Motor starter

Abstract

The invention relates to a motor starter (50), comprising - a voltage input (4) for applying a voltage, by means of the voltage level of which an STO signal can be signaled, - a bus interface (3) for receiving and transmitting data packets via a bus (10B), - two redundant voltage evaluation paths (U1, U2), each of which is configured for evaluating whether a voltage at the voltage input (4) signals an STO signal, - two redundant data packet evaluation paths (D1, D2), each of which is configured for evaluating whether a data packet received at the bus interface (3) contains an STO signal, and - a switching device (7, 8), which is configured for interrupting a load current path (9) running through the motor starter (50) when an STO signal is detected in at least one of the evaluation paths (D1, D2, U1, U2).

Description

[0001] 202408801

[0002] 1

[0003] Description

[0004] Engine starter

[0005] Technical field

[0006] The present invention relates to a motor starter and a method for operating a motor starter.

[0007] Technical background

[0008] In a well-known motor starter, the ET200SP motor starter from Siemens AG, a STO command (STO = Safe Torque Off) is given as a DC voltage signal to a safe digital input (STO+ (24 V), STO- (GND)) ("safety function STO hardwired"). See chapter "6.8.2 Behavior during safety-related shutdown" on page 90 of the device manual "SIMATIC / ET 200SP / Motor starter ET 200SP (3RK1308-...)", edition 10 / 2021, publication no. A5E34821005001 A / RS-AD / 004, published by Siemens AG, Smart Infrastructure, Electrical Products, P.O. Box 10 09 53, 90009 Regensburg, Germany.

[0009] It is known that a digital input assigns a DC voltage signal at a first defined voltage level, e.g., in the range of 19.2 V to 28.8 V, a logic one ("1") and a DC voltage signal at a second defined voltage level, e.g., in the range below 5 V, a logic zero ("0"), similar to the line code NRZ for binary signals. See chapter "5.1.4 Safety Integrated Functions" on pages 35 ff. of the device manual "SIMATIC / ET 200SP / F-TM StepDrive ST 1x24..48V 5A", edition 04 / 2021, publication no. A5E50747346-AA, published by Siemens AG, Digital Industries, P.O. Box 4848, 90026 Nuremberg, Germany.

[0010] When a logic zero (= STO) is present, the ET200SP motor starter switches off the energy supply to a downstream electric motor, preventing it from generating torque or force. Conversely, a logic one (= no STO) actively enables the energy supply to the electric motor. See page 90 of the aforementioned device manual "SIMATIC / ET 200SP / Motor starter ET 200SP (3RK1308-...)".

[0011] The STO safety function of the ET200SP motor starter complies with Safety Integrity Level SIL3. SIL3 requires redundancy in the evaluation and transmission of the STO signal to the switching elements. This redundancy results in a 202408801

[0012] 2

[0013] A hardware fault tolerance of 1 means that the minimum number of faults that can lead to a loss of the safety function is equal to 1 + 1 (= 2). The requirement to achieve a hardware fault tolerance of 1 for SIL3 arises from section 7.4 "Design and Development of the E / E / PE System" and the associated Table 3, page 27 of the standard DIN EN 61508-2 (VDE 0803-2):2011-02. The alternative shown in the table, achieving SIL3 with a hardware fault tolerance of 0 but a safe failure rate of 99 percent or greater, is not feasible in practice. This is because the dangerous failure rate, due to the complexity of the circuit required for the safety function under consideration, will be higher than 1%.

[0014] Summary of the invention

[0015] The object of the present invention is to improve the STO safety function in engine starters.

[0016] This problem is solved according to the invention by a motor starter with the features specified in claim 1. The motor starter has a voltage input to which a voltage can be applied, whereby, by selecting a defined voltage level, the so-called "voltage level," the motor starter can be signaled whether a STO signal is present (e.g., voltage level approximately 0 V) ​​or not (e.g., voltage level 24 V). The motor starter also has a bus interface to which a data bus, hereinafter also simply referred to as "bus," can be connected. The bus interface serves to receive and send data packets via the data bus. A data packet that is received or sent via the data bus can hereinafter also be referred to as a "telegram."The motor starter also has two redundant voltage evaluation paths, each configured to evaluate whether a voltage applied to the voltage input signals an STO (Start-up-Off) signal. The motor starter also has two redundant data packet evaluation paths, each configured to evaluate whether a data packet received at the bus interface contains an STO signal. Finally, the motor starter has a switching device configured to interrupt a load current path running through the motor starter upon detection of an STO signal in at least one of the evaluation paths. The motor starter can, for example, include a power section with at least one switch per phase conductor. This switch can be a mechanical switch such as a relay or an electronic switch such as a transistor (MOSFET, IGBT, etc.).An STO signal present in at least one of the evaluation paths can thus be used to induce an STO state in a motor connected to the motor starter. 202408801.

