Apparatus for controlling safety-critical processes

• US 6,832,343 B2
• Filed: 02/08/2002
• Issued: 12/14/2004
• Est. Priority Date: 08/20/1999
• Status: Expired due to Term

• Current Assignee: PILZ GmbH & Company
• Original Assignee: PILZ GmbH & Company
• Inventors: Wohnhaas, Klaus, Schwenkel, Hans, Rupp, Roland
• Primary Examiner(s): Baderman, Scott
• Assistant Examiner(s): Damiano, Anne L.
• Application Number:
  US10/072,558
• Publication Number:
  US 20020093951A1
• Time in Patent Office: 1,040 Days
• Field of Search: 714/25, 714/43, 714/44, 714/47, 714/48, 700/21, 700/40, 700/80, 710/100, 709/243, 702/35
• US Class Current: 714/47.1
• CPC Class Codes: G05B 9/03 with multiple-channel loop, i.e. redundant control systems

Abstract

The present invention relates to an apparatus for controlling safety-critical processes. The apparatus includes at least one safe control unit for controlling the safety-critical processes and at least two safe signal units which are connected via I/O channels to the safety-critical processes. The safe control unit and the safe signal units are connected to a common fieldbus. The safe signal units communicate with the safe control unit, but not with one another, when the apparatus is in the control mode. The safe signal units have an evaluator for evaluating a fault message which is broadcasted across the fieldbus, as well as a switching device which autonomously change the safety-critical process to a safe state when a fault message which is evaluated as being relevant occurs.

Claims

1. An apparatus for controlling safety-critical processes, said apparatus comprising:

a safe control unit for controlling said safety-critical processes,

a plurality of safe signal units each of which having I/O channels for connecting said safe signal units to said safety critical processes, and each of said signal units being allocated to at least one defined group of signal units, and

a fieldbus, wherein said safe control unit and said safe signal units are connected to said fieldbus for communication, and wherein said safe signal units communicate with said safe control unit, but not with one another during faultless control mode,

wherein each safe signal unit further comprises;

a transmitter for broadcasting a fault message via said fieldbus, when a fault is detected by said signal unit,

an evaluator for evaluating any fault message broadcasted by another unit across said fieldbus as to its relevance with respect to the safety critical processes connected, and

a switching device which autonomously changes, via said I/O channels, said safety-critical processes connected to a safe state when said evaluator evaluates said fault message as being relevant,

wherein said evaluator evaluates said fault message for its relevance to said group to which said respective signal unit is allocated.

2. The apparatus of claim 1, wherein groups that are affected by a fault are coded in said fault message.

3. An apparatus for controlling safety-critical processes, said apparatus comprising:

a safe control unit for controlling said safety-critical processes,

at least two safe signal units having I/O channels which are connected to said safety-critical processes, and

a fieldbus, said safe control unit and said safe signal units being connected to said fieldbus for communication,

wherein said safe signal units communicate with said safe control unit, but not with one another, when said apparatus is in a faultless control mode, and

wherein said safe signal units each comprise an evaluator for evaluating any general fault message broadcasted across said fieldbus, as well as a switching device which autonomously changes at least one of said safety-critical processes to a safe state when a general fault message broadcasted is evaluated as being relevant.

4. The apparatus of claim 3, wherein said signal units each have a transmitter for broadcasting general fault messages across said fieldbus.

5. The apparatus of claim 3, wherein said signal units are each allocated to at least one defined group of signal units, and said evaluator evaluates said general fault message for a relevance with respect to the associated group.

6. The apparatus of claim 5, wherein groups that are affected by a fault are coded in said fault message.

7. The apparatus of claim 3, wherein said fieldbus provides a bus protocol for organizing said communication, said bus protocol assigning different transmission priorities to said signal units, and wherein said general fault messages are always broadcasted with the highest priority, irrespective of the transmission priority assigned to their sender.

8. The apparatus of claim 3, wherein said evaluator evaluates said fault messages without sending an acknowledgment message.

9. The apparatus of claim 3, wherein said signal units further comprise a time monitor for monitoring a timely occurrence of an expected event, said time monitor initiating the broadcast of said fault message when said expected event is not timely detected.

10. The apparatus of claim 9, wherein said expected event is a reception of an acknowledgment message.

11. The apparatus of claim 9, wherein said expected event is a reception of a test message which is sent cyclically.

12. The apparatus of claim 9, wherein said expected event is a transmission window.

13. The apparatus of claim 3, wherein said fieldbus is a CAN bus.

14. The apparatus of claim 3, comprising at least two safe control units for controlling safety-critical processes, said at least two safe control units being connected to a plurality of safe signal units via said common fieldbus.

15. The apparatus of claim 14, further comprising an administration unit for co-ordinating said at least two safe control units.

16. The apparatus of claim 14, wherein at least one signal unit is associated jointly with said at least two safe control units, wherein a first one of said safe control units communicates directly with said signal unit, while a second one of said safe control units communicates with said signal unit via said first control unit.