DE102005007477B4 - Programmable control for machine and / or plant automation with standard control and safety functions and communication with a safety I / O and method for operating the programmable controller - Google Patents

Abstract

Programmable control (1) for machine and / or plant automation, comprising a standard controller (20) with standard control functions, and a safety controller (30) with safety functions, the programmable controller (1) being based on a personal computer (PC) (10) having a PC-CPU (11) and a PC-Bus (12, 12, 13), the PC (10) being configured to operate with a standard operating system, and wherein the Standard functions on the PC (10) or a PC plug-in module (21) for the standard controller (20) are realized, wherein the safety controller (30) from one or more with the PC bus (12, 13) connected security Modules (31, 32), wherein the security modules (31, 32) comprise a safety-certified hardware and / or firmware, and wherein the programmable controller (1) is designed such that a non-safety-related data transmission and a safety-related data transmission übe r the PC bus (12; 12, 13), whereby the security-related data transmission between the security controller (30) and a decentralized security I / O (42) takes place via secure data packets which are transported intact via the PC bus (12, 12, 13) and checked for integrity by the security controller (30) and the remote security I / O (42) as communication end users, and wherein the standard controller (20) is controlled via an automation bus (40) with the remote security I / O (42), wherein the standard controller (20) is connected to the security controller (30) via the PC bus (12; 12,13) such that communication between the security controller (30) and the remote safety I / O (42) is via the PC bus (12; 12, 13), the standard controller (20) and the automation bus (40).

Description

State of the art

The invention relates to a programmable controller for machine and / or plant automation with a standard controller with standard control functions and a safety controller with security functions based on a personal computer (PC) with a PC-CPU and a PC bus wherein the PC is operated with a standard operating system and wherein the standard functions are implemented on the PC or a PC plug-in module for the standard control. The invention further relates to a method for operating such a programmable controller.

Control systems based on automation and drive bus systems are today used in large numbers, in particular in automated manufacturing processes. For example, manufacturing machines are controlled by means of one or more mostly programmable controllers via the bus systems. As feedback, data can be passed from the production devices to the controller, for example via the respective process and machine parameters, via the bus systems.

If safety-critical system components are controlled, the control system is subject to increased requirements regarding fault and failure safety. Design guidelines for such control systems are laid down in standards such as EN 954 and EN 61508. In this case, measures such as two-channel redundant design, cyclical diagnosis in operation with sufficient coverage or sufficiently low error and probability of failure are prescribed for the control according to the desired safety category or the desired safety integrity level.

The suitability and approval of a controller for carrying out safety-related control tasks is confirmed by a corresponding certification. The certification effort increases with increasing complexity of the control. Controls based on standard PC hardware (e.g., Pentium processor) with a standard operating system (e.g., Windows) are now considered non-certifiable due to their complexity for security controls.

Safety controllers approved today are therefore more likely to be assigned to the single control area. Due to their safety overhead, they are not economically viable for standard tasks and are less suitable for demanding automation tasks because of their simplicity. Their use is therefore generally limited to safety applications.

To carry out demanding automation tasks, a separation of an arbitrarily complex standard control and a safety-related control subject to the mentioned restrictions takes place today. This separation takes place in the known automation structures generally at the system or plant level. The disadvantage of such a separation is the use of different control devices with separate configuration, installation and programming, the latter usually with different programming tools.

From the DE 199 27 635 A1 An automation system is known which has at least one bus system, connected I / O bus users and a standard control device and at least one safety analyzer, wherein the safety analyzer overhears the data flow via the bus system and is designed to perform at least safety-related functions. The standard control device controls at least one safety-related output and the safety analyzer is set up to check and / or process safety-related data in the bus data stream. The security analyzer includes means for manipulating the input and output data transferred to the bus. In this case, at least one datum of the data stream can be overwritten, deleted and / or at least one datum can be inserted in the bus datastream. In addition, in another variant, the security analyzer can copy the output data accessible to it into input data.

From the cited document, a method for operating an automation system is known in which the standard control device carries out the process control with the processing of process-bound I / O data and a safety-related control with the processing of safety-related data and furthermore processing of safety-related data at least one safety analyzer is performed, wherein safety-related data, in particular safety-related linkage data in the bus data stream are processed in the safety analyzer.

The system allows the implementation of standard functions based on a PC solution. The separation between standard function and safety function occurs at fieldbus level.

The disadvantage of this automation system is that it requires the use of a specific fieldbus. The security features refer only to participants of this fieldbus. A further disadvantage is that the system requires additional components in the form of safety analyzers on the fieldbus, which must be programmed separately with a safety program.

DE 298 24 062 U1 shows a safety device for a programmable logic controller. US 5,561,767 A shows a safety-critical processor and a processing method for a data processing system. DE 10 2004 003 571 A1 discloses a process control system with embedded security system. EP 0 742 500 A2 refers to safe tap-button and switch functions with fault detection.

