DE102006007844A1 - Method for single-channel bus coupling of safety-critical process, involves transmitting release signal from processing channel to intermediate register through processing channel - Google Patents

Abstract

The method involves transmitting a release signal from the processing channel to the intermediate register through a processing channel (1,2). The activation of an enabling-signal is caused by the presence of a release through each redundant processing channel accessing a common buffer register (30) over an "AND-circuit" of the individual releasing signals. Each redundant safe record (14,24) formed from a number of record parts corresponding to the number of redundant processing channels and a number of packets, where an authorization is assigned for a packet-wise registration. Another record part is registered in the intermediate register for assembling common safe record by each processing channel. Each of the redundant processing channels reads the contents of each register point in the buffer register, which is characterized in jointly formed safe protocol, which is transferred after a release by each redundant processing channel. Independent claims are also included for the following: (1) use of a method for the single-channel bus coupling of a sensitive process (2) device for the single-channel bus coupling of a sensitive process.

Description

The The invention relates to a method and a for carrying out the Method adapted device for single-channel bus coupling safety-relevant processes.

Under A safety-relevant process is subsequently a process understood, of which in the occurrence of a mistake a non-negligible danger for People and / or material goods. In a security-relevant process must therefore be guaranteed with 100 percent security in the ideal case be that in the presence of a mistake this process, one with this Process-coupled follow-up process and / or a process comprising this process Whole system is transferred to a safe state. Such security relevant Processes can thus also sub-processes of larger, higher-level Be whole processes. Examples of security-relevant processes are chemical processes where critical parameters are unconditional must be kept in a predetermined range, complex machine controls, such as a hydraulic press or a production line which, for example, the commissioning of a press / cutting tool can represent a safety-relevant sub-process. Further examples for Safety-relevant (partial) processes are the monitoring of protective gratings, protective doors or Photoelectric sensors, the control of two-hand switches or the Reaction to emergency stop switch.

For all security relevant Processes, it is thus absolutely necessary that the respectively associated, generated or recorded or measured, safety-relevant data without some adulteration be transported in a timely manner, since any adulteration is a faulty function and / or reaction can result in the last consequence can endanger the life and health of people.

Around has to meet the safety requirements, it has in recent years Numerous agreements have been made that are nearly error-free Demand data transport when using bus systems. These concern in particular the data transport itself as well as a permissible residual error probability dependent on the respective application or process. As relevant standards Here, in particular, EN 61508 and EN 954-1 should be mentioned as well as the principles for the exam and certification of "bus systems for the transmission safety-relevant messages "of the testing and certification body the professional trade associations.

Corresponding These agreements and standards are safety-related bus systems have been developed which transmit data with high redundancy. Possible Errors are detected in good time and a threat can be averted. Examples of this include the Safety Bus P, Profibus F, Interbus Safety, et al

adversely However, here is that for already installed the use of safety-related bus systems Bus systems must be replaced and often Restrictions on the number of participants, the data transport rate or the Data log must be accepted.

When The result is safety-related procedures and / or components been developed, which is a simpler and more cost-effective Retrofit already enable existing bus systems. Especially in the control and Automation technology used electronic security methods use for transmission safety-relevant data, in particular between sensors, actuators and / or control devices operating between the individual units involved in a process already in use (field) Bus systems for data communication.

The EP 1 188 096 B1 discloses, for example, a control system for a safety-related processes with a fieldbus, via which a control unit for controlling the safety-relevant process and a signal unit, which is linked via I / O channels to the safety-relevant process, are connected. In order to ensure a fail-safe communication with each other, these units have safety-related facilities, by means of which non-secure units are supposed to become secure units. In detail, at least two redundant processing channels are provided in each case such that an error in one of the processing channels can be detected and possibly corrected on the basis of a result which differs from that of another of the redundant processing channels. This multichannel structure is realized, in particular, by two redundant computers, with the security consideration ending after the two redundant computers, and the consideration for a secure data protocol starting from this point comes to bear without further explanations.

Under the general term calculator are below, if a more extensive Specification does not take place, essentially any type of data processing equipment like micro-computers, micro-processors, micro-controllers or even PC's, understand.

