FR2771877A1 - HIGH SECURITY AND AVAILABILITY FIELD NETWORK - Google Patents

Abstract

The invention concerns a ground network with high security and availability consisting of ring looping in the exposed zones of the whole network using a cable (1) for routing information and a cable (2) providing electric power supply to the instruments (An), said two cables capable of constituting a single one and being combined with hardware devices (3, 8) for isolating the fault, and software devices for detecting the faults, locating them and substitution measurements ensuring the continuity of the installation operation. The invention is particularly designed for automation, monitoring industrial processes, and for all installations where data security and availability is an essential requirement.

Description

 The present invention relates to a high security and availability field network relating in particular to automation, to the monitoring of industrial processes, and to any installation where data security and the availability of the installation are necessary.

 These operations use numerous instruments, sensors, actuators, horns, various automata, etc., linked together by cable networks.

 In traditional systems, the information is gathered on centralized stations in charge of monitoring and associated actions, each local device or instrument being generally connected by its own cable, or set of cables, to these centralized stations.

 Field networks are gradually replacing this centralized organization by outsourcing the processing of information over the entire route of a bus traveling the site.

 These new structures bring savings in cabling, a single cable replacing several tens, even hundreds of individual cables.

 In addition, the information is systematically digitized and available throughout the site, usable by several instruments simultaneously. The installation is thus much less dependent on a central system, which contributes to its operational reliability and its availability.

 Field networks already strongly established in the manufacturing industry are gradually gaining ground in the continuous process sector.

 However, the fields of security, fire risks and gas detection are extremely sensitive to the robustness and permanent availability of detection and alert devices. There is therefore some reluctance to entrust to a single cable all the devices contributing to the security of goods and people.

 Instruments dedicated to the detection of danger are potentially subject to risks of degradation generated by their environment, mechanical shock, chemical attack, fire or explosion for example. In these critical situations, their operation is particularly important. Without further precautions, the destruction of a cable by a fire located in an area, for example, would prevent the routing of the fire alarm for which the network was set up. This destruction would make ineffective the detection of other areas not yet subject to the phenomenon and served by the same cable.

 Different field networks "known to date have given rise to variants in so-called high security installations, and allow the implementation of two redundant cables. In the event of a fault on a communication channel, the information passes through the parallel channel. This device improves the availability of equipment in the event of an instrument failure and does not completely solve the problem of aggression on the cable itself since doubled cables generally use the same route.

 The system according to the present invention aims to remedy this state of affairs. It makes it possible to permanently ensure the flow of information by different channels. Thus, on local deterioration or destruction of the information medium, the information will use the other route, the alert will be transmitted and the fault located for maintenance intervention.

 It is characterized by ringing the entire network in areas exposed to aggressive environments, by means of a cable carrying information and a cable ensuring the electrical supply of the instruments, these two cables being able to constitute only one and being associated with hardware devices which ensure the isolation and non-propagation of the fault, and with software devices taking charge of the detection of faults, their location, and the substitution measures ensuring the sustainability of the operation of the facility pending curative intervention.

In the appended schematic drawings, given by way of nonlimiting examples of embodiments of the subject of the invention:
FIG. 1 represents a network in normal operation, showing the routing of the information transmitted by a station connected to the loop cable,
FIG. 2 is an enlargement of detail D of FIG. 1 showing the connection element ensuring the routing of information,
FIGS. 3 and 4 respectively represent a network comprising a defect in the cable or the part of the cable transmitting the information, and a network comprising a defect in the cable or the part of the cable ensuring the electrical supply of the connected stations,
FIG. 5 illustrates a variant of a network comprising a single source of electrical power
and FIG. 6 represents a second variant in which several power sources each supply a cluster of instruments.

 The device, FIGS. 1 to 6, is formed by a double loop network, a transmission loop 1 and a power supply loop 2 to which the devices exchanging information on the network, or "subscribers" Ai, A2, are connected. ..Year....

 The hardware and software devices implemented in the context of the invention take into account the possible rupture of these conductors, their short-circuiting and any intermediate condition leading to deterioration of performance, leakage between conductors or increase in resistance. series.

 For the transmission of information, which is fully digital, each network subscriber is connected to the cable transmission loop 1 through coupling elements 3 ensuring galvanic isolation from the two branches of the network. These elements include pulse transformers 4 and electronic signal shaping devices, so that a short circuit or an open circuit on one of the branches is not passed on to the other branch.

In normal operation, each subscriber Al, ..,
Az receives information which it repeats to the next subscriber, and which it may use if it is the recipient. The next in the chain repeats the message and gradually transmits the information to the recipients. When a subscriber sends a message himself, on his own initiative, or in response to a request from another subscriber, he does so simultaneously on the two branches of the network (Figure 1).

 Certain messages may require an acknowledgment of receipt, which will, if necessary, be transmitted identically.

 A particular subscriber, "central" C, supervises the network. This central unit also has dual access to the network and "closes" the ring in software. In normal operation, all the messages which pass through the network are doubled and received on the two branches; the control panel checks for the presence of each message and its duplicate, checks that the two messages are replicas of each other, and interrupts the routing. In the same way, it exploits the information which concerns it and emits its own messages simultaneously on the two branches of the network.

 In the event of a break in continuity on either branch, the central office receives only one message for each transaction, originating from a single branch. It then transmits messages and acknowledgments to the other branch (arrow 5).

At the same time, it undertakes the localization of the fault and reports it to the supervision system (Figure 3).

 The application continues to operate normally, only a fault message is generated locally by the central unit intended for maintenance services. After repairing the network, the information resumes normal routing.

