Control Device With Guard Module

Abstract

A control device for controlling a technical installation includes a guard module. The control device has a modular structure with an input module, which receives an input signal representing a state of the technical installation, and an output module, which outputs an output signal controlling the technical installation based on the input signal. A guard module is integrated into the modular structure to monitor operability of the input module and the output module. The guard module confirms the output signal of the output module based on its monitoring of the input module and the output module. Within the modular structure, the input module and the output module form a first potential group. The guard module forms a second potential group within in the modular structure. The second potential group is independent of the first potential group.

Claims

1. A control device having a modular structure for controlling a technical installation, the control device comprising: an input module configured to receive an input signal representing a state of the technical installation; an output module configured to output an output signal which controls the technical installation based on the input signal; and a guard module integrated in the modular structure and configured to: monitor operability of the input module and the output module, and confirm the output signal of the output module in dependence thereon, wherein the input module and the output module form a first potential group within the modular structure, wherein the guard module forms a second potential group within the modular structure, and wherein the second potential group is independent of the first potential group.

2. The control device of claim 1, wherein the first potential group provides the output signal and the second potential group provides a signal for confirming the output signal.

3. The control device of claim 1, wherein: the input module, the output module, and the guard module each comprise a bus module part via which the input module, the output module, and the guard module are connected to one another, and the bus module part of the guard module includes an isolation element configured to galvanically isolate the bus module part of the guard module from further components of the guard module.

4. The control device of claim 1, wherein: the input module and the output module are configured to send state information to the guard module at defined intervals, and the guard module is configured to confirm the output signal based on the state information.

5. The control device of claim 4, wherein: the first potential group comprises, in addition to the input module and the output module, one or more further modules relevant for providing the output signal, the further modules are each configured to transmit the state information at the defined intervals, and the guard module is configured to confirm the output signal in response to reception of the state information of all relevant modules.

6. The control device of claim 1, wherein the guard module comprises a first supply terminal configured to be connected to a potential forming the second potential group.

7. The control device of claim 1, wherein the guard module comprises an output module part configured to provide the output signal for the output module of the first potential group.

8. The control device of claim 7, wherein: the guard module comprises a second supply terminal to be connected to a further potential feeding the output module part, and the output module part is galvanically isolated from the guard module.

9. The control device of claim 1, wherein the guard module is of multi-channel redundant design.

10. The control device of claim 1, wherein the control device includes a safety controller with two separate signal processing channels.

11. The control device of claim 1, wherein the control device includes a safety controller with a diversitary structure.

12. The control device of claim 1, wherein the control device includes a safety controller configured to implement voltage/time monitoring.

13. The control device of claim 1, wherein the control device is configured to test at least one of the input and the output module continuously as well as to ensure a safe shutdown behavior in case of a fault or danger.

14. A guard apparatus for monitoring operability of an input module and an output module of a control device having a modular structure, the guard apparatus comprising: a bus module part configured to receive state information from the input module and the output module; a logic module part configured to evaluate the state information from the input module and the output module; and an output module part configured to confirm an output signal of the output module based on the evaluation, wherein the input module and the output module form a first potential group within the modular structure, and wherein at least the logic module part of the guard apparatus forms a second potential group independent of the first potential group within the modular structure.

15. The guard apparatus of claim 14, further comprising an isolation element configured to electrically isolate a circuit in the logic module part from a circuit in at least one of the output module part and the bus module part.

16. The guard apparatus of claim 14, wherein the logic module part is configured to stop feeding of the output signal of the output module from an external peripheral voltage.

17. A method for controlling a technical installation, the method comprising: providing a control device having a modular structure with at least one input module and one output module; receiving an input signal via the input module, the input signal representing a state of the technical installation; outputting an output signal via the output module, the output signal controlling the technical installation based on the input signal; integrating a guard module into the modular structure, wherein the guard module is configured to monitor operability of the input module and the output module; forming a first potential group within the modular structure, the first potential group comprising the input module and the output module; and forming a second potential group, independent of the first potential group, within the modular structure, wherein the second potential group includes the guard module.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Embodiments of the invention are shown in the drawings and are explained in more detail in the following description.

[0040] FIG. 1 shows a schematic representation of a first embodiment of a control device having a guard module.

[0041] FIG. 2 shows a schematic representation of an embodiment of a method for controlling a technical installation with a control device having a guard module.

