Method and arrangement for monitoring and controlling machines, such as machine installations

00013. The invention relates to a method and a device for monitoring and controlling machines or mechanical systems according to the preambles of claims 1 and 3 respectively.

0002An actuator-sensor interface system (AS-i system), as it is for example in Kriesel, W., Madelung OW, AS-Interface, the actuator-sensor interface for automation, Hanser-Verlag, 2nd revision. Edition, 1999, according to an AS-i standard, comprises a two-wire bus for data and energy transmission, an attached master, which is used for data transmission, which controls the logical and temporal behavior on the two-wire bus and as a link between a host and Peripherals can serve, a power supply for power supply and slaves in the form of sensors and actuators for switching states. The master takes over the data transmission and the system management according to a rigid protocol such as the admission of newly added slaves, parameterization, query of the configuration and addresses all existing slaves with data calls in a cyclical mode of operation with a cycle time <5ms in a predetermined address sequence and awaits the response of the Slaves, whereby 4-bit user data are contained in the data call and in the response. Each slave has a transmit and receive circuit, a sequential control unit and a non-volatile memory (EEPROM) for recording the address and the configuration data. The address of each slave is set to a valid operating address when it is started up.

0003If safety-relevant slaves are used, safety-related information is transmitted via data telegrams, the interpretation of which is carried out using a safety monitor, which can be designed as a separate device and is purely passive on the two-wire bus. The safety monitor monitors whether the query of the slaves has ended within a predetermined time and whether all addresses of the slaves have been processed. The safety-relevant slaves supplying input signals are also evaluated in the safety monitor, initially with a safe process image in which the states of the slaves are stored (whereby in addition to the on and off states, information about intermediate states may also be present per slave, which results from the dynamic coding result), created and this is then evaluated in order to determine the states of shutdown groups in accordance with a predetermined specification.

0004The safety monitor, which is redundant, ie at least two-channel, for delivering the desired safety, has two safe outputs which are each coupled to a likewise redundant relay path. However, if additional output paths are required, a corresponding number of safety monitors with appropriate wiring to the two-wire bus must be provided, which considerably increases the effort.

0005The object of the invention is to provide a method and a device according to the preambles of claims 1 and 3, respectively, which enable a larger number of safe starting paths without great expenditure on equipment and assembly.

0006This object is achieved in accordance with the characterizing part of claims 1 and 3, respectively.

0007Further refinements of the invention can be found in the following description and the subclaims.

0008The invention is explained below with reference to an embodiment shown in the accompanying figures.

00091 shows a basic circuit diagram of a device for monitoring and controlling a machine or machine system.

0010FIG. 2 schematically shows a data transmission within the device from FIG. 1.

0011The device shown in FIG. 1 comprises a two-wire bus 1 for data and possibly for energy transmission, which is connected to a power supply unit 2. A master 3 is connected to the two-wire bus 1, which is used for data transmission, which controls the logical and temporal behavior on the two-wire bus 1 and can serve as a connecting link between a host and peripherals, for example. The two-wire bus 1 and the master 3 are non-safe components.

0012The two-wire bus 1 is additionally connected via an interface 4 to slaves 5 supplying input signals as well as slaves 6 providing output signals and also a redundant safety monitor 7 (only one of slaves 6, 7 is shown in each case). The input signals delivering slaves 5 can be, for example, those of safety switches on doors, flaps or the like. of access openings in barriers such as fences, housings etc. of machines or mechanical systems that, when they work, pose a hazard for employees when they enter, so that it should be ensured that the doors, flaps or the like. cannot be opened while the machine is running, or if there is an error somewhere due to a malfunction of a switch, a short or short circuit or the like. the machine is turned off. The slaves 5 can also be light sensors that detect the penetration of an obstacle in a protected area, light barriers or emergency stop buttons. In addition, non-safety-relevant slaves (not shown), which are then only controlled by the master 3, can be connected to the two-wire bus 1.

0013In addition to its interface 4, each slave 5 comprises a counter 9 (in particular a modulo8 counter) with a memory with eight addresses and 4 bits in width with the values ​​of a sequence of, for example, 8 by 4 data bits, of which the slaves 5, 6 are cyclically polled the next value of the sequence is transmitted by the master 3, so that the sequence is completely transmitted after eight cycles. If the respective slave 5 recognizes a data call for the address assigned to it, in this example it sends the four data bits located at the inputs in its response. At the same time, the interface 4 generates a delayed data strobe signal DSTB for incrementing the counter 9 via a timer 8, so that the next value of the sequence is transmitted in the response in the next cycle in the next cycle. The following data record results:<tables id="tabl0001" num="0001"><img file="EP1170645A2_D0001.tif" /></tables>

0014In this case, each slave 5 has two input channels connected to an associated sensor system, each of which emits corresponding information bits to the interface 4.

