Systems and methods for testing filters in redundant signal paths

Abstract

The present disclosure relates to systems and methods for testing filters in redundant signal paths. Systems and methods for detecting faults in redundant signal paths during operation of the redundant signal paths are disclosed. A test signal is sequentially injected into each signal path while input signals are conducted by other signal paths that are not receiving the test signal. The test signal is selected at a certain frequency to verify the operation of filters connected in series along each path. A processor generates the test signal, injects the test signal at the input of the filter, and receives the output of the filter. Then, the processor generates the frequency response of the filter in each signal path based on the output from the filter and the original test signal. The frequency responses obtained along each path in the redundant signal path are compared with each other to detect a fault in one of the filters present along the corresponding signal path.

Description

Technical Field

[0001] The subject matter disclosed herein relates to detecting faults within a filter path. More specifically, systems and methods for determining a faulty component within a filter are disclosed, where the filter is located within a redundant signal path. Background Art

[0002] An industrial controller is a specialized computer used to control an industrial machine or process. Under the guidance of a stored control program, the industrial controller examines a series of inputs that reflect the state of the controlled machine or process and changes a series of outputs that control the machine or process. The inputs and outputs can be binary (i.e., on or off) or analog (providing values within a substantially continuous range). The inputs can be obtained from sensors attached to the controlled process, and the outputs can be signals to actuators regarding the controlled process.

[0003] A "safety industrial control system" is an industrial control system designed to ensure the safety of persons working in an industrial processing environment. Such a system can include electronic devices associated with emergency stop buttons, light curtains, and other machine locks. A safety industrial control system is not optimized for "availability" to operate without error for long periods of time, but is optimized for "safety" to accurately detect unsafe operating conditions and shut down. A safety industrial controller typically provides a predetermined safe state for its outputs upon a safe shutdown, and the predetermined values of these outputs are intended to bring the industrial process into its safest static mode.

[0004] A safety industrial control system can be associated with a "safety integrity level" (SIL) that indicates a given amount of risk reduction. The standard IEC EN 61508 defines four SIL levels from SIL-1 to SIL-4, with higher numbers representing a higher amount of risk reduction.

[0005] Industrial controllers that are part of systems providing SIL-2 and higher levels typically use diagnostic programs that run concurrently with the industrial controller to diagnose the operation of the hardware of the industrial controller to ensure that it is working correctly.

[0006] Safety industrial control systems providing SIL-3 and higher levels preferably provide "full redundancy" in hardware, e.g., by using two different industrial controllers with separate microprocessors, storage systems, communication systems, etc. to provide "full redundancy" in hardware. In such a fully redundant system, the industrial controllers run in parallel and their results are compared. If these results do not match, a "safety fault" can be indicated, causing the control system to change to a safe state.

[0007] As is known to those skilled in the art, one aspect of achieving a desired SIL safety level is to verify the operation of components within a system and detect faults in the components. Comparison of redundant hardware allows an industrial controller to detect differences between each set of hardware. Under normal operation, each path in the redundant hardware operates in the same manner and produces the same output. If the controller detects a difference between the two paths, then that difference indicates that one of the paths is not operating properly and has experienced a fault. The industrial controller can then bring the controlled machine or process into a safe state and provide an indication of the detected fault.

[0008] However, detecting faults in redundant paths is not without its challenges. For example, pairs of analog input signals generated by pairs of sensors are sent via conductors or pairs of redundant conductors and received at an input module or at redundant input modules. The pairs of signals can be filtered and converted from analog signals to digital signals, and then provided as digital values to a processor within the input module. While the two digital values can be compared, the difference between the two values only indicates that a fault exists somewhere between the sensors and the processor within the input module. The technician must conduct additional investigations of the sensors, conductors, and input module to identify the source of the fault before being able to correct the fault.

[0009] Accordingly, it is desirable to provide improved systems and methods for identifying the specific location of a fault in a redundant signal path.

[0010] In some applications, an analog signal can be constant over an extended period of time (e.g., days or weeks). For example, certain production lines can operate at a constant temperature or pressure, and sensors used to monitor the temperature or pressure receive a generally constant voltage signal corresponding to that temperature or pressure. The temperature or pressure may only change when switching to a new part, a new recipe, or for periodic maintenance. However, there is a possibility that during the extended period of time when the signal remains at a constant value, an electronic component within the signal path may fail. For example, if the electronic component is an element of a filter in the signal path, the component may only affect transient or changing signals along the signal path and may not affect a constant value, such as a signal indicating a constant temperature or pressure. Without detecting the faulty component, the electronic component may remain faulty for some time until there is a change in the input signal.

[0011] Accordingly, it is desirable to provide improved systems and methods for detecting faulty electronic components in a redundant signal path without relying on the state of the input signal. SUMMARY OF THE INVENTION

[0012] According to an embodiment of the present invention, a method for testing a filter in a redundant signal path is disclosed. The method includes: generating a test signal at a predefined frequency; injecting the test signal into a first signal path; measuring a first output signal from a first filter operably connected in the first signal path; and determining a first frequency response of the first filter based on the test signal and the first output signal. The test signal is injected into a second signal path, and a second output signal from a second filter operably connected in the second signal path is measured. A second frequency response of the second filter is determined based on the test signal and the second output signal, and the first frequency response is compared with the second frequency response. When the difference between the first frequency response and the second frequency response exceeds a predefined threshold, a fault is identified in the first filter or the second filter.

[0013] According to another embodiment of the present invention, a system for testing a filter in a redundant signal path is disclosed. The system includes a first signal path, a second signal path, a first filter, a second filter, and a processor. The first signal path includes a first input terminal and a first output terminal, wherein the first input terminal is configured to receive an input signal from an external device and the first output terminal is configured to provide a first output signal to at least one processor. The first filter is connected in series along the first signal path between the first input terminal and the first output terminal, wherein the first filter is configured to receive the input signal and generate the first output signal. The second signal path includes a second input terminal and a second output terminal, wherein the second input terminal is configured to receive an input signal from an external device and the second output terminal is configured to provide a second output signal to at least one processor. The second filter is connected in series along the second signal path between the second input terminal and the second output terminal, wherein the second filter is configured to receive the input signal and generate the second output signal. The processor is configured to generate a test signal at a predefined frequency, inject the test signal into the first signal path, measure the first output signal from the first filter, and determine a first frequency response of the first filter based on the test signal and the first output signal. The processor is further configured to inject the test signal into the second signal path, measure the second output signal from the second filter, and determine a second frequency response of the second filter based on the test signal and the second output signal. The processor compares the first frequency response with the second frequency