[0042] FIG. 3 shows a schematic representation of a second embodiment of a control device with a power supply module that performs the function of a guard module.

[0043] FIG. 4 shows a schematic representation of a first embodiment of a guard module for a control device.

[0044] FIG. 5 shows a schematic representation of a second embodiment of a guard module in the form of a power supply module for a control device.

DETAILED DESCRIPTION

[0045] FIG. 1 shows a first example embodiment of a control device having a guard module. The control device is designated in its entirety by reference numeral 10.

[0046] The control device 10 has a modular structure. In the present embodiment, the control device comprises four individual modules. The first module is a head module 12, the second module is an input module 14, the third module is an output module 16, and the fourth module is a guard module 100.

[0047] The modules may each be housed in their own housing (18a-18d) and combined to form the control device 10. The order in which the modules are arranged is initially irrelevant and the modules do not have to be arranged in the order shown here. However, it is also conceivable that in another embodiment the order of the modules arranged next to each other is of importance for defining the role of the respective module. In addition, the number of modules is not limited to the four modules shown here. The control device 10 may include a plurality of other input and output modules (peripheral modules) in addition to the typically single header module. Further modules with other functions than the input and output shown here are also conceivable. These other modules can benefit from the guard module in an equivalent manner. While being modular, the control device 10 forms a single unit.

[0048] The modules of the control device may themselves also be modular. The modular structure of the individual modules is hereinafter referred to as vertical modularity, while the modular structure of the control device consisting of the individual modules is referred to as horizontal modularity.

[0049] A module may include an input/output module part 20, a logic module part 22, and a bus module part 24 integrated into a single module.

[0050] The input/output module part 20 of a module implements the physical interface to the periphery to acquire a process image of the inputs (PII) and to set outputs with respect to a process image of the outputs (PIO). An input/output module part comprises a plurality of terminals for connecting sensors and actuators to receive input signals from sensors and encoders, on the one hand, and to provide output signals to actuators, on the other hand. Input and output can be redundant, as indicated here by the double arrow.

[0051] The logic module part 22 of a module forms the core of a module. In this module part, the actual signal processing (logic) takes place by means of corresponding signal processing devices 26. The processing includes the evaluation of the detected states as well as the determination of the reaction to be carried out depending on the evaluation. Signal processing can be performed by microcontrollers (μC), but is not limited to such. Other signal processing devices such as CPU, GPU, ASIC, etc. are equally conceivable. For error prevention and/or detection, the modules may include two or more signal processing devices 26, as indicated herein by the suffixes a and b for each module. The signal processing devices 26 may process or generate the input and output signals in parallel, and may synchronize and monitor each other. This is also referred to as multi-channel redundant design. A multi-channel redundant design of the individual modules is a known design for providing a fail-safe facility.

[0052] The bus module part 24 forms the communication interface to the other modules. In addition to a communication link to the signal processing devices 26 of a module, the bus module part 24 includes respective cross-connections to adjacent bus module parts of adjacent modules. In this way, the bus module parts 24, which are connected side by side, form a communication bus through which the modules of the control device can communicate with each other. The signal processing devices 26 of the input module 14, the output module 16, and the guard module 100 can exchange data via the bus. Similarly, the head module 12 may exchange data with the other modules via the bus. The bus module parts 24 are each formed here as module parts of the individual modules. However, it is also conceivable that the bus module parts 24 are formed as a single backplane which is coupled to the head module and onto which the individual modules can be plugged.

[0053] The guard module 100 has a similar structure to a peripheral module, and accordingly can be integrated into the modular structure of the control device like any other peripheral module. Like the peripheral modules, the guard module 100 has at least one logic module part 22 and a bus module part 24. Further, in various embodiments, the guard module 100 may have an input/output module part 20.

[0054] The signal processing devices 26 of the guard module 100 exchange data and signals with the peripheral modules 14, 16 and the head module 12. As will be described below, the guard module 100 monitors the proper operation of the peripheral modules 14, 16 and the head module 12. In the event of proper operation of the peripheral modules 14, 16 and the head module 12, the guard module 100 confirms the output signals of the output modules. To this end, the guard module 100 may include a dedicated output module part that provides an additional output signal depending on the signal processing of the logic module part. The confirmation of the output signals of the output modules of the control device may then be performed by an “AND” operation of these output signals, so that a linked output signal 28 is generated only when the output signal of the guard module and the output signals to be confirmed are present at the “AND” operation. It is understood that this is only one way of confirming the output signal.

