Safety relay (emergency stop) with galvanic isolation

[Mads Barnkob]

Hi all

The background for this idea is to discuss the implementation of a standard industrial safety relay in a Tesla coil power supply. However with the twist of obtaining galvanic isolation between the power electronics and control panel.

A regular safety category 3/4 relay has 2 channels with surveillance between them. The emergency push buttons goes through these two channels, output signal is sent to power electronics mains contactors, a contact set from this mains contactor is sent back to safety relay as part of the reset push button circuit.



I could be single channel, double channel, with one or two mains contactors and with- or without the reset switch going through the mains contactors feedback, its all about what safety category you want to design for.

Here is a generic schematic of a two channel relay with feedback through reset.


To obtain galvanic isolation, I want to run a fiber with either a just on signal or a pulse train that has to change every x seconds in order to keep the mains contactors on. I figured the most correct way to implement this is to put the safety relay in the control panel where the reset/emergency buttons are and only run that single fiber to the power electronics, that does however present me with a components that needs 24VDC in a 5VDC environment. The other way around with safety relay at the power electronics gives me a problem of needing to run two fibers back to control panel to maintain two channels, here the deviation could be to just use a single channel relay or use a single contact to activate both channels of a 2 channel relay.


Please give me your best ideas and suggestions on how to implement this in a way most practical and cheapest. If money was not an issue I would just go out and buy a approved wireless safety relay

[TMaxElectronics]

I think the easiest way to do this is to just have a seperate fiber for power control.
Light on = power on ; Light off = power off
Then maybe have a timer for the pre-charge relay that gets reset when the signal is off, and will wait for a few seconds after the signals turns on and then bridges the charging resistor.

Or you can use a UD3 with the watchdog enabled as it can control the charging and discharging of the bridge, and will turn everything off if the connection is somehow lost

[Mads Barnkob]

I think the easiest way to do this is to just have a seperate fiber for power control.
Light on = power on ; Light off = power off
Then maybe have a timer for the pre-charge relay that gets reset when the signal is off, and will wait for a few seconds after the signals turns on and then bridges the charging resistor.

This is exactly my setup, I have timers and pre-charge resistors across the mains contactors in a "safety" box that has a grounding scheme connected to key switches for a safe order of working, so that grounding of the tesla coil takes the key away to turn it on.

Either on or pulsing signal, I am not sure if fiber transmitters and receivers are made for continues use or that could "burn" them out. The pulse train would also protect against both false light activating it.

Or you can use a UD3 with the watchdog enabled as it can control the charging and discharging of the bridge, and will turn everything off if the connection is somehow lost

No matter what nice features you have in any equipment, it can never become a safety function unless you attest to it to comply to relevant standards for safety equipment, hence why I want to use a common 2 channel safety relay to obtain a validated safety circuit, at whatever category would be able to be made.

[davekni]

"I figured the most correct way to implement this is to put the safety relay in the control panel where the reset/emergency buttons are and only run that single fiber to the power electronics, that does however present me with a components that needs 24VDC in a 5VDC environment."

Perhaps I'm not understanding the system correctly.  In the generic schematic you posted, is the "power electronics" the right-hand side showing the normally-open contacts of K3 and K4 and the motor?  Is the "safety relay" the block labeled "PSR-ESL4/3..."?  If so, wouldn't the fiber connection need to handle K3 and K4 coils and K3 and K4 normally-open contacts that are in series with the reset switch?  This is for the above quoted first option.

Your second option seems to make more sense.  If I understand that option correctly, all of the "generic schematic" would be housed together.  All you are adding is a fiber-isolated way to trip shutdown and reset.  In that case, do you really want the fiber to control reset?  Wouldn't it be better to have a loss of fiber signal trip shutdown, but require someone to walk over to the control panel to hit reset?

For this low-bandwidth use, I wonder if IR remote-control devices would be appropriate.  They usually modulate a 455kHz carrier.  You could send the signal over fiber or over air as in typical remote use.

[Mads Barnkob]

"I figured the most correct way to implement this is to put the safety relay in the control panel where the reset/emergency buttons are and only run that single fiber to the power electronics, that does however present me with a components that needs 24VDC in a 5VDC environment."

