WO2017084653A1

WO2017084653A1 - Rfid system for controlling safety-relevant switching processes

Info

Publication number: WO2017084653A1
Application number: PCT/DE2016/100527
Authority: WO
Inventors: Rene Wermke; Olaf Wilmsmeier
Original assignee: Harting It Software Development Gmbh & Co. Kg
Priority date: 2015-11-19
Filing date: 2016-11-09
Publication date: 2017-05-26
Also published as: DE102015120056B4; DE102015120056A1

Abstract

The object of the invention is to specify an RFID system having a control unit (1) and an RFID reader (2) that uses the lowest possible hardware and certification complexity to allow safety-critical switching processes in accordance with the second-highest safety integrity level ("SIL") of the safety standard EN 61508, namely what is known as "SIL 3". This object is achieved by proposing a second communication path having a data line (4) and a test RFID transponder (5), the test RFID transponder (5) being arranged in the transmission/reception range of the RFID reader (1) for the purpose of communication therewith. Therefore, the RFID reader (1) needs neither itself to be SIL 3 certificated nor to be protected by means of a further RFID reader, since the second communication path is realised by means of the substantially cheaper test RFID transponder (5).

Description

RFID Svstem

for checking safety-relevant switching processes

description

The invention is based on an RFID system according to the preamble of independent claim 1.

Such RFID systems are required to control safety-relevant switching operations, in particular in connection with safety-relevant mechanical interlocks.

State of the art

In the prior art are safety-relevant switching operations and in particular associated safety relevant mechanical

Locks known. In particular, this problem with respect to door locks and the locking-relevant position of safety bars in particularly safety-critical areas is known, such as on gondolas or corresponding seats in the field of cable cars and / or ski lifts and the like.

Furthermore, it is known that, at least in Europe, according to the European safety standard EN 61508, originated from the international standard IEC 61508, such applications must comply with the second highest associated safety integrity level ("SIL"), namely the so-called "SIL 3". In any case, the relevant standard IEC 61508 applies internationally.

Depending on the design and application, to achieve this SIL 3 certification an appropriate control system for the transmission of safety-related data always requires a so-called "second communication path" and / or the use of SIL 3-certified devices.

Depending on its structure and application, this requires a correspondingly high level of hardware and certification effort from an associated control system.

task

The object of the invention is to specify an RFID system which monitors such safety-critical switching operations, in particular according to SIL 3, with as little hardware and certification effort as possible.

This object is achieved with an RFID system of the type mentioned by the features of the characterizing part of the independent claim 1.

The RFID system for checking safety-relevant switching operations comprises a control unit which is certified in accordance with a predetermined safety standard according to a predetermined safety integrity level ("SIL") and has a first data connection, the RFID system also having a data transmission to the control unit The RFID reader further has an antenna as the air interface with an associated transmission receiving area, wherein the RFID system further comprises a test RFID transponder with an associated antenna and wherein the control unit further comprises a second RFID reader Data terminal, via which it is capable of transmitting test data to a corresponding data port of the test RFID transponder by data transmission means, wherein the test RFID transponder is arranged with its antenna for communication with the RFID reader via the air interface in the SendeVEmpfangsbereich.

The indicator that "the RFID system furthermore has an RFID reader connected to this control unit for data transmission to the control unit" in this context means that the RFID reader can transmit data to the control unit the control unit and the RFID reader on the first data port to be possible, which has the advantage that the control unit specifically query the RFID reader and / or it for better data separation between the simultaneous signals of multiple RFID transponder at least parts of the test data The data exchange between the RFID reader and the control unit may preferably take place via a connecting line because this represents a particularly inexpensive and secure data connection. Bluetooth or the like.

Among other things, the invention serves to simulate the function of the sensor RFID transponder and the associated so-called "first communication path" by means of the test RFID transponder via a so-called "second communication path".

Advantageous embodiments of the invention are specified in the subclaims.

In particular, the predetermined safety standard according to which the control unit is certified can be distinguished by the fact that it prescribes a second communication path for protection for the said given security level for all security-relevant areas. In particular, the safety standard may be the European standard EN 61508. It may also be the international standard IEC 61508, from which the safety standard EN 61508 was created. The security integrity level may be the associated second highest security integrity level ("SIL") 3.

