Arrangement having two redundant modules

Abstract

An arrangement having two redundant modules that monitor one another and that each contain a current or voltage source, which is connected to a first line terminal via a first controllable switch and a first current sensor, wherein each module also has a second line terminal and a ground terminal, between which lies a second current sensor in series with a second controllable switch, where each module, when in the functioning state, closes the controllable switches contained therein, and contains a monitoring device connected to the two current sensors of the modules, the monitoring device generating a monitoring signal identifying the corresponding other module as functioning if at least one of the two current sensors detects a current flow.

Claims

1. An arrangement comprising: a first module; and a redundant, second module, the first module and the redundant, second module operatively monitoring one another mutually; wherein the first module and redundant, second module each includes: a current source or voltage source, which is one of (i) switchable on and off and is connected via a first current sensor to a first line terminal of a respective module of the first module and redundant, second module and (ii) connected to a first line terminal via a series circuit formed by a first controllable switch and a first current sensor; and a second line terminal and aground terminal, between which is operatively connected a second current sensor in series with a second controllable switch; wherein the first line terminal of the first module is connected via a first line to the second line terminal of the second module, and the first line terminal of the second module is connected via a second line to the second line terminal of the first module; and wherein the first module and redundant, second module are, when in a functioning state, configured to switch on its current source or voltage source and further configured to one of (i) close the second controllable switch contained in said respective module of the first module and redundant, second module and (ii) close the first and second controllable switches contained in said respective module of the first module and redundant, second module; wherein the first module and redundant, second module each additionally include: a monitoring device connected to the first and second current sensors contained in said respective module of the first module and redundant, second module, said monitoring device generating a monitoring signal which identifies a corresponding other module of the first module and redundant, second module as functioning if at least one of the first and second current sensors detects a current flow.

2. The arrangement as claimed in claim 1, wherein the first and second current sensors are formed as optocouplers.

3. The arrangement as claimed in claim 1, wherein the first and second current sensors each comprise a current sensing resistor; and wherein the monitoring device is configured to detect a voltage drop across the current sensing resistor.

4. The arrangement as claimed in claim 3, wherein the first current sensor in the first module and the second current sensor in the redundant, second module have a common current sensing resistor in a corresponding other module, said resistor being connected at one end to the second line terminal of the corresponding other module.

5. The arrangement as claimed in claim 1, wherein the first and second controllable switches are formed as optocouplers.

6. The arrangement as claimed in one claim 1, wherein at least one of the first module and the redundant, second module comprises a transmitter for applying an information signal to at least one of the first and second lines, and wherein a corresponding other module includes a receiver for receiving the applied information signal.

7. The arrangement as claimed in claim 6, wherein one controllable switch of the first and second controllable switches, located within the at least one of the first module and the redundant, second module, forms part of the transmitter; and wherein the transmitter is configured for pulse modulation by the controllable switch of a current supplied by the current source or voltage source.

8. The arrangement as claimed in claim 7, wherein one current sensor of the first and second current sensors, located within the corresponding other module, forms part of the receiver to receive the pulse-modulated current.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

(1) In order to explain the invention further, reference is made below to the figures of the drawing, in which:

(2) FIG. 1 is a schematic block diagram illustrating a redundant control system having two redundant modules;

(3) FIG. 2 is a schematic block diagram of a first exemplary embodiment illustrating the arrangement in accordance with the invention having two modules in which optocouplers are used as the switches and current sensors;

(4) FIG. 3 is a schematic block diagram illustrating a second exemplary embodiment of the arrangement in accordance with the invention having current sources and current sensing resistors in the modules;

(5) FIG. 4 is a schematic block diagram of another exemplary embodiment of the arrangement in accordance with the invention having voltage sources and current sensing resistors in the modules; and

(6) FIG. 5 is a schematic black diagram of an exemplary switchable current source.

DETAILED DESCRIPTION OF THE EXEMPLARY EMBODIMENTS

(7) The same reference numbers are used to denote identical and equivalent elements.

