System and method for operating an actuator by non-reactive separation

Abstract

The invention relates to a system for operating an actuator (12), which system has a supply unit (14) and an electronics unit (16) with at least one switching output (18), in order to operate or control the actuator (12), wherein the at least one switching output (18) can be controlled by means of an internal switching element (20), wherein the electronics unit (16) with the at least one switching output (18) and the internal switching element (20) is designed as a functionally non-safe standard device. The electronics unit (16) has a safety switching device (24) between the at least one switching output (18) and the actuator (12), which safety switching device is designed to switch off the functionally non-safe actuator (12) in a non-reactive manner and ensures non-reactive separation (T) towards the actuator (12). The invention further relates to a system (10) having separate supply units (14a, 14b) and to a system (10) for operating a plurality of actuators (12).

Description

[0001] P2023.1205-WQ / RP

[0002] - 1 -

[0003] System for operating an actuator

[0004] The invention relates to a system for operating an actuator according to the preamble of claim 1. The invention further relates to a system according to the preamble of claims 2 and 6, as well as a method according to the preamble of claim 8.

[0005] In industrial automation technology, actuators are components that receive signals from a controller and translate them into physical actions. They are crucial for executing control commands and realizing movements or other physical changes in an automated process, particularly for mobile machinery, industrial robots, or in the automation and process industries. Actuators can be understood as motors or valves, for example.

[0006] In operation, actuators must meet increased safety requirements to ensure the safety of people and equipment, as well as particularly reliable operation. Functionally safe controllers can be used for this purpose; these detect faults early and react accordingly, in order to comply with legal regulations and standards, in particular the DIN EN ISO 13849 standard for functional safety.

[0007] Implementing functional safety is very complex and can require not only increased component requirements but also multiple redundancies and functionally safe programming. In some applications, however, such an effort is unnecessary due to lower safety requirements, which is why non-safe standard devices are often used. However, safety-relevant faults can occur in these cases, for example, if transient overvoltages in a printed circuit board material damage a creepage distance. Due to cross-circuits, an actuator can then be unintentionally powered, thus posing a safety risk.

[0008] To stop hazardous movements of actuators, safety switching devices, such as safety relays, are frequently used in state-of-the-art technology. These are installed in the supply line between a power supply unit and P2023.1205-WQ / RP.

[0009] - 2 - is connected to a switching output for controlling the actuator in order to safely disconnect it from the power supply if necessary, for example, after an emergency stop button has been pressed. However, such a simple interruption of the supply voltage is not sufficient in all cases to guarantee a safe state. Residual risks remain, particularly when using standard electronic control devices that are not themselves designed for functional safety. For example, internal faults in the control electronics, such as transient overvoltages or leakage currents on a circuit board, can lead to a short circuit. In such a fault, the actuator could be unintentionally supplied with voltage even though the external safety switching device has already interrupted the intended supply line.

[0010] Furthermore, such a shutdown does not address the problem of faulty feedback. Faults occurring on the actuator side or in its wiring can affect the upstream control electronics and compromise their shutdown state. Simply disconnecting the supply voltage does not provide a solution for this. This is particularly relevant for more complex control systems that have separate power supplies for the internal logic and the external load.

[0011] The object of the invention is to provide a system and a method for operating actuators that, while avoiding the disadvantages known from the prior art, enables a simple yet reliable implementation of actuator operation. In particular, a standard electronic unit for actuator control is to be upgraded in such a way that a reliable shutdown of the actuator is guaranteed even in the event of an internal fault, and that faulty feedback from the actuator to the electronic unit is prevented.

[0012] The problem is solved by the features of claim 1, claim 2 and claim 6. With regard to the method, the problem is solved by the features of claim 8.

[0013] Advantageous embodiments of the invention are specified in the dependent claims.

[0014] According to the invention, a system for operating an actuator is claimed, comprising a power supply unit, in particular a single power supply unit, and an electronic unit with at least one switching output for operating or controlling the actuator, particularly in a state connected to the electronic unit, wherein the at least one switching output is controllable by means of one or more internal switching elements, and wherein the electronic unit with the at least one switching output and the internal switching element is designed as a functionally non-safe standard device. The electronic unit includes a safety switching device between the at least one switching output and the actuator, in particular an actuator connection, which is designed for the non-reactive shutdown of the functionally non-safe actuator and ensures a non-reactive isolation from the actuator.