It is an object of the invention to provide a programmable controller and a method for their operation, which eliminate the disadvantages of the aforementioned prior art and in particular economically perceive both the standard functions and the security functions.

Advantages of the invention

The above object of the invention is achieved by a programmable controller for machine and / or plant automation according to claim 1, wherein in the programmable controller, the safety controller consists of one or more connected to the PC bus security modules and in the security Modules a security certified firmware is provided.

The control according to the invention thus provides a separation between the non-safety-related standard function and the safety function through modular division within the control unit. The standard function is subject to this division no safety-related restrictions and can be correspondingly complex, for example, based on a standard PC processor and a standard operating system, realized. The tasks of the safety modules are limited to the safety-related applications of the system and are designed and certified for its requirements. They are designed in such a way that in the event of a fault they can autonomously achieve the achievement of a secure state on their own. The safety-related units can monitor each other and thus ensure the achievement of a secure state for the entire system.

Standard functions and safety-related functions can thus be integrated on a PC-based hardware platform.

An essential prerequisite for the certification of the controller is that the programmable controller is designed as a feedback-free combination of standard control functions and at least one safety module. The freedom from retroactivity must be proven during certification. It prevents malfunctioning of the standard controller from affecting the safety features of the safety controller. If the freedom from feedback is guaranteed, PC-based solutions or even software control on a standard PC are possible for the standard function.

A simple and variable integration of the security module in the PC hardware can be achieved in that the at least one security module is designed as a PC plug-in module with at least one interface to a PC bus. The plug-in module can be adapted directly to the PC-PCI bus or it can be connected to the standard controller via a separate PCI interface. The infrastructure of the PC, such as the power supply, can be used.

In a preferred embodiment of the invention, the standard control functions are implemented in a running in the PC-CPU under control of the PC operating system software and the security module has an interface to the PC bus. The connection between the standard controller and the safety module is made via the PC-PCI bus. It thus existing units of the PC's are used as PC-CPU, PC operating system and PC-PCI bus and there are no additional components needed to implement the standard control functions. Advantageously, the programming and configuration software can be present as an application on the PC.

In a further embodiment of the invention, the standard control functions are implemented in a PC plug-in module and this PC plug-in module has an interface for connection to the safety controller. In this setup, the PC serves as the controller of the functional unit control (safety and standard control) and provides the infrastructure (power supply unit, operating and display function, etc.) required to operate this control. Here, too, the programming and configuration software can be available as an application on the PC. The control function itself, represented by the user program, runs independently of the PC and its operating system on the PC plug-in module, under the control of a runtime system and a separate real-time operating system.

A particularly variable architecture of the programmable controller with regard to the usable interfaces provides that the communication interfaces of the programmable controller are part of the PC plug-in module of the standard controller and / or designed as additional interface modules in the form of plug-in cards.

The control of system components or production equipment and machines is made possible by the fact that one or more decentralized digital and / or analog outputs can be controlled via an automation bus and / or a drive bus designed for drive communication within the programmable controller. In this case, both the data transfer from the controller to the connected system parts as well as the declining data transfer from the system components to the controller takes place via these interfaces, for example with information on process deviations from the predefined values.

If the programmable controller is connected via the automation bus and / or the drive bus to drives which can be controlled via the respective bus, a large number of commercially available drives can be connected to the programmable controller.

Simplified programming of the standard and safety functions can be achieved by providing a standard engineering and programming interface for programming standard functions and safety functions. The programmer thus finds a consistent unified user interface for the configuration and programming software for the standard as well as for the safety functions and does not have to combine different systems.

The aforementioned object is also achieved by a method for operating a programmable controller for machine and / or plant automation according to claim 10, wherein run in the process safety functions exclusively in security modules. This ensures that a clear separation of safety-related functions and standard functions is possible, which allows separate certification of the safety-relevant modules.

An extensive use of the infrastructure of the standard PC is made possible by a non-safety-related data transmission and a safety-related data transfer via the PC bus, the safety-related data transmission via secure data packets that are transported intact via the PC bus and by communication end users Integrity.

If the standard controller realizes a master function for data transmission via the PC bus when implementing the standard control functions in the PC CPU as well as in the form of a PC plug-in module, it can be achieved that the standard controller is the safety-relevant one as well as non-security-relevant data can be distributed to the respectively associated interfaces.

If the safety controller can access interfaces and / or the standard controller directly, safety-relevant processes can be triggered without the standard controller initiating a data transfer.

drawings

The invention will be explained in more detail below with reference to the exemplary embodiments illustrated in the figures. Show it:

1 a schematic representation of the basic system architecture,

2 a version with a security module on the PC-PCI bus,

3 a version with the safety module on the bus of a standard controller in the form of a PC plug-in module.

