DE19860358A1 - Error suppression in output units in control devices connected to automation apparatus via bus system by comparing redundant data with buffered information - Google Patents

Abstract

A monitoring unit (2) monitors bus data. Secure output units (8) are installed for secure functions and routines and internally comprise two separate bus users. One of these units includes a buffer memory (11) which detects output information from a control device (1) and supplies it to a comparator (12) which contains redundant data relating to the second bus user and compares them with the buffered information, to start a process if there is agreement.

Description

The invention relates to a method for error suppression of Output units that are connected to automation devices via a bus system are connected.

Automation devices are everywhere according to the current state of the art used where processes, procedures or other electromechanical Control, regulate, monitor or visualize facilities. In the narrower sense, programmable logic controllers are often used for this Controllers or microcomputers. Typical areas of application are Automation islands, production lines, machining centers or chemical Facilities.

It is not uncommon for these previously mentioned processes to contain security-relevant ones Processes that pose a danger to people or parts of the machine. Of The faulty states of the control system then pose extreme dangers must be kept away from people or other facilities. Examples for this are uncontrolled movements of robots, premature movement of Turning or milling devices, unwanted accelerations or incorrect ones Speeds of rotation devices or delayed switching off of heating or Dosing processes in chemical plants.

The causes of these fatal errors are many. Mostly, however, lies Programming errors, an uncontrolled behavior due to electromagnetic Influences or any other disturbance that the process into an undefined Situation.

These types of errors are in the literature (esp .: in standardization works, see: DIN 19251) adequately described. Likewise, the standard already presents concepts of how to recognizes and eliminates such errors (e.g. DIN V 0801). Also offer different manufacturers of control devices already complete solutions which are to be used for safety-relevant facilities (as presented) (see product offers Siemens (115 / 155F) or products from the manufacturers Pilz and Hi Mom).

Of particular importance in such processes are output units, all of which Trigger functions within the automated process. If those Output units receive faulty data or are faulty themselves, so Defects initiated that lead to the hazards mentioned above. It is therefore desirable and - in safety-relevant areas - absolutely necessary to recognize such malfunctions and measures to suppress them to take the error so that the process is not a hazard in its course represents.

The method presented is based on the fact that in typical Automation equipment brings some additional components, the one Guaranteed error control and error suppression. These additional Components ensure that a single fault is both detected and is suppressed. Only when two errors meet in the same state is not detected as an error. The process thus increases the security of the  Process quite considerable, since errors are caused by the effects of disturbances or by wrong program sequence can be prevented safely.

The process also has the essential advantage that Control device and safety device either complete or almost are completely separate. So there are specification or implementation errors (as you know them with parallel units) excluded in principle. This advantage is also shown by the fact that the safety-relevant components must also be installed retrospectively. In addition, in the control system Changes are made that are completely independent of Monitoring function work. The case of "on-site" Adaptation "to the process can also be implemented in the security area.

The process is also designed so that the normal process do not change within a controller or an automation network got to. This applies in particular to the PLC cycle in the controller as well for the transmission cycle on the local network. Only in the security area special components are added, which in turn are used for data transport participate, but do not change it.

Fig. 1 shows a typical configuration of an automation system. The controller ( 1 ) controls or regulates the process ( 6 ). A local network ( 3 ) (bus system) and decentralized units ( 4 , 5 ) are used to transport data from the controller to the sensors and actuators in the process. The unit ( 5 ) represents a typical input device and the unit ( 4 ) a typical output device. To process the desired process function, the controller ( 1 ) fetches the state of the inputs via the input unit ( 5 ) at the beginning of the PLC cycle Memory within their unit. Based on this state, the logical processing is carried out by the PLC program, and at the end of the PLC cycle, the control sends the calculated data to the output unit ( 4 ) via the bus system. Then this process begins again and repeats itself continuously. In modern controls, peripheral units are often used, which carry out data transport via the local network independently of the PLC cycle. Depending on the application, the update of the actuators can be synchronized or mapped as a parallel process.

An error that is caused either by incorrect programming in the controller ( 1 ), by a fault in the controller ( 1 ) or on the bus system ( 2 ) usually leads to an error that leads to incorrect control via the decentralized Unit ( 4 ) in the process ( 6 ) can cause damage.

In the case of non-safety-relevant processes ( 7 ) in the process, such errors lead to undesired states or processes; however, there is no danger. An error case with safety-relevant processes behaves differently ( 13 ). Here, the unintentional setting of an output can, for example, lead to a motor starting up or to the heating of an explosive liquid and thus endanger the life or health of people.

In order to avoid such fatal errors, a monitoring unit ( 2 ) is added to the system in accordance with the patent claim. In addition, you replace those decentralized output units that operate in safety functions in the process. For example, the output unit ( 4 ) is thus replaced by the more complex output unit ( 8 ).

This output unit ( 8 ) consists internally of two independent bus units, which look like normal bus users. Behind these units is a comparator unit ( 12 ), which carries out a comparison internally and is equipped with security elements in its technology.

The monitoring unit is also constructed as a normal bus participant and is represented by the automation system ( 1 ) as an additional participant with a pure slave function. All safety functions are stored in it, so that it is informed based on the status of the inputs and outputs whether a safety function is injured or not.