[0015] In other words, the safety switching device is arranged and designed to create a non-reactive separation from the actuator in order to ensure a shutdown even if the electronic unit and / or the actuator itself is faulty.

[0016] The invention focuses on the non-reactive shutdown of the actuator in order to protect people and equipment from hazardous conditions. The safety switching device is therefore to be understood in terms of functional safety.

[0017] For the purposes of the present invention, a safety switching device is preferably understood to be a device that meets the requirements of functional safety. In contrast to a mere device protection circuit, for example an electronic fuse, a safety switching device is characterized by a fail-safe architecture.

[0018] In particular, this is an internal safety switching device within the electronic unit. The electronic unit is preferably configured as a mobile controller, industrial controller, and / or switching device for operating or controlling the actuator. Preferably, the electronic unit can be configured as a programmable control unit, advantageously eliminating the need for functionally safe programming of the control unit. Alternatively or additionally, the electronic unit can also be configured as a monitor for monitoring actuator parameters.

[0019] The invention has the advantage that, by using a safety switching device, a non-safety electronic unit can be upgraded to enable the safe shutdown of a non-safety actuator. This has P2023.1205-WQ / RP

[0020] - 4 - The advantage is that significantly more cost-effective devices can be used, while still ensuring a safe state after a shutdown, for example, following an emergency shutdown. The non-reactive isolation prevents short circuits from supplying power to the actuator. Furthermore, the invention has the advantage that standard devices can be used without requiring full functional safety. The shutdown advantageously meets specific, increased safety requirements, particularly according to the DIN EN ISO 13849 standard, which is why actuator operation can be implemented simply yet with sufficient safety.

[0021] In other words, the use of the safety switching device enables easy retrofitting and upgrading of standard devices for safe actuator operation, without the need for secure programming and complex certifications.

[0022] The invention further relates to a system for operating an actuator, which has at least two supply units and an electronic unit with at least one switching output to operate or control the actuator, wherein a first supply unit provides a first supply voltage for the at least one switching output and at least a second supply unit provides a second supply voltage for an internal switching element to control the at least one switching output, wherein the electronic unit is designed as a functionally non-safety standard device.The electronic unit has a safety switching device between the at least one switching output and the actuator, which is designed to shut down the functionally non-safe actuator without back-effect and ensures a back-effect-free separation towards the actuator, whereby an internal back-effect-free potential separation of the first and the second supply voltage within the electronic unit is formed by a standard-specified insulation.

[0023] Preferably, a safe state of a functionally non-safe actuator can be enabled by means of the safety switching device by interrupting the first supply voltage, wherein the at least one switching output is functionally safe and non-reactively separated from the second supply voltage in order to reliably prevent an unwanted energy supply to the actuator.

[0024] A non-reactive isolation ensures, in particular, that even in the event of a fault, no transient overvoltages can be transmitted to the switching output, thus reliably preventing an unplanned supply to the actuator.

[0025] A non-reactive isolation between the internal switching element and the at least one switching output can preferably be achieved by means of a safety relay integrated into the electronic unit and / or an electronic component for galvanic isolation, in particular an optocoupler. Advantageously, control signals can also be transmitted via the insulating and non-reactive isolation gap.

[0026] According to a preferred embodiment, the safety switching device comprises a safety relay, wherein the safety relay is preferably switchable by means of a functionally safe signaling unit and wherein the functionally safe signaling unit is preferably designed as a light grid, light curtain, proximity switch and / or as an external emergency stop switch.

[0027] Preferably, the safety relay is permanently or pluggably integrated into the electronic unit. Alternatively or additionally, the safety relay can also be located outside the electronic unit. A pluggable safety relay is particularly easy to retrofit.

[0028] Alternatively or additionally, the safety switching device may be designed as an integrated, functionally safe emergency stop switching device.

[0029] According to a further preferred embodiment, the at least one power supply unit can be designed as at least one switched-mode power supply with an isolation transformer and / or connected to a grounded neutral point in order to reduce and / or dissipate transient overvoltages from a mains supply and thereby reduce the requirements for non-reactive isolation. In particular, the required clearance and creepage distance and the requirements for solid insulation of the electronic unit can be reduced. The power supply unit can preferably be designed as a single or two separate switched-mode power supplies.

