator takes the operating unit 100 and leaves a predetermined local permissible area, the indicator unit 30 can output, by means of the signal converter SG1, a lighting information, e.g., a flashing information, that a local permissible area for the connection between the operating unit 100 and the plant 90 has been left. In a further example, when the power supply of the operating unit 100 is realized by a battery, the signal converter SG1 can output a lighting information, which indicates a low charge state of the battery.

[0095] FIG. 8 shows a flowchart of a method for operating at least one plant 90 from among a plurality of plants using an operation unit 100. In a first step S1, the operation unit 100 connects to at least one plant 90 via the operation unit's communication port 80. The plant 90 may be selected by an operator on the operation unit 100, for example, via the second actuation element 6 of the display 10 or the touch screen before the connecting step S1, or may be a plant that has already been pre-stored in the operation unit's memory. The connecting step S1 is performed via wired or wireless communication. When the operation unit 100 connects to the plant 90, communication between the operation unit 100 and the plant 90 is performed in real time or at intervals in the millisecond range. This ensures that, in a second step S2, the status of the plant 90 is safely output by the indicator unit 30 in real time or with barely noticeable delay.

[0096] Step S2 of outputting the status of the plant 90 includes one of a functional state, a hazardous state, and a position state, and is implemented by the indicator unit 30 of the operating unit 100 as at least one of a light signal, an acoustic signal, and a vibration signal. Step S2 of outputting the status of the plant 90 by the indicator unit 30 is monitored by the safety electronics 50 using control and feedback signals R1, R2 to the indicator unit 30. Step S2 of outputting by the safety electronics is monitored using safety outputs A1+, A1-, ..., An+, An-, at least one signal converter SG1, ..., SGn, at least one signal detector SD1, ..., SDn, and safety inputs E1+, E1-, ..., En+, En-. If no danger exists and an operator with the operating unit 100 is located within the local tolerance zone for connection, the functional state is output S2 by the indicator unit 30, for example, as a green light signal and / or an acoustic signal indicating correct function and connection between the operating unit 100 and the plant 90.

[0097] The operator can start and continue step S3 of operating the plant 90 via the operation unit 100. Step S3 of operating the plant 90 via the operation unit 100 is followed by step S4 of further outputting the status of the plant 90. Step S4 of further outputting the status of the plant 90 includes one of a functional status, a dangerous status, and a position status, which is implemented by the indicator unit 30 as at least one of lighting information, sound information, and vibration information. Step S4 of further outputting is continuously repeated in real time or at intervals within the millisecond range during connection or communication between the operation unit 100 and the plant 90. This ensures that the status of the plant 90 is safely output by the indicator unit 30 in real time or with an almost imperceptible delay, which is monitored by the safety electronics 50 of the operation unit 100 via step S4 of further outputting.

[0098] 9, the method for operating at least one plant 90 from among a plurality of plants using an operational unit 100 further includes a step S5 of signaling about termination of connection of the operational unit 100 to the at least one plant 90 by an indicator unit 30 of the operational unit 100. The indicator unit 30 signals about termination of connection S5 using a signal different from signals reporting or reflecting functional, hazardous, and positional states of the plant 90.

[0099] A connection termination occurs when the communication port 80 loses connection / communication with the previously connected plant 90. The reason for the connection termination can be, for example, a user leaving the local permitted area with the operating unit 100, or a low battery state, or a termination of the power supply of the plant 90 or the operating unit 100. If a connection termination of the plant 90 to the operating unit 100 occurs, the plant 90 goes into a safe state independently by S6. The step S6 of independently putting the plant into a safe state and the step S5 of informing are performed substantially simultaneously.

[0100] The method further comprises a step S7 of monitoring the indicator units 30 via the safety outputs A1+, A1-, ..., An+, An- of the safety electronics 50 of the operating unit 100. By means of this step S7 of monitoring the indicator units 30, a high safety standard (high SIL or PL) can be achieved.