Description of the embodiments

1 shows an overview of the system architecture of a safety controller with a function module for safety functions. The programmable controller 1 consists of a personal computer (PC) 10 and with it via an automation bus 40 , a drive bus 50 and other non-secure communication links 60 connected external devices. The computer 10 is from a standard controller 20 and one via a PC bus 12 with its associated security control 30 built up. The standard controller 20 is about a programming 70 loaded with programs for the operating system, standard functions and also security functions. Over all system levels, a mixed operation of safe and non-safe control functions and components is provided.

The automation bus 40 connects the standard controller 20 with a decentralized standard input / output (I / O) 41 , a decentralized safety input / output (I / O) 42 and one or more drives 43 , each consisting of a drive controller 44 and an integrated security function 45 are constructed. This is ensured by the safety function 45 in the event of an error self-sufficient for achieving a safe state. The decentralized standard I / O 41 and the decentralized safety I / O 42 can process digital and analog signals. The data transfer between the safety controller 30 and the decentralized security I / O 42 is carried out via the transmission paths also used for non-secure communication, but is additionally secured by the error models known from the standards and the literature. For this purpose, methods such as the formation of checksums, numbering, time monitoring and redundancy can be used. With these methods, data packets are formed, which are transported untouched via the standard components and standard channels ("gray channels"). Hedging takes place only in the respective communication end users who check the data packets for safety integrity.

In the present embodiment are other drives 51 over the drive bus 50 with the standard controller 20 connected. Like the drives 43 assign drive controllers 52 and integrated security features 53 that provide self-sufficient for the achievement of a safe condition in case of error.

The non-secure functional units execute the standard functions. The safety-related functional units are designed so that the standard functions have no direct influence on the safety functions. The non-secure functional units are therefore not subject to safety-related restrictions. When developing hardware and software, therefore, no security-specific rules must be applied. In particular, changes in these functional units have no effect on the safety functions.

The safety-related functional units individually have the architecture and safety integrity normatively required for the desired safety category (Cat. 3 or Cat. 4 according to EN 954-1) or for the safety integrity level (SIL2 or SIL3 according to EN 61508). For this purpose, two-channel redundant design, cyclical diagnosis in operation with sufficient coverage and sufficiently low error and / or failure probability can be provided. These functional units are based on the lifecycle defined in EN 61508, from concept creation to decommissioning, and all necessary error-prevention measures are taken during development.

For programming 70 the programmable controller 1 An engineering suite can be provided which also includes the programming and parameterization of the safety-related functional units. The tools provided are certified according to the desired security categories or security integrity levels. The advantage here is that the user can use a consistent programming interface for standard and safety functions.

In 2 is a version of the PC 10 shown at the standard control 20 either as a PC CPU 11 or as a PC plug-in module 21 with an interface 22 on the PC bus 12 acts. The standard controller can be used when using the PC CPU 11 be executed as pure software. The safety controller 30 is in the form of one or more security modules 31 . 32 directly with the PC bus 12 connected. The PC bus 12 can be designed as a standard PCI bus. Interface Modules 23 be from the PC CPU 11 via the PC bus 12 charged with data and queried. In this version, the PC presents 10 the infrastructure consisting of power supply, operating and display function as well as interface modules 23 for both the standard controller 20 as well as for the safety control 30 to disposal.

In 3 an embodiment is shown in which, in addition to the in 2 displayed directly with the PC bus 12 connected security control 30 another security control 30 with a PC bus 13 the standard controller implemented as a function module 20 connected is. Also in this embodiment it is ensured that in the data transfer between the on the PC bus 13 arranged safety control 30 and the decentralized safety I / O not shown here 42 and / or the drives 43 . 51 the security of data transmission is maintained.

The master functionality for data transfer via the PC bus 12 is from the standard controller 20 perceived. It initiates and monitors the data transfer and distributes the data to the interfaces 23 , For data transfer via the PC bus 13 when the PC plug-in module 21 executed standard control 20 generally also takes over the standard control 20 the master functionality. However, it is also possible that on the PC bus 13 temporarily or permanently the safety control 30 gets assigned the master functionality and directly to the interfaces 23 and on the standard controller 20 can access. Furthermore, it is conceivable that in this embodiment, the safety controller 30 owns interfaces and can operate them without the PC bus 13 to use.