WO 01/15385 A2 also relates to the control of safety-relevant processes using tion of (field) bus systems, wherein the units involved in the control of the safety-relevant process in turn generally have redundantly structured processing channels. Each of the redundant channels includes a computer that control each other. This multichannel structure is transferred via a further computer connected to the fieldbus into a single-channel structure ( 3 ). Further details, including the transition from multi-channeling to single-channeling, can not be found in the document.

WO 01/15391 A1 and the published patent application DE 199 39 567 A1 are other examples of secure bus subscribers with each other with respect to a secure log creation controlling, redundant running processing channels and / or computer and subsequent transition from two-channel to single-channel via another coupled to the bus computer, which is connected to a protocol chip or has integrated , refer to. Again, the safety consideration ends without the disclosure of further technical measures after the two redundant computer and the consideration for a secure data protocol comes from this point to bear.

The one device for single-channel. Transmission of data formed by two redundant computers data related patent DE 195 32 639 C2 integrated, in order to reduce the circuit complexity, the function of the bus coupling in one of the two redundantly running computer. Only the computer having the bus coupling functionality thus has an output channel to which user data originating from this computer and test data originating from the other computer are supplied or vice versa or useful and test data of both computers are interleaved with one another ( 4 ). However, to ensure that the computer that operates the bus is not able to generate telegrams that can not influence the other computer, in the implementation of an increased effort in the security consideration is required because on the one hand, the non-reaction and on the other hand, the independence of the computers for the creation of the secure protocol must be proven. The patent proposes this only a corresponding wiring or Nichtbeschaltung the respective computer outputs.

Furthermore, the describes DE 100 65 907 A1 a method based on the principle of "cross-redundancy redundancy" secured data transport for data transmission on parallel or serial networks or bus systems, wherein an intermediate register is used with two logically identical data areas for the transition from two-channel to single-channel. The complete, single-channel transmission over the bus system, safety-oriented message includes the data content of both data areas of the intermediate register. Upstream of the intermediate register on the transmitter side are in turn two redundantly operating computers which, depending on the nature of the application, provide single-channel or dual-channel security-relevant data each with redundant information about secure data and exchange these mutually for verification. If both have reached the same result, each of the computers transfers its secure data to the intermediate register, wherein each data area is assigned to the secure data of a respective computer, which in turn already contains redundant information for error detection. If, in an alternative embodiment, the intermediate register is contained in one of the two computers, so that this one computer accordingly occupies both data areas of the intermediate register in coordination with the second computer, this second computer again reads the intermediate register with the two data areas for checking purposes. Depending on the application, the data content of one of the two data areas of the intermediate register may also have inverted data or other additional interleaves, for example to detect systematic errors in the transmitters, receivers and / or other units forwarding the data. The disadvantage here is thus in particular that the total data length of the safety-related message in relation to the actual payload is very large and the data transmission rate with respect to the actual payload is thus small, since for each payload record to be transmitted two identical payload records and a respective redundant information to each the identical payload records is to be transmitted. As the number of user data per data packet to be transmitted decreases, as is the case, for example, with the Interbus, the ratio of the user data length to the total data length increasingly deteriorates.

The on August 17, 2004, by the same assignee of the present invention filed German patent application 10 2004 039 932.8, to which the present invention represents a further development had presented as a task for the secure bus connection of security-related processes another, new and improved Way for the transition from multi-channeling to single-channeling and to provide in an easy to implement way, especially easy to be tested, a reaction free and independence when creating a safety-related protocol, which as safety telegram over transfer a bus is to be sure.

For this It was proposed a method for single-channel bus coupling to provide a safety-critical process, in which one for the safety-critical Process relevant record over at least two redundant processing channels, in particular protocol-specific, according to identical laws is processed to a safety-related protocol and the redundant safety-related protocols for single-channel Bus coupling back to a common safety-related Protocol by putting from each of the processing channels to one common temporary register is accessed, wherein for each register location a write permission is given only once, so that the common safety-related protocol, that is to be transmitted Safety telegram, proportionate by registered letter in each case different Shares of the respective safety-related protocols composed becomes.

One The main advantage here was that on the one hand both processing channels are able to complete the safety-related protocol so that this has a positive effect on the required telegram length, since all data bits with the different security mechanisms already known in the redundant processing channels and none additional Transfer data bits Need to become, the on the receiver side the inference allow for proper calculation. In addition, it is guaranteed that a processing channel alone is not capable of a safety telegram to send, with the control over the only one ever assignable write authorization of data in a registrar one easy to implement and high efficient way Represents to be independent From the bus (system) used a cost significantly increased security to ensure.