[0017] 3

[0018] This problem is further solved according to the invention by a method with the features specified in claim 8. This method is for operating a motor starter. The method includes a step in which a voltage input of the motor starter is provided, configured to tap a voltage. The method includes a step in which a bus interface of the motor starter is provided, configured to receive and send data packets via a bus. The method includes a step in which two redundant voltage evaluation paths of the motor starter are operated to evaluate whether a voltage level of a voltage tapped at the voltage input signals an STO signal. The method includes a step in which two redundant data packet evaluation paths of the motor starter are operated to evaluate whether a data packet received at the bus interface contains an STO signal.And the procedure includes a step in which a load current path running through the motor starter is interrupted if an STO signal is detected in at least one of the evaluation paths.

[0019] The invention relates to an architecture within a bus-controlled and parameterizable motor starter for preferably fixed-speed motors, wherein this architecture enables a STO function with redundancy in signal evaluation and transmission to the switching device of the motor starter. The motor starter has suitable receiving devices with which it can receive both an STO signal signaled by a voltage level and an STO signal transmitted via a data bus. The signal that triggers STO can therefore be selectively transmitted to the motor starter either via a voltage level to an input terminal of the motor starter or as part of a data packet (e.g., a telegram) preferably received cyclically via a bus and secured using a safe bus protocol, e.g., PROFIsafe, or via both methods.The motor starter is capable of receiving an STO signal both as a voltage signal and as a data packet. For STO via the safe input terminal and for STO via bus communication secured by a safe bus protocol, e.g., PROFIsafe, there are redundant paths for evaluating and executing the STO command.

[0020] The motor starter is configured so that, if an STO command is detected via at least one of the four specified evaluation paths, it can establish the STO motor state on a motor downstream of the motor starter using the switching device. 202408801

[0021] 4

[0022] Providing the capability for a motor starter to receive an STO command via a safe bus protocol requires less wiring than signaling the STO command to the motor starter via a safe voltage input. Most importantly, a safe bus protocol eliminates the need for a component, such as a safety switching device or a safe digital output module, since a safety controller can transmit the STO signal directly to the motor starter via a bus. Using a safe bus protocol, which must also be SIL3 certified, ensures that communication errors (transmission errors) are detected and that an STO is initiated in such cases.

[0023] At the same time, there are users of motor starters who still require that STO be triggered via a voltage input. With the invention, both variants—i.e., STO triggering via a voltage input and STO triggering via a bus protocol—can be achieved with a single device variant. This reduces device variance and thus saves costs and effort for both the motor starter manufacturer and the user. Furthermore, selecting the desired STO triggering method(s) is very easy for the user.

[0024] The motor starter is used for functional safety; in order to achieve a defined safety level, preferably according to standards, the evaluation paths are designed redundantly.

[0025] The STO safety function is not designed to protect the motor starter itself. The STO safety function protects people from hazards emanating from a drive or machine powered by a motor that is operated by the motor starter.

[0026] The present invention can be used, among other things, to protect persons from the hazards emanating from a drive by means of a motor starter, i.e., a device for switching and controlling three-phase motors, and the STO (Safe To Stop) safety function. For example, STO can be triggered when a light barrier detects that a person has entered a danger zone near a drive or a driven machine. The combination of all elements in the safety chain, such as sensors (e.g., light barrier) or evaluation units (e.g., PLC), must, as a whole, meet the requirements for SIL3 (Safety Integrity Level 3) so that the safety function as a whole achieves SIL3 (PLC = Programmable Logic Controller).

[0027] Embodiments of the invention 202408801

[0028] 5

[0029] Advantageous embodiments and further developments of the invention are specified in the dependent claims. The method according to the invention can also be further developed according to the dependent apparatus claims, and vice versa.

