Motor starter

Abstract

The invention relates to a motor starter (50), comprising - a bus interface (3) for receiving and transmitting data packets via a bus (10B), - a technology controller (1), which is configured to control switching functions of the motor starter (50), - a communication controller (2), which is responsible for the bus connection of the motor starter (50) and is configured to forward data packets created by the technology controller for transmission to the bus interface and to forward data packets received by the bus interface to the technology controller, - two redundant data packet evaluation paths (D1, D2), each of which is configured to evaluate whether a data packet received at the bus interface contains an STO signal, a first data packet evaluation path (D1) of the data packet evaluation paths (D1, D2) comprising the technology controller (1), which is configured for the aforementioned evaluation of the data packet in the first data packet evaluation path (D1), and a second data packet evaluation path (D2) of the data packet evaluation paths (D1, D2) comprising the communication controller (2), which is configured for the aforementioned evaluation of the data packet in the second data packet evaluation path (D2), and - a switching device (7, 8) which is configured to interrupt a load current path (9) running through the motor starter (50) if an STO signal is detected in at least one of the evaluation paths (D1, D2).

Description

[0001] 202408799

[0002] 1

[0003] Description

[0004] Engine starter

[0005] Technical field

[0006] The present invention relates to a motor starter and a method for operating a motor starter.

[0007] Technical background

[0008] In a well-known motor starter, the ET200SP motor starter from Siemens AG, a STO command (STO = Safe Torque Off) is given as a DC voltage signal to a safe digital input (STO+ (24 V), STO- (GND)) ("safety function STO hardwired"). See chapter "6.8.2 Behavior during safety-related shutdown" on page 90 of the device manual "SIMATIC / ET 200SP / Motor starter ET 200SP (3RK1308-...)", edition 10 / 2021, publication no. A5E34821005001 A / RS-AD / 004, published by Siemens AG, Smart Infrastructure, Electrical Products, P.O. Box 10 09 53, 90009 Regensburg, Germany.

[0009] It is known that a digital input assigns a DC voltage signal at a first defined voltage level, e.g., in the range of 19.2 V to 28.8 V, a logic one ("1") and a DC voltage signal at a second defined voltage level, e.g., in the range below 5 V, a logic zero ("0"), similar to the line code NRZ for binary signals. See chapter "5.1.4 Safety Integrated Functions" on pages 35 ff. of the device manual "SIMATIC / ET 200SP / F-TM StepDrive ST 1x24..48V 5A", edition 04 / 2021, publication no. A5E50747346-AA, published by Siemens AG, Digital Industries, P.O. Box 4848, 90026 Nuremberg, Germany.

[0010] When a logic zero (= STO) is present, the ET200SP motor starter switches off the energy supply to a downstream electric motor, preventing it from generating torque or force. Conversely, a logic one (= no STO) actively enables the energy supply to the electric motor. See page 90 of the aforementioned device manual "SIMATIC / ET 200SP / Motor starter ET 200SP (3RK1308-...)".

[0011] The STO safety function of the ET200SP motor starter complies with Safety Integrity Level SIL3. SIL3 requires redundancy in the evaluation and transmission of the STO signal to the switching elements. This redundancy results in a 202408799

[0012] 2

[0013] A hardware fault tolerance of 1 means that the minimum number of faults that can lead to a loss of the safety function is equal to 1 + 1 (= 2). The requirement to achieve a hardware fault tolerance of 1 for SIL3 arises from section 7.4 "Design and Development of the E / E / PE System" and the associated Table 3, page 27 of the standard DIN EN 61508-2 (VDE 0803-2):2011-02. The alternative shown in the table, achieving SIL3 with a hardware fault tolerance of 0 but a safe failure rate of 99 percent or greater, is not feasible in practice. This is because the dangerous failure rate, due to the complexity of the circuit required for the safety function under consideration, will be higher than 1%.

[0014] Summary of the invention

[0015] The object of the present invention is to improve the STO safety function in engine starters.