The additional installation of the monitoring unit ( 2 ) and the decentralized output unit ( 8 ) makes it possible to keep faulty states away from the safety-relevant process ( 13 ). The process is as follows:

• - The controller ( 1 ) fetches all information representing the states of the sensors in the process via the bus system ( 3 ).
• - The monitoring unit ( 2 ) listens to the bus system during data transport and stores all states that are important for safety in its internal memory.
• - After the read-in function has ended, the controller ( 1 ) processes all sizes and generates the necessary output information to control the process.
• - The monitoring unit uses the internally stored states of the security-relevant inputs and uses your program to check which States for the safety function are allowed or prohibited.
• - After calculation by the controller ( 1 ), this sends all output information via the bus system ( 3 ) to the decentralized output units ( 4 , 8 ). While the normal (non-security-relevant) output units immediately output the data and thus make it clear to the process, the security output unit ( 8 ) only stores its information in a buffer ( 11 ).
• - At the end of the entire bus cycle, the monitoring unit ( 2 ) is now addressed by the controller ( 1 ) as a normal slave.
• - This ( 2 ) now reports with all output data that it considers correct due to the security check.
• - During this transmission of the data from the monitoring unit ( 2 ) to the controller ( 1 ), the safety output unit ( 8 ) also listens. The corresponding permitted states are recorded by each unit and also buffered. For this purpose, a separate bus unit ( 9 ) is available in the safety output unit ( 8 ).
• - The following comparator ( 12 ) then examines whether the data previously stored in the buffer unit ( 11 ) match the permitted data from the unit ( 9 ).
• - Depending on the failure of the comparison result, the comparator ( 12 ) enables the output (comparison correct and allowed) or prevents the output (comparison incorrect or incorrect).
• - If the comparator detects an error, it switches all outputs to a safe state. Furthermore, the safety output unit ( 8 ) withdraws from the bus event in the next cycle or signals an error.
• - This ensures in the event of an error that not only invalid data does no damage, but also information about the error state is given to the control ( 1 ) and the monitoring unit ( 2 ).

The decentralized safety output unit ( 8 ) must have a fail-safe comparator ( 12 ) to accomplish this task. It has the task of comparing the temporarily stored value from the memory ( 11 ) with the permitted data of the unit ( 9 ). If the comparator ( 12 ) recognizes that the data are present without errors, it can forward the output information to the process ( 13 ). Such fail-safe comparators are already state of the art today (see for example: product range from Square D).

The internal structure of this security output unit ( 8 ) is not part of this application, rather the invention relates only to the method of how to recognize and suppress an error by adding the two units ( 2 , 8 ).

The invention is part of a security system, which under the Case number 198 57 683.8 was presented as a procedure.

The overall system also includes security-relevant input units ( 5 ) and the monitoring unit ( 2 ) already mentioned several times.

In connection with the output units presented here, the monitoring unit ( 2 ) also fulfills the task of generating a safe shutdown in the event of a fault if this is no longer possible with the output units. For example, behind the output unit described, a supply cable can have a short circuit (to another output or to the operating voltage), so that even a shutdown within the output unit does not result in the safety state of the corresponding actuator. In this case, the monitoring unit has separate outputs that switch off the power supply and thus initiate a safe state.

Claims (8)

1.Procedure for suppressing errors in output units in control devices which are connected via a bus system ( 3 ) to an automation device ( 1 ) (programmable logic controller or microcomputer) and operate actuators in the safety-relevant process or initiate dangerous functions and processes, thereby characterized in that a monitoring unit ( 2 ) monitors the bus data and safety output units ( 8 ) for safety-related functions and processes are installed, which consist internally of two separate bus users, one of which has a buffer ( 11 ), which records the output information from the controller ( 1 ) and does not yet make it available to the comparator ( 12 ), which at the end of the bus cycle receives redundant data from the data from the monitoring unit ( 2 ) via the second bus subscriber and this with the cached information v compares and, if there is a match, initiates the output function that serves the process. 2. The method according to claim 1, characterized in that the security output unit ( 8 ) replaces a normal output unit ( 4 ) and thus brings an increased level of security in cooperation with the monitoring unit ( 2 ). 3. The method according to claims 1 to 2, characterized in that the safety output unit ( 8 ) can also be installed retrospectively without the process in the controller ( 1 ) having to be changed. 4. The method according to claims 1 to 3, characterized in that together with a monitoring unit and designed redundantly Input units a complete security system for Automation processes arise. 5. The method according to claims 1 to 4, characterized in that an installation on standard bus systems is possible. 6. The method according to claims 1 to 5, characterized in that the Output unit reaches a safe state in the event of a fault, which means any danger for the function of the automation device and the associated Excludes machine or system. 7. The method according to claims 1 to 6, characterized in that for redundant monitoring of the output information is neither a special module (e.g. ASIC) an additional address must be provided as a bus node. 8. The method according to claims 1 to 7, characterized in that an installed monitoring unit in the event of a fault via its own outputs the power supply is interrupted and thus potentially dangerous actuators switches off.