[0030] According to a preferred embodiment of the invention, a first voltage evaluation path comprises a controller in which the voltage is evaluated, and a second voltage evaluation path comprises a hardware circuit in which the voltage is evaluated. According to a preferred embodiment of the invention, evaluation in a first voltage evaluation path is performed by means of a controller in which the voltage is evaluated, and evaluation in a second voltage evaluation path is performed by means of a hardware circuit in which the voltage is evaluated.The voltage at the input terminal is evaluated simultaneously by two instances: firstly by a controller, which, depending on the voltage level of the voltage applied to the input terminal, preferably when a defined voltage level is undershot, initiates STO, and secondly by an electronic circuit without the involvement of a controller, which can also initiate STO independently of the controller depending on the voltage level of the voltage applied to the input terminal.

[0031] According to a preferred embodiment of the invention, each data packet evaluation path includes a controller in which the data packet is evaluated. In a preferred embodiment of the invention, evaluation in each data packet evaluation path is performed by means of a controller in which the data packet is evaluated. If, in the case of a motor starter, the possibility is to be provided that STO can be triggered via an STO command received as payload of a data packet received via the bus interface, a hardware circuit as a redundant path is not permissible; therefore, in this case, a second controller as a redundant path is mandatory.

[0032] According to a preferred embodiment of the invention, at least one of the controllers is a technology controller and / or at least one of the controllers is a communication controller. The technology controller is configured to control the switching functions of the motor starter. The communication controller is responsible for the bus connection of the motor starter and is configured to forward data packets created by the technology controller to the bus interface for transmission and to forward data packets received from the bus interface to the technology controller. Thus, 202408801

[0033] 6. A communication controller already present in the engine starter is used to evaluate the STO command. This allows for better utilization of the available resources of an engine starter and avoids unnecessary costs.

[0034] According to a preferred embodiment of the invention, the motor starter is configured to control a fixed-speed motor. To control a variable-speed motor, a frequency converter can be used instead of a motor starter; in this case, an STO signal is sent to the frequency converter.

[0035] According to a preferred embodiment of the invention, the voltage input is a safe digital input. This means that the voltage input is certified according to a functional safety standard and meets the requirements stipulated in that standard. One such requirement might be that the probability of a stuck-at-1 fault occurring at the evaluation units due to a defect in an electronic component must be below a certain value. Achieving this requires specific measures in the design of the electronics, such as a redundant circuit design or a cyclic dark test. In a dark test, a controller applies a test signal to the electronic circuit of a safe input and tests whether the level then changes from high to low, which would prove that no stuck-at-1 fault is present.

[0036] According to a preferred embodiment of the invention, the evaluation of the data packet is secured using a secure bus protocol.

[0037] According to a preferred embodiment of the invention, for the evaluation of an STO command received via the bus interface, a program runs on at least two controllers of the motor starter. This program uses a safe bus protocol, also referred to as a "safety protocol," to detect communication errors in the cyclic exchange of telegrams containing the process value for STO and to extract the process value for STO. The safety protocol can be, for example, PROFIsafe. STO is triggered by a controller when the corresponding cyclic process value reaches the value defined for triggering STO, or when a relevant communication error is detected during the transmission of the telegrams containing this process value using the safe bus protocol, e.g., PROFIsafe. Such a communication error can be a transmission error. Safety protocols detect errors that can occur during bus communication, e.g.,Timeouts, incorrect addressing, lost telegrams, data corruption. Various security measures can be used for this; for example, CRC-202408801.

[0038] 7

[0039] These could be checksums, telegram numbers, or similar identifiers appended to the actual payload in the transmitted telegrams, which contain the STO instruction, e.g., in the form of an STO / Non_STO bit. The "Safety Protocol Program" therefore preferably outputs the following two outputs:

[0040] - a value of the STO / NOT_STO bit; and

[0041] - Information on whether the value of the STO / NOT_STO bit is valid (e.g., if there is neither a communication error not corrected within the timeout time nor a timeout) or invalid (e.g., if there is a communication error not corrected within the timeout time or a timeout).

[0042] According to a preferred embodiment of the invention, the receiving and sending of data packets via the data bus is carried out using a secure bus protocol.

[0043] According to a preferred embodiment of the invention, parameterization of the motor starter via the bus input determines whether evaluation should only take place in the voltage evaluation paths or whether evaluation should take place in both the voltage evaluation paths and the data packet evaluation paths. The motor starter can be controlled and parameterized via the bus. The method of receiving and triggering STO via the bus can be deactivated by parameterizing the motor starter, e.g., using an engineering tool. The parameterization data that the motor starter receives via the bus contains information about whether evaluation of an STO command in the data packet evaluation paths should be deactivated or not.In the firmware of the controllers, which contains the programs for the safe bus protocol, logic is implemented that prevents the output of an STO command if, based on the received parameterization data, it is recognized that the method of receiving and triggering STO via the bus should be disabled (FW = Firmware).