[0016] This problem is solved according to the invention by a motor starter with the features specified in claim 1. The motor starter has a bus interface to which a data bus, hereinafter also simply referred to as the "bus", can be connected. The bus interface serves to receive and send data packets via the data bus. A data packet that is received or sent via the data bus can also be referred to as a "telegram" hereinafter. The motor starter has a technology controller that is configured to control switching functions of the motor starter. The motor starter also has a communication controller that is responsible for the bus connection of the motor starter and is configured to forward data packets created by the technology controller to the bus interface for transmission and to forward data packets received by the bus interface to the technology controller.The motor starter also features two redundant data packet evaluation paths, each configured to determine whether a data packet received at the bus interface contains an STO signal. The first data packet evaluation path contains the technology controller configured for evaluating the data packet in that path, while the second data packet evaluation path contains the communication controller configured for evaluating the data packet in that path. Furthermore, the motor starter includes a switching device configured to interrupt a load current path running through the motor starter upon detection of an STO signal in at least one of the evaluation paths. The motor starter may, for example, include a power section with at least one switch per phase conductor.The at least one switch can be a mechanical switch such as a relay or a 202408799.

[0017] Three electronic switches, such as transistors (MOSFET, IGBT, etc.), can be used. An STO signal present in at least one of the evaluation paths can thus be used to induce an STO state in a motor connected to the motor starter.

[0018] This problem is further solved according to the invention by a method with the features specified in claim 4. This method is for operating a motor starter. The method comprises a step in which a bus interface of the motor starter is provided, which is configured to receive and send data packets via a bus. The method comprises a step in which a data packet is received at the bus interface. The method comprises a step in which, in two redundant data packet evaluation paths, it is evaluated whether the data packet received at the bus input contains an STO signal. In a first of the data packet evaluation paths, the data packet is evaluated by a technology controller configured to control switching functions of the motor starter.The evaluation of the data packet in a second data packet evaluation path is performed by a communication controller responsible for the bus connection of the motor starter. This controller is configured to forward data packets created by the technology controller to the bus interface for transmission and to forward data packets received from the bus interface to the technology controller. The procedure includes a step in which a load current path running through the motor starter is interrupted if an STO signal is detected in at least one of the evaluation paths.

[0019] The invention relates to an architecture within a bus-controlled motor starter for preferably fixed-speed motors, wherein this architecture enables a STO function with redundancy in signal evaluation and transmission to the switching device of the motor starter. The motor starter has suitable receiving devices with which it can receive an STO signal transmitted via a data bus. The signal that triggers STO can thus be transmitted to the motor starter as part of a data packet (e.g., a telegram) preferably received cyclically via a bus and secured by a safe bus protocol (e.g., PROFIsafe). The motor starter is capable of receiving an STO signal in a data packet. For STO via bus communication secured by a safe bus protocol (e.g., PROFIsafe), there are at least two redundant paths for evaluating and executing the STO command. 202408799

[0020] 4

[0021] The motor starter is configured so that, if an STO command is detected via at least one of the two mentioned evaluation paths, it can establish the STO motor state using the switching device on a motor downstream of the motor starter.

[0022] Providing a motor starter with the capability to receive an STO command via a safe bus protocol requires less wiring than signaling the STO command to the motor starter via a safe voltage input. Most importantly, a safe bus protocol eliminates the need for a component, such as a safety switching device or a safe digital output module, since a safety controller can transmit the STO signal directly to the motor starter via a bus. Using a safe bus protocol, which must also be SIL3 certified, ensures that communication errors (transmission errors) are detected and that an STO is initiated in such cases.

[0023] The motor starter is used for functional safety; in order to achieve a defined safety level, preferably according to standards, the evaluation paths are designed redundantly.

[0024] The STO safety function is not designed to protect the motor starter itself. The STO safety function protects people from hazards emanating from a drive or machine powered by a motor that is operated by the motor starter.

[0025] The present invention can be used, among other things, to protect persons from the hazards emanating from a drive by means of a motor starter, i.e., a device for switching and controlling three-phase motors, and the STO (Safe To Stop) safety function. For example, STO can be triggered when a light barrier detects that a person has entered a danger zone near a drive or a driven machine. The combination of all elements in the safety chain, such as sensors (e.g., light barrier) or evaluation units (e.g., PLC), must collectively meet the requirements for SIL3 (Safety Integrity Level 3) so that the safety function as a whole achieves SIL3 (PLC = Programmable Logic Controller).