The Realization of an intelligent unit for performing the inventive method is thus already by using at least two redundant Calculator comprehensive device guaranteed, in which the Computer for processing an identical input data set under Application of identical laws are each designed for a safety-related protocol and the over a circuit arrangement with a common intermediate register such are connected that for each register of the intermediate register is write-only for each one of the computers is given.

The Invention according to the German Patent application 10 2004 039 932.8 thus already allows by Use of standard components and independent of the respective bus system an easy to implement, highly dynamic and highly efficient solution for non-reactive and independent Formation of a respective safety-related protocol, wherein the specific processing rules for the formation of the safety telegram this expediently are suitable to meet the respective safety requirements, in particular the security requirements for a easy transmission according to SIL 3 IEC 61508.

Further saw the invention according to the German Patent Application 10 2004 039 932.8 before, the circuit arrangement in an appropriate manner such that each of the computers on each register location of the intermediate register can read, so that according to preferred Training before a handover of the common safety-related protocol from the intermediate register for transmission from each of the redundant processing channels to each register location recourse to reading is a verification of the jointly formed safety-related Protocol. Through this possible additional Comparison of the jointly formed safety-related protocol with each formed separately or individually via the processing channels Safety-related protocol was able to achieve the safety significantly increased again be, because in case of failure or error of a computer consequently no complete Safety telegram can be generated, so that inevitably Error is detected and a safety-related function can be triggered.

It However, it has been shown that the jointly formed safety-oriented Protocol in case of error possibly already from the intermediate register for further processing although the verification of the returned protocol is not yet is completed.

A Object of the present invention is now, the subject German Patent Application 10 2004 039 932.8 to develop such that when reading back for verification of the safety-related ones registered in the intermediate register Protocol the handover this common safety-related protocol from the intermediate register is excluded as long as the verification is not completed.

The inventive solution most surprising Already by an object with the characteristics of one of pending independent claims given.

advantageous and / or preferred embodiments and further developments are the subject of the respective dependent claims.

According to the invention is thus provided that when reading back of the written to the intermediate register safety-related protocol for its verification this jointly formed, in the intermediate register inscribed secure or safety-related protocol only in response to a release by each of the redundant processing channels for handover or takeover is released from the intermediate register for further processing.

is according to the invention, the at least two redundant computer comprehensive device designed such that with a read access option to each register location of the intermediate register for each of the computers, the computers Means for verifying a read from the intermediate register Contents and to release the contents of the clipboard below Such a response can include a positive verification Release in a simple and cost-effective way already by transfer corresponding release signals are effected to the intermediate register.

Around an access to the intermediate register contents for its transfer or acceptance for further processing exclusively when enabled by each of the redundant processing channels or release, e.g. the activation of an output of the Content enabling signal or enable signal via an AND operation of the individual release signals are effected.

In a further preferred embodiment It is further contemplated that each of the redundant secure protocols from one of the number of redundant processing channels Number of protocol parts, and write permissions be assigned in such a way that to put together the common secure protocol from each processing channel one at a time Protocol part is written to the intermediate register.

Especially during training and / or use of a device according to the invention, wherein each of the at least two redundant computers is packet-based Data processing is formed, is in development of the method suggested that any redundant secure protocol be from a Number of data packets is built and the write permission for a Data packet-wise registered mail is awarded.

The Invention encompasses this beyond embodiments, in which the at least two redundant computers by means of redundant Hardware and / or redundant software are formed.

The inventive device and the method according to the invention Thus, instead of one-channel bus coupling of a safety-critical Process also for otherwise coupling a safety-critical Process from a secure, having at least two redundant processing channels Environment to a non-secure environment or to a secure environment that but includes less redundant processing channels, usable and are therefore suitable for essentially any connection between secure processing channels via not safe transport routes.

A about that In addition, further increase in security is in turn by it gewährleistbar, if in a particularly preferred embodiment before writing the common safety-related protocol the redundantly formed safety-related protocols through the processing channels initially mutual identity checked out so that the formation of a common safety-related protocol only in response to identical, independently from one another identical input data set processed safety-related Logs done. Occurs already in the redundant processing If there is an error, it will be detected even earlier and the process will be detected can be even earlier be driven to a safe state. The in and of themselves decoupled computers are thus again preferred via a communication interface connected with each other.