It is particularly advantageous that said RFID reader neither SIL 3 itself certified nor must be secured by a second RFID reader and that the entire RFID system can still be SIL 3 certified. The second communication path is finally realized on the much cheaper test RFID transponder.

It is particularly advantageous if the said data transmission means, which serve for transmitting test data from the control unit to the test RFID transponder, exist in a wired data line, because this increases the data security compared to a wireless data transmission and is also particularly inexpensive , In other words, it is particularly advantageous to carry out a transmission of test data from the control unit to the test RFID transponder in a wired fashion, because this ensures particularly good data security and furthermore the costs and outlay for wireless transmission be saved. In special applications but are also other data transmission methods, eg. B. wireless data transmission methods, such. B. Bluetooth, conceivable.

It is particularly advantageous that the entire RFID system in this way with a single and very simple and inexpensive constructed second communication path as redundancy,

wherein the second communication path requires as additional components only the test RFID transponder and a single, especially wired, data line. This is possible because the control unit, which is preferably a so-called programmable logic controller Control ("SPS") can act, in turn, already SIL 3 is certified, which in anyway due to their function, in particular the control of corresponding safety-critical applications such as cable cars or the like, is mandatory .. Thus, the to be integrated in such an application RFID -System its function on the test RFID transponder, ie via the second communication path, check in the form of a self-test and obtained in the first communication path, the actual useful signal, namely information about the safety-relevant switching process, from the sensor RFID transponder For example, the entire signal path from the sensor RFID transponder to the control unit can be protected by the second communication path, said second communication path, in simple words, controlling the signal flow in a complete loop, ie "everything", and thus also the complete first communication path which in this case runs from the sensor RFID transponder to the control unit. The entire path from the sensor RFID transponder via its antenna and the radio link, via the antenna of the RFID reader to the RFID reader and from the RFID reader, for example, via an additional network, is thus realized via this very simply constructed "second communication path" This solution is, as already mentioned, thus particularly inexpensive, compared to a double protection, in which in particular the RFID reader would have to be present twice to reach the SIL 3.

In an advantageous embodiment, the RFID system can have a sensor RFID transponder with an associated antenna for checking the switching state of an associated sensor switch. The sensor RFID transponder is characterized in that it has a sensor input via which in particular its activity status can be switched. The sensor switch is characterized in that it is connected to the sensor input of the sensor RFID transponder. In particular, In particular, the sensor switch can be a sensor which mechanically detects the locking status of the locking device and converts this mechanical to an electrical variable and forwards it to the sensor transponder.

In a preferred embodiment, the sensor switch may internally have a second communication path that may help to reach the SIL 3. For example, it can be designed such that it signals the locked and the unlocked state of the locking device at two different outputs. The sensor RFID transponder can accordingly have two sensor inputs, one of which is connected to one of the outputs of the sensor switch. Thus, each locking state can be signaled twice, not only by the presence of the one, but at the same time by the absence of the other signal, for. B. a switching voltage. If both signals are present at the same time or if there is no signal, this is a clear indication of an error.

The sensor RFID transponder is arranged with its antenna at least during its communication with the RFID reader via the air interface in the transmission / reception area. Advantageously, the distance between their antennas may be smaller than the distance between the antenna of the test RFID transponder and the antenna of the RFID reader. This is particularly advantageous because, by the correct reception of the test data, the transmission of the switching signal can be regarded as safe even against possible interference of the wireless RFID communication.

Furthermore, the RFID system may include a test switch capable of activating or deactivating the test RFID transponder. The test switch can, for. B. externally, ie outside the control unit, be arranged in the data line between the control unit and the test RFID transponder. For example, it can be opened or closed by the control unit via a particular separate first control line. However, in another preferred embodiment, the test switch can be part of the control unit and switch from there the data stream of the control unit to the test RFID transponder.

In each of the two cases, it is particularly advantageous that the test switch in the off, d. H. opened state, the test data stream interrupts, because thereby a faulty function information for the control unit is almost impossible. Finally, the SIL 3 certified control unit compares the test data it sends through its second data port with the data it receives via its first data port, and only consults from a secure data connection. In this case, the test data may in particular include a globally unique code in order to identify the signal of the test RFID transponder in particular one-to-one and thus to produce a particularly high level of security. Preferably, these test data can also be regenerated for each data transfer, possibly also on the basis of predetermined data, eg. B. by a redundant mathematical modification, for example, the multiplication with a random number, which is known only to the control unit.