[0026] The motor starter contains a power section with at least one switch, e.g., a relay or a MOSFET, per phase, through which STO (Safe Start Over) can be initiated for the motor connected to the motor starter. Two controllers are involved; the first is a technology controller that manages the actual device functions of the motor starter, and the second is a communication controller responsible for the device's bus connection. 202408799

[0027] 5 and forwards all telegrams generated by the technology controller to the bus and forwards telegrams received from the bus to the technology controller. Thus, a communication controller already present in the motor starter is used for evaluating the STO command. This optimizes the use of the motor starter's existing resources, as an additional controller, which would be needed solely for the redundant evaluation and forwarding of the STO signal, is eliminated. This avoids unnecessary component costs and development effort, and reduces the circuit's footprint.

[0028] Each controller runs a program that uses a secure bus protocol to detect communication errors in the telegrams containing the process value for STO (Safe To Start) and extracts the corresponding process value for STO. STO is triggered by a controller when the relevant cyclic process value reaches the value defined for triggering STO, or when a relevant communication error is detected during the transmission of the telegrams containing this process value using the secure bus protocol (e.g., PROFIsafe). The motor starter's electronic circuitry is designed so that as soon as at least one of the two controllers issues an STO command, STO is initiated using the switches in the power section. Normally, both controllers would output the same signal; the redundancy is only necessary to achieve SIL3 (Safety Integrity Level 3).If the secure communication protocol requires sending telegrams back to the bus, the telegrams compiled by the technology controller are sent. The driver for the secure communication protocol on the communication controller only acts as a "silent reader" and does not send any telegrams back to the bus.

[0029] Embodiments of the invention

[0030] Advantageous embodiments and further developments of the invention are specified in the dependent claims. The method according to the invention can also be further developed according to the dependent apparatus claims, and vice versa.

[0031] According to a preferred embodiment of the invention, the motor starter is configured to control a fixed-speed motor. To control a variable-speed motor, a frequency converter can be used instead of a motor starter; in this case, an STO signal is sent to the frequency converter. An advantage of this is that the motor speed can be controlled by a frequency converter.

[0032] According to a preferred embodiment of the invention, the evaluation of the data packet is secured by means of a secure bus protocol. An advantage of this is that, with the aid of a 202408799

[0033] Six such protocols detect communication errors in the transmission of data packets, such as data corruption, excessively long intervals between telegrams, lost telegrams, and incorrect telegram addressing. If such errors were to remain undetected, an STO signal sent via the bus to the motor starter could not be recognized as such. In the event of a communication error detected using the safe bus protocol, STO is also initiated to ensure that such a communication error does not lead to a safety risk.

[0034] According to a preferred embodiment of the invention, a program runs on each of the two controllers of the motor starter for evaluating an STO command received via the bus interface. This program uses a safe bus protocol, also known as a "safety protocol," to detect communication errors in the cyclic exchange of telegrams containing the process value for STO. A load current path running through the motor starter is interrupted if an STO signal is detected in at least one of the evaluation paths or if a detected transmission error is not rectified within a defined time period by correctly retransmitting the data packet. An advantage of this approach is that the Safety Integrity Level (SIL) 3 can be achieved through the redundant evaluation of the STO signal using the safe bus protocol and the redundant forwarding of the signal to the switching elements.

[0035] The safety protocol can be, for example, PROFIsafe. STO is triggered by a controller when the corresponding cyclic process value reaches the value defined for triggering STO, or when a relevant communication error is detected during the transmission of the telegrams containing this process value using the safe bus protocol, e.g., PROFIsafe. Such a communication error can be a transmission error. Safety protocols detect errors that can occur during bus communication, such as timeouts, incorrect addressing, lost telegrams, and data corruption. Various safety measures can be used for this purpose; these can include, for example, CRC checksums, telegram numbers, or similar elements, which are appended to the actual payload in the transmitted telegrams, containing the STO instruction, e.g., in the form of an STO / No_STO bit. The "safety protocol program" preferably outputs the following two outputs:

[0036] - a value of the STO / NOT_STO bit; and

[0037] - Information on whether the value of the STO / NOT_STO bit is valid (e.g., if there is neither a communication error not corrected within the timeout period nor a timeout) or invalid (e.g., if there is a communication error not corrected within the timeout period or a timeout). 202408799

[0038] 7

[0039] The safety protocol program extracts an STO signal contained in a data packet from the data packet using the safe bus protocol.

