WO2019006546A1

WO2019006546A1 - Valve bank communication module with safety i/o

Info

Publication number: WO2019006546A1
Application number: PCT/CA2018/050811
Authority: WO
Inventors: César Armando Prieto SILLER
Original assignee: Magna International Inc
Current assignee: Magna International Inc
Priority date: 2017-07-02
Filing date: 2018-06-29
Publication date: 2019-01-10
Anticipated expiration: 2020-01-02

Abstract

A communication module and associated method of operation for controlling a valve bank including at least one fluid valve is provided. The communication module includes a module body mechanically and electrically coupled to the fluid valves and includes a safety processor which is responsive to a CIP safety control signal from a safety controller. The communication module also includes a safety power controller that is operable to remove safety output power from the fluid valves connected thereto in order to satisfy a given functional safety standard for machinery such as PLe or SIL4. The communication module may also include a safety relay with redundant and self-monitoring contacts to further its ability to reliably remove the safety output power from the fluid valves, particularly in the presence of a malfunction with the safety power controller.

Description

VALVE BANK COMMUNICATION MODULE WITH SAFETY I/O

CROSS REFERENCE TO RELATED APPLICATION

[0001] This PCT International Patent Application claims the benefit of U.S. Provisional

Patent Application Serial No. 62/528, 110 filed July 2, 2017 entitled "Valve Bank

Communication Module with Safety I/O," the entire disclosure of the application being considered part of the disclosure of this application and hereby incorporated by reference.

BACKGROUND

[0002] Different arrangements exist for controlling valve banks of one or more pneumatic valves such as those used for industrial automation equipment. One type of arrangement includes a communication module to switch an output power and to direct the pneumatic valves to go to a specified fluid flow configuration in response to a control signal that is communicated via a communications channel. A safety output power is a source of energy that can be reliably removed in order to cause devices such as pneumatic valves to go to a known or "safe" state.

[0003] An objective of the present disclosure is to provide a communication module and an associated method of operation for controlling a safety output power to at least one fluid valve as part of a control system that exceeds the functional safety standard for machinery as set forth in the Safety Integrity Level (SIL) as defined in the International Electrotechnical Commission's (IEC) 61508 standard and/or a Performance Level (PL) safety level as defined by the International Organization for Standardization in ISO 13849-1. In particular, it is an objective to provide a communication module that can provide a given functional safety standard for machinery up to Performance Level "e" (PLe) and/or Safety Integration Level 4 (SIL4), which each define the highest risk reduction factor (RRF) within the respective functional safety standard and to do so without the need for additional safety I/O devices or an additional safety relay.

SUMMARY

[0004] A communication module for controlling a valve bank including at least one fluid valve is provided. The communication module may include a module body configured to mechanically and electrically couple to the fluid valve or valves and a first communications channel for receiving a first control signal from a safety controller. The communications module may also include an electrical interface for controlling the fluid valves. The communication module provides a second control signal to the fluid valve to change a fluid flow characteristic of the fluid valve based upon the first control signal. A safety power controller within the module body provides a safety output power to the fluid valve. The communication module also includes a safety processor that receives and verifies the integrity of a safety input/output data within the first control signal and which removes the safety output power from the fluid valves in the case of an error in the safety input/output data or in response to a power-off command from the safety controller.

[0005] A method for controlling a safety output power to a fluid valve by a

communication module is also provided and which includes the steps of receiving by the communication module electrical energy from a power supply; receiving by the communication module a first control signal from a safety controller via a first communications channel;

receiving and verifying the integrity of a safety input/output data within the first control signal by the safety processor of the communication module; and removing by the safety power controller the safety output power to the fluid valve or valves in response to an error in the safety input/output data or in response to a power-off command from the safety controller.

[0006] The device and method of the present disclosure may provide several advantages over the prior art including reductions in cost and complexity of a control system that includes fewer safety rated devices, and space savings within control panels and in the physical layout of an automation cell on a factory floor. It may also provide for reduction in the amount of networking cabling required which may reduce cost and increase system reliability. Furthermore, the device and method of the present disclosure may provide for a reduced number of I/O and/or memory requirements within the safety PLC and may simplify the programming of the safety PLC and may also reduce engineering and design time and associated costs.

