Security control system, method for the operation thereof

• US 6,853,292 B1
• Filed: 03/27/1998
• Issued: 02/08/2005
• Est. Priority Date: 03/27/1997
• Status: Expired due to Fees

• Current Assignee: Elan Schaltelemente GmbH & Co. KG. (K.A. Schmersal GmbH & Co. KG)
• Original Assignee: Elan Schaltelemente GmbH & Co. KG. (K.A. Schmersal GmbH & Co. KG)
• Inventors: Ziegler, Olaf, Kramer, Manfred, Thüringer, Rainer, Schneider, Volkmar, Krauskopf, Arno
• Primary Examiner(s): Zimmerman, Brian
• Assistant Examiner(s): YANG, CLARA I
• Application Number:
  US09/381,304
• Time in Patent Office: 2,510 Days
• Field of Search: 340/3.43, 340/3.1, 324/500, 324/511, 700/108, 700/109, 700/110, 714/4, 714/24, 714/43, 714/47, 714/53
• US Class Current: 340/3.43
• CPC Class Codes: G05B 19/0426 Programming the control sequence
• CPC Class Codes: G05B 2219/23424 Select construction element from function library
• CPC Class Codes: G05B 2219/24173 One sensor, two I-O channels each for different processor
• CPC Class Codes: G05B 2219/24186 Redundant processors are synchronised
• CPC Class Codes: G05B 2219/25032 CAN, canbus, controller area network bus
• CPC Class Codes: G05B 2219/25331 Module connected to canbus and to controlled device
• CPC Class Codes: G05B 2219/25389 Macro's, subroutines
• CPC Class Codes: G05B 9/03 with multiple-channel loop, i.e. redundant control systems
• CPC Class Codes: H04L 12/10 Current supply arrangements
• CPC Class Codes: H04L 12/40013 Details regarding a bus controller
• CPC Class Codes: H04L 12/40182 by using a plurality of communication lines
• CPC Class Codes: H04L 12/403 with centralised control, e.g. polling
• CPC Class Codes: H04L 2012/40273 the transportation system being a vehicle

Abstract

A safety-oriented control system with a plurality of decentralized stations is disclosed. The safety-oriented control system is provided with inputs and outputs and at least one centralized station exchanging information with each other via a bus line, wherein at least one of the decentralized stations has independent devices for fault-tolerating and/or fault-controlling self-monitoring to ensure normal operation for linkage and evaluation of signals located at the inputs and outputs of this station or further stations, and devices for processing of the signals and for generation of independent control commands.

Claims

1. A safety-oriented control system (10) comprising:

a plurality of decentralized stations (14, 16, 18, 20) provided with inputs and outputs (138, 140, 142, 144) and at least one centralized station (12) exchanging information with each other via a bus line (38, 40, 42, 44), wherein at least one of the decentralized stations (14, 16, 18, 20) has independent devices (62, 64) for fault-tolerating and/or fault-controlling self-monitoring to ensure normal operation for linkage and evaluation of signals located at an input of at least one decentralized station, and wherein at least one of the decentralized stations has devices for processing of said signals and for generation of independent control commands, wherein the independent device (62, 64) is coupled via a coupling element to the bus line (38, 40, 42, 44),

wherein the centralized station (12) is coupled to a programmer that generates a shutdown table independently from the user program programmed by the user and adding said table to the transmission protocol when transmitting the user program to the centralized station (12);

wherein the shutdown table is transmitted from the centralized station (12) to the decentralized stations (14, 16, 18, 20);

wherein the independent devices (62, 64) comprise a storage cell for the shutdown table that is transmitted from the central station via the bus line (38, 40, 42, 44);

wherein the shutdown table comprises shutdown information in the form of logical linkages between inputs of the same and/or inputs of other stations allocated to each output of the station;

wherein the decentralized stations (14, 16, 18, 20) are provided with outputs reading and evaluating all messages transmitted via the bus line (38, 40, 42, 44); and

wherein the independent devices (62, 46) have a comparator, in which the messages transmitted via the bus line (38, 40, 42, 44) and the linkages stored in the shutdown table can be compared, where when a linkage assigned to an output is fulfilled a direct shutdown of the output assigned can be performed.

2. Safety-oriented control system according to claim 1,

wherein the stations (12, 14, 16, 18, 20) have a redundant design with two independent and galvanically isolated part-systems/nodes or channels (A, B).

3. Safety-oriented control system according to claim 2, wherein redundant part-systems or channels (A, B) each have independent software packages with differing program structure for performance of the same computation.

4. Safety-oriented control system according to claim 2, wherein each channel (A, B) of a station (12, 14, 16, 18, 20) has one of the programmable control units (62, 64).

5. Safety-oriented control system according to claim 2, wherein the stations (12, 14, 16, 18, 20) and/or consumers connected thereto are supplied via the bus line with AC voltage, where each channel (A, B) of a station (12, 14, 16, 18, 20) is assigned a separate power pack (54, 56).

6. Safety-oriented control system according to claim 2, wherein the programmable control units (62, 64) arranged in the channels (A, B) are serially linked to one another via a galvanically decoupled interface (86).

7. Safety-oriented control system according to claim 1, wherein the independent devices has at least one programmable control unit (62, 64) such as a microcomputer that assumes the functions of signal transmission, signal reception and evaluation as well as processing of the signals to control signals.