[0040] According to a preferred embodiment of the invention, the receiving and sending of data packets via the data bus is carried out using a secure bus protocol. Preferably, in the event of a transmission error in a data packet, a Secure Tolerance (STO) is triggered if the transmission error is not rectified within a specified time period by a correct retransmission of the data packet. This is one of the reasons why a secure bus protocol is used. With regard to a secure protocol for safeguarding the data packets, safeguarding does not mean that the data packets are protected against transmission errors, but only that such transmission errors are reliably detected.

[0041] Exemplary embodiments of the drawing

[0042] The properties, features, and advantages of this invention described above, as well as the manner in which they are achieved, will become clearer and more easily understood through the following description of exemplary embodiments, which will be explained in more detail with reference to the drawings. The drawings are schematic and not to scale.

[0043] Fig. 1 shows a motor branch; and

[0044] Fig. 2 shows a motor starter according to the invention; and

[0045] Fig. 3 shows a flowchart of the procedure for operating a motor starter.

[0046] Detailed description of the exemplary implementations

[0047] Fig. 1 shows a motor branch. From a power supply network 40 with three phase conductors L1, L2, L3, e.g., a three-phase network, a three-phase load circuit 41 branches off at connection points 42, via which electrical energy can be transported to an electric motor 43. The motor can be a low-voltage three-phase asynchronous motor or any other electrically operated motor.

[0048] A motor starter 50 is connected between connection points 42 and the motor 43 in the phase conductors L1, L2, L3 of the load circuit 41. The motor starter has input terminals 31 on the mains side and output terminals 32 on the load side, to which 202408799

[0049] 8 the phase conductors L1, L2, L3 are connected. Inside the motor starter 50, load current paths run between the input terminals 31 and the output terminals 32, which can be interrupted by means of switching devices of the motor starter 50.

[0050] The motor starter 50 switches all three phase conductors L1, L2, L3 of the load circuit 41. For this purpose, the motor starter 50, which can be divided into a power section and a control section, has at least one switch per phase L1, L2, L3 in its power section. The switch can be electromechanical, e.g., a relay, or electronic, e.g., a transistor (MOSFET, IGBT, etc.). It is also possible that at least one electromechanical switch, e.g., a relay or a galvanically isolating disconnect switch, and one electronic semiconductor switch, e.g., a transistor switch, are arranged in series in at least one phase conductor. The motor starter is configured for a fixed-speed motor.

[0051] The motor starter 50 has a bus interface 3. Bus interface 3 is used to receive and send data packets via a bus line 10B. A command, such as an STO signal, can be transmitted to the motor starter 50 via bus interface 3. Other devices are also connected to bus line 10B: a bus node 62 in the form of a PLC, which sends commands such as an STO signal to the motor starter 50, and a parameterization device 61 (PLC = Programmable Logic Controller). The parameterization device 61, e.g., For example, a PC (= personal computer) with an engineering tool such as the Siemens TIA Portal (TIA = Totally Integrated Automation) does not send parameterization data directly to the motor starter 50, but to the PLC 62. The parameterization data is permanently stored there, and the PLC 62 sends the parameterization data to the motor starter 50 whenever the motor starter 50 "reports" to bus 10B after its startup."Start-up" of the motor starter 50 means that the motor starter 50 is switched on by connecting a 24 V supply voltage to its control unit. The parameterization device 61 is therefore only required for initial parameterization and if the parameterization data is to be changed after the initial parameterization.

[0052] An STO signal can originate from an STO triggering device 65, e.g., a light barrier, a light curtain, a safety mat, an emergency stop switch, a safety door, or a safety scanner, which, when a defined condition exists, issues a safety command to the BUS node 62, which sends this safety command in the form of an STO signal to the motor starter 50. 202408799

[0053] 9

[0054] Fig. 2 shows an embodiment of a motor starter 50 according to the invention. The motor starter 50 has a bus interface 3 for receiving and sending data packets 101 via a bus line 10B; thus, a STO signal can be signaled to the motor starter 50 by a bus data packet 101.

[0055] The motor starter 50 has two redundant data packet evaluation paths D1, D2, each configured to evaluate whether a data packet 101 received at bus interface 3 contains an STO signal. The motor starter 50 also has a switching device 7, 8 configured to interrupt a load current path 9 running through the motor starter 50 upon detection of an STO signal in at least one of the evaluation paths D1, D2. The switching device 7, 8 can operate electromechanically, with an actuator 7 and a relay 8. Alternatively, the switching device 7, 8 can operate electronically, with a control unit 7, e.g., a gate driver, and a semiconductor switch 8, e.g., a transistor.