DESCRIPTION OF THE DRAWINGS

[0007] The detailed description refers to the following drawings, in which like numerals refer to like items, and in which:

[0008] FIG. 1 is a schematic diagram of a system in accordance with the prior art;

[0009] FIG. 2 is a block diagram of a system in accordance with the prior art;

[0010] FIG. 3 is a schematic diagram of a system in accordance with the present disclosure;

[0011] FIG. 4 is a block diagram of a system in accordance with the present disclosure; and

[0012] FIG. 5 is a flow chart of a method in accordance with the present disclosure. DETAILED DESCRIPTION OF THE EXAMPLE EMBODIMENTS

[0013] The invention is described more fully hereinafter with references to the accompanying drawings, in which exemplary embodiments of the invention are shown. This invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these exemplary embodiments are provided so that this disclosure is thorough, and will fully convey the scope of the invention to those skilled in the art. It will be understood that for the purposes of this disclosure, "at least one of each" will be interpreted to mean any combination the enumerated elements following the respective language, including combination of multiples of the enumerated elements. For example, "at least one of X, Y, and Z" will be construed to mean X only, Y only, Z only, or any combination of two or more items X, Y, and Z (e.g., XYZ, XZ, YZ, X). Throughout the drawings and the detailed description, unless otherwise described, the same drawing reference numerals are understood to refer to the same elements, features, and structures. The relative size and depiction of these elements may be exaggerated for clarity, illustration, and convenience. Unless otherwise stated, any reference to moving between two or more different positions should be construed as including moving in either direction from one position to another position or vice-versa.

[0014] Referring to the Figures, wherein like numerals indicate corresponding parts throughout the several views, a communication module 20 for controlling a valve bank 22 including at least one fluid valve 24 is disclosed. The fluid valves 24, which may also be called electrovalves, may each be fluidly connected to a mechanical actuator 26, such as those used on industrial machinery, using one or more fluid conduits 28. [0015] As shown in FIGS. 1-2, a communication module 20 is provided for controlling at least one fluid valve 24 within a valve bank 22. The communication module 20 includes a module body 30 with a standard, or non-safety processor 32 and is configured to mechanically and electrically couple to the fluid valves 24 in order to control the flow of a fluid through the fluid valves 24. The standard processor 32 of the communication module 20 is configured to cause a corresponding one of the fluid valves 24 to change its fluid characteristics (i.e. to allow or to disallow fluid communication between two fluid ports) based upon a standard control signal, such as a standard (non-safety) CIP signal, that is communicated via a first

communications channel 34 from a safety controller 36, which may be, for example, a Safety Programmable Logic Controller (PLC) such as a GuardLogix processor by Allen Bradley and which may be installed in a PLC chassis 38. The safety controller 36 may be located within a first electrical panel 40, which may also be called a PLC panel. The communication module 20 may be, for example, an EX600-SEN1 Ethernet/IP module by SMC and may provide Common Industrial Protocol (CIP) connectivity over Ethernet. Industrial Protocol Ethernet (Ethernet/IP) and CIP are both technologies managed by ODVA, Inc. (formerly Open DeviceNet Vendors Association, Inc.) for communications between industrial automation devices.

[0016] As shown in Fig. 1, a second electrical panel 42 may be configured to provide the valve bank 22 with safety output power 43 in order to satisfy a given functional safety standard for machinery. The safety output power 43 may be supplied to the valve bank 22 by an electrical power cable 44 connected between the second electrical panel 42 and the communication module 20. The second electrical panel 42 may include a power supply 46, which may supply the communications module with a low voltage DC power, such as 5-50 VDC. In one example embodiment, the power supply 46 provides the valve bank 22 with 24 VDC. The second electrical panel 42 may also include one or more overcurrent protection devices 48 such as fuses or circuit breakers to prevent an electrical current produced from exceeding a predetermined value. The first and second electrical panels 40, 42 may be physically combined together into one combined electrical panel 40, 42. The second electrical panel 42 may further include a safety processor 50, which may include, for instance, a safety Point I/O module such as a 1734-OB8S safety output module from Allen Bradley and one or more safety relays 52 each having redundant and self-monitoring contacts for reliably controlling the supply of the safety output power 43 to the valve bank 22 in order to satisfy the requirements of the given functional safety standard. An example of such a safety relay 52 is catalog number 700-Z by Allen Bradley. The safety processor 50 may be responsive to a power-off control signal from the safety controller 36 as communicated by a second communications channel 54 therebetween, which may be designated as a safety communications channel. The safety processor 50 may also monitor the integrity of the second communications channel in order to ensure that vital signals such as the power-off control signal are received and may function to remove the safety output power 43 in case a malfunction in the second communications channel 54 or with the safety controller 36 is detected. Such action by a safety processor 50 may be required in order to satisfy a given functional safety standard for machinery. Other alternative configurations may be used for the second communications channel 54 which are designed and/or certified to verify the integrity of I/O data to satisfy a given functional safety standard for machinery, such as, for example, Safety variations of Device ET, Profibus or Profinet.