[0055] The control device 10 comprises two potential groups. Here, the first potential group 30 includes the header module 12, the input module 14, and the output module 16. The second potential group 32 includes the logic module part and the output module part of the guard module 100. In FIG. 1, the second potential group 32 is highlighted by the shaded area.

[0056] A first supply voltage terminal 34 feeds the first potential group 30 and is arranged, for example, on the head module. A second supply terminal 36 feeds the second potential group 32 and is arranged on the guard module 100. The associated potentials of the potential groups 30, 32 can be identical in nature and can be 24V, for example, as shown here. Furthermore, the potential groups 30, 32 are independent of each other and galvanically isolated from each other within the control device. It is understood that a separation of the potential groups 30, 32 is not limited to the separation shown here, as long as at least the output signal of the guard module is fed from a different potential group than the output signals of the modules to be monitored.

[0057] By forming the guard module as an independent module, a separation of the potential groups 30, 32 can be easily achieved. The guard module only needs to communicate with the other modules. By means of a corresponding communication interface with isolation 38, this is possible without removing the galvanic isolation of the potential groups. The isolation 38 of the communication interface can be implemented, for example, by means of an optocoupler which enables signal transmission between two electrically isolated circuits. An optocoupler is usually formed by a light-emitting diode (LED) or laser diode (LD) as optical transmitter and a photodiode or phototransistor as optical receiver.

[0058] In the embodiment shown in FIG. 1, the isolation 38 of the communication interface is disposed between the logic module part 22 and the bus module part 24. It is understood that other arrangements of the isolation 38 are also conceivable. In another embodiment, the isolation 38 may also be integrated into the bus module part 24, for example, wherein each of the cross-connections includes a galvanic isolation.

[0059] With reference to FIG. 2, the operation of the control device 10 is described in more detail below. FIG. 2 shows a schematic representation of an embodiment of a method for controlling a technical installation with a control device having a guard module.

[0060] The method comprises, in a first step (S1), providing a control device having a modular structure according to an embodiment of the present disclosure. The control device comprising at least one input module and one output module.

[0061] Via the input module, the control device receives at least one input signal (S2) representing a state of the technical installation. The input signal can be a signal from a safety sensor, e.g. a light barrier or an emergency stop switch. The sum of the input signals results in the process image of the inputs (PII) and thus reflects the state of the technical installation.

[0062] Via the output module, the control device outputs at least one output signal for controlling actuators. The sum of the output signals is determined by the process image of the outputs (PIO). For example, the actuators can be contactors in a power supply of the technical installation, which only release a power supply of the technical installation if the output signal is present. It is understood that shutting down the technical installation is only one way of transferring the technical installation into a safe state. In another embodiment, the output signal may also trigger another control function that moves the technical installation into a safe position without de-energizing the technical installation itself.

[0063] Furthermore, the method includes integrating a guard module into the modular structure of the control device (S4). The guard module is configured to monitor at least the operability of the peripheral modules, i.e. the input module and the output module. In another embodiment, the guard module may also monitor other modules, for example, the head module. Details of the monitoring process are explained in more detail below.

[0064] The last steps of the method (S5, S6) involve the formation of defined potential groups within the modular structure. The separate potential groups enable independent monitoring of the modules by the guard module, so that faults in the power supply of certain modules cannot affect other modules in the same way.

[0065] In step S5, a first potential group comprising at least the peripheral modules is formed. The first potential group is defined, for example, by applying a supply voltage to a supply terminal of the modules.

[0066] In step S6, a second potential group comprising the guard module is formed. The second potential group is independent of the first potential group within the modular structure of the control device. The guard module thus has at least one circuit, galvanically isolated from the other modules, for monitoring as well as for providing confirmation of the output signal. The guard module can be coupled to a supply voltage via a further supply terminal to form the second potential group.