Claims (11)

Programmable controller ( 1 ) for machine and / or plant automation, with a standard controller ( 20 ) with standard control functions, and a safety controller ( 30 ) with safety functions, whereby the programmable controller ( 1 ) based on a personal computer (PC) ( 10 ), which is a PC-CPU ( 11 ) and a PC bus ( 12 ; 12 . 13 ), wherein the PC ( 10 ) is designed for operation with a standard operating system, and wherein the standard functions on the PC ( 10 ) or a PC plug-in module ( 21 ) for the standard control ( 20 ), whereby the safety controller ( 30 ) from one or more with the PC bus ( 12 . 13 ) security modules ( 31 . 32 ), the security modules ( 31 . 32 ) comprise safety certified hardware and / or firmware, and wherein the programmable controller ( 1 ) is configured such that a non-safety-related data transmission and a security-related data transmission via the PC bus ( 12 ; 12 . 13 ), whereby the safety-related data transmission between the safety controller ( 30 ) and a decentralized safety I / O ( 42 ) via secured data packets that are not touched via the PC bus ( 12 ; 12 . 13 ) and from the safety controller ( 30 ) and the decentralized safety I / O ( 42 ) are checked for integrity as communication end users, and where the standard controller ( 20 ) via an automation bus ( 40 ) with the decentralized safety I / O ( 42 ), the standard controller ( 20 ) via the PC bus ( 12 ; 12 . 13 ) with the safety controller ( 30 ), so that communication between the safety controller ( 30 ) and the decentralized safety I / O ( 42 ) via the PC bus ( 12 ; 12 . 13 ), the standard controller ( 20 ) and the automation bus ( 40 ) he follows. Programmable controller ( 1 ) according to claim 1, characterized in that the programmable controller ( 1 ) as a non-reactive combination of standard control functions and at least one safety module ( 31 . 32 ) is executed. Programmable controller ( 1 ) according to claim 1 or 2, characterized in that the at least one security module ( 31 . 32 ) as a PC plug-in module with at least one interface to a PC bus ( 12 . 13 ) is executed. Programmable controller ( 1 ) according to one of claims 1 to 3, characterized in that the standard control functions in one in the PC-CPU ( 11 ) are implemented under the control of the PC operating system software and that the security module ( 31 . 32 ) an interface to the PC bus ( 12 ; 12 . 13 ) having. Programmable controller ( 1 ) according to one of claims 1 to 3, characterized in that the standard control functions in a PC plug-in module ( 21 ) and that this PC plug-in module ( 21 ) an interface for connection to the safety controller ( 30 ) having. Programmable controller ( 1 ) according to one of claims 1 to 5, characterized in that communication interfaces ( 22 . 23 ) of the programmable controller ( 1 ) Part of the PC plug-in module ( 21 ) of the standard controller ( 20 ) and / or as additional interface modules ( 23 ) in the form of plug-in cards are executed. Programmable controller ( 1 ) according to one of claims 1 to 6, characterized in that one or more decentralized digital and / or analog outputs ( 41 . 42 ) via an automation bus ( 40 ) and / or a drive bus designed for drive communication ( 50 ) within the programmable controller ( 1 ) are controllable. Programmable controller ( 1 ) according to one of claims 1 to 8, characterized in that a uniform engineering and programming interface is provided for programming standard functions and safety functions. Method for operating a programmable controller ( 1 ) for machine and / or plant automation, whereby the programmable controller ( 1 ) a standard controller ( 20 ) with standard control functions and a safety controller ( 30 ) with security functions and based on a personal computer (PC) ( 10 ) with a PC-CPU ( 11 ) and a PC bus ( 12 ; 12 . 13 ), whereby the PC ( 10 ) is operated with a standard operating system and the standard control functions on the PC ( 10 ) or a plug-in module ( 21 ) for the PC ( 10 ), with security functions exclusively in security modules ( 31 . 32 ), whereby a non-safety-related data transmission and a safety-related data transmission via the PC bus ( 12 . 13 ), whereby the safety-related data transmission between the safety controller ( 30 ) and a decentralized safety I / O ( 42 ) via secured data packets that are not touched via the PC bus ( 12 ; 12 . 13 ) and from the safety controller ( 30 ) and the decentralized safety I / O ( 42 ) are checked for integrity as communication end users, where the standard controller ( 20 ) via an automation bus ( 40 ) with the decentralized safety I / O ( 42 ) and the standard controller ( 20 ) via the PC bus ( 12 ; 12 . 13 ) with the safety controller ( 30 ), so that communication between the safety controller ( 30 ) and the decentralized safety I / O ( 42 ) via the PC bus ( 12 ; 12 . 13 ), the standard controller ( 20 ) and the automation bus ( 40 ) he follows. A method according to claim 10, characterized in that in the realization of the standard control functions in the PC-CPU ( 11 ) as well as in the form of a PC plug-in module ( 21 ) the standard controller ( 20 ) a master function for a safety-related data transmission via the PC bus ( 12 ; 12 . 13 ) perceives. Method according to one of claims 10 or 11, characterized in that in the realization of the standard control functions in the form of the PC plug-in module ( 21 ) the security module ( 31 . 32 ) at least temporarily the master function for the safety-related data transmission via the PC bus ( 13 ) perceives.

Images