[0030] Furthermore, the invention also relates to a system for operating several actuators, which has at least one supply unit and an electronic unit with several switching outputs to operate or control the actuators, wherein the at least one supply unit provides a first supply voltage for the switching outputs and a second supply voltage for an internal switching element of the switching outputs, wherein the electronic unit is designed as a functionally non-safe standard device.In this case, parallel cabling between the at least one supply unit and parallel switching outputs is routed without feedback at least from a separation point onwards, wherein a safety switching device is designed between the separation point and the parallel switching outputs in order to safely switch off the actuators connected to the electronic unit by interrupting the first supply voltage and to ensure a feedback-free separation to the actuators.

[0031] Preferably, the electronic unit has a switching output group for connecting multiple actuators. In particular, these can be detachable connections, whereby, in principle, only a single actuator can be connected.

[0032] In this context, the invention also offers the advantage of a safe and non-reactive shutdown, whereby the arrangement of the safety switching device upstream of several switching outputs allows these to be safely shut down simultaneously. Thus, a group of parallel switching outputs can preferably be shut down by a single, easily retrofitted safety switching device. In particular, parallel wiring is used for this purpose.

[0033] The safety switching device can interact with the electronic unit externally or internally, with separate wiring being particularly necessary for an external safety switching device.

[0034] According to a preferred embodiment, the electronic unit is configured as a functionally non-safety master unit, preferably an IO-Link master unit, or as a controller for industrial communication systems, which provides multiple connections for multiple actuators and / or at least one sensor, wherein the at least one sensor supplies a measurement signal. The second supply voltage of the at least one sensor is isolated from the first supply voltage of the actuators without any feedback effect. In particular, according to one embodiment, an actuator with an integrated sensor can be operated by the IO-Link master unit. Advantageously, the sensor is integrated in a way that is isolated from the actuator circuit without any feedback effect.

[0035] In this context, it should be added that the invention is preferably not limited to IO-Link systems. Rather, the electronic unit can be configured as a master unit or controller for any industrial communication system in which separate power supplies are provided for the control electronics and the actuator power. Examples of such systems include, among others, AS-Interface (AS-i), in which the AS-i and AUX voltages are separate, or systems for mobile machinery in which several supply voltages (e.g., VBB30, VBBO) must also be switched without affecting each other.

[0036] It is further preferred that the aforementioned embodiments of a system include one or more actuators.

[0037] Furthermore, the invention also relates to a method for operating at least one actuator using a previously mentioned system.

[0038] Preferably, at least one actuator is operated via at least one switching output of an electronic unit designed as a functionally non-safety-compliant standard device. To safely switch off at least one actuator, a non-reactive disconnection of the power supply between the switching output of the electronic unit and the actuator is achieved by means of an intermediate safety switching device.

[0039] The invention will now be explained in more detail using exemplary embodiments and with reference to the drawings.

[0040] The following is shown schematically: Fig. 1a: a block diagram of a system for the safe shutdown of a

[0041] Actuator with an electronic unit, a functionally safe signaling unit and a single power supply unit,

[0042] Fig. 1b: a block diagram of a system according to Fig. 1a with two separate supply units,

[0043] Fig. 2: a block diagram of a system for the safe shutdown of a

[0044] Actuator with an integrated, safe emergency stop switching device,

[0045] Fig. 3a: a block diagram of an IO-Link master unit for secure

[0046] Switching off an actuator with a single switched-mode power supply,

[0047] Fig. 3b: a block diagram of an IO-Link master unit according to Fig. 3a with two separate switching power supplies.

[0048] In the following description of preferred embodiments, identical reference numerals denote identical or comparable components.