0015The security monitor 7 checks the data records of the master 3 for the content and chronological correctness of the transmission, the above 14 bits being used for the master query. Then there is a master pause of 3 bits, for example, then a slave response of 7 bits and a transmission pause of 2 bits. This results in a maximum time corresponding to the cycle time and the number of slaves 5, 6 to be requested, which is monitored by the safety monitor 7. The addressing and data interrogation of all registered safety-relevant slaves 5 are thus checked within a predetermined time.

0016The slaves 5 now in turn place a special bit pattern that changes with each query when called up by the master 3 on the two-wire bus 1.<tables id="tabl0002" num="0002"><img file="EP1170645A2_D0002.tif" /></tables>

0017The safety monitor 7 also receives this information via its interface 4 and now takes over the checking of this information and the comparison of the transmitted bit pattern with a bit pattern stored for each slave 5 in a memory 10 by means of a corresponding comparator 11.

0018(The assignment of which slave 5 sends which bit pattern is firmly programmed in the manufacture of each device. When the system is configured, each slave 5 reads the respective bit pattern, compares it with a code table of released bit patterns and, if there is a match Data record in this code table stores the recognized bit pattern for each individual slave 5 in the safety monitor 7. As soon as the safety monitor 7 has recognized a complete set of bit patterns from a registered slave 5, its information is deemed to have been released.)

0019The safety monitor 7 forms a process image from the various pieces of information which are regarded as genuine and thus secured, from which safe output paths 15 are controlled.

0020For this purpose, the information of the process image is mapped onto a safety-relevant slave 12 emulated in the safety monitor 7, the function of which is analogous to that of the slave 5. This leads to the fact that the safety monitor, via its internal slave 12, in turn sends a changing bit pattern to the two-wire bus 1 via the corresponding interface 4 when the master 3 requests special addresses provided for safe output paths 15.

0021The special addresses provided for safe output paths 15 are in turn checked by the slaves 6 as well as their timing, as was previously done by the safety monitor 7 in relation to the addresses and the timing of the master 3. Accordingly, in addition to an interface 4, the slaves 6 include a memory 13 for a code table and a comparator 14. The slaves 6 are therefore functionally the same in this respect with the safety monitor 7, but they do not establish any links for a process image. Only after a complete test cycle, if all data packets are correct, are the output paths 15 of the slaves 6 released. This ensures that the data transmission as a whole is checked and secured.

0022In this way, decentralized control of safe slaves 6 for output paths 15 with a single safety monitor 7 on the two-wire bus 1 is possible.

0023When using input / output interfaces 4, the safety monitor 7 can have a single interface 4, and in addition the function of the slave 12 through appropriate configuration of the safety monitor 7, which then has an additional link level for each of the slaves 6 and, in this regard, provides an input signal Slave acts without a slave module as such, each of the link levels places its link result on one of the assigned addresses of the slaves 6, cf. also FIG. 2, in which the transmitted sequences 13a, which are compared by the comparator 14 with the code table of the memory 13, are also shown.

0024If the master 3 addresses one of the addresses of the slaves 6, the safety monitor 7, as a "safe slave", places the result of the associated link in the form of an associated bit pattern on the two-wire bus 1. At the same time, the slave 6 located at this address "listens" as " safe monitor ", but without its own link level, on the two-wire bus 1. If the safety condition is fulfilled, the slave 6 switches on its output paths 15.

0025The system is configured on safety monitor 7. The slaves 6, the output paths 15 for driving elements 16 such as relays, electromagnets or the like. serve, are only addressed and configured.

0026The dynamic transmission between safety monitor 7 and slave 6 is shown schematically in FIG. 2.

0027Information bits 10 to 13 form a code word (in the AS-i standard, code word 0000 signals the off state, for example, the emergency stop button is pressed or the light barrier is interrupted, while code word 1111 is reserved). The on state of the safe output slaves is signaled by a sequence of special code words that are permanently assigned to the reserved addresses. The code words for the safe outputs form a cyclic sequence of length 4. Two successive code words differ in at least one bit. Each code word has a unique successor, it occurs only once in the sequence. Each bit in a sequence must be at least a 1 and a 0 once. Two bits must not be the same over the entire length of the sequence.

0028After a call by master 3, slave 5 switches to the next word in the sequence. The same is done in the safety monitor 7. According to the AS-i standard, it is provided here that a delay of the table changeover signal of 200 to 280 microseconds by the timer 8 ensures that in a cycle even in the event of a faulty slave response, in which the master 3 immediately repeats would carry out, the sequence is only advanced one step. This means that the dynamic signal corresponds to a precisely defined protocol. The safety monitor 7 detects any deviation from this protocol and triggers a predetermined reaction, for example switching off the relevant machine part. For the rest, reference is made to the AS-i standard.

0029The coupling between the safety monitor 7 as well as the slaves 6 and possibly the slaves 5 to the two-wire bus 1 can, if necessary, take place via optocouplers as the input stage of the respective interface 4, in which the signals are processed for further processing.