[0044] According to a preferred embodiment of the invention, by permanently applying a voltage at a level that does not signal an STO (Start-up To Disable) signal to the voltage input, it is determined that evaluation should only take place in the data packet evaluation paths. This provides a simple way to define the desired evaluation path of the motor starter. If the possibility of triggering STO on a motor starter via a safe voltage input is to be deactivated, a corresponding voltage level, e.g., 24 V, must be permanently applied to the voltage input.

[0045] According to a preferred embodiment of the invention, in the event of a transmission error of a data packet, STO is triggered if the transmission error is not rectified within a specified time period by a correct retransmission of the data packet. (202408801)

[0046] Point 8 is one of the reasons why a secure bus protocol is used. With regard to a secure protocol for safeguarding data packets, e.g., telegrams, safeguarding does not mean that the data packets are protected against transmission errors, but only that such transmission errors are reliably detected.

[0047] Exemplary embodiments of the drawing

[0048] The properties, features, and advantages of this invention described above, as well as the manner in which they are achieved, will become clearer and more easily understood through the following description of exemplary embodiments, which will be explained in more detail with reference to the drawings. The drawings are schematic and not to scale.

[0049] Fig. 1 shows a motor branch;

[0050] Fig. 2 shows a motor starter according to the invention in a first embodiment;

[0051] Fig. 3 shows a flowchart of the procedure for operating a motor starter; and

[0052] Fig. 4 shows a motor starter according to the invention in a different embodiment.

[0053] Detailed description of the exemplary implementations

[0054] Fig. 1 shows a motor branch. From a power supply network 40 with three phase conductors L1, L2, L3, e.g., a three-phase network, a three-phase load circuit 41 branches off at connection points 42, via which electrical energy can be transported to an electric motor 43. The motor can be a low-voltage three-phase asynchronous motor or any other electrically operated motor.

[0055] A motor starter 50 is connected between connection points 42 and the motor 43, in the phase conductors L1, L2, L3 of the load circuit 41. The motor starter has input terminals 31 on the mains side and output terminals 32 on the load side, to which the phase conductors L1, L2, L3 are connected. Inside the motor starter 50, load current paths run between the input terminals 31 and the output terminals 32, which can be interrupted by means of switching devices in the motor starter 50.

[0056] The motor starter 50 switches all three phase conductors L1, L2, L3 of the load circuit 41. For this purpose, the motor starter 50, which can be divided into a power section and a control section, has the following features: 202408801

[0057] 9. The power section of the motor starter contains at least one switch per phase L1, L2, L3. The switch can be electromechanical, e.g., a relay, or electronic, e.g., a transistor (Mostet, IGBT, etc.). It is also possible that at least one electromechanical switch, e.g., a relay or a galvanically isolating disconnect switch, and one electronic semiconductor switch, e.g., a transistor switch, are arranged in series in at least one phase conductor. The motor starter is configured for a fixed-speed motor.

[0058] The motor starter 50 has a bus interface 3 and a voltage input 4. The bus interface 3 is used to receive and send data packets via a bus line 10B. The voltage input 4 is connected to an electrical line 10U; in this way, a voltage is applied to the voltage input 4, the voltage level of which can signal the motor starter.

[0059] A command, such as an STO signal, can be transmitted to the motor starter 50 via both the bus interface 3 and the voltage input 4. Further devices are connected to the bus line 10B: a BUS node 62 in the form of a PLC, which sends commands such as an STO signal to the motor starter 50, and a parameterization device 61. The parameterization device 61, e.g. For example, a PC (personal computer) with an engineering tool such as the Siemens TIA Portal (TIA = Totally Integrated Automation) does not send parameterization data directly to the motor starter 50, but to the PLC 62. The parameterization data is permanently stored there, and the PLC 62 sends the parameterization data to the motor starter 50 whenever the motor starter 50 "reports" to bus 10B after its startup. "Start-up" of the motor starter 50 means that the motor starter 50 is switched on by connecting a 24 V supply voltage to its control unit.The parameterization device 61 is therefore only required for initial parameterization, and if the parameterization data is to be changed after the initial parameterization.