[0067] An example of a monitoring process of the guard module is described below. According to this example, the guard module operates according to the principle of a “watchdog”. According to this principle, the modules to be monitored continuously emit a signal at defined intervals to indicate the module's operability. Such a signal is also called a “heartbeat” signal. Only if the guard module receives the heartbeat signal as expected, the guard module agrees to the output of the control device. Enabling can be done, for example, by an “AND” operation of an output signal of the guard module with the outputs of the control device, so that operation is only permitted if all output signals of both the control device and the guard module are present. If the guard module does not receive a heartbeat signal, it will not confirm the output of the control device. Thereby, the technical installation is transferred into a safe state or the technical installation remains in such a state. It can be achieved, for example, by the outputs of the control device driving contactors in a power supply of the technical installation, which only pick up and supply the technical installation with a power in the presence of an output signal of the control device. If, on the other hand, the contactors fall off because there is no output signal, the technical installation is de-energized and therefore not dangerous for a person anymore. It is understood that the described process is only one example of how a safe state of a technical installation can be achieved. Further procedures are known from the field of safety engineering as to how a safe state can be established with the aid of an output signal. The control device proposed herein is not limited to any particular procedure.

[0068] Likewise, the watchdog principle is only one way of monitoring the modules. In addition to the direct monitoring of individual peripheral modules, indirect monitoring can also be implemented, for example. In the case of indirect monitoring, only one module (e.g. the head module of the control device) is monitored in accordance with the above principle on behalf of the other modules. If, for example, the head module is configured to monitor the associated peripheral modules and to switch off the outputs in the event of a fault, it may be sufficient to monitor only the head module in order to enable indirect monitoring of the peripheral modules.

[0069] Furthermore, in another embodiment, the guard module may also be arranged to emit a heartbeat signal to indicate its own operability to the other modules of the control device. For example, the guard module may send a heartbeat signal to a head module of the control device and the head module causes the outputs to be turned off if the heartbeat signal is not received as expected. In this way, the other modules monitor the guard module and cause a safe state to be assumed if a fault should occur in the guard module's potential group. Accordingly, the modules of the control device and the guard module can monitor each other, whereby common cause failures can be better detected due to the fact that the modules of the control device and the guard module belong to separate potential groups.

[0070] Confirmation by the guard module can be achieved in the manner described above. In other words, the guard module has its own output module part and provides its own output signal depending on the monitoring of the other modules. The output signal of the guard module can be linked to the actual output signals of the control device. An alternative embodiment is described below with reference to FIG. 3.

[0071] FIG. 3 shows a schematic representation of a second embodiment of a control device with a power supply module that performs the function of a guard module. Same reference numerals denote the same parts as before in FIG. 1.

[0072] Like the embodiment according to FIG. 1, the embodiment according to FIG. 3 comprises a control device 10 having a head module 12, an input module 14 and an output module 16. The modules operate and communicate with each other in the manner previously described with reference to FIG. 1. Likewise, the modules are combined in the modular structure to form a first potential group in the manner described above. The head module 12, the input module 14, and the output module 16 are fed by a first supply voltage terminal 34.

[0073] In contrast to the previous embodiment according to FIG. 1, the control device 10 according to the embodiment according to FIG. 3 has an additional power supply module 40. The power supply module 40 is configured to receive an external peripheral voltage and to make it available to the peripheral modules for providing the output signals. The output modules 16 of the control device can thus feed their output signals from the external peripheral voltage without having to rely on the voltage supply of the control device. With the help of power supply modules, a control device can be easily scaled, since the number of outputs is not limited by the control device's own power supply.

[0074] The power supply module 40 includes an input/output module part 42 configured to receive and pass an external peripheral voltage to other modules. Forwarding may be accomplished by separate wiring, or it may be accomplished by special coupling of the input/output module part 42 to the input/output module part of an adjacent module. The forwarding of an external peripheral voltage is schematically indicated here by the arrow 44.

[0075] The input/output module part 42 is further configured to be able to switch on and off the forwarding. For example, the input/output module part 42 may have a switching element 46 between an input terminal 48 of the external peripheral voltage and an output terminal 50 to the adjacent modules. As shown herein, the switching element 46 may be provided redundantly.

[0076] The switching element 46 may be actuated by a logic module part 22 of the power supply module 40. In other words, the logic module part 22 of the power supply module 40 may be configured to switch on and off the forwarding of the external peripheral voltage. Only if logic module part 22 allows forwarding, the output modules can feed their output signal from the external peripheral voltage. Thus, by controlling the forwarding, the logic module part 22 can easily confirm the output signals of the dependent output modules.