In a further preferred embodiment, the RFID system has an additional sensor for detecting the arrival of a means of transport. This additional sensor can in particular be connected to the control unit via a second control line.

The sensor RFID transponder and the associated sensor switch can be arranged on the transport. The means of transport, which may be, for example, a cabin, a gondola, an armchair, etc., ie a means of transport for a cableway, a ski lift, a chairlift or the like provided for the transport of persons, comprise a safety-critical according to SIL 3 Locking device whose locking state is controlled by the sensor switch, so for example mechanically coupled thereto. In particular, this locking device may belong to a bracket or a door or any comparable lockable device, which prevents in the locked state, for example, that people fall from the moving means of transport.

Furthermore, the means of transport may also be provided for transporting material, as long as its locking is regarded as safety-critical in terms of SIL 3 certification. Accordingly, it may also be a material basket, a bucket, a lore, a Hunte, etc. act.

embodiment

An embodiment of the invention is illustrated in the drawings and will be explained in more detail below. Show it:

1 a, b show a basic structure of an RFID system without and with a sensor RFID transponder;

2a, b the RFID system with associated sensor and test switches;

3a, b the RFID system with an integrated test switch;

4a shows the RFID system with an additional sensor;

4b, the RFID system with the additional sensor its associated means of transport;

Fig. 5 shows a sensor switch with two communication paths.

The figures contain partially simplified, schematic representations. In part, identical reference numerals are used for the same but possibly not identical elements. Different views of the same elements could be scaled differently.

1 a and 1 b show a basic structure of an RFID system according to the invention. The basis is a basic system 3, comprising an RFID reader 1 with an associated antenna 11 as an air interface and at least one data interface 12. Furthermore, the base system 3 comprises a control unit 2, which is in particular a so-called programmable logic controller ("PLC"). The control unit 2 is certified according to SIL 3.

The control unit 2 has a first data connection 21, via which it receives at least data from the RFID reader 1 via its data interface 12. In particular, the control unit 2 with the RFID reader 1 can also be in bidirectional data exchange. In the present embodiment, the data transmission takes place via a common connection line 41. It could in principle but also other transmission methods, eg. B. wireless transmission method, such. As Bluetooth and the like, apply.

Furthermore, the control unit 2 has a second data connection 22 with which it is connected via a data line 4 to a data input 52 of a test RFID transponder 5. The test RFID transponder 5 has an antenna 51 with which it is located in a transmitting receiving area of the RFID reader 1 in order to communicate with this RFID reader 1 via its air interface, ie via its antenna 11, as in FIG a provides, communicate. Here, too, the use of the data line is particularly cost-effective and safe and therefore particularly advantageous. However, it could be in other versions but for other transmission methods, eg. B. wireless transmission method, such. As Bluetooth and the like, apply.

Thus, the base system 3 is able to perform a self-test via its second communication lane II as follows: The control unit 2 sends test data, in particular a special code, via the data line 4 to the test RFID transponder 5. The test RFID Transponder 5 sends this test data with its antenna 51 directly or in processed form via the air interface to the RFID reader 1, via which they finally get back to the SIL 3 certified control unit 2, so that the control unit 2 sent them with the original of her Can match test data. Thus, a so-called "second communication path" II is guaranteed as a redundant signal path through this closed signal path.

A so-called "first communication path" I is shown in FIGURE 1b. To the test RFID transponder 5, a sensor RFID transponder 6 has been added within the transmission reception area of the RFID reader 1, which via its antenna 61 with the RFID reader 1 communicates via its antenna 1 1. The data transmitted thereby are security-relevant useful data and are forwarded to the control unit 2 for further processing via the data interface 12 of the reader 1.

The structure shown in FIGS. 2a and 2b differs from the preceding illustrations in that the test RFID transponder 5 is switched via a test switch S1 and the sensor RFID transponder via a sensor switch S2. In the example shown, the test switch S1 is located in the data line 4 which, via this test switch S1, is connected to a data input 52 of the test device. RFID transponder 5 is connected and thus switches its activity state. Alternatively, however, it could also be connected to a possibly existing separate sensor input of the test RFID transponder 5 in order to activate or deactivate this test RFID transponder 5.