The invention further comprises embodiments in which a respective, respectively assigned to a processing channel write permission for verification by means of a test procedure is checked, including, for example, the full read access for each register is appropriate. For example, each of the processing channels can be attempted to write a different, specifically assigned default value into all register locations of the intermediate register, wherein each of the processing channels then reads out all register locations of the intermediate register and verifies the contents of the register locations to a unique interleaving and wherein such a test procedure expediently repeatedly and / or by alternately writing to and reading out the register locations via different processing channels. Essentially, any safety transfer / acceptance rule set by the coupling of the proportionate data to be transferred to the intermediate register to specific positions or addresses within the common safety-related protocol or the intermediate register can again be easily tested and any error in the formation of a safety telegram to be transmitted gram, including due to a computer failure, can thus be reliably detected. In particular, in order to ensure, after a respectively protocol-specific processing of the input data for a safety-related protocol, its storage and protocol-specific transfer to the bus, wherein the safety-oriented protocol satisfies the specifications based on the respective application to a secure protocol data record, a computer according to one embodiment in each case comprises one integrated protocol chip. In an alternative embodiment, the protocol chip can also be connected on the output side to a computer. To avoid such, integrated or downstream, protocol chips and consequently also for component and cost reduction is proposed in a further, particularly expedient embodiment to provide the computer with a trained for processing and protocol-specific transfer of data appropriately designed software.

The inventive device can be designed as a bus subscriber unit, wherein the computer this expedient manner on the input side at least with input channels for single or multi-channel Connection of process data input units and according to single or multi-channel Recording of safety-related input data to be processed are interconnected or as a bus control unit, which e.g. the generates safety-related input data to be processed, is trained. The computers are thus in particular as a micro-controller or formed as a central processing units (CPUs).

The Circuit arrangement for connecting the computer or optionally the computer downstream protocol chips can be used as a simple logic circuit be formed, whereby also highly integrated circuits, e.g. in the form of an FPGA (Field Programmable Gate Array), are usable and application specific of additional Can be an advantage.

The Intermediate register has an interface over which the deposited there common safety-related protocol single-channel directly into one Bus, e.g. an Interbus, can be coupled or one-channel to one pass application-trained further device can be, as a further device application specific in particular another protocol chip, another micro-controller or a other intelligent unit can be used.

When Intermediate register is thus already sufficient standard RAM. In a preferred embodiment, however, is provided in particular the intermediate register or the buffer in the form of a dual port memory (DPM), so that in a simple and cost-effective manner via a the two interface ports the computers are connectable and over the second interface port, the one-channel further coupling can take place.

Further Features and advantages of the invention will become apparent from the following, detailed description of a preferred but merely exemplary embodiment of the invention with reference to the accompanying drawings.

In show the drawings:

1 a schematic diagram for the redundant formation of safety-related protocols for a safety telegram to be transmitted by redundant processing channels and subsequent common formation of an identical safety-oriented protocol under control of a transfer / takeover rule concerning the safety-related protocols each to be transferred / receiving shares according to the German patent application 10 2004 039 932.8;

2 a possible functional block diagram of an implementation of the invention, based on two micro-controllers redundantly calculating in each case the complete, safety-related protocol according to the German patent application 10 2004 039 932.8,

3 u. 4 other known realizations for the transition from two-channel to single-channel, and

5 a schematic diagram of one on the 1 and 2 *** "" In the preferred embodiment of the present invention relating to coupling from a secure multi-redundant processing channel environment of a safety-related protocol constructed of a number of data packets corresponding to the number of processing channels to a data area used as an intermediate register located in a non-secure environment or in a secure environment, but with fewer processing channels.

at 1 shown are two redundant processing channels 1 and 2 a bus subscriber unit, not shown, or bus control unit for coupling a safety-critical process to a bus 40 , eg an Interbus. In the case of a bus subscriber unit, each of the processing channels is associated with the safety-critical process associated, likewise not shown input / output units, such as sensors and / or Actuators connected.