[0101] According to the selection of a plant 90 from among a plurality of plants (90), the operational unit 100 can be used for at least one plant 90 from the plurality of plants. In one embodiment, the operational unit 100 can operate multiple plants in a manufacturing environment, such as a manufacturing hall. [Explanation of symbols]

[0102] 5. First operating element 6 Second operating element 10 Display 30 Indicator unit 40 Detector element 50 Safety Electronics 80 communication port 90 Plant, equipment and machinery 100 Operation Unit A1+, A1-, ..., An+, An- Safety output section, twisted wire E1+, E1-, …, En+, En- Safety input, stranded wire K1, K2 channels LWL fiber optic cable M1 Measuring instrument, first measuring device M2 Measuring instrument, second measuring device R1, R2 feedback S1, S2 switches S1, S2, S3, S4, S5, S6, S7, S8, S9 steps SD1, ..., SDn signal detectors SG1, ..., SGn signal converter

Claims

1. An operating unit for operating at least one plant from a plurality of plants, comprising: a communication port for connecting the operational unit to the at least one plant; an indicator unit for outputting an output relating to a state of the at least one plant and for continuously repeating further outputs, the indicator unit being provided in the operating unit; safety electronics for monitoring the indicator unit during the output of the state of the at least one plant, the safety electronics including at least one safety input and at least one safety output, the safety electronics being connected to the indicator unit via the at least one safety output, and the safety electronics being connected to a detection element via the at least one safety input; Including, the detection element is configured to detect an output of the indicator unit; The condition is at least one of a functional condition, a hazard condition, and a location condition. Operation unit.

2. the safety electronics is connected to the indicator unit via a feedback loop using the safety output, either in a single channel or multiple channels; and the safety electronics is connected to the detection element via the safety input, either in a single channel or multiple channels. The operating unit according to claim 1.

3. the indicator unit includes at least one signal converter; The operating unit according to claim 1.

4. each of the at least one signal converter is connected to the safety electronics via the at least one safety output; The operating unit according to claim 3.

5. the at least one signal transducer includes at least one of a lamp, an acoustic transducer, and a vibration transducer; The operating unit according to claim 3.

6. The lamp may include a single lamp or a multiple lamp. The operating unit according to claim 5.

7. the indicator unit outputs the functional state, the dangerous state, and the position state of the at least one plant using one of lighting information, sound information, and vibration information. The operating unit according to claim 1.

8. the detection element includes at least one signal detector, and the number of signal detectors may be different from the number of signal converters; The operating unit according to claim 3.

9. the at least one signal detector includes at least one of a photoresistor, a photodiode, a phototransistor, an acoustic sensor, and a vibration sensor; The operating unit according to claim 8.

10. each signal detector is connected to said safety electronics via said at least one safety input; The operating unit according to claim 8.

11. The operational unit is an independent part of the at least one plant or a part of the plant, The operating unit according to claim 1.

12. the communication port communicates with the at least one plant wirelessly or by wire; The operating unit according to claim 1.

13. at least one actuation element configured to actuate the operating unit; a display configured to display information about the state of the at least one plant and information about the state of the operational unit; The operation unit of claim 1 further comprising:

14. A method for operating at least one plant from among a plurality of plants using an operating unit according to claim 1, comprising: connecting the operational unit to the at least one plant by a communication port of the operational unit; outputting, by an indicator unit of the operation unit, a state of the at least one plant, including one of a functional state, a dangerous state, and a position state, as at least one of lighting information, sound information, and vibration information; operating the at least one plant by the operating unit; further outputting, by the indicator unit, the status of the at least one plant, including one of the functional status, the hazardous status, and the position status, as at least one of the lighting information, the sound information, and the vibration information; Including, and the step of outputting is repeated continuously during the connection between the operational unit and the at least one plant; the indicator unit is further monitored by safety electronics of the operating unit during the outputting step, the safety electronics including a safety input and a safety output, and the indicator unit is connected to the safety electronics via the at least one safety output. method.

15. - informing the at least one plant by the indicator unit of the operating unit about the termination of the connection of the operating unit; Upon termination of the connection of the at least one plant to the operating unit, the at least one plant is independently transferred to a safe state. further comprising the step of informing is performed using signals different from signals indicating the functional state, the hazardous state, and the position state of the at least one plant. The method of claim 14.

16. The step of connecting is performed by wired or wireless communication. The method of claim 14.

17. the step of outputting is monitored by the safety electronics by controlling and feeding back a signal to the indicator unit. The method of claim 14.

18. the outputting step includes information including the operational unit leaving a local tolerance region for the connection between the operational unit and the plant. The method of claim 14.

19. monitoring the indicator unit via the safety output of the safety electronics of the operating unit; 15. The method of claim 14, further comprising:

20. signalling by means of the indicator unit about the establishment or termination of a connection between the operating unit and the at least one plant.

15. The method of claim 14, further comprising:

21. indicating, by the indicator unit, a pairing between the operational unit and the at least one plant; 15. The method of claim 14, further comprising:

22. Use of the operational unit according to any one of claims 1 to 13 for at least one plant from among a plurality of plants.

Images