[0077] According to the embodiment shown in FIG. 3, the power supply module 40 is configured such that the logic module part 22 is assigned to a different potential group than the other modules. For this purpose, a second supply terminal 36 may be provided to supply power only to the logic module part 22, as well as additional isolating means 52 to isolate the logic module part 22 from the other module parts and modules. In this way, a second potential group 32 is formed around the logic module part 22, which is independent of the first potential group 30.

[0078] The logic module part 22 may further perform the same function as the logic module part 22 of the guard module 100 shown in FIG. 1. The power supply module 40 is thus capable of performing one of the monitoring operations described above, with confirmation of the outputs being performed via controlled forwarding of the external peripheral voltage. In other words, according to the embodiment example shown in FIG. 3, a power supply module 40 can be extended to perform the tasks of a guard module by providing its own potential group. In this way, the power supply module and the guard module are integrated into one module, which means that the control device can be smaller and simpler. At the same time, effective protection against common cause faults is possible.

[0079] Finally, FIG. 4 and FIG. 5 each show an embodiment of a guard module 100.

[0080] FIG. 4 shows a schematic representation of a first embodiment of a guard module for a control device. The guard module corresponds to the guard module as described with reference to FIG. 1. Same reference numbers indicate same parts as before.

[0081] Here, the guard module 100 is a stand-alone guard module for monitoring other modules of a module arrangement. In the illustrated embodiment, the guard module comprises three module parts that may be formed as independent components and may be assembled to form the guard module. A stand-alone component in this context is one that is not specific to the guard module but can be used with other modules.

[0082] A first module part is a bus module part 24 that includes a communication interface 54. The communication interface 54 allows the bus module part to communicate with and receive signals from the modules to be monitored.

[0083] The second module part is a logic module part 22 having a signal-processing device 26. The signal-processing device 26 evaluates the signals received from the modules to be monitored and verifies the proper operation of the modules. The evaluation may be performed redundantly by two separate signal-processing units 56 that synchronize and monitor each other.

[0084] The third module part is an output module part 42. Via the output module part 42, the guard module may provide an output signal in response to the received signals. The output signal of the guard module is used to confirm one or more output signals of an output module of the control device to be monitored. The output signal may be an enable signal 58, which must be present in addition to the actual output signals of the control device in order to enable operation of the technical installation controlled by the control device.

[0085] The guard module forms an independent potential group 32 within the control device in which the module is integrated. In this context, independent means that the potential group 32 is separate and independent from a potential group from which the other modules of the control device are fed. This means that at least one circuit within the guard module, which is responsible for monitoring and enabling, is galvanically isolated from a circuit of the other modules. The separation can be achieved by an isolation 38. To generate the potential group, the guard module may have a supply terminal 34 through which the guard module 100 receives a potential defining the potential group 32.

[0086] FIG. 5 shows a schematic representation of a second embodiment of a guard module in the form of a power supply module for a control device.

[0087] The guard module according to FIG. 5 is based on the same operating principle as the guard module according to FIG. 4 and is divided into three module parts. The bus module part 24 and logic module part 22 are identical to the corresponding module parts of the guard module shown in FIG. 4, but the guard module 100 shown in FIG. 5 differs in the output module part 42.

[0088] The output module part 42 includes here a terminal 48 for receiving a potential and a terminal 50 for passing the potential to an adjacent module. An adjacent module may thus provide an output signal fed by the potential input to the output module part 42. In addition, the output module part 42 includes a switching element 46 between the terminal 48 and the terminal 50 to connect and disconnect the terminal 48 and the terminal 50. The switching element 46 may be controlled by the logic module part 22, such that the guard module 100 is configured to prevent forwarding of the injected potential. In this way, the guard module can confirm an output signal of that module which uses the injected potential to provide its output signal.

[0089] As in the case of the guard module according to FIG. 4, the logic module part 22 of the guard module according to FIG. 5 is also arranged in an independent potential group 32 in order to be able to ensure independent monitoring in the manner described above.

[0090] Both the guard module of FIG. 4 and the guard module of FIG. 5 allow a particular source of common cause faults to be effectively eliminated within a control device in which the modules are used.

[0091] As used herein, the phrase at least one of A, B, and C should be construed to mean a logical (A OR B OR C), using a non-exclusive logical OR, and should not be construed to mean “at least one of A, at least one of B, and at least one of C.