(8) FIG. 1 shows a segment of a process control system having a control facility 1 at a process management level, a first and second control processor 2, 3 in the form of programmable logic controllers at a control level, and an actuator 4 at field level. The field level contains other field devices (not shown here) which, formed as sensors, detect the states of a technical process, and formed as actuators, systematically influence the process. The control facility 1 and the control processors 2, 3 are connected to one another via a plant bus 5 (e.g., Ethernet). In order to generate output values for the actuator 4, the two control processors 2, 3 each execute in redundant operation one and the same control program or user program, where they process, inter alia, input values received from sensors via separate digital field buses 6, 7 (e.g., PROFIBUS DP). The field devices are interfaced to the field buses 6, 7 of the two control processors 2, 3 via a first and second distributed peripheral station 8, 9. Each of the two peripheral stations 8, 9 consists of an interface module (header module) 10, 11 for connecting to the relevant field bus 6, 7 and consist of a number of single-channel or multichannel input/output modules, of which just one output module 12, 13 is shown here for each station. The actuator 4 is connected via decoupling diodes 14, 15 to the signal outputs 16, 17 of the two output modules 12, 13. The interface modules 10, 11 transfer output values, which are received from the corresponding control processor 2, 3 for the actuator 4, to the output modules 12, 13, where the diodes 14, 15 combine digital values by a disjunctive (OR) operation and add analog values (currents) for the actuator 4. Both output modules 12, 13 are active. In fault-free redundant operation, the output modules 12, 13 both receive the same output values. The two control processors 2, 3 synchronize themselves accordingly. Alternatively, only one of the two modules, such as module 12, is active and transfers the output values received from the control processor 2 to the actuator 4.

(9) The interface modules 10, 11 each monitor the field bus 6, 7 to which they are connected, and in the event of a fault, such as if the control processor fails (e.g., operating state STOP or cable pulled out) issue a command to all the output modules of the relevant peripheral station 8, 9 to output substitute values, such as in the form of the last received output values.

(10) FIG. 2 shows an example of the arrangement in accordance with the invention having two redundant modules 21, 22, where the modules may be the two output modules 12, 13 of FIG. 1 or any other module type. Both modules, i.e., the first module 21 and the second module 22, have the same configuration and both contain a function unit 23, 24 for performing module-specific functions which involve receiving input data 25 and generating output data 26.

(11) The first module 21 contains a current source 27 (or alternatively a voltage source), which is connected to a first line terminal 30 via a series circuit composed of a first controllable switch 28 and a first current sensor 29. The module 21 also contains a second current sensor 31, which lies in series with a second controllable switch 32 between a second line terminal 33 and ground. In the exemplary illustrated embodiment, the controllable switches 28, 32 and the current sensors 29, 31 each consist of an optocoupler comprising light emitting diode and phototransistor.

(12) In the functioning state, i.e., if the module 21 is plugged in, supplied with power and has not switched itself off because of a fault, the function unit 23 generates a control signal 34, which is used to close the controllable switches 28, 32. In the functioning state, the module 21 can be active but also passive in the sense that although it is not currently performing any module-specific functions it can be activated to do so.

(13) The two current sensors 29, 31 are intended to detect a current flowing via the first and second line terminals 30, 33 respectively, and to signal this current flow to a monitoring device 35, which then generates a monitoring signal 36 for the function unit 23 if at least one of the two current sensors 29, 31 detects a current flow.

(14) The redundant second module 22 likewise contains a first controllable switch 37 and a first current sensor 38 between a current source 39 (or voltage source) and a first line terminal 40, and contains a second current sensor 41 in series with a second controllable switch 42 between a second line terminal 43 and ground. Again, in this case, the controllable switches 37, 42 and the current sensors 38, 41 consist of optocouplers.

(15) In the functioning state of the second module 22, the function unit 24 generates a control signal 44, which is used to close the controllable switches 37, 42. The two current sensors 38, 41 signal to a monitoring device 45 a current flow occurring via the first and second line terminals 40, 43 respectively, where the monitoring device then generates a monitoring signal 46 for the function unit 24 if at least one of the two current sensors 38, 41 signals such a current flow.

(16) The first line terminal 30 of the first module 21 is connected via a first line 47 to the second line terminal 43 of the second module 22. A second line 48 connects the first line terminal 40 of the second module 22 to the second line terminal 33 of the first module 21. The first current sensor 29 in the first module 21, and the second current sensor 41 in the second module 22 thus detect a possible current flow on the first line 47, while first current sensor 38 in the second module 22 and the second current sensor 31 in the first module 21 detect a current flow on the second line 48.