The sensor switch S2 is connected to the sensor RFID transponder 6. In particular, the sensor switch S2 is connected to a sensor input 62 of the sensor RFID transponder 6 in order to switch over the activity state of the sensor RFID transponder 6, ie. H. to activate or deactivate the sensor RFID transponder 6.

The switch positions are chosen in this example so that only one of the two RFID transponders 5, 6 is active. Although this would not be necessary for the function of the RFID system, if the RFID reader 1 includes, for example, collision protection, it simplifies the corresponding method and the representation. By a short-term switching of the two switches S1, S2 can be ensured in this way a security SIL 3. The measurement period can be adapted to the requirement. For example, between the successive data transmissions of a plurality of different sensor RFID transponders 6 to the RFID reader 1, a test can take place via the test RFID transponder 5. It can also be carried out in the entire period between the data transmissions of the sensor RFID transponder 6 to the RFID reader 1 with an even higher frequency, for example, every second, such a test measurement. However, in contrast, if desired according to the particular application, such a test may take place only once a day.

Alternatively, using the collision protection but also both communication paths I, II could be operated simultaneously. Then in particular, the RFID reader should also be able to perform a corresponding data separation between the signals of the test RFID transponder 5 and the sensor RFID transponder, for example, with knowledge of the test data or at least relevant parts thereof, which the RFID reader 1, for example can be transmitted from the control unit 2. For safety reasons, the control unit 2 can still retain some of the test data in order to rule out a possible error by the uncertified RFID reader 1.

The test switch S1 is arranged in the second communication path II, namely in the data line 4. When this test switch S2 is closed, the corresponding data input 52 of the test RFID transponder 5 receives the said data from the control unit 1. In the present case, the test switch S1 is controlled by the control unit 2 via a control line C1, ie closed or opened. If the test switch S1 is closed, as shown in FIG. 2a, the test RFID transponder 5 can receive the test data from the control unit 2 and this test data via its antenna 51 and via the air interface 11 transmitted to the RFID reader 1.

If, as shown in FIG. 2b, the test switch S1 is opened, the test RFID transponder 5 does not transmit any data to the RFID reader 1. At the same time, however, the sensor switch S2 is closed and the sensor RFID transponder 6 sends data to the RFID reader 1 via the air interface.

FIGS. 3a and 3b differ from FIGS. 2a and 2b only in that the test switch S1 is part of the control unit 2 and thus the first control line C1 is saved.

Fig. 4a also shows an additional sensor 8, which is provided to the control unit 2, the arrival or the presence of a Transport means 7, for example a cabin, a gondola, a chair, a basket of material, a bucket, a lore, a Hunte, etc., ie a driving means of a cable car, a ski lift, a chairlift or the like to signal. The additional sensor 8 is connected to the control unit 2 via a control line C2. Thus, in particular, the switch position of the test switch S1 can be made dependent on the presence of the transport means 7. In particular, the test switch S1 can always be closed when no means of transport 7 is currently detected by the additional sensor 8. Thus, it can be ensured that only one RFID transponder, ie either the test RFID transponder 5 or the sensor RFID transponder 6, communicates with the RFID reader 1 at a time.

Furthermore, the transport means 7 has a locking device 9, which is shown in FIG. 4b in the form of a lock symbol and is coupled, in particular mechanically, to the sensor switch S2. For example, the sensor switch S2 can always be closed when the locking device 9 is closed. The sensor switch S2 may be a sensor which mechanically detects the locking of the locking device 9 and converts it into an electrical quantity. The sensor switch S2 activates the RFID transponder 6, which communicates with the RFID reader 1 accordingly and the control unit 2 about the switch position and thus the locking state of the locking device 9 with very high security, according to the SIL 3, notifies.