[0060] An STO (Safe Torque Off) device 65, such as a light barrier, light curtain, safety mat, emergency stop switch, safety door, or safety scanner, can be connected to the electrical line 10U, which is connected to the voltage input 4. This device sends a safety command in the form of an STO signal to the motor starter 50 when a defined condition is present. The safety command can be signaled to the motor starter 50 by a defined voltage level, e.g., a voltage < 5 V, at the voltage input 4. 202408801

[0061] 10

[0062] Fig. 2 shows a first embodiment of a motor starter 50 according to the invention. The motor starter 50 has a voltage input 4 for connecting an electrical line 10U; a voltage 102 can be applied to the voltage input 4 via the electrical line 10U, and the voltage level of this voltage can signal an STO signal to the motor starter 50. The voltage input 4 can be a safe digital input.

[0063] The motor starter 50 also has a bus interface 3 for receiving and sending data packets 101 via a bus line 10B; thus, a STO signal can be sent to the motor starter 50 by a bus data packet 101. Each data packet can be secured using a secure bus protocol. The motor starter 50 therefore has two independent inputs 3 and 4 for receiving an STO signal, with the two inputs 3 and 4 operating using different communication methods.

[0064] The motor starter 50 has two redundant voltage evaluation paths U1 and U2, each configured to evaluate whether a voltage 102 applied to voltage input 4 signals an STO signal. The motor starter 50 also has two redundant data packet evaluation paths D1 and D2, each configured to evaluate whether a data packet 101 received at bus interface 3 contains an STO signal. Finally, the motor starter 50 has a switching device 7, 8 configured to interrupt a load current path 9 running through the motor starter 50, which runs from an input 31 of the load current line (power supply side) to an output 32 of the load current line (load side), upon detection of an STO signal in at least one of the evaluation paths U1, U2, D1, or D2. The switching device 7, 8 can function electromechanically, with an actuator 7 and a relay 8.The switching device 7, 8 can alternatively function electronically, with a control unit 7, e.g. a gate driver, and a semiconductor switch 8, e.g. a transistor.

[0065] Each of the evaluation paths U1, U2, D1, D2 can operate with any suitable evaluation method, e.g., based on data packets or on voltage levels. It is therefore possible that in each of the evaluation paths U1, U2, D1, D2, a controller performs the evaluation for an incoming STO signal. It is also possible that the voltage evaluation paths U1, U2 each operate with a hardware circuit and the data packet evaluation paths D1, D2 each with a controller. It is also possible that one controller performs the evaluation of two or more of the evaluation paths U1, U2, D1, D2, provided that the evaluations are performed independently of each other. It is possible that two or more controllers are identically constructed or different from each other. 202408801

[0066] 11

[0067] If an evaluation of the voltage level transmitted via electrical lines 103, 104 within the motor starter 50 in one of the voltage evaluation paths U1, U2 shows that the voltage level of the voltage applied to the input terminal 4 signals an STO signal, a logic one ("1 signal") 105, 106 is sent to an OR gate 16 of the motor starter 50. The OR gate 16 can be a logic gate or an electronic circuit that performs the function of a logic gate.

[0068] If an evaluation of a bus data packet 101, which arrived at bus interface 3 and was forwarded within the motor starter 50 via a data packet transmission path 113, reveals in one of the data packet evaluation paths D1, D2 that the bus data packet 101 signals an STO signal, a logic one ("1 signal") 107, 108 is sent to the OR gate 16 of the motor starter 50. As soon as a logic one is present at the OR gate 16, a switching signal 111 is sent to the switching device 7, 8, which interrupts the load current path 9 after receiving the switching signal 111.

[0069] Figure 3 shows a flowchart of the procedure for operating a motor starter. In a first step 201, a voltage input of the motor starter is provided, configured to tap a voltage. In a second step 202, a bus interface of the motor starter is provided, configured to receive and send data packets via a bus. In a third step 203, two redundant voltage evaluation paths of the motor starter are operated to evaluate whether a voltage level of a voltage tapped at the voltage input signals an STO signal. In a fourth step 204, two redundant data packet evaluation paths of the motor starter are operated to evaluate whether a data packet received at the bus interface contains an STO signal.In a fifth step 205, a load current path running through the motor starter is interrupted if an STO signal is detected in at least one of the evaluation paths or if a communication error in the data packet evaluation path is detected that is not corrected within a timeout time by correct repetition.