[0049] Fig. 1a shows a system 10 for safely switching off an actuator 12, wherein the system 10 comprises an electronic unit 16 and a single power supply unit 14 for operating or controlling the actuator 12. The electronic unit 16 preferably has a switching output 18 for controlling a supply voltage 11a and a voltage supply for the actuator 12. For controlling the switching output 18, the electronic unit 16 has an internal switching element 20. According to the invention, the electronic unit 16 with the switching output 18 and the internal switching element 20 is designed as a non-safety standard device, for example, a functionally non-safety control unit, for operating a preferably non-safety actuator 12. In order to nevertheless ensure safe switching off of the actuator 12, a safety switching device 24, in particular a safety relay 25, is arranged between the switching output 18 and the actuator 12.The safety switching device 24, particularly due to its functionally safe design, enables a non-reactive disconnection T, shown here as a dashed line, to the actuator 12. In this way, a functionally safe shutdown of the actuator 12 can be ensured despite the functionally non-safe basic components of the electronic unit 16. In particular, it prevents cross-voltage from acting on the actuator 12 and, for example, causing an unwanted voltage supply.

[0050] Fig. 1b shows an alternative embodiment of the system 10 with two separate first and second supply units 14a,b, which provide a first supply voltage 14a for actuator operation and a second supply voltage Ui for an internal switching element 20. Preferably, an internal, non-reactive potential isolation TP between the first and second supply voltages Ua,Ui is formed by a standard-specified isolation, which is shown here as a dashed line.

[0051] Preferably, the safety switching device 24 according to Fig. 1a and Fig. 1b is switched by means of an external functionally safe signaling unit 26, which is preferably connected to a functionally safe input 28. The signaling unit 26 can be, for example, a light grid, light curtain, proximity switch and / or an external emergency stop switch.

[0052] Fig. 2 shows an alternative embodiment to Fig. 1b, wherein the safety switching device 24 is designed by means of a functionally safe and integrated emergency stop switching device 30. An embodiment with a single supply unit 14 according to Fig. 1a is also conceivable for the emergency stop switching device 30 in an analogous manner.

[0053] A switching signal S between the internal switching element 20 and the switching output 18 is shown as a dashed line, wherein a safe transmission can preferably be formed by means of optocouplers or by the safety switching device 24 itself, forming the safe isolation gap TP.

[0054] Figures 3a and 3b show a further preferred embodiment of a system 10, wherein an electronic unit 16 is configured as a functionally non-safety IO-Link master unit 32 with a switching output 18 or a switching group for controlling an actuator 12, which is operated by a first supply voltage Ua or actuator voltage. The IO-Link master unit 32 also serves to evaluate an integrated sensor 34 within the actuator 12 and to evaluate measurement signals, wherein the sensor 34 or a monitoring unit is operated by a second supply voltage Ui or sensor voltage. Preferably, the first and the second supply voltages Ia, Ui are separated from each other without feedback by sufficiently large clearance and creepage distances along the dashed dividing line T. In particular, separation occurs from a separation point P or star point.To ensure the safe shutdown of the actuator 12, a safety switching device 24 is preferably connected upstream of the IO-Link master unit 32 or alternatively integrated. The safety switching device 24 is preferably designed for the two-pole shutdown of the first supply voltage Ua.

[0055] Preferably, the sensor 34 is separated within the actuator 12 shown without any effect on the feedback, in order to ensure safe shutdown there as well.

[0056] The IO-Link master unit 32 shown is particularly suitable for connecting multiple actuators 12, whereby several plug connections (not shown) can be provided with parallel wiring. The upstream safety switching device 24 enables the safe disconnection of all parallel plug connections and the actuators 12 connected to them.

[0057] According to Fig. 3a, the power supply unit 14 can preferably be configured as a single switched-mode power supply or, alternatively, according to Fig. 3b, with two separate switched-mode power supplies to provide the two supply voltages Ua and Ui. Preferably, the system 10 is operated with a safety extra-low voltage.

[0058] Preferably, the supply unit 14 or the supply units 14a, 14b is equipped with an isolating transformer and / or connected to an earthed star point P in order to reduce and / or dissipate transient overvoltages from a mains supply and thereby reduce the requirement for the non-reactive isolation T between parallel wiring.