[0017] The communication module 20 includes an electrical interface 56 for controlling the fluid valves 24. As shown in FIGS. 1-4, the valve bank 22 may be directly mechanically coupled to the communication module 20, which may directly replace an existing (non-safety) communication module 20 of the prior art. The communication module 20 provides a second control signal to the fluid valve 24, which may be communicated, for instance, across a direct mechanical coupling or through a backplane and/or a chassis in order to change a fluid flow characteristic of the fluid valve 24 based upon the first control signal. The second control signal may use, for example, DeviceNet, a serial protocol such as RS-485 and/or a POINTBus protocol by Allen Bradley. In the example shown in FIGS. 1-4, a plurality of different fluid valves 24 are mechanically coupled to one-another in a stacked configuration, which is mechanically and electrically coupled to the communication module 20. Alternatively, the fluid valves 22 may be provided as modules that individually couple to a backplane or chassis that provides the electrical and mechanical connection to the communication module 20. One or more of the fluid valves 24 may also be provided with a source of pressurized fluid from the backplane or chassis or from one or more adjacent ones of the fluid valves 24 in the valve stack 22. As shown in FIGS. 1 and 3, the fluid valves 24 may control, hydraulic or pneumatic (e.g. compressed air) flow to a mechanical actuator 26 such as in an industrial machine.

[0018] In accordance with the present invention and as shown in FIGS. 3-4, a communication module 20 for controlling a valve bank 22 including at least one fluid valve 24 includes a module body 30 configured to mechanically and electrically couple to the fluid valve or valves 24 and which also includes a safety processor 50 is provided. The communication module 20 may be configured to receive a first control signal, which may be for example, a CIP safety signal or an ASIsafe signal or a Profisafe signal via a first communications channel 34 from a safety controller 36, which may be, for example, a safety PLC such as a GuardLogix processor by Allen Bradley. The first communications channel 34 may transmit the first control signal using one or more physical networks, which may use, for example, EtherNet/IP and/or DeviceNet protocols. Other networking hardware and/or protocols may be used for the first communications channel 34 which are designed and/or certified to verify the integrity of I/O data to satisfy a given functional safety standard for machinery, such as, for example, Safety variations of ControlNet, EtherCat, Profibus, Profinet, or AS-Interface (AS-i).

[0019] As also shown in FIGS. 3-4, the power supply 46 directly provides electrical power, such as a low voltage power to the communication module 20, without the electrical power being interrupted by a safety power controller 58 before the communication module 20. Therefore, the communications module 20 can remain powered and able to provide diagnostics and other communications, even in cases where safety power is removed, for example, if an emergency stop (E-stop) is activated. The low voltage power provided by the power supply 46 may be 3-60 V AC or DC and is preferably 12 VDC or 24 VDC or 24 VAC. Alternatively, the communication module 20 may be directly powered with AC control power such as 120 VAC or 250 VAC.

[0020] In accordance with the present invention and as shown in FIGS. 3-4, a safety power controller 58 within the module body 30 provides a safety output power 43 to the fluid valve 24. The communication module 20 also includes a safety processor 50 that receives and verifies the integrity of safety input/output data within the first control signal and which may also monitor the safety power controller 58 and which removes the safety output power 43 from the fluid valve 24 in the case of an error in the safety input/output data or in response to a power-off command from the safety controller 36. The first, or safety control signal may enable the safety power controller 58 to reliably control the safety output power 43 supplied to the fluid valves 24 in order to satisfy the given functional safety standard for machinery. In other words, the present disclosure provides a communication module 20 that accepts a CD³ safety control signal to reliably control each of fluid valves 24 and which also triggers the safety output power 43 to the fluid valves 24 on and off without the need for additional safety hardware.

[0021] As also shown in FIG. 3, the communication module 20 is also configured to control and/or monitor one or more electrical input or output (I/O) channels connected to an electrical I/O interface 60 which is mechanically and electrically coupled to the module body 30. The electrical I/O may include one or more digital, analog, and/or specialty inputs or outputs, which may be configured to control and/or monitor one or more electrical signals by the safety controller 36. Specialty inputs may include, for example, thermocouple or RTD temperature inputs. The electrical I/O interface 60 also be configured to use the safety output power 43. The first, or safety control signal may enable the safety power controller 58 to reliably control the safety output power 43 supplied to the electrical I/O interface 60 in order to satisfy the given functional safety standard for machinery.