Fig. 5 shows a sensor switch S2 ^' having an internal second communication path. Thus, it can signal at two different outputs A1 and A2 respectively the locked and the unlocked state of the locking device by depending on the switch position, for example, a switching voltage Us to the first output A1 or to the second output A2 is transferable. The sensor RFID transponder can accordingly have two separate sensor inputs 621, 622, one of which is connected to one of the outputs A1, A2 of the sensor switch S2 ^' . Thus, each locking state can be signaled twice, not only by the presence of the one, but at the same time by the absence of the other signal. If both signals are present at the same time or there is no signal at all, this is a clear indication of an error.

LIST OF REFERENCE NUMBERS

1 RFID reader

1 1 Antenna of the RFID reader

12 Data interface of the RFID reader

2 control unit

21 first data port of the control unit

22 second data port of the control unit

3 base station

4 data line for test data

41 connection line

5 test RFID transponders

51 Antenna of the test RFID transponder

52 Data input of the test RFID transponder

6,6 ^' sensor RFID transponder

61 Antenna of the sensor RFID transponder

62 Sensor input of the sensor RFID transponder 621, 622 Separate sensor inputs of the sensor RFID transponder

7 means of transport

8 additional sensors

9 locking device

S1 test switch

S2, S2 ^' sensor switch

A1, A2 separate outputs of the sensor switch

C1, C2 first, second control line

Us switching voltage

I, II first, second communication path

Claims

claims

1 . RFID system for checking safety-related switching processes, comprising a control unit (2) which is certified according to a predetermined safety standard according to a predetermined safety integrity level ("SIL") and has a first data connection (21), the RFID system also having a for data transmission to the control unit (2) having this first data port (21) connected RFID reader (1), wherein the RFID reader (1) further comprises an antenna (1 1) as an air interface with an associated transmission / reception area, characterized in that the RFID system further comprises a test RFID transponder (5) with an associated antenna (51) and in that the control unit (2) further comprises a second data port (22) through which it is transmitted by data transfer means (4). is capable of transmitting test data to a corresponding data port (22) of the test RFID transponder (5), the test RFID transpo Nder (5) with its antenna (51) for communication with the RFID reader (1) via the air interface in the transmission / reception area is arranged.

2. RFID system according to claim 1, characterized in that the predetermined safety standard, according to which the control unit (2) is certified, is characterized in that it provides for said predetermined security integrity level, a second communication path (II) for hedging.

3. RFID system according to one of the preceding claims, characterized in that the safety standard is the standard EN 61508 and / or the standard IEC 61508 and the safety integrity level is the associated second highest safety integrity level SIL 3.

4. RFID system according to one of the preceding claims,

characterized in that the data transmission means in a data line (4) consist, via which the second data connection (22) of the control unit (2) for line-bound data transmission to the corresponding data port (52) of the test RFID transponder (5) is connected ,

5. RFID system according to one of the preceding claims,

characterized in that the RFID system further comprises a sensor switch (S2) and a sensor RFID transponder (6) with an associated antenna (61) for checking the switching state of the sensor switch (S2), wherein the sensor RFID transponder (6) is arranged at least during its communication with the RFID reader (1) via the air interface in its transmission / reception area.

6. RFID system according to claim 5, characterized in that at least during the communication of the sensor RFID transponder (6) with the RFID reader (1), the distance between the antennas (61, 1 1) is smaller than the distance between the antenna (51) of the test RFID transponder (5) and the antenna (1 1) of the RFID reader (1).

7. RFID system according to one of the preceding claims,

characterized in that the RFID system comprises a test switch (S1) capable of carrying out the test RFID Transponder (5) to activate or deactivate.

8. RFID system according to claim 5, characterized in that the sensor switch (S2) internally has a second communication path (II).

9. RFID system according to claim 7, characterized in that the test switch (S1) is part of the control unit (2).

10. RFID system according to one of the preceding claims,

characterized in that the RFID system comprises an additional sensor (8) for detecting the arrival of a means of transport (7).

1 1. RFID system according to claim 9, characterized in that the sensor RFID transponder (6) and the associated sensor switch (S2) on the transport means (7) are arranged.

12. RFID system according to claim 1 1, characterized in that the transport means (7) according to the SIL 3 safety-critical locking device (9) whose locking state is controlled by the sensor switch (S2).

13. RFID system according to one of the preceding claims,

characterized in that the SIL-3 certified control unit (2) is a programmable logic controller ("PLC").