Patent ID: 12244478

A safety component11,12,13is shown inFIG.1. The safety component11,12,13has a signal input Rx for receiving data packets DP1, DP2, DP3and a signal output Tx for transmitting data packets DP1, DP2, DP3, The safety component11,12,13also has a ready status r, which can be set to active or inactive. The safety component11,12,13includes a safety module M, which can be set to active or inactive, but is always set to inactive when the ready status is inactive. However, this does not mean that the safety module M always has to be set to active when the ready status r is active.

The safety component11,12,13carries out at least one function test T cyclically. If all function tests T are successful, the ready status r is set to active. If only one function test T fails, the ready status r is set to inactive, which means that the safety module M is also set to inactive, or remains inactive if it was already inactive.

In the figures shown, an active ready status r, as well as an active safety module M, is represented in general as “1,” and an inactive ready status r, as well as an inactive safety module M, is represented in general as “0.” A failed function test T is shown as a crossed-out. T: if the function test T is successful, it is shown as a T.

FIG.2shows the construction of a test arrangement made up of a plurality of safety components11,12,13as described with reference toFIG.1. The safety components11,12,13are connected to one another as a circular test arrangement in the form of a ring bus, by connecting a signal input Rx of a safety component11,12,13to a signal output Tx of another safety component11,12,13. InFIG.2, for example, the signal output Tx of the first safety component11is connected to the signal input Rx of the second safety component12, the signal output Tx of the second safety component12is connected to the signal input Rx of the third safety component13, and the signal output Tx of the third safety component13is connected to the signal input Rx the first safety component11.

Of course, the number three for the number of safety components11,12,13is only selected as an example in the drawings shown; the test arrangement can include any number of safety components11,12,13.

As a function test T, the safety components11,12,13carry out at least one check of a cyclic, error-free reception of a data packet. DR This can be done, for example, via a checksum check, a sequence check, a timeout, etc. This check for error-free reception of the data packets DP establishes a so-called black channel between the safety components11,12,13.

If all function tests T of a safety component11,12,13are successful in a current cycle, the ready status r of this safety component11,12,13is set to active, if it is not already active. If the safety module M and the ready status r were already set to active, the safety module M remains activated—unless another security precaution deactivates the safety module M. InFIG.2, only the essential function test T(DP1), T(DP2), T(DP3) of a check for the cyclic, error-free reception of a data packet DP is provided on one of the safety components11,12,13. If this function test T(DP1), T(DP2), T(DP3) fails, the respective ready status r is set to inactive; if the function test T(DP1), T(DP2), T(DP3) is successful—which in this case means that “all” function tests T for each safety component11,12,13are successful, because this is the only function test T provided—the ready status r is set to active.

According to the invention, one of the safety components11,12,13is also selected as the bus master BM, wherein the bus master BM can be selected using a component identification, such as an identification number UID, of the safety components11,12,13. For example, that safety component11,12,13with the lowest identification number UID can be selected. InFIG.3, the first safety component11with the UID1is selected as the bus master BM, by way of example. According to the invention, the bus master BM checks whether the safety components11,12,13actually form a circular test arrangement—that is, a ring bus. To do this, the bus master BM transmits a bus verification signal B in a data packet DP1to the safety component which is adjacent in the direction of transmission, in this case the second safety component12. If there is a connection between the safety components11,12,13, the bus verification signal B is received via the signal input Rx in a data packet DP1, DP2, DP3, and forwarded via the signal output Tx, by all safety components11,12,13present in the ring bus.

Since each safety component11,12,13thus expects a periodic data packet DP1, DP2, DP3(with a bus verification signal B), an (essential) function test T can be to check that this data packet DP is received cyclically without errors. If the data packet DP1, DP2, DP3is not received as expected, or if the error check and thus the (essential) function test T fail, the respective safety components11,12,13deactivate their ready status r.

In this case, the safety component11,12,13can optionally also transmit an emergency signal N in a data packet DP1, DP2, DP3, which is forwarded by all safety components11,12,13in a data packet DP1, DP2, DP3, and all safety components11,12,13that receive the emergency signal deactivate their safety module M, which represents a further security mechanism.

InFIG.3, the first safety component11as bus master BM thus transmits the bus verification signal B via its signal output Tx in a data packet DP1to the signal input Rx of the second safety component12. The second safety component12transmits the bus verification signal B in a data packet DP2via its signal output Tx to the signal input Rx of the third safety component13, and the third safety component13further transmits the bus verification signal B in a data packet DP3via its signal output Tx to the signal input Rx of the first safety component11, which represents the bus master BM. Of course, the bus master BM only receives the bus verification signal B when the ring bus is closed. It can thus be ensured by the bus master BM, by receiving the bus verification signal B, that the ring bus is closed.

