EP0563787B1 - Monitoring circuit for computer controlled safety devices - Google Patents

Abstract

The invention relates to a monitoring circuit for computer-controlled safety devices. The monitoring circuit described here is an arrangement which initially holds safety-relevant loads switched off by means of a safety relay (K) until a self-test of the controlling computer has been completed within required time conditions. A holding capacitor (C1) is connected in parallel with the drive path of the safety relay (K), which holding capacitor (C1) can be charged via a charging circuit (R1, V1) when the safety relay (K) is in the quiescent position (Nc), and, after charging has been completed, moves the relay into the operating position, subject to simultaneous application of a drive signal from the microprocessor, only when specified connection conditions for the safety-relevant loads are met. A remanence relay can be used as the safety relay (K) for defect locking. The monitoring circuit according to the invention uses the difference between the pull-in voltage and the tripping voltage of the safety relay (K). <IMAGE>

Description

The invention relates to a monitoring circuit for computer-controlled safety devices with a switchover element that can be brought into an operating position by a first control signal from the computer, a holding capacitor being connected in parallel with the control branch of the switchover element, and the holding capacitor being able to be charged via the charging circuit in the rest position of the switchover element.

Such a monitoring circuit is known from GB-A-2 207 307. The known monitoring circuit compares an analog sensor signal with an analog reference signal, the two signals being digitized alternately in the same AD converter. The results of the comparison are continuously evaluated dynamically and a safety control contact is activated accordingly.

In addition to normal security functions, computer-controlled or microprocessor-controlled safety devices require special monitoring measures, which also ensure safety in the event of a fault in the controlling computer.

Safety devices are gas valves, ignition devices and the like in gas installations. Ä.

On the other hand, there are also non-safety-related consumers, such as blower motors, circulation pumps, three-way valves, etc.

There are relevant standards and regulations for the safety classes to be fulfilled by the safety devices. There are two main operating modes in gas burner safety technology. These are "intermittent operation" under 24 hours and "continuous operation". For intermittent operation, "start-up monitoring" is particularly important, ie the functions or circuit components important for safety must be checked before the gas is released. In the case of sequential controls, an error must be recognized in the course of a switching sequence and the gas release must be prevented without a doubt.

During continuous operation, the errors must be constant, i.e. be recognized continuously or quasi continuously, and the shutdown must take place within a certain time. In the case of a microprocessor control of such gas burners, it can happen that the controlling microprocessor no longer executes a control program in the event of a fault or unexpected program jumps or changes in state occur due to faults (EMC).

Generic monitoring circuits, which perform a so-called "watchdog" function by means of a relay acted upon by the microprocessor with control pulses, are known in the prior art. The safety relay initially keeps the safety-relevant devices switched off until the microprocessor has successfully completed its self-test routine in compliance with the required time conditions. Furthermore, the monitoring circuit requires that the microprocessor must continuously generate further output commands after the self-test has been carried out, which keep the safety relay in its operating position.

Such monitoring circuits have a special need for a simple and intrinsically safe circuit arrangement.

It is therefore an object of the invention to enable a generic monitoring arrangement such that a particularly simple circuit arrangement with high intrinsic safety can be implemented.

The above object is achieved according to the invention in a generic monitoring circuit in that
that the resistance of the charging circuit of the holding capacitor is chosen so high that it is not possible for the switching element is to attract directly via the resistor that a voltage divider is switched on in the charging circuit of the holding capacitor, at least one safety-technical device being connected to one end of the voltage divider via a switching element, and the current flowing through the device from the voltage divider when the switching element is switched on Charging the holding capacitor prevents a drive circuit from being provided, through which the drive path of the switching element can become high-resistance or low-resistance, and that the switching element is held in its operating position after the charging of the holding capacitor and simultaneous application of the first drive signal, in which the charging circuit is switched off is.