[0059] In this context, it may also be possible for the IO-Link master unit 32 to be equipped with a functional ground (FE). Reference numeral list

[0060] 10 System

[0061] 12 Actuator

[0062] 14 supply units

[0063] 14a, b first and second supply unit

[0064] 16 Electronic unit

[0065] 18 Switching output of the electronic unit

[0066] 20 internal switching element of the electronic unit

[0067] 24 Safety switching device

[0068] 25 safety relays

[0069] 26 functionally safe reporting units

[0070] 28 functionally safe inputs for the alarm unit

[0071] 30 Emergency stop switching device

[0072] 32 IO-Link master units

[0073] 34 integrated sensors

[0074] T non-reactive separation

[0075] TP non-reactive potential isolation

[0076] S switching signal

[0077] P Star point

[0078] FE functional grounding

[0079] Ua first supply voltage

[0080] Ui second supply voltage

Claims

1. Patent claims 1. System for operating a functionally non-safe actuator (12), comprising a power supply unit (14) and an electronic unit (16) with at least one switching output (18) for operating and / or controlling the actuator (12), wherein the at least one switching output (18) is controllable by means of an internal switching element (20), wherein the electronic unit (16) with the at least one switching output (18) and the internal switching element (20) is designed as a functionally non-safe standard device, characterized in that the electronic unit (16) has a safety switching device (24) between the at least one switching output (18) and the actuator (12), which is designed for the non-reactive shutdown of the functionally non-safe actuator (12) and ensures a non-reactive separation (T) to the actuator (12).

2. System for operating a functionally non-safe actuator (12), comprising at least two power supply units (14a, 14b) and an electronic unit (16) with at least one switching output (18) for operating and / or controlling the actuator (12), wherein a first power supply unit (14a) provides a first supply voltage (11a) for the at least one switching output (18) and at least a second power supply unit (14b) provides a second supply voltage (Ui) for an internal switching element (20) for controlling the at least one switching output (18), wherein the electronic unit (16) is designed as a functionally non-safe standard device, characterized in that the electronic unit (16) has a safety switching device (24) between the at least one switching output (18) and the actuator (12), which is designed for the non-reactive shutdown of the functionally non-safe actuator (12) and ensures a non-reactive isolation (T) from the actuator (12).wherein an internal non-reactive potential isolation (TP) of the first and second supply voltages (Ua,Ui) within the, The electronic unit (16) is formed by a normatively specified insulation.

3. System according to one of claims 1 or 2, characterized in that the safety switching device (24) comprises a safety relay (25), wherein the safety relay (25) can be switched by means of a functionally safe signaling unit (26) and wherein the functionally safe signaling unit (26) is preferably designed as a light grid, light curtain, proximity switch and / or as an external emergency stop switch.

4. System according to one of claims 1 to 3, characterized in that the safety switching device (24) is designed as an integrated functionally safe emergency stop switching device (30).

5. System according to one of claims 1 to 4, characterized in that the supply unit (14) or the supply units (14a, 14b), in particular switching power supplies, is / are equipped with an isolating transformer and / or is connected to an earthed neutral point in order to reduce and / or dissipate transient overvoltages from a mains supply and thereby reduce the requirement for non-reactive isolation (T).

6. System for operating multiple actuators (12), comprising at least one power supply unit (14) and an electronic unit (16) with multiple switching outputs (18) for operating and / or controlling the actuators (12), wherein the at least one power supply unit (14) provides a first supply voltage (Ua) for the switching outputs (18) and a second supply voltage (Ui) for an internal switching element (20) of the switching outputs (18), wherein the electronic unit (16) is designed as a functionally non-safety standard device, characterized in that that a parallel cabling between the at least one supply unit (14) and parallel switching outputs (18) is guided without feedback at least from a separation point (P), wherein a safety switching device (24) is formed between the separation point (P) and the parallel switching outputs (18) in order to safely switch off the actuators (12) connected to the electronic unit (16) by interrupting the first supply voltage (Ua) and to ensure a feedback-free separation (T) to the actuators (12).

7. System according to claim 6, characterized in that the electronic unit (16) is designed as a functionally non-safe IO-Link master unit, which has several connections for several actuators (12) and / or at least one sensor (34), wherein the at least one sensor (34) provides a measurement signal and is supplied by the second supply voltage (Ui), which is separated from the first supply voltage (Ua) of the actuators (12) without any feedback effect.

8. Method for operating at least one actuator (12) by means of a system according to one of claims 1 to 7, wherein the at least one actuator (12) is operated via at least one switching output (18) of an electronic unit (16) which is designed as a functionally non-safe standard device, characterized in that, for the safe switching off of the at least one actuator (12), a non-reactive disconnection (T) of the power supply between the switching output (18) of the electronic unit (16) and the actuator (12) is carried out by means of an intermediate safety switching device (24).

Images