[0056] The motor starter 50 has a technology controller 1, which is configured to control the switching functions of the motor starter 50. The motor starter 50 has a communication controller 2, which is responsible for the bus connection of the motor starter 50. The communication controller 2 is configured to forward data packets created by the technology controller 1, which the technology controller 1 sends to the communication controller 2 via a third data packet transmission path 122, to the bus interface 3 via a fourth data packet transmission path 123, and to forward data packets received from the bus interface 3 to the technology controller 1 via a first data packet transmission path 120 and a second data packet transmission path 121. For this purpose, the communication controller 2 has a first

[0057] Communication node 130 and a second communication node 131 are configured for forwarding and correctly distributing data packets. Communication nodes 130 and 131 represent a distribution function of the motor starter 50, ensuring that data packets received via bus interface 3 reach the correct receiver(s) in the motor starter 50, and that data packets intended for transmission reach bus interface 3, where they are fed into the external bus line 10B.

[0058] The bus interface 3 and the data packet transmission paths 120, 121, 122, 123 in the motor starter 50 can, for example, be an SPI bus interface with MISO, MOSI, SS, and SCLK lines, through which all telegrams, whether STO telegrams, control commands, or parameter telegrams, run (SPI = Serial Peripheral Interface). 202408799

[0059] 10

[0060] The motor starter 50 has two redundant data packet evaluation paths, D1 and D2, each configured to evaluate whether a data packet received at bus interface 3 contains an STO signal. The first data packet evaluation path, D1, includes the technology controller 1, which is configured for evaluating the data packet in that path. The second data packet evaluation path, D2, includes the communication controller 2, which is configured for evaluating the data packet in that path. The two controllers may be identical or different.

[0061] A bus data packet 101, arriving at bus interface 3, is forwarded as a first signal 120 to a safety protocol program 21 of the communication controller 2 and evaluated there. Using a first communication node 130, the received bus data packet 101 is also forwarded as a second signal 121 to a safety protocol program 11 of the technology controller 1 and evaluated there. The safety protocol programs 11 and 21 are designed to detect transmission errors, missing data packets, missing addresses, etc., using checksums, sequence numbers, etc. The safety protocol programs can, for example, be a PROFIsafe driver from Siemens AG. Safety protocols must be certified according to the relevant safety standard for the desired safety level of the STO function.Certified drivers for protocols such as PROFIsafe or FsoE are often offered as software packages for integration into custom software / firmware. An example is the PROFIsafe Device Driver from Siemens: Part number 6ES7195-3BF03-0YA0, product description: PROFIsafe Starter Kit V3.5 according to PROFIsafe Profile V2.6.1.

[0062] If the evaluation of bus data packet 101 in one of the data packet evaluation paths D1, D2, i.e., by the safety protocol program 11 of the technology controller 1 and / or by the safety protocol program 21 of the communication controller 2, reveals that bus data packet 101 signals an STO signal, the safety protocol program 11, 21, which has determined this result, sends a logic one ("1 signal") 105, 106 to the OR gate 16 of the motor starter 50. As soon as at least one logic one is present at the OR gate 16, a switching signal 111 is sent to the switching device 7, 8, which, after receiving the switching signal 111, interrupts the load current path 9. The OR gate 16 can be a logic gate or an electronic circuit that performs the function of a logic gate.

[0063] Fig. 3 shows a flowchart of the procedure for operating a motor starter. 202408799

[0064] 11

[0065] In the first step (201), a bus interface of the motor starter is provided, which is configured to receive and send data packets via a bus. In the second step (202), a data packet is received at the bus interface.

[0066] In a third step, 203, the data packet received at the bus input is evaluated in two redundant data packet evaluation paths to determine whether it contains an STO signal. In the first of these paths, the data packet is evaluated by a technology controller configured to control the switching functions of the motor starter. In the second path, the data packet is evaluated by a communication controller responsible for the bus connection of the motor starter. This communication controller is configured to forward data packets created by the technology controller to the bus interface and to forward data packets received from the bus interface to the technology controller.