A bus subscriber unit with sensor-side application thus become one-channel or two-channel processing channels, depending on the type of specific connection 1 and 2 identical, relevant for the safety-critical process input data provided and expediently initially in memory 12 respectively. 22 filed for further processing. Particularly in the case of a bus control unit, safety-related input data to be reprocessed for safe data in front of a bus transmission are stored in memories 12 respectively. 22 ,

The input data is first sent before the transmission of a safety telegram via the bus 40 redundant using the same laws for each safety-related protocol 14 and 24 processed. The processing channels each include a microcontroller for this purpose 11 respectively. 21 for the respective treatment / processing in the store 12 or 22 safety-relevant input data for a safety-related protocol 14 respectively. 24 as well as in the execution according to 1 one each to the micro-controller 11 or 21 downstream protocol chip 13 respectively. 23 that of the respective micro-controller 11 or 21 calculated, safety-related protocol 14 respectively. 24 for further transfer to the bus 40 receives. In an alternative embodiment to the illustrated protocol chips 13 respectively. 23 can the micro-controller 11 and 21 also include a suitably trained software, so that the further, described below transfer of the calculated protocols 14 and 24 to the bus 40 through the micro-controller 11 and 21 he follows.

The calculated, safe or safety-related protocols 14 and 24 are therefore identical unless an error or failure has occurred in the calculation. It should be noted that the secure protocols are of course designed in such a way that they meet the requirements of the standard for a safety-related transmission.

To further increase the security is before transmission of a secure telegram on the bus 40 the joint formation of another identical, common safety-related protocol is provided, which then one-channel to the bus 40 can be transferred for transmission.

This common safety-related protocol is achieved by sharing data from the secure protocol 14 and data of the secure protocol 24 in a buffer or intermediate register 30 formed on the each of the processing channels 1 and 2 can access.

To prevent this shared safety-related protocol from only looking at data from just one of the processing channels 1 or 2 which therefore transmits a security telegram only by one of the micro-controllers 11 or 21 gleichkäme, eg due to an occurring failure of one of the two micro-controller controls a defined or definable access rule the write rights on the cache 30 , The access rule determines that of each processing channel 1 and 2 from only the parts of the respective calculated safety-related protocol for the formation of the common safety-related protocol in the corresponding memory locations of the buffer 30 can be enrolled for which the respective micro-controller 11 or 21 has a respective write permission. Therefore, according to the invention, only one write authorization is defined for each memory or register location.

Assuming that the secure protocols 14 and 24 Thus, each of the protocols also includes the same number of bytes 1 marked with ByteX to Byte X + 5. In the present example according to 1 is for the micro-controller 21 of the processing channel 2 the write permission for the memory addresses of the cache 30 for the byte X, the byte X + 2 as well as for the byte X + 4 permanently assigned and for the micro-controller 11 of the processing channel 1 the write permission is assigned for entering the byte X + 1, the byte X + 3 and the byte X + 5. Consequently, each of the micro-controllers 11 and 21 only one write permission to enter every second byte in the cache 30 assigned.

If, for example, X = 0, the redundant safety-related protocols exist 14 and 24 as well as the identical safety-related protocol to be formed together, ie the security telegram to be sent out of a total of 6 bytes, the data within the redundant secure protocols and thus also within the safety telegram to be transmitted, for example, consist of a header of 2 bits, then user data of 14 bits , an address of 8 bits and a CRC checksum of 24 bits together. With the above defined write-assigned permission, the 2-bit header and the first 6-bit of the payload are referenced 1 consequently from the via the processing channel 2 calculated, secure protocol 24 , the next 8 bits of payload from the via the processing channel 1 calculated protocol 14 , the 8-bit address in turn from the log record 24 , and the 24-bit CRC checksum in a proportional succession the calculated logs 14 . 24 and 14 accepted.

When Cache is thus already a standard RAM or preferred As can be seen below, a standard DPM can be used.

Even with only two redundancy, a still greater security is achieved, if further in a suitable manner, the micro-controller 11 and 21 both processing channels 1 and 2 full read access to the cache 30 get assigned.

This allows a simple comparison of the entire data, by firstly verifiable, whether the jointly formed, to be transmitted as a safety telegram secure protocol, for example, meets the safety requirements for a simple transmission according to SIL 3 IEC 61508, error-free, namely by respective verification against its own separately formed safety-related protocol 14 or 24 , In addition, full read access allows for each of the processing channels 1 and 2 the, expediently already before the control / monitoring / regulation of a safety-critical process feasible check whether the access rule is generally error-free. For this purpose, it is in particular checked whether the calculated data of a respective microcontroller of the one and the other processing channel exclusively, but this guarantees, only in the respectively assigned memory addresses of the buffer 30 to be written.