One requirement for such a monitoring circuit for automatic gas burner controls is that the latter remain switched off when an impermissible operating state occurs and that a fault lock must be implemented. The power supply line to each safety-relevant consumer is routed via a changeover contact of the said changeover element, wherein at least one switching element is again provided in the power supply lines to the safety-relevant consumers, the open state of which is also detected. This is done in that the switching element is connected in parallel with the safety capacitor in the rest position of the switching element together with the safety-relevant consumer, a voltage divider being switched on in the charging circuit of the holding capacitor after the switch of the switching element, with one end of which has at least one safety-related device via one of the said Switching elements is connected and which is closed by the safety-relevant device Switching element current flowing from the voltage divider prevents charging of the holding capacitor.

A changeover relay is preferably used as the changeover element.

Unlocking must be done manually and must not be caused by a power failure and recurring power.

According to an advantageous embodiment, the monitoring circuit according to the invention is designed so that the switchover element remains in its rest position in the event of a power failure and return of the power supply.

Since there is a time requirement that the fault lock must be stored for at least 10 hours, in the event that the switching element is a switching relay, a battery emergency power supply that remains functional over this period can be provided. The fault lock can be stored in an EEPROM, a battery-backed RAM or an additional remanence relay.

Such an emergency power supply can, however, be dispensed with if a remanence relay is connected in parallel with the changeover relay as a fault locking element or if the changeover element is a remanence relay.

The remanence relay is preferably set and ejected by control pulses from the computer. Under no circumstances may the computer delete the lock.

A remanence relay with one or more windings can be used.

The remanence relay can also be coupled with an NTC resistor in order to release the remanence relay with a delay.

Of course, a circuit containing a remanence relay and controlling the actual switching element can also be provided. Such retentive relays have the advantage that the fault is stored for as long as required, even if the mains voltage fails. Remote fault unlocking by means of electrical pulses can only be provided if the fault unlocking device is in the visible range of the burner.

So that the controlling microprocessor can monitor the monitoring circuit itself, the latter has a first output connection which emits a first output signal indicating the position of the switching element, which is led to the microprocessor. Furthermore, the monitoring circuit advantageously has a second output connection via which the microprocessor assists the correct functioning of the monitoring circuit Can query concerns of the first control signal generated by him.

Since it is preferable for the monitoring circuit to be electrically isolated from the microprocessor, in the preferred embodiment of the monitoring circuit, a potential isolation stage is provided between the latter and the first and the second output connection.

In the preferred embodiment, the monitoring circuit has a logic antivalence circuit which links the first control signal generated by the microprocessor with a second control signal generated at regular time intervals in such a way that the changeover relay can only be brought into its operating position when both control signals are not present at the same time. For this purpose, a program-controlled synchronization of the first control signal with the second control signal which is also applied to the microprocessor must be carried out in the microprocessor.

The antivalence circuit is preferably electrically isolated from the monitoring circuit by a further potential isolating stage.

Fig. 1

in Blockform eine prinzipielle Schaltungsanordnung der erfindungsgemäßen Überwachungsschaltung;

Fig. 2

drei alternative Ausführungsformen einer Schaltung zur Erzeugung des am ersten Ausgangsanschluß anliegenden ersten Ausgangssignals;

Fig. 3

zwei alternative Schaltungsvarianten einer Ansteuerschaltung;

Fig. 4

ein Schaltdiagramm einer bevorzugten Ausführungsform der erfindungsgemäßen Überwachungsschaltung; und

Fig. 5

ein Funktions-Zeitdiagramm zur Erläuterung der Funktionen der erfindungsgemäßen Überwachungsschaltung.

Further advantageous properties of the monitoring circuit according to the invention are described in more detail below with reference to the drawing, which represents several alternative embodiments and a preferred embodiment of the invention. Show it:

Fig. 1

in block form a basic circuit arrangement of the monitoring circuit according to the invention;

Fig. 2

three alternative embodiments of a circuit for generating the first output signal present at the first output terminal;

Fig. 3

two alternative circuit variants of a control circuit;

Fig. 4

a circuit diagram of a preferred embodiment of the monitoring circuit according to the invention; and

Fig. 5

a functional timing diagram to explain the functions of the monitoring circuit according to the invention.

First, a basic and then alternative embodiments of the monitoring circuit according to the invention and its function are described.