[0067] In a fourth step 204, a load current path running through the motor starter is interrupted if an STO signal is detected in at least one of the evaluation paths or if a communication error is detected in the data packet evaluation path that is not corrected within a timeout time by correct repetition.

[0068] 202408799

[0069] 12

[0070] Reference symbol list

[0071] 1 Technology Controller

[0072] 2 communication controllers

[0073] 3 Bus interface

[0074] 7 Actuator, control unit

[0075] 8 switches

[0076] 9 Power line 10B Bus line

[0077] 11 Safety Protocol Program of 1

[0078] 16 Oder gates

[0079] 21 Safety Protocol Program of 2

[0080] 31 Input of the load current line (power supply side)

[0081] 32 Output of the load current line (load side)

[0082] 40 Power supply network

[0083] 41 load circuit, motor supply cable

[0084] 42 Connection point

[0085] 43 Engine

[0086] 50 engine starters

[0087] 61 Parameterization device

[0088] 62 bus nodes, F-PLC

[0089] 65 STO release device

[0090] 101 Bus data package

[0091] 105 Signal STO_SIG1

[0092] 106 Signal STO_SIG2

[0093] 111 Switching signal

[0094] 112 Bus signal, outgoing

[0095] 120 data packet transmission path, first

[0096] 121 Data packet transmission path, second

[0097] 122 Data packet transmission path, third

[0098] 123 Data packet transmission path, fourth

[0099] 130 communication nodes, first

[0100] 131 communication nodes, second

[0101] D1 data packet evaluation path, first

[0102] D2 data packet evaluation path, second L1 phase conductor 202408799

[0103] 13

[0104] L2 phase conductor

[0105] L3 phase conductor

Claims

1. 202408799 14 Patent claims 1. Engine starter (50), comprising - a bus interface (3) for receiving and sending data packets via a bus (10B), - a technology controller (1) configured to control switching functions of the motor starter (50), - a communication controller (2) which is responsible for the bus connection of the motor starter (50) and is configured to forward data packets created by the technology controller to the bus interface for sending and to forward data packets received from the bus interface to the technology controller, - two redundant data packet evaluation paths (D1, D2), each configured to evaluate whether a data packet received at the bus interface contains an STO signal, wherein a first (D1) of the data packet evaluation paths (D1, D2) includes the technology controller (1) configured for said evaluation of the data packet in the first data packet evaluation path (D1), and wherein a second (D2) of the data packet evaluation paths (D1, D2) includes the communication controller (2) configured for said evaluation of the data packet in the second data packet evaluation path (D2), and - a switching device (7, 8) configured to interrupt a load current path (9) passing through the motor starter (50) when an STO signal is detected in at least one of the evaluation paths (D1, D2).

2. Motor starter according to claim 1, wherein the motor starter (50) is configured for a fixed-speed motor (43).

3. Motor starter according to one of the preceding claims, wherein the data packet is secured using a secure bus protocol.

4. Method for operating a motor starter (50), comprising the following steps: - Providing a bus interface (3) of the motor starter (50) configured to receive and send data packets via a bus (10B); - Receiving a data packet at the bus interface (3), - Evaluate in two redundant data packet evaluation paths (D1, D2) whether the data packet received at the bus input contains an STO signal, 202408799 15 wherein an evaluation of the data packet in a first (D1) of the data packet evaluation paths is carried out by a technology controller (1) which is configured to control switching functions of the motor starter (50), wherein an evaluation of the data packet in a second (D2) of the data packet evaluation paths is carried out by a communication controller (2) which is responsible for a bus connection of the motor starter and is configured to forward data packets created by the technology controller for sending to the bus interface and to forward data packets received from the bus interface to the technology controller, and - Interrupting a load current path (9) passing through the motor starter (50) if an STO signal is detected in at least one of the evaluation paths (D1 , D2).

5. Method according to claim 4, wherein a safety protocol program runs on each of the controllers, which detects a transmission error of a data packet using a safe bus protocol, wherein an interruption of a load current path running through the motor starter occurs if an STO signal is detected in at least one of the evaluation paths or a detected transmission error is not rectified within a specified time period by a correct repetition of the data packet.

6. Method according to claim 5, wherein the safety protocol program extracts an STO signal contained in a data packet from the data packet using the safe bus protocol.

Images