Does this "self-certification" and / or "cross-verification" lead to an unequal Result becomes inevitable detected an error and initiated a safety-related function.

2 exemplifies, but using software described above instead of protocol chips, a possible functional diagram of an implementation of in 1 sketched write permission and the full read permission as the basis for these verifications.

As in 2 1, the area marked M on the left comprises the multichannel architecture with security consideration according to the invention and FIG 2 The right-hand area marked with E is the single-channel architecture with the safety-related protocol to be transmitted as a safety telegram.

Thus, essentially based on 1 are the two micro-processors 11 and 21 decoupled by known per se, at 2 with the reference number 100 characterized, and further via a communication interface 101 for additional mutual verification of separately calculated safety-related protocols 14 and 24 connected with each other.

The address bus 102 for the addresses Ax, with x between 0 and N, the data bus 103 for the data Dx, with x between 0 and N, as well as the signals / CS (Chipselect) and / RD (Read) are, as usual, directly to the at 2 shown default DPM and applied to the corresponding pins for the signals / CSL or / RDL. The address line A0 is the microcontroller with the write signals / WR μC1 and / WR μC2 11 and 21 so linked that in even addresses only the micro-controller 11 is write-authored and for odd addresses only the micro-controller 21 is authorized to write.

Only in these two cases can the write signal / WR be triggered via the corresponding pin for the "low active" signal / WL on the RAM of the standard DPM. However, both micro-controllers can read 11 and 21 on the entire memory 30 access.

An expediently before the writing of the safety telegram to be formed feasible tests of access locking takes place, for example, according to the following sequence:
The micro-controller 11 tries a default value, eg FFh, in all memory locations of the DPM 30 to write.

The micro-controller 21 then tries another default value, eg 00h, in all memory locations of the DPM 30 to write.

The micro-controller 11 then reads all memory locations of the DPM 30 out and check if only in the, the micro-controller 21 Assigned memory locations the value 00h is registered and if necessary., whether in the the micro-controller 11 assigned memory locations the value FFh is entered. Subsequently, the micro-controller tries 11 once again write the value FFh in all memory locations.

The microcontroller reads 21 all memory locations of the DPM 30 out and check if only in the, the micro-controller 11 allocated memory locations the value FFh is registered and if necessary, whether in the the micro-controller 21 Assigned memory locations the value 00h is entered.

If an error occurs with this expectation, the error is detected and a safety-related function is initiated, for example, the process is transferred to a safe state. Otherwise, it can be assumed that the access lock is working properly. An essential Feature in the implementation of the invention is thus that not the actual write signals from each micro-controller 11 respectively. 21 directly but that a link with the addresses takes place. Thus, it is only possible to write to the addresses assigned to the respective microcontroller.

The data; in the RAM of the DPM 30 are filed accordingly. backed by a highly secure protocol. The DPM 30 Similar to the transmission channel itself, it is not considered secure. The security is thus achieved, among other things, that on the processing side, ie in the 2 marked with M, an expectation of the structure or content of the data exists. Consequently, the further processing or distribution of the DPM 30 cached data, for example via another micro-controller 35 that the data from the DPM 30 single-channel takes place, and then to the bus system, for example by coupling into a fieldbus 40 , be handed over.

By performing a self-certification, both micro-controllers monitor 11 and 21 the respective access rule practically during the writing of the security telegram in the cache 30 automatically and the data stored in the memory can be accessed via an interface of the buffer 30 for transmission to a protocol chip, another micro-controller or any other intelligent single-channel unit. Because in case of failure or failure of a micro-controller 11 or 21 If a complete safety telegram can no longer be generated, it will inevitably be detected for faults and a safety-related function triggered. The safety consideration of the redundant architecture M thus basically ends with the storage of the data on the memory 30 , because from here the security mechanism of the protocol, since the errors that are possible from here are considered for a transmission anyway as before and must be mastered. A possible error from the principle for the examination and certification of "bus systems for the transmission of security-relevant messages" is a message corruption.

Thus, by the use of standard components, the comparison or verification of the security telegram to be transmitted before the actual transmission via a. By the above-mentioned unconditional linkage of the write authorization with the positions to be described in common to be formed secure protocol and the unrestricted read authorization of both micro-controller bus 40 guaranteed. Consequently, a micro-controller 11 respectively. 21 alone unable to send a security telegram.