Perhaps I'm not understanding the system correctly.  In the generic schematic you posted, is the "power electronics" the right-hand side showing the normally-open contacts of K3 and K4 and the motor?  Is the "safety relay" the block labeled "PSR-ESL4/3..."?  If so, wouldn't the fiber connection need to handle K3 and K4 coils and K3 and K4 normally-open contacts that are in series with the reset switch?  This is for the above quoted first option.

Yes, it would need feedback from two separate mains contactors to loop back into the reset circuit, to avoid a safety circuit failure from welded contactors, if one contactor welds, the other can not be reset. So this high category of a safety circuit is not that viable if just done with a single fiber without using some kind of advanced signal sequence for tx/rx.

Your second option seems to make more sense.  If I understand that option correctly, all of the "generic schematic" would be housed together.  All you are adding is a fiber-isolated way to trip shutdown and reset.  In that case, do you really want the fiber to control reset?  Wouldn't it be better to have a loss of fiber signal trip shutdown, but require someone to walk over to the control panel to hit reset?

For this low-bandwidth use, I wonder if IR remote-control devices would be appropriate.  They usually modulate a 455kHz carrier.  You could send the signal over fiber or over air as in typical remote use.

Actually I would put the safety relay in the control panel, as I could then maintain two channels in the push button chain, to ensure that has less likelyhood to fail dangerously. Using the output to K3 to power both the optical outputs to the coil from interrupter and also via a 2nd fiber cable shutdown the mains contactor in the tesla coil. This is best example of low cost and highest safety I can think of.

Imagine that below picture had a two channel emergency stop, but still with the single reset line that would only look at the integrity of the two channel emergency push buttons and not for welded mains contactors.

[davekni]

Perhaps I understand better now.  You are planning to have this safety module disable a mains contactor in your coil box, not a separate contactor at the power source.  Redundancy is provided by disabling interrupter signaling.  Makes sense.

In this case, is the safety module performing any other function than being a latch?  If not, how about using a mechanically-latching emergency stop button and skipping the safety module completely?  At work we have systems where the emergency stop button is pushed to actuate.  To reset requires simultaneous pulling and rotating.

BTW, long ago I had a case of contact welding of the contactor feeding the compressor in my heat-pump.  The over-temperature and over-pressure safety cutouts were in series with the coil side of the contactor, so ineffective.  By luck, I happened to hear the compressor running without the inside air blower, so shut off the breaker before the compressor died.

[johnf]

I know that I would not use electronics to do this function due to the ever present EMI / big strike taking out some part of the safety circuit

how about a pressurized air circuit with electrical pressure switch that pulls in the master contactor
Vent pressure to atmosphere and all shuts down, no emi or strike hazard and totally isolated.

boiler controls always never used anything but relays, bimetallic temp switches , prerssure switches, flame failure relay in series and latching relays in the lockout circuit ie no semiconductors or microprocessors allowed.

[Mads Barnkob]

boiler controls always never used anything but relays, bimetallic temp switches , prerssure switches, flame failure relay in series and latching relays in the lockout circuit ie no semiconductors or microprocessors allowed.

I have spent 6 years programmering safety systems for offshore oil/gas platforms and I find it hard to believe that boilers should have restrictions beyond what a nuclear power plant would have. It is correct that you have mechanical failover methods in place like overpressure valves at 3 times rated normal pressure or crack-plates inside vessels. But all these are extremely expensive to exchange, so of cause you have safety PLCs to control the proces and shut it down before it ever gets near these end limits.

It is only the mains contactor that is near the coil /inside the coils power electronics box. All safety circuit and relay is to be at the remote controlled panel and only a optic fiber runs to the coil. It might not be perfect, but its the most practical. Using compressed air in a setup that does not have compressed air available just adds to a already large setup.

I am not trying to make the perfect safety solution, I know how that should be made. I try to find the best possible way with the most benefits and least installation changes to implement readily available cheap 2 channel safety relays to make multiply shutdown points in the systems that can make a coil generate sparks / be powered up.

[Netzpfuscher]

Our boilers at the refinery all have a safety PLC. The new HIMA HiMax is suitable for SIL3, so no problem. They even have safe ethernet which is suitable for emergency shutdown.

I would use a fiber to control the main contactor. But no DC Signal, lets say you pull the fiber at bright sunshine and the contactor kicks in ^^

I think the easiest solution is a fiber with a square wave on. With a highpass --> mosfet it should be very easy to "decode" the signal. If the frequency is gone or to low, the switch goes off.