The safety components11,12,13are advantageously designed in such a way that they each transmit their identification number UID1, UID2, UID3with the bus verification signal B in the data packet, as also shown inFIG.3. Correspondingly, the bus master BM can be designed to identify the safety components11,12,13using the identifications UID1, UID2, UID3received with the bus verification signal B. As shown inFIG.3, the second safety component12receives the bus verification signal B with the data packet DP1from the bus master BM, adds its identification number UID2, and transmits the data packet DP2with the bus verification signal B to the third safety component13. This in turn adds its identification number UID3and transmits the bus verification signal B in a data packet DP3to the first safety component11, which constitutes the bus master BM. In the data packet DP with the bus verification signal B, the bus master BM not only receives the information that the ring bus is closed, but also the identification numbers UID2, UID3of the other safety components12,13; the bus master BM already knows its own identification number UID1. The safety components11,12,13in the test arrangement are therefore known to the bus master BM via their identification numbers UID1, UID2, UID3.

The safety components11,12,13continue to carry out cyclical function tests T, and in any case at least the essential function test T, by checking for a cyclic, error-free reception of data packets (DP1, DP2, DP3). The function tests T are not shown inFIGS.3to5for reasons of clarity.

Likewise, the bus master BM continues to carry out a check for a closed circular test arrangement by transmitting a bus verification signal B.

The bus master BM could now also transmit the respective identification numbers UID2, UID3back to the respective safety components12,13(not shown). In this way, each safety component11,12,13can itself check whether the ring bus is actually closed. The safety components12,13can preferably be configured in such a way that they set their ready status r to inactive if they do not receive their identification number UID2, UID3back from the bus master BM, since this indicates an error in the ring bus.

If the bus master BM receives the bus verification signal B via its signal input Rx (which establishes that the ring bus is closed), and if the ready status r of the bus master BM is active, the bus master BM transmits a ready signal R in the data packet DP via its signal output Tx to the adjacent safety component12in the direction of transmission (in this case, the second), as shown inFIG.4a, b. Upon receiving a data packet DP1, DP2, DP3with a ready signal R, each safety component11,12,13checks whether its ready status r is active. If the ready status r is inactive, each respective safety component11,12,13does not transmit a ready signal R in the data packet DP1, DP2, DP3. However, if a safety component11,12,13receives a ready signal R in the data packet DP and if its ready status r is active, the safety component11,12,13also transmits a ready signal R via its signal output Tx in a data packet to the signal input Rx of the safety component11,12,13connected to it.

InFIG.4ait is assumed that the third safety component13has an inactive ready status r. The ready signal R is thus routed in a data packet DP1from the bus master BM to the second safety component12. Since the second safety component12has an active ready status r, it forwards the ready signal R to the third safety component13in a data packet DP2. However, the third safety component13has an inactive ready status r, and therefore does not forward the ready signal R in the data packet DP3to the first safety component11(in this case, the bus master BM). The bus master BM thus concludes that not all safety components have an active ready status r=1.

If the bus master BM does not receive the ready signal R, it advantageously transmits an emergency stop signal N in a data packet DP1(not shown), which is forwarded by the safety components11,12,13. Upon receipt of the emergency stop signal N, the safety components11,12,13switch their safety module M to inactive, if it is not already inactive. This provides an additional safety precaution, and ensures that all safety modules M are inactive.

In contrast, it is assumed inFIG.4bthat all safety components11,12,13have an active ready status r. Thus, the ready signal R is only routed in the data packet DP1to the second safety component12, which, because of its active ready status r, routes the ready signal R in the data packet DP2to the third safety component13. Due to its active ready status r, the third safety component13routes the ready signal R in the data packet DP3to the first safety component11, which constitutes the bus master BM. The bus master BM thus establishes that all safety components11,12,13have an active ready status r, and thus determines an operational test arrangement. It should be noted that both with an active ready status r (FIG.4b) and an inactive ready status r (FIG.4a) of the third safety component13, the bus master BM receives the bus verification signal B in the data packet DP3, This means that in both cases, the circular test arrangement is closed. If this were not the case, then the bus master BM would not receive any data packet DP3, and therefore no bus verification signal B (and of course no ready signal R, etc.).

FIG.5shows the situation in which the bus master BM has already established that the test arrangement is ready for operation, by receiving the ready signal R. The bus master BM therefore transmits an activation signal A to all other safety components12,13, i.e, in a data packet DP1to the adjacent safety component connected in the direction of transmission (in this case, the second safety component12), which in turn transmits the activation signal A in a data packet DP2to the adjacent safety component connected in the direction of transmission (in this case, the third safety component13), etc. The other safety components12,13switch their safety module M to active upon receipt of the activation signal A in the data packet DP, which means that the circular test arrangement is active.

The safety components11,12,13are only allowed to transmit and receive safety-relevant information M1, M2, M3if the safety module M is active in each case. InFIG.5, it is assumed that all safety components11,12,13have already received an activation signal A/still receive it cyclically.

The first safety component11includes an input unit, for example a switch, and due to an activated safety module M, it can add safety-relevant information M1to the data packet DP1. For example, a measurement start command can be instructed by the first safety component11as safety-relevant information M1.

The second safety component12comprises a power unit. Since its safety module M is activated, the second safety component12can thus read out safety-relevant information M1from the data packet DP1, as well as add safety-relevant information M2to the data packet DP2. For example, the second safety component12can activate its power unit from the safety-relevant information M1originating from the first safety component11in the form of a measurement start command, and also add safety-relevant information M2in the form of measured values to the data packet DP2.