The at 2 shown functional diagram is thus already realized by a simple logic circuit, but may for example also be implemented by an FPGA. Furthermore, of course, instead of at 2 represented DPM 30 also a simple standard RAM can be used. However, the DPM simplifies the circuit with regard to the readout of the safety telegram from the buffer. For a person skilled in the art, it is apparent that the 2 shown circuitry represents only one of the possible technical implementation for a unique write access. The data lines can also be divided, for example, so that a computer can only write to the upper data lines and a redundant computer can only write to the lower data lines of the buffer. A write access control according to the invention is further applicable to more than two redundant computer / processing channels.

at 5 is now shown in the form of a schematic diagram of a preferred embodiment of the present invention, in which only after complete and positive implementation of a self-certification of a data from a memory 30 read back safety telegram, this is released for further transmission.

at 5 again are two processing channels 1 and 2 outlines that are part of a secure system and application specific, can be constructed by means of multi-channel hardware or multiple software processes or any combination thereof, which in the overall composition of the above-indicated required security essentially corresponding security to ensure the safety requirements. Such a secure system thus again comprises at least two redundant secure processing channels 1 . 2 to generate at least one safety-critical process associated with secure protocols to obtain a correspondingly higher security.

The processing channels 1 and 2 or included therein, also on different hardware or on different software on a common hardware based computer 11 . 21 are further formed in the present embodiment for packet-oriented data processing.

According to 5 creates every secure processing channel 1 and 2 again a complete and identical secure protocol 14 respectively. 24 , Due to the training for packet-oriented data processing Here, however, every secure protocol 14 and 24 each of a number of data packets 15 and 16 built up. The number of data packets 15 and 16 corresponds in the present embodiment also the number of secure processing channels 1 and 2 So any secure protocol 14 and 24 from two data packages 15 and 16 consists.

The secure processing channels 1 and 2 can optionally turn over a communication interface 101 connected to each other, eg the created secure protocols 14 and 24 if necessary, compare with each other before the respective data packets or protocol parts 15 and 16 for further processing, ie for writing in the data memory 30 be released. However, such a comparison need not necessarily be provided at this point.

The access permissions for the processing channels 1 and 2 to the data store 30 for reading and writing data are in turn controlled appropriately defined, for example by a at 5 with the reference number 8th indicated access lock by means of hardware. Based on the design of the processing channels 1 and 2 for packet-oriented data processing, write permissions are in the embodiment 5 divided such that a respective packet-wise writing data into the data memory 30 is possible.

To ensure that in the data store 30 from every processing channel 1 and 2 In each case, another data packet is written, for example, the access authorization may be such that the processing channel 1 only on storage locations of a first contiguous storage area and the redundant processing channel 2 only to memory locations of another contiguous memory area of the data memory 30 can write access.

at 5 are the write permissions and read permissions for the processing channel 1 indicated by the arrows marked "S1" or "L1" and the write permissions and read permissions for the processing channel 2 by the arrows marked "S2" or "L2". Accordingly, the processing channel 1 thus only the data package 15 in the common data store 30 write and the processing channel 2 can the data package 16 in the common data store 30 write. Both processing channels 1 and 2 are, however, authorized from the data store 30 both data packets 15 and 16 to read.

Again, therefore, each provides a secure redundant processing channel 1 and 2 each a different part of each generated secure protocol 14 respectively. 24 in the common data area 30 to put together a secure protocol together.

After the processing channel 1 the data package 15 of the protocol 14 and the processing channel 2 the data package 16 of the protocol 24 in the common data store 30 have written as respective protocol part read the secure redundant processing channels 1 and 2 the full data back from the data store 30 and compare them with the internally released secure protocol or data set 14 respectively. 24 , If a respective comparison reveals that the read-out data is the same as the internally released data record, the processing channel gives 1 respectively. 2 that in the data store 30 jointly formed secure protocol according to. suitable means and / or measures, such as by means of a release signal 9 free for further processing. Only when every redundant processing channel 1 and 2 that in the data store 30 shared secure protocol has been released for further processing, this is the transfer / transfer from the data store 30 effectively released. For example, to enable or disable access to the temporary register content for its handover or capture for further processing only in the presence of a release by each of the redundant processing channels, the activation of a signal or enable signal enabling a corresponding output of the content via an AND memory. Linking the individual enable signals in the presence of a release by each redundant processing channel 1 . 2 be effected.