(17) When the first module 21 is functioning, the controllable switches 28, 32 are closed and both current sensors 29, 31 are active in order to be able to detect a current flow on each of the first and second lines 47, 48. If the other module 22 is likewise in a functioning state, then the controllable switches 37, 42 of this module are also closed. As a result, a current flows in both the first and second lines 47, 48. The current sensors 29, 31 in the first module 21, and the current sensors 38, 41 in the second module 22 then detect a current flow on both the first and second lines 47, 48, with the result that the monitoring devices 35 and 36 respectively arranged thereafter generate respective monitoring signals 36 and 46 that each indicate that the corresponding other module 22 or 21 is functioning. Even if one of the two lines, e.g. first line 47, is discontinuous, both modules 21, 22 still detect a current flow in the second line 48 and hence the functionality of the other module in each case. If, on the other hand, the module 22 is not plugged in or is unable to function, for instance, then its controllable switches 37, 42 are open. As a result, current does not flow in either of the first and second lines 47, 48 and the first module 21 identifies the non-functionality of the second module 22 from the fact that neither of the current sensors 29, 31 are detecting a current flow.

(18) In order to transfer information useful for the redundant operation, the first module 21 contains a transmitter 49 for applying an information signal 50 generated by the function unit 23 to the first line 47, and a receiver 51 for receiving an information signal 52 received from the second module 22 via the second line 48. The function unit 23 controls the transmitter 49 and receivers 51. In the identically configured second module 22, a receiver 53 receives the information signal 50 received from the first module 21 via the first line 47, while a transmitter 54 applies the information signal 52 to the second line 48.

(19) In the exemplary illustrated embodiment, the information signals 50, 52 are applied to the first and second lines 47, 48 by pulse modulation of the current supplied by the corresponding current sources 27, 39, with the controllable switches 28, 37 (or alternatively the switches 32, 42) being used for this purpose and hence forming part of the corresponding transmitter. The current sensors 31, 41 detect the pulse modulation of the current and hence receive the information signals, and therefore are part of the corresponding receiver.

(20) As explained below, components such as electromechanical switches or semiconductor switches or current sensing resistors, for instance, can be used for the controllable switches and/or current sensors instead of the optocouplers shown in FIG. 2.

(21) FIG. 3 shows an alternative exemplary arrangement in accordance with the invention, in which the first current source 27, in the first module 21, and the second current source 30, in the second module 22, are connected to ground via a first current divider and a second current divider respectively. The first current divider comprises a first resistor 60 and a second resistor 61, where the first resistor 60 is arranged together with a first controllable switch 62 in the first module 21, and the second resistor 31 is arranged in series with a second controllable switch 63 in the second module 22. The resistors 60, 61 of the first current divider, which are arranged in the different modules 21, 22, are connected together via the first line 47. The first controllable switch 62 is arranged between the first line 47 and the first current source 27 and respectively the first resistor 60 connected in parallel therewith.

(22) The second current divider, which is connected to the second current source 39, likewise comprises a first resistor 64 and a second resistor 65, where the first resistor 64 is arranged together with a first controllable switch 66 in the second module 22, and the second resistor 65 is arranged in series with a second controllable switch 67 in the first module 21. The resistors 64, 65 of the second current divider, which are arranged in the different modules 21, 22, are connected together via the second line 48. The first controllable switch 66 is arranged between the second line 48 and the second current source 39 and respectively the first resistor 64 connected in parallel therewith.

(23) The first resistor 60, 64 of each of the two current dividers conducts the current from the respective current sources 27 and 39 when the first switch 62 and 66 respectively is open. The first resistor 60, 64 is set to a value such that the voltage drop across this resistor does not exceed a maximum value. For real current sources 27, 39 having current limiting, the first resistor 60, 64 can be formed by the internal resistance of the relevant current source.

(24) The controllable switches 62, 63, 66, 67 are controlled by control signals 34, 44 generated by the function units 23, 24 such that the switches 62 and 67 in the first module 21 are closed when the module 21 is functioning, and the switches 66 and 63 in the second module 22 are closed when the module 22 is functioning. For example, the controllable switches 62, 63, 66, 67 may be semiconductor switches, such as transistors or MOSFETs, optocouplers or electromechanical switches (relay switches).

(25) In each of the two modules 21, 22, a monitoring device 68 and 69 respectively is connected to the first and second lines 47, 48, where the monitoring device detects the voltages between each of the first and second lines 47, 48 and ground and generates a monitoring signal 36, 46 identifying the corresponding other module as functioning if at least one of the two detected voltages has a value equal to the voltage drop expected across the second resistors 61, 65 when switches 62, 63, 66, 67 are in the closed position.