With regard to the electrical energy conveyed by the network, all "subscribers" can be supplied by two connections 6, 7 connected to the supply chain 2. In faultless operation, two electrical supplies El, E2 distributed along the network provide energy by two different paths (Figures 1, 3 and 4). Each subscriber is equipped with means, such as a relay or contactor 8, allowing the circuit to be opened. In the event of an abnormal discontinuity or overload due, for example, to a short-circuit in the supply loop 2, the subscriber detects the fault using test means provided for this purpose, opens the supply network to avoid the spread of the incident and pass on the corresponding information to the control panel
C and beyond, maintenance services. Power continues to be supplied from the healthy branch of the cable (Figure 4).

 If the power supply fails and several "subscribers" disconnected, the central unit selectively re-energizes the subscribers until the faulty section is isolated. In the same way, it locates and signals the fault to the supervision system.

 According to a first alternative embodiment, usable for networks of limited importance, the power supply loop 2 has only one power source E (Figure 5).

 According to a second alternative embodiment, the supply loop 2 is in fact made up of a chain comprising several sources El, E2, ... In, each supplying a cluster of subscribers Al, ..... .An (Figure 6).

 This variant makes it possible to have separate power sources in order to ensure the operation of all the other clusters when one of these power sources is faulty. These can be located on site or in a safe area such as a technical room.

 It is thus possible to size and distribute the power supply units according to the powers consumed by each sensor and according to the lengths of cable (line voltage drop).

 Each cluster can be wired, looped or not, the possible looping being carried out for example by means of junction boxes 9 allowing two clusters to be connected (FIG. 6).

 For the 4 variants, the power supply and data transmission circuits are either in the same cable, or in two separate cables, depending on the line losses and the powers consumed.

 The possibility of interrupting the supply loop 2 is used to electrically isolate a subscriber from the network on demand. The central or network maintenance terminal issues an order to open the supply circuit to the two subscribers immediately upstream and downstream of the station to be isolated. The two supply connections 6, 7 are then interrupted.

 This device is particularly advantageous for interventions in areas at risk of explosion, on explosion-proof equipment which cannot be opened under voltage. Selective power-off allows safe intervention without general interruption of the power supply.

 The positioning of the various constituent elements gives the object of the invention a maximum of useful effects which had not, to date, been obtained by similar devices.

Claims (6)

 10. High security field network, generally applicable to the automation and monitoring of industrial processes, capable of transmitting, over a whole site, digital information usable by several instruments simultaneously,  characterized by a ring loop of the entire network, consisting of a transmission loop (1) conveying the digitized information and a supply loop (2) connected to one or more sources of electrical energy ( El, E2, ... .En) distributed along the network, each device, or "subscriber" (Al, A2, .. An ....), exchanging information on the network being connected, on the one hand, to the transmission loop (1) through coupling elements (3) ensuring galvanic isolation from the two branches of the network and, on the other hand, to the supply loop (2) by l 'intermediate of two connections (6, 7) which can be isolated from each other by means, such as a relay or contactor (8), allowing the opening of the circuit, a particular subscriber, "the central" ( C), also having dual access to the network and closing the ring in software, ensuring the supervision of said network, the assembly being associated with hardware devices ensuring the isolation and non-propagation of faults, and software devices taking charge of the detection of these faults, their location, and replacement measures ensuring the sustainability of the operation of the installation.  2 ". Device according to claim 1, characterized in that the digital information transmitted to the network by a subscriber (Ax), on his initiative or in response to a request from another subscriber, are transmitted simultaneously on both branches of said network.  30. Device according to any one of the preceding claims, characterized in that the transmission loop (1) conveying the digitized information and the electrical supply loop (2) consist of a single cable.  40. Device according to any one of the preceding claims, characterized in that the transmission loop (1) conveying the digitized information and the electrical supply loop (2) consist of two separate cables.  50. Device according to any one of the preceding claims, characterized in that the coupling elements (3) include pulse transformers (4) and electronic devices for shaping the signals, so that '' a short circuit or an open circuit on one of the branches of the network is not passed on to the other branch.  60. Device according to any one of the preceding claims, characterized in that the central unit (C) is arranged to interrupt, in normal operation, the routing of the two digitized messages sent by a subscriber (Ax) on the two branches of the network after having verified that they are indeed a replica of each other and, on the contrary, ensuring the transmission to the other branch of information when it receives only one message for each transaction, in from a single branch.  70. Device according to any one of the preceding claims, characterized in that each "subscriber" (Ax) is provided with test devices making it possible to detect a discontinuity or an abnormal overload due, for example, to a short circuit of the electrical supply loop (2), said subscriber being furthermore equipped with means enabling it to cause the opening of the supply network between the two connections (6, 7) and to transmit the corresponding information to the central (C) and beyond, maintenance services.  80. Device according to any one of the preceding claims, characterized in that the central unit "C" is equipped with hardware and software means capable of interrupting the supply loop (2) to electrically isolate a subscriber on demand ( Ax) or a defective section of said supply loop.  9 Device according to claim 8, characterized in that the central "C" is provided with devices capable of locating a failure of the supply loop (2) by proceeding to the selective re-energization of the subscribers (Ax) up to to isolate the faulty section.  100. Device according to any one of the preceding claims, characterized in that the supply loop (2) is connected to a single source of electrical energy (E).  110. Device according to any one of claims 1 to 9, characterized in that the supply loop (2) consists of a chain comprising several sources of electrical energy (El, E2, ... ) each feeding a cluster of subscribers "(Al, A2, ... Year).