The further transport of the jointly formed protocol after transfer / transfer from the data store 30 can be arbitrary, for example, according to the above description with respect to the 1 and 2 and is essentially dependent solely on the measures that have been integrated into the secure protocol.

The according to 5 Thus, the described embodiment is not only suitable for single-channel bus coupling of a safety-critical process but also for coupling security-critical process from a secure, at least two redundant processing channels environment to a non-secure environment or a safe, but less channels having environment, without the security of to endanger. The coupling mechanism described above is therefore expediently used for any connection between secure processing units via non-secure transport routes. This applies to the transport of data over networks, like. eg Interbus or Ethernet, or within devices including devices that can be configured by extensions, such as inline stations.

It it should be noted that basically in the same way and data in a secure, multiple processing channels having process environment from a non-secure or a secure but fewer processing channels Environment taken over can be.

Claims (11)

Method in which according to German Patent Application 10 2004 039932.8 for single-channel bus coupling of a safety-critical process, a data relevant for the safety-critical process data set via at least two redundant processing channels ( 1 . 2 ), in particular protocol-specific, according to identical laws to a secure protocol ( 14 . 24 ) and the redundant secure protocols ( 14 . 24 ) for single-channel bus coupling to a common secure protocol, by adding from each of the processing channels ( 1 . 2 ) to a common intermediate register ( 30 ), whereby a write authorization is assigned only once for each register location, so that the common secure protocol is proportionately composed by writing respectively different portions of the respective secure protocols, whereby prior to a transfer of the common secure protocol from the intermediate register ( 30 ) for verifying the jointly formed secure protocol of each of the redundant processing channels ( 1 . 2 ) the content of each register of the intermediate register ( 30 ), and characterized in that the shared secure protocol is not triggered until in response to a release by each redundant processing channel (16). 1 . 2 ) is released for transfer or transfer from the intermediate register for further processing. Method according to the preceding claim, wherein the release by a processing channel ( 1 . 2 ) by transmitting an enable signal from the processing channel to the intermediate register. Method according to the preceding claim, wherein the activation of an enable signal in the presence of a release by each redundant processing channel ( 1 . 2 ) is effected via an AND operation of the individual enable signals. Method according to one of the preceding claims, further characterized in that each of the redundant secure protocols ( 14 . 24 ) from one of the number of redundant processing channels ( 1 . 2 corresponding number of protocol parts, and to assemble the common secure protocol of each processing channel, a different protocol part is written to the intermediate register. Method according to one of the preceding claims, in which each redundant secure protocol ( 14 . 24 ) is constructed from a number of data packets and the write authorization is granted for a packet-by-packet write-in. Use of a method according to one of the preceding claims instead of a single-channel bus connection of a safety-critical Process for otherwise coupling a safety-critical one Process from a secure, at least two redundant processing channels having environment to a non-secure environment or to a secure environment that however, includes fewer redundant processing channels. Use of the method according to the preceding claim for one Connection between secure processing channels via non-secure transport routes. Device comprising according to dt. Patent Application 10 2004 039932.8 for single-channel bus coupling of a safety-critical process at least two redundant computer ( 11 . 21 ) for, in particular protocol-specific, processing of an identical input data record using identical laws to a secure protocol ( 14 . 24 ), and circuitry for connecting each computer ( 11 . 21 ) with a common intermediate register ( 30 ) such that for each register location of the intermediate register ( 30 ) a write access option only for each of the computer and a read access option for each of the computer ( 11 . 21 ), and characterized in that each computer comprises means for verifying a content read back from the intermediate register and for releasing the contents of the intermediate register in response to a positive verification. Device according to one of the two preceding claims, further characterized in that each of the at least two redundant computers ( 11 . 21 ) is designed for packet-based data processing. Device according to one of the preceding claims, wherein the at least two redundant computers by means of redundant hardware and / or redundant software are formed. Use of a device according to one of the preceding claims instead of the single-channel bus coupling for otherwise coupling a safety-critical process from a safe, at least two redundant processing channels environment to a non-secure environment or one secure environment, but with fewer redundant processing channels.