The third safety component13comprises an output unit which can now output safety-relevant information M1, M2contained in the data packet DP2, for example safety-relevant information M1originating from the first safety component11with regard to the input unit, such as a measurement start command, or safety-relevant information M2originating from the second safety component12with regard to the power unit, such as a measured value. When the safety module M is activated, the safety components11,12,13can therefore add safety-relevant information M1, M2, M3to a data packet DP1, DP2, DP3and/or read it out of a data packet DP1, DP2, DP3—depending on the design of the safety component11,12,13. The input unit, power unit and output unit are only shown inFIGS.5and6a, since the safety modules M of the safety components11,12,13are only activated here.

InFIG.5, as inFIG.4, the data packets DP1, DP2, DP3also contain the bus verification signal B and the ready signal R, with the bus master BM continuing to monitor a closed circular test arrangement, as well as an active ready status r of all safety components11,12,13.

The safety components11,12,13can also carry out a security test S (not shown) and, if the security test fails, deactivate their safety module M and emit an emergency stop signal N in a data packet DP1, DP2, DP3to the other safety components11,12,13, which, upon receipt of the emergency stop signal N, not only forward it in a data packet DP1, DP2, DP3, but also disable their safety module M. A failed security test S thus immediately leads to a data packet DP1, DP2, DP3being transmitted with an emergency stop signal N in order to deactivate the safety modules M of all safety components11,12,13. An emergency stop signal N can also be transmitted by the bus master BM if the bus master BM does not receive back the activation signal A that it transmitted at the signal input Rx in a data packet DP3.

In contrast to a safety test S, failure of a function test T (which is not safety-critical) only leads to an inactive ready status r of said safety component11,12,13. This inactive ready status r is only recognized by the bus master BM when it transmits a ready signal R and does not receive it. The other safety components11,12,13whose function tests T fail can remain in the active ready status r.

A break in the ring is shown inFIGS.6a, b, i.e., an interruption in the communication line between the second safety component12and the third safety component13. It is assumed that the break in the ring inFIG.6aoccurs after the bus master BM has received the data packet DP3, which means that the bus master BM still has no indication of the break in the ring when the data packet DP1is sent. The data packet DP1with the bus verification signal B (and in this case, also a ready signal R, activation signal A, and safety-relevant information M1, M2, M3) thus reaches the second safety component12, which at this point in time has also not yet detected a break in the ring, and thus transmits a data packet DP2, which, however, does not arrive at the third safety component13.

The third safety component13is configured in this case in such a way that it does not transmit any data packet DP3if it does not receive any data packet DP2. The cyclic function test T of the bus master BM thus fails, and the bus master BM would deactivate its ready status r. The bus master BM thus sets its ready status r to inactive and transmits a data packet DP with an emergency stop signal N in order to deactivate the safety modules M of all safety components11,12,13. The emergency signal N reaches the second safety component12in the data packet DP1, with the result that the safety module M of the second safety component12is deactivated.

If the third safety component13were configured in such a way that it also transmits a data packet DP3if it does not receive a data packet DP2(not shown), the essential function test T of the bus master BM would be successful, with the bus master BM leaving its ready status r active. In this case, it is advantageous if the bus master BM is configured in such a way that it transmits an emergency stop signal N if it does not receive a bus verification signal B. However, the bus master BM would still not receive a bus verification signal B due to the break in the ring, and would therefore transmit an emergency stop signal N in the data packet DP1if it was configured in this way. In the event of a break in the ring, the bus master BM does not receive a bus verification signal B in any case, and thus determines that the circular test arrangement is no longer closed (FIG.613).

However, because of the break in the ring, the second safety component12cannot transmit the emergency signal N to the third safety component13in the data packet DP2. However, the third safety component13cyclically carries out at least one essential function test T(DP) and waits for at least one data packet DP2for the verification. This function test T thus fails, with the result that the third safety module13switches its operating status r to inactive, with the result that the safety module M is also switched to inactive.

The first and third safety components11,12,13thus remain with an inactive safety module M in the test arrangement shown. The second safety component12can have an active ready status r, provided that no associated function tests T fail. However, this is only possible if the first safety component11is configured in such a way that it transmits a data packet DP even if it does not receive a data packet DP (for example, with a bus verification signal B), since otherwise the essential function test T of the second safety component12would fail.

The test arrangement can now, for example, be supplemented in a simple manner by additional safety components between the second safety component12and the third safety component13. Alternatively, a different arrangement of safety components11,12,13can be made, or the break in the ring can simply be closed.

Only when the break in the ring has been remedied is, as described above, a bus master BM determined, a data packet DP1, DP2, DP3with a bus verification signal B transmitted to determine a closed circular test arrangement, a data packet DP1, DP2, DP3with a ready signal R transmitted, and, as long as all safety components11,12,13have an active ready status r, an activation signal A for activating the safety modules M of the safety components11,12,13of the test arrangement transmitted. Safety-relevant information M1. M2, M3can then be exchanged between the safety components11,12,13again.