(26) It should be understood all the resistors 60, 61, 64, 65 are of equal value R. The current sources 27, 39 each supply a current I. When both modules 21, 22 are functioning, all the switches 62, 63, 66, 67 are closed and both monitoring devices 68, 69 detect a voltage U=I/2.Math.R at each of the first and second lines 47, 48. This indicates for each of the two monitoring devices 68, 69 that the other module is functioning.

(27) If, for instance, the second line 48 now breaks, then there no current flows through the resistor 65. As a result, the current I from the current source 39 flows solely through the resistor 64 and produces a voltage drop U=I.Math.R. The monitoring device 68 in the first module 21 measures the voltage U=I/2.Math.R at the line 47 and the value zero at the line 48. The monitoring device 69 in the second module 22 measures the voltage U=I.Math.R at the line 48 and the voltage U=I/2.Math.R at the line 47. At least one of the voltages detected by the monitoring device 68 and at least one of the voltages detected by the monitoring device 69 equals U=I/2.Math.R. As a result, both monitoring devices 68, 69 establish, despite the break in the line 48, that the other, opposite module is functioning.

(28) If when the first and second lines 47, 48 are intact the second module 22 is not functioning, then its switches 63, 66 are open. The switches 62, 67 of the functioning first module 21 are closed. The first monitoring device 68 measures the voltage U=I.Math.R at the line 47 and the value zero at the line 48. Since both detected voltages differ from U=I/2.Math.R, the monitoring device 68 hence identifies the failure or non-existence of the other, opposite module 22.

(29) As in the example shown in FIG. 2, information 50, 52 to be exchanged between the modules 21, 22 can be transmitted and received by pulse modulation of the currents flowing in the first and second lines 47, 48. For zero-mean modulation, the mean value of the current on the lines 47, 48 can be used for the mutual monitoring of the modules 21, 22 and is not affected by the modulation component used for the information transfer. The information can be modulated onto the currents in the lines 47, 48 by various means, e.g., inductively, and received in the same manner.

(30) FIG. 4 shows another example of the two redundant modules 21, 22, which differs from the example shown in FIG. 3 in that instead of current sources a first and second voltage source 70, 71 is present in the different modules 21, 22. The resistors 60, 61 form a first potential divider, across which the first voltage source 70 is connected to ground. The resistors 64, 65 form a second potential divider, across which the second voltage source 71 is connected to ground.

(31) Here, it should be understood all the resistors 60, 61, 64, 65 are of equal value R. The voltage sources 70, 71 each supply a voltage U. When both modules 21, 22 are functioning, all the switches 62, 63, 66, 67 are closed and both monitoring devices 68, 69 detect at each of the first and second lines 47, 48 a voltage U/2. This indicates that for each of the two monitoring devices 68, 69 the corresponding other module is functioning. In the event of a discontinuity in the second line 48, the monitoring device 68 in the first module 21 measures the voltage U/2 at the first line 47 and the value zero at the second line 48. The monitoring device 69 in the second module 21 measures the voltage U at the second line 48 and the value U/2 at the line 47. At least one of the voltages detected by the monitoring device 41 and at least one of the voltages detected by the monitoring device 42 equals U/2. Consequently, both monitoring devices 68, 69 establish, despite the break in the second line 48, that the other, opposite module in each case is functioning.

(32) FIG. 5 shows an exemplary embodiment of the current source 27 or 39 as a switchable constant current source, so that it is possible to dispense with the first switch 28, 37 (FIG. 2) or 62, 66 (FIG. 3) in the relevant module 21, 22.

(33) Thus. while there have been shown, described and pointed out fundamental novel features of the invention as applied to a preferred embodiment thereof, it will be understood that various omissions and substitutions and changes in the form and details of the methods described and the devices illustrated, and in their operation, may be made by those skilled in the art without departing from the spirit of the invention. For example, it is expressly intended that all combinations of those elements which perform substantially the same function in substantially the same way to achieve the same results are within the scope of the invention. Moreover, it should be recognized that structures and/or elements shown and/or described in connection with any disclosed form or embodiment of the invention may be incorporated in any other disclosed or described or suggested form or embodiment as a general matter of design choice. It is the intention, therefore, to be limited only as indicated by the scope of the claims appended hereto.