[0070] Fig. 4 shows a further embodiment of a motor starter 50 according to the invention. The motor starter 50 has a voltage input 4 for connecting an electrical line 10U; a voltage 102 can be applied to the voltage input 4 via the electrical line 10U, and the voltage level of this voltage can signal an STO signal to the motor starter 50. The motor starter 50 has a bus interface 3 for receiving and 202408801

[0071] 12

[0072] Sending data packets 101 via a bus line 10B; thus, a STO signal can be signaled to the motor starter 50 by a bus data packet 101.

[0073] The motor starter 50 has two redundant voltage evaluation paths, each configured to evaluate whether a voltage 102 applied to voltage input 4 signals an STO signal. The motor starter 50 also has two redundant data packet evaluation paths, each configured to evaluate whether a data packet 101 received at bus interface 3 contains an STO signal. Finally, the motor starter 50 has a switching device 7, 8 configured to interrupt a load current path 9 running through the motor starter 50 upon detection of an STO signal in at least one of the evaluation paths.

[0074] One of the voltage evaluation paths includes a first controller 1; the first controller 1 is a technology controller configured to control switching functions of the motor starter 50, e.g., to control a switching action of a power section of the motor starter. The voltage 102 is evaluated in the first controller 1. For this purpose, a value representing the voltage level is transmitted via a first electrical line 103 to an evaluation unit 13 of the first controller 1.

[0075] To prevent damage to the evaluation unit 13 of the first controller 1 from a voltage applied to input terminal 4, which may have a voltage level of, for example, approximately 24 V, this voltage is reduced between input terminal 4 and evaluation unit 13 to a voltage level suitable for the first controller 1, e.g., from approximately 24 V to approximately 5 V or 3.3 V.

[0076] If an evaluation of the voltage level in the evaluation unit 13 shows that the voltage level applied to input terminal 4 signals an STO signal, the evaluation unit 13 sends a logic one ("1 signal") 106 to an OR gate 16 of the motor starter 50. The OR gate 16 can be a logic gate or an electronic circuit that performs the function of a logic gate.

[0077] A second voltage evaluation path includes a hardware circuit 5 in which the voltage 102 is evaluated. For this purpose, the value of the voltage applied to input terminal 4 is transmitted to the hardware circuit 5 via a second electrical line 104. If an evaluation of the voltage level in the hardware circuit 5 indicates that the voltage level signals an STO signal, a logic one ("1 signal") 105 is sent from the hardware circuit 5 to the OR gate 16. 202408801

[0078] 13

[0079] The first of the data packet evaluation paths uses the same first controller 1 as the first voltage evaluation path. To evaluate a data packet 101 received at bus interface 3, the data packet 101 is transmitted via a data packet transmission path 113, 116, which runs through a first communication node 130a of a second controller 2 acting as a communication controller, to the first controller 1, where the data packet is analyzed by a safety protocol program 11. The safety protocol program 11 is designed to detect transmission errors, missing data packets, missing addresses, etc., using checksums, sequence numbers, etc. The first communication node 130a acts as a distribution point for the motor starter 50, ensuring that data packets received via bus interface 3 reach the correct receiver(s) in the motor starter 50.

[0080] The first data packet evaluation path from the safety protocol program 11 runs via a first signal path 109 to a firmware logic program 12 of the first controller 1. The output of the safety protocol program 11 is therefore the input of a firmware logic program 12 of the first controller 1. The safety protocol program can, for example, be a PROFIsafe driver from Siemens AG. Safety protocols must be certified according to the relevant safety standard for the desired safety level of the STO function. Often, already certified drivers for protocols such as PROFIsafe or FsoE are offered as software packages for integration into custom software / firmware. An example of this is the PROFIsafe Device Driver from Siemens: Part number 6ES7195-3BF03-0YA0, product description: PROFIsafe Starter Kit V3.5 according to PROFIsafe Profile V2.6.1.The firmware logic program 12 outputs the level for Non_STO if, according to the parameterization of the motor starter 50, evaluation of a data packet received via the data bus is deactivated. If, according to the parameterization of the motor starter 50, evaluation of a data packet received via the data bus is activated, the output of the firmware logic program 12 depends on the output of the "Safety Protocol Program" block 11. Only if the current process value is NOT_STO and this value is valid (no communication error not corrected within a timeout period by correct repetition and no timeout), does the firmware logic program 12 output the level for Non_STO (preferably "0"); otherwise, it always outputs the level for STO (preferably "1").If an evaluation of data packet 101 in the safety protocol program 11 and the firewall logic program 12 reveals that data packet 101 contains an STO signal, a logic one ("1 signal") 107 is sent by the firewall logic program 12 to the OR gate 16. 202408801.