[0022] According to an aspect, the communication module 20 may also include a safety relay 52 having redundant and self-monitoring contacts for removing the safety output power 43 from the fluid valve 24 in the presence of a malfunction with the safety power controller 58. Such a safety relay 52 may include, for example, multiple positive-guided relays which can detect malfunctions such as a stuck or "welded" contact, and which include redundant contacts capable of switching the safety output power 43 even when a malfunction exists. Such a safety relay 52 may also signal the detection of a detected malfunction to prevent the safety output power 43 from being restored until the malfunctioning component is replaced. [0023] As shown in FIG. 5, the subject disclosure also includes a method 100 for controlling a safety output power 43 to a fluid valve 24 by a communication module 20 and which includes the steps of: 102 receiving by the communication module 20 electrical energy from a power supply 46; 104 receiving by the communication module 20 a first control signal from a safety controller 36 via a first communications channel 34; 106 receiving and verifying the integrity of safety input/output data within the first control signal by the safety processor 50 of the communication module 20; and 108 removing by the safety power controller 58 the safety output power 43 to the fluid valve 24 in response to an error in the safety input/output data or in response to a power-off command from the safety controller 36. Such a power-off command may include, for example, an emergency stop (e-stop) command to remove the safety output power 43 from the fluid valve 24 and to thereby cause any machinery connected thereto to go to a known safe condition. The method 100 may also include the step of 110 removing by the safety power controller 58 the safety output power 43 from the fluid valve 24 in the presence of a malfunction with the safety power controller, such as may be detected by a safety relay 52 within the safety power controller and which has redundant and self-monitoring circuitry. Errors in the input/output data may include lost or malformed data packets, such as those that fail an error checking mechanism or those that are not received within a

predetermined period of time.

[0024] Obviously, many modifications and variations of the present invention are possible in light of the above teachings and may be practiced otherwise than as specifically described while within the scope of the appended claims.

Claims

CLAIMS What is claimed is:

Claim 1. A communication module for controlling a valve bank including a fluid valve and comprising:

a module body configured to mechanically and electrically couple to the fluid valve in the valve bank;

a first communications channel for receiving a first control signal from a safety controller;

an electrical interface for controlling the at least one fluid valve;

wherein said communication module provides a second control signal to the at least one fluid valve to change a fluid flow characteristic of the at least one fluid valve based upon said first control signal;

a safety power controller within said module body providing a safety output power to said at least one fluid valve; and

a safety processor configured to receive and verify the integrity of a safety input/output data within the first control signal to cause said safety power controller to remove said safety output power from said at least one fluid valve in the case of an error in said safety input/output data or in response to a power-off command from the safety controller.

Claim 2. The communication module according to Claim 1, wherein said safety power controller includes a safety relay having redundant and self-monitoring contacts for removing said safety output power from said at least one fluid valve in the presence of a malfunction with said safety power controller.

Claim 3. The communication module according to Claim 1, wherein said first communications channel uses Common Industrial Protocol (CIP) safety protocol.

Claim 4. The communication module according to Claim 1, wherein said first communications channel uses an EtherNet/IP protocol.

Claim 5. The communication module according to Claim 1, wherein said first communications channel uses a DeviceNet protocol.

Claim 6. The communication module according to Claim 1, wherein said first communications channel uses a PROFINET protocol.

Claim 7. The communication module according to Claim 1, further including said communication module receiving a low-voltage DC power from a power supply.

Claim 8. The communication module according to Claim 7, wherein said power supply provides said low-voltage DC power at 24 VDC.

Claim 9. The communication module according to Claim 7, wherein said safety output power is sourced from said low-voltage DC power.

Claim 10. The communication module according to Claim 1, wherein said module body is mechanically and electrically coupled to said fluid valve with one of a backplane or a chassis.

Claim 11. The communication module according to Claim 1, wherein said second control signal uses a POINTBus protocol.

Claim 12. The communication module according to Claim 1, wherein said valve bank includes a plurality of fluid valves in a stacked configuration electrically and

mechanically coupled to said module body.

Claim 13. The communication module according to Claim 1, wherein said safety processor is configured to control or to monitor an electrical input or output channel connected to an electrical I/O interface electrically and mechanically coupled to said module body.

Claim 14. A method for controlling a safety output power to at least one fluid valve by a communication module comprising:

receiving by the communication module a first control signal from a safety controller via a first communications channel;

receiving and verifying the integrity of a safety input/output data within the first control signal by a safety processor of the communication module; and removing by a safety power controller of the communication module the safety output power to the at least one fluid valve in response to an error in the safety input/output data or in response to a power-off command from the safety controller.

Claim 15. The method for controlling a safety output power to at least one fluid valve by a communication module according to Claim 14 and further including:

removing by the safety power controller the safety output power from the at least one fluid valve in the presence of a malfunction with the safety power controller.