8. Safety-oriented control system according to claim 1, wherein the stations (12, 14, 16, 18, 20) are linked to one another by a CAN bus line (38, 40, 42, 44), wherein at least the centralized station (12) is a bus start station.

9. Safety-oriented control system according to claim 1, wherein the control system (10) is designed as a bus line.

10. Safety-oriented control system according to claim 1, wherein the bus line (38, 40, 42, 44) extends between the bus start station (12) and a bus end station (decentralized station) (20) and further decentralized stations (14, 16, 18) with a bus input (26, 28, 30) and a bus output (32, 34, 36) are incorporated into the bus line.

11. Safety-oriented control system according to claim 1, wherein bus signals or information are exchangeable between the stations (12, 14, 16, 18, 20), wherein one of said stations provides the bus with information on the basis of a state change to the input, which is read and evaluated by at least one further station, and where the stations perform independently allocated control functions depending on the information received.

12. Safety-oriented control system according to claim 1, wherein the centralized station (12) is designed as the bus master and assumes higher-order bus control functions.

13. Safety-oriented control system according to claim 1, wherein signals are mutually exchanged between the centralized station (12) and a decentralized station for checking of the bus line.

14. Safety-oriented control system according to claim 1, wherein the bus line has a data line (46) and a power supply line (48) each with two conductors.

15. Safety-oriented control system according to claim 1, wherein at last the centralized station (12), is connected to an external isolating transformer (52) for generation of the supply AC voltage.

16. Safety-oriented control system according to claim 1, wherein at least the centralized station (12) has a serial interface (88, 90) such as an RS 232 or CAN interface for programming of the system.

17. Safety-oriented control system according to claim 1, wherein at least the centralized station (12) and at least the bus end station (20) each have units for generating preferably periodic bus messages or bus signals and devices for receiving bus messages or bus signals, and wherein a fault message is generated within a certain period if there are no bus messages.

18. Safety-oriented control system according to claim 1,

wherein the programmable control units (62, 64) are each connected on the output side with an electromechanical switching unit (146, 148) such as a relay for control, said electromechanical switching unit having switching contacts (130, 132, 134, 136) that perform a higher-order shutdown function.

19. Safety-oriented control system according to claim 1, wherein the message contents are filed in the form of a table.

20. A method for operation of a safety-oriented control system (10) with a plurality of decentralized stations (14, 16, 18, 20) provided with inputs and outputs (138, 140, 142, 144) and at least one centralized station (12) exchanging information with each other via a bus line (38, 40, 42, 44), wherein in at least one of the decentralized stations (14, 16, 18, 20) a linkage and evaluation of signals located at the inputs (138) of the same stations takes place and a message is transmitted to a bus line (38, 40, 42, 44) in dependence of signals located at the inputs (138), said signals being received and evaluated by the centralized station (12) or at least one of the decentralized stations (14, 16, 18, 20);

comprising,

generating a shutdown table independently in a programmer on the basis of a user program programmed by a user, where said shutdown table is attached to the transmission protocol when transmitting the user program to the central station (12);

transmitting the shutdown table to each decentralized station (14, 16, 18, 20) via a bus line (38, 40) originating from the centralized station (12) comprising outputs prior to starting the control system (10);

wherein the shutdown table includes shutdown information assigned to each output of the decentralized station (14, 16, 18, 20), said information being provided in the form of logical linkages between inputs of the same station and/or inputs of further stations;

wherein the decentralized station (14, 16, 18, 20) comprising outputs read all messages transmitted via the bus line (38, 40) and check whether the messages transmitted via the bus line (38, 40, 42, 44) correspond to a logical linkage stored in the shutdown table; and

wherein when fulfilling a linkage being assigned to an output, a direct shutdown of the output assigned takes place.

21. Method according to claim 20 wherein message contents (shutdown tables) in the form of logic links between inputs and outputs (138, 140, 142, 144) of the control system (10) are filed in at least one centralized station, wherein a message content assigned to one decentralized station (14, 16, 18, 20) is transmitted to the respective decentralized station via the bus line, and wherein the decentralized station (14, 16, 18, 20) independent of a control program, running in at least one of said centralized stations reacts directly or indirectly to a message content in form of a data block, transmitted via the bus line and corresponding to the filed data content.

22. Method according to claim 20, wherein one or more inputs (142, 144) are assigned to each safety-relevant output (138, 140), the state change of which effects a shutdown of the respective output.

23. Method according to claim 20, wherein the shutdown table initiates a direct shutdown of the assigned output (138, 140) when predetermined input information is met/not met.

24. Method according to claim 20, wherein the stations (12, 14, 16, 18, 20) having outputs (138, 140) independently initiate the shutdown of outputs (138, 140) depending on the information located at the bus line.

25. Method according to claim 20, wherein the shutdown of the outputs (138, 140) by the bus stations takes priority even before the shutdown by the centralized station (12).

26. Method according to claim 20, wherein said the stations have a redundant design with two independent and galvanically isolated part-systems/nodes or channels (A, B).

27. Method according to claim 26, wherein in the case of two-channel stations (12, 14, 16, 18, 20) a comparison is made between the shutdown tables of both channels (A, B).