[0081] 14

[0082] A second data packet evaluation path has a second controller 2 (redundancy!). The second controller 2 can be structured differently from the first controller 1, or it can be structured identically. The second controller 2 is a communication controller: the communication controller 2 of the motor starter 50 is responsible for the bus connection of the motor starter 50 and is configured to forward data packets created by the technology controller 1 to the bus interface 3 for transmission and to forward data packets received from the bus interface 3 to the technology controller 1.

[0083] For redundant evaluation of a data packet 101 received at bus interface 3, the data packet 101 is also transmitted via data packet transmission path 113 to a safety protocol program 21 of the second controller 2. There, the same evaluation steps are performed as in the safety protocol program 11 of the first controller 1. From there, the second data packet evaluation path runs via a second signal path 110 to a firmware logic program 22 of the second controller 2. There, the same evaluation steps are performed as in the firmware logic program 12 of the first controller 1. If an evaluation of the data packet 101 in the safety protocol program 21 and the firmware logic program 22 reveals that the data packet 101 contains an STO signal, a logic one ("1 signal") 108 is sent by the firmware logic program 22 to the OR gate 6.

[0084] Parameter data received at the bus interface 3 of the motor starter 50 can be transmitted to the firmware logic programs 12, 22 of the two controllers 1, 2 via a parameterization data transmission path 114, 117, 118, which runs via a second communication node 130b of the second controller 2. There, it triggers specific parameterization of the controllers 1, 2. For example, parameterizing the motor starter 50 via bus interface 3 can determine whether evaluation should only take place in the voltage evaluation paths or whether evaluation should take place in both the voltage evaluation paths and the data packet evaluation paths. The second communication node 130b acts as a distribution function for the motor starter 50, ensuring that data packets received via bus interface 3 reach the correct receiver(s) in the motor starter 50.

[0085] Regarding the data packet transmission path 113 and the parameterization data transmission path 114, it should be noted that there is only one physical bus interface, e.g., an SPI bus interface with MISO, MOSI, SS, and SCLK lines, through which all telegrams, whether STO telegrams, control commands, or parameter telegrams, are transmitted (SPI = Serial Peripheral Interface). The representation in Fig. 4 with two separate paths 113 and 114 is for clarity only. 202408801

[0086] 15

[0087] Reference symbol list

[0088] 1 controller, first

[0089] 2 controllers, second

[0090] 3 Bus interface

[0091] 4 voltage inputs

[0092] 5 HW circuit

[0093] 7 Actuator, control unit

[0094] 8 switches

[0095] 9. Power line

[0096] 10B Bus, Bus Management

[0097] 10U electrical line

[0098] 11 Safety Protocol Program of 1

[0099] 12 FW logic program of 1

[0100] 13 evaluation units of 1

[0101] 16 Oder gates

[0102] 21 Safety Protocol Program of 2

[0103] 22 FW logic program of 2

[0104] 31 Input of the load current line (power supply side)

[0105] 32 Output of the load current line (load side)