1 shows a changeover relay K with a changeover contact K 1, the center contact COM of which is connected to a supply voltage input connection L1. In the idle state, the changeover contact K1 is in the position labeled N _c . Parallel to the drive path of the change-over relay K is a holding capacitor C1, which in the rest position N _c of the changeover switch K1 via the resistor R1 and the diode is charged V1. However, the charging of the holding capacitor C1 can only take place if the control circuit of the changeover relay K is high-resistance, ie if the circuit 40 is high-resistance.

A storage member z. B. a remanence relay for fault locking is not shown in Fig. 1 and the other figures.

The function of the circuit 40 is discussed further below. The resistor R1 is chosen to be so high that it is not possible for the relay K to pull in directly via R1.

The holding capacitor C1 must now be charged until its charge is sufficient to attract the relay and to bring the changeover contact K1 safely into the position labeled No.

• Der Haltekondensator C1 muß über die Ladeschaltung mit der Energiemenge geladen werden, die benötigt wird um das Umschaltrelais K in die Betriebsstellung zu bringen.
• Diese Energiemenge aus dem Haltekondensator C1 wird über den Widerstand R3 und die Ansteuerschaltung 40 als Anzugsenergie auf die Spule des Umschaltrelais K geschaltet. Reicht diese Energiemenge nicht aus, um das Umschaltrelais K in die Betriebsstellung zu bringen und damit den Haltestromkreis zu schließen, fällt das Umschaltrelais K in seine Ruhestellung zurück.
• Die Energiemenge des Haltekondensators ist die Ladungsmenge Q, die dem Produkt aus Spannung und Kapazität entspricht.
• Kapazitätsverlust des Haltekondensators C1 reduziert die Ladungsmenge und damit bleibt das Umschaltrelais K in seiner Ruhestellung.
• Durch die Wahl eines Haltekondensators C1 mit entsprechender Kapazität kann z. B. erreicht werden, daß die Kondensatorspannung zum Anziehen des Umschaltrelais doppelt so hoch sein muß wie die Anzugsspannung des Umschaltrelais K.
• Mit einem Haltekondensator sehr hoher Kapazität muß die Kondensatorspannung nur größer oder gleich der Anzugsspannung sein.
• Durch die Dimensionierung der Ladeschaltung, die Wahl der Kapazität des Kondensators C1 und die Auswahl des Relais kann die Schaltung in weiten Bereichen an die Erfordernisse der Funktion und Anlaufsicherheit angepaßt werden.
• Die Schaltung ist für Gleich- und Wechselspannung geeignet.

In order to understand the functioning of the monitoring circuit described, it is important that the resistor R ₁ mentioned forms a voltage divider with a further resistor R ₂ , the other end of the resistor R _{2 is} at the contact point N _{0 of} the changeover contact K1, and that the contact point N _o connected output lines S ₁ to S _n to the safety-relevant consumers, switches or switches X ₂ to X _n which can be switched individually or in groups are arranged, the switching state of which is also detected. This is done in that an unswitched, safety-relevant consumer forms a resistance between the respective output S ₁ to S _n and a return line N and thus the charging current flowing through the relatively high-resistance resistor R1 flows for the holding capacitor C1 via R2 and the switched-on consumer. As a result, the holding capacitor C1 cannot be charged if one or more switches X ₂ to X _{n are} closed. The resistor R2 is designed so that it is enough for the changeover relay K to keep on the N _o side. The voltage at relay K is between the drop and the pull-in voltage. In order to reliably attract the relay K, the drive path consisting of the resistor R3, the changeover relay K, the circuit 30 and the circuit 40 must become low-resistance. In order to switch the relay from To bring the rest position into the operating position, the following conditions must be met:

• The holding capacitor C1 must be charged via the charging circuit with the amount of energy required to bring the changeover relay K into the operating position.
• This amount of energy from the holding capacitor C1 is connected via the resistor R3 and the control circuit 40 as pulling energy to the coil of the changeover relay K. If this amount of energy is not sufficient to bring the changeover relay K into the operating position and thus to close the holding circuit, the changeover relay K falls back into its rest position.
• The amount of energy of the holding capacitor is the amount of charge Q, which corresponds to the product of voltage and capacitance.
• Loss of capacity of the holding capacitor C1 reduces the amount of charge and the changeover relay K remains in its rest position.
• By choosing a holding capacitor C1 with appropriate capacitance z. B. can be achieved that the capacitor voltage to attract the switching relay must be twice as high as the starting voltage of the switching relay K.
• With a holding capacitor of very high capacitance, the capacitor voltage only has to be greater than or equal to the starting voltage.
• Through the dimensioning of the charging circuit, the choice of the capacitance of the capacitor C1 and the selection of the relay, the circuit can be adapted in a wide range to the requirements of the function and start-up reliability.
• The circuit is suitable for direct and alternating voltage.

On the right side of the monitoring circuit 10 are shown two output connections A1 and A2 leading to the microprocessor and two input connections E1 and E2, the input connection E1 receiving a signal 101 from the microprocessor and the input connection E2 receiving a signal from a square wave generator or a signal derived from the mains frequency which will be described in more detail later.

2 and 3, the circuit 20 arranged between the contact point Nc of the changeover switch K1 and the first output connection A1, the circuit 30 generating the signal 104 at the second output connection A2 and the two input signals 101 and 102 from the input connections E1 and E2 receiving control circuit 40 described in more variants. 2 shows three variants 20a, 20b and 20c of the circuit 20. The variant 20a shown at the top has a rectifier which rectifies the input voltage at the contact point Nc and consists of a resistor 201, a capacitive series resistor 202, a full-wave rectifier 203 and one Electrolytic capacitor 204 exists. At its output, the rectifier circuit outputs a voltage which is matched to the input voltage of the microprocessor and is coupled as a signal 103 to the first output terminal A1 via a potential isolating stage, an optocoupler 206 controlled via a resistor 205.

The circuit variant 20b shown in the middle assumes that DC voltage is already present at the contact point Mc, so that the rectifier and also the potential isolation stage are unnecessary. The circuit 20b consists of a voltage divider composed of resistance elements 210 and 211 and an inverting operational amplifier 212 which generates the DC voltage signal 103 at the first output terminal A1 with a level adapted to the input voltage of the microprocessor.

The circuit variant 20c shown below in FIG. 2 has a similar function to the circuit variant 20a described first and has a potential isolating stage consisting of an isolating transformer 220 and a rectifier stage consisting of a full-wave rectifier 221 and an electrolytic capacitor 222, as well as an output decoupling stage comprising a resistance element 223 and a transistor 224. The circuit 20c also supplies the level-adjusted output signal 103 at the first output terminal A1.

The function of the circuit 20 or of the circuit variants 20a, 20b and 20c is that the microprocessor can query the position of the changeover contact K1 at the first output connection A1 on the basis of the logic level of the signal 103. With such a query, the microprocessor z. B. recognize a sticking of the contacts of the switch K1. Furthermore, the microprocessor can use the signal 103 to detect the sticking of one or more of the switches X2 to Xn, since in this case the holding capacitor C1 does not receive its full charging voltage and thus the relay K does not pick up even after the circuit 40 has been activated.