[0106] 40 Power supply network

[0107] 41 load circuit, motor supply cable

[0108] 42 Connection point

[0109] 43 Engine

[0110] 50 engine starters

[0111] 61 Parameterization device

[0112] 62 bus nodes, F-PLC

[0113] 65 STO release device

[0114] 101 Bus data package

[0115] 102 Voltage

[0116] 103 electrical line, first

[0117] 104 electrical line, second

[0118] 105 STO signal, first

[0119] 106 STO signal, second

[0120] 107 STO signal, third

[0121] 108 STO signal, fourth 202408801

[0122] 16

[0123] 109 Signal path, first

[0124] 110 Signal path, second

[0125] 111 Switching signal

[0126] 113 Data packet transmission path

[0127] 114 Parameterization data transfer path

[0128] 115 Data packet transmission path

[0129] 116 Data packet transmission path

[0130] 117 Parameterization data transfer path

[0131] 118 Parameterization data transfer path

[0132] 130a Communication node, first

[0133] 130b Communication node, second

[0134] 201 Procedure step

[0135] 202 Procedure step

[0136] 203 Procedure step

[0137] 204 Procedure step

[0138] 205 Procedure step

[0139] D1 data packet evaluation path, first

[0140] D2 data packet evaluation path, second

[0141] L1 phase conductor

[0142] L2 phase conductor

[0143] L3 phase conductor

[0144] U1 Voltage evaluation path, first

[0145] U2 voltage evaluation path, second

Claims

202408801 17 Patent claims 1. Engine starter (50), comprising - a voltage input (4) for applying a voltage, the voltage level of which can signal an STO signal, - a bus interface (3) for receiving and sending data packets via a bus (10B), - two redundant voltage evaluation paths (U1 , U2), each configured to evaluate whether a voltage applied to the voltage input (4) signals an STO signal, - two redundant data packet evaluation paths (D1 , D2), each configured to evaluate whether a data packet received at the bus interface (3) contains an STO signal, - a switching device (7, 8) configured to interrupt a load current path (9) passing through the motor starter (50) when an STO signal is detected in at least one of the evaluation paths (D1 , D2, U1 , U2).

2. Motor starter according to claim 1, wherein a first of the voltage evaluation paths (U 1 , U2) has a controller (1) in which an evaluation of the voltage takes place, and a second of the voltage evaluation paths (U 1 , U2) has a hardware circuit (5) in which an evaluation of the voltage takes place.

3. Motor starter according to one of the preceding claims, wherein the data packet evaluation paths (D1 , D2) each have a controller (1 , 2) in which an evaluation of the data packet takes place.

4. Motor starter according to claim 3, wherein at least one (1) of the controllers (1 , 2) is a technology controller and / or at least one (2) of the controllers (1 , 2) is a communication controller, wherein the technology controller (1) is configured to control switching functions of the motor starter (50), and wherein the communication controller (2) is responsible for the bus connection of the motor starter (50) and is configured to forward data packets created by the technology controller (1) for transmission to the bus interface (3) and to forward data packets received from the bus interface (3) to the technology controller (1).

5. Motor starter according to any of the preceding claims, wherein the motor starter (50) is configured for a fixed-speed motor (43). 202408801 18 6. Motor starter according to any of the preceding claims, wherein the voltage input (4) is a safe digital input.

7. Motor starter according to one of the preceding claims, wherein the data packet is secured using a secure bus protocol.

8. Method for operating a motor starter (50), comprising the following steps: - Providing a voltage input (4) of the motor starter (50) configured to tap into a voltage; - Providing a bus interface (3) of the motor starter (50) configured to receive and send data packets via a bus (10B); - Operating two redundant voltage evaluation paths (U1, U2) of the motor starter (50) to evaluate whether a voltage level of a voltage tapped at the voltage input (4) signals an STO signal; - Operation of two redundant data packet evaluation paths (D1, D2) of the motor starter (50) to evaluate whether a data packet received at the bus interface (3) contains an STO signal; and - Interrupting a load current path (9) passing through the motor starter (50) if an STO signal is detected in at least one of the evaluation paths (D1, D2, U1, U2).

9. Method according to claim 8, wherein the evaluation in a first of the voltage evaluation paths (U1, U2) is carried out by means of a controller (1) of the motor starter (50) and the evaluation in a second of the voltage evaluation paths (U1, U2) is carried out by means of a hardware circuit (5) of the motor starter (50).

10. Method according to one of claims 8 or 9, wherein the evaluation in a first of the data packet evaluation paths (D1 , D2) is carried out by means of a first controller (1) of the motor starter (50) and the evaluation in a second of the data packet evaluation paths (D1, D2) is carried out by means of a second controller (2) of the motor starter (50).

11. Method according to one of claims 8 to 10, wherein by parameterizing the motor starter (50) via the bus interface (3) it is determined that either only evaluation in the voltage evaluation paths (U1, U2) takes place. 202408801 19 or an evaluation is performed in both the voltage evaluation paths (U1, U2) and the data packet evaluation paths (D1, D2).

12. Method according to one of claims 8 to 11, wherein by permanently applying a voltage at the voltage input (4) with a voltage level that does not signal an STO signal, evaluation in the data packet evaluation paths (D1, D2) is deactivated.

13. Method according to any one of claims 8 to 12, wherein in the event of a transmission error of a data packet STO is brought about if the transmission error is not cured within a specified period of time by a correct retransmission of the data packet.

Images