In Fig. 3, the two circuits 30 and 40 are each shown together in two alternative circuit variants 30a, 40a and 30b, 40b. The circuit variant shown in the upper part has an antivalence element 404 in the control circuit 40a, which is connected on the input side to the input connections E1 and E2. The antivalence circuit 404 combines a square-wave signal applied by the microprocessor at the first input terminal E1 with a second input signal 102 at the second input terminal E2, which is generated by a square-wave generator or is derived from the mains frequency. The mains frequency or the signal E2 can also be fed to the microprocessor for synchronization. The antivalence circuit 404 only generates an output signal if the two signals 101 and 102 are not present at the first and second input terminals E1 and E2 at the same time. So that the holding capacitor C1 can be charged, the microprocessor must generate the first input signal 101 at the first input terminal E1 in synchronism with the second input signal 102 at the second input terminal E2, the output signal of the antivalence circuit 404 remaining low, the transistor 401 blocked and thus the drive path of the relay K remains high-impedance. The transistor 401 is connected in the usual way as a switching transistor at its base via a voltage divider consisting of resistance elements 402 and 403 to the output of the antivalence circuit 404. The output circuit 30a simply consists of a diode 301 which is connected to the collector of the transistor 401, so that the microcomputer at the second output terminal A2 can interrogate a signal 104 which indicates whether the switching transistor 401 has switched through or not, ie whether the control path for relay K is low-resistance or high-resistance. To attract and hold relay K, the microprocessor must control input E1 in push-pull to input E2, so that the two input signals 101 and 102 are not present at the same time. The circuit variants 30b and 40b shown in the lower part of FIG. 3 differ from the circuit variants described above primarily in that the output signal of the antivalence circuit 418 in the control circuit 40b is electrically isolated from the monitoring circuit by an optocoupler 416 and that the output signal is also isolated A2 of circuit 30b is electrically isolated from the monitoring circuit by an optocoupler 302. In addition, instead of the bipolar switching transistor 401 of the circuit variant 40a, a field effect transistor 414 is used in conjunction with a 10 series diode 415. The gate of the field effect transistor 414 is connected to a voltage divider, which is formed by the zener diode 415 and a resistor 413, which in turn lies at its other end at a connection point of a rectifier diode 420 and a capacitor 421. The diode 420 is connected to the center contact COM of the switch K1 and forms a one-way rectifier with the capacitor 421, so that the gate bias voltage generated by this one-way rectifier through the voltage divider 413 and 415 keeps the field effect transistor 414 open, ie high-impedance, until the optocoupler transistor 416 becomes conductive . The driving conditions for the antivalence element 418 by the input signals 101 and 102 at the two input connections E1 and E2 are the same as were explained above for the circuit variant 40a.

• Ansteuerfehler, die durch einen eventuellen Ausfall oder fehlerhafte Programmsprünge des Mikroprozessors verursacht sein können, werden während des Ladevorgangs dadurch erkannt, daß der Haltekondensator C1 immer wieder entladen wird, so daß dieser die erforderliche Anzugsladespannung nicht erreicht;
• Ansteuerfehler, wenn das Umschaltrelais K angezogen hat führen zu einem Abfall des Relais K in die NC-Stellung. Ein sofortiges Wiederanziehen ist nicht möglich, da der Haltekondensator C₁ nur auf Haltespannung aufgeladen ist. Die Voraussetzung dafür ist, daß das Widerstandselement R1 so dimensioniert ist, daß die Ladung des Haltekondensators C1 erst nach mehreren Zyklen des zweiten Eingangssignals 102 am zweiten Eingangsanschluß zum Anzug des Relais K ausreicht;
• wenn vom Mikroprozessor das Signal 101 am ersten Eingangsanschluß E1 nicht oder nicht zeitrichtig erzeugt wird, bleibt die erfindungsgemäße Überwachungsschaltung im Ruhezustand, da das zweite Eingangssignal 102 am zweiten Eingangsanschluß E2 verhindert, daß der Haltekondensator C1 auf die Haltespannung aufgeladen wird;
• der Ausfall eines Bauteils wird erkannt oder führt zu einer Blockierung der Überwachungsschaltung;
• die Schalter X₂ bis X_n stellen einen zweiten Abschaltweg dar;
• die Überwachungsschaltung kann nicht freischalten, wenn eines der Schalter X₂ bis X_n mit angeschlossener Last geschlossen ist. Eine zweckmäßige Dimensionierung der den Ladespannungsteiler bildenden Widerstandselemente R1 und R2 ist R1 ≈ 10 . R2;

Overall, the circuits described above with reference to FIGS. 1 to 3 have the following features and advantageous functions:

• Control errors, which can be caused by a possible failure or incorrect program jumps of the microprocessor, are recognized during the loading process, that the holding capacitor C1 is discharged again and again so that it does not reach the required starting charge voltage;
• Activation errors when the changeover relay K has picked up lead to a drop in the relay K to the NC position. Immediate re-tightening is not possible since the holding capacitor C _{1 is} only charged to the holding voltage. The prerequisite for this is that the resistance element R1 is dimensioned such that the charge of the holding capacitor C1 is sufficient to attract the relay K only after several cycles of the second input signal 102 at the second input terminal;
• if the microprocessor does not generate the signal 101 at the first input terminal E1 or does not generate it in the correct time, the monitoring circuit according to the invention remains in the idle state since the second input signal 102 at the second input terminal E2 prevents the holding capacitor C1 from being charged to the holding voltage;
• the failure of a component is recognized or leads to a blocking of the monitoring circuit;
• switches X ₂ to X _n represent a second switch-off path;
• the monitoring circuit cannot activate if one of the switches X ₂ to X _n is closed with a connected load. An expedient dimensioning of the resistance elements R1 and R2 forming the charge voltage divider is R1 ≈ 10. R2;

FIG. 4 shows a preferred circuit arrangement of the monitoring circuit according to the invention, which is composed of the basic circuit according to FIG. 1 and the circuit variants 20a, 30b and 40b according to FIGS. 2 and 3. The switching elements as well as signals and lines which correspond to the corresponding switching elements of FIGS. 1 to 3 are designated in FIG. 4 with the same reference numbers.

FIG. 5 shows a function-time diagram, based on which the function of the preferred embodiment of the monitoring circuit according to the invention shown in FIG. 4 is explained below. In the upper part of FIG. 5, the input signals 101 and 102, which are present at the first and second input terminals E1 and E2 and with which the antivalence element 418 is applied, are shown. In the middle part the two output signals 103 and 104 are shown, which occur at the output connections A1 and A2 and can be queried by the microcomputer. In the lower part of FIG. 5, the supply voltage supplied to the switches X ₂ to X _n via the changeover contact N _{0 is} shown. The time diagram is divided into the charging time period T _L and the operating time period T _{W of} the monitoring circuit according to FIG. 4. In order to charge the holding capacitor C1, ie to block the field effect transistor 414, the microprocessor generates the signal 101 in synchronism with the signal 102. The charging process of the Holding capacitor C1 begins at time t ₀ , the resistance values of the resistance elements R1 and R2 and the capacitance value of the holding capacitor C1 being chosen such that the charging process lasts at least 50 cycles of the signals E1 and E2. As the first output signal 103 shown in the third line in FIG. 5 indicates during the charging period T _L , the changeover relay K is in the idle state during this time and Changeover contact K ₁ has the position Nc. The second output signal 104, which can be queried by the microcomputer, at the second output terminal A2 (see the fourth line in FIG. 5) indicates during the charging period T _L from the time t ₁ that the field effect transistor 414 is not conductive. After the charging time T _{L has} elapsed, the changeover relay K switches the changeover contact K1 to the position N ₀ , which the microcomputer recognizes by querying the signal 103 at the first output terminal A1 and then generates the signal E1 in push-pull to the signal E2 (time t ₂ ). As a result, the field effect transistor 414 becomes conductive on the basis of the output signal of the antivalence circuit 418, which state can be queried at the low level of the output signal 104 at the output terminal A2.

• Anzugsverzögerung; und
• Abwurf des Umschaltrelais K sofort nach Sperrung des Feldeffekttransistors 414 mit einer Abwurfzeit ≤ 5 ms.

In order to carry out the common-mode or push-pull control, the microprocessor must synchronize with the square-wave signal at input E1 or the signal derived from the mains frequency, since otherwise the relay cannot be picked up or held. This means security through

• Delayed onset; and
• Release of the changeover relay K immediately after blocking the field effect transistor 414 with a release time ≤ 5 ms.

The value of the resistor R2 is to be dimensioned such that only a multiple of the network periods, or the periods of the square-wave signal E2, is sufficient to charge the holding capacitor C1 to the level necessary to attract the changeover relay K. The value of R2 must be selected so that it, in conjunction with the value of R3, is sufficient to hold the changeover relay and in Combination with the holding capacitor C1 can bridge a power failure of up to 20 ms.

The start-up security of the monitoring circuit according to the invention is ensured in that a consumer connected to the switches X ₂ to X _n with a resistance 10 10 kOhm prevents the holding capacitor C ₁ from being charged to a voltage sufficient for the relay to pull when the switch is closed.

The output signals 103 and 104 that can be queried by the microprocessor enable the microprocessor to test the monitoring circuit according to the invention. To ensure that the field effect transistor 414 can be switched, it can be switched on during operation, e.g. H. when the changeover relay K is activated, are briefly blocked and immediately switched on again (signals 101 'and 104' in FIG. 5). Using the signal 104 'at the output terminal A2, the microprocessor can query whether the transistor 414 can be blocked or not.

The monitoring circuit described here is an arrangement which, by means of a safety relay K, initially keeps safety-relevant consumers switched off until a self-test of the controlling computer has been completed while maintaining the required time conditions. A holding capacitor C ₁ is connected in parallel to the control branch of the safety relay K, which holding capacitor C _{1 can be} charged in the rest position N _{c of} the safety relay K via a charging circuit R ₁ , V ₁ and the relay K after charging with the simultaneous application of a control signal from the microprocessor to the Brings operating position only if specified connection conditions of the safety-relevant consumers are fulfilled. The monitoring circuit according to the invention uses the difference between the pull-in and the drop-out voltage of the safety relay.

Claims (9)

1. Monitoring circuit for computer-controlled safety devices having a switch-over member (K) which can be brought into an operating position (N₀) via a first control signal (E1) of a computer, wherein a holding capacitor (C₁) is in parallel with the control path of the switch-over member (K) and the holding capacitor (C₁) can be charged-up via a charging current circuit (R₁; V₁) in the non-operative position (N_c) of the switch-over member (K),
   characterized in that

   the resistance (R₁) of the charging circuit current (R₁; V₁) of the holding capacitor (C₁) is chosen to be sufficiently high ohmic that it is not possible to pull-up the switch-over relay (K) directly via the resistance (R₁),

   and a voltage divider (R₁, R₂) is located within the charging current circuit of the holding capacitor (C₁) with at least one safety relevant device being connected to one end of the voltage divider (R₁, R₂) via a switching element (X₂, ... X_n) and wherein the current flowing through the device from the voltage divider (R₁, R₂) when the switching element (X₂, ..., X_n) has been switched-on prevents a charging-up of the holding capacitor (C₁),

   and a control circuit (40) is provided for by means of which the control path of the switch-over member (K) can be caused to become high ohmic or low ohmic,

   and the switch-over member (K) is held in its operating condition, in which the charging current circuit (R₁, V₁) is switched-off, after charge-up of the holding capacitor (C₁) and simultaneous presence of the first control signal (E1).
2. Monitoring circuit according to claim 1, characterized in that the switch-over member is a monostable switch-over relay (K).
3. Monitoring circuit according to claim 1 or 2, characterized in that the monitoring circuit is configured in such a fashion that the switch-over member (K) remains in its non-operative position in the event of a power failure and subsequent return of mains voltage.
4. Monitoring circuit according to one of the claims 1 or 2, characterized in that a remanence relay is utilized for malfunction storage in addition to the switch-over member (K).
5. Monitoring circuit according to at least one of the preceding claims, characterized in that the monitoring circuit (10) has a first output terminal (A1) which issues a first output signal (103) indicating the position of the switch-over relay (K).
6. Monitoring circuit according to at least one of the preceding claims, characterized in that the monitoring circuit (10) has a second output terminal (A2) which issues a second output signal (104) indicating the presence of the first control signal (E1).
7. Monitoring circuit according to claim 5 or 6, characterized in that a potential separation stage (206; 302) is provided for between the monitoring circuit (10) and both the first (A1) and/or the second output terminal (A2).
8. Monitoring circuit according to at least one of the preceding claims characterized in that the computer is a microprocessor which carries out a program-controlled internal test routine at regular intervals and which only issues the first control signal (E1) when recognition is made cf proper functioning of the microprocessor.
9. Monitoring circuit according to claim 8, characterized in that the monitoring circuit has a logical exclusive "OR" circuit (418) which combines the first control signal (E1) issued by the microcomputer with a second control signal (E2) produced in regular time intervals in such a fashion that the switch-over member (K) can only be brought into its operating position when both control signals (E1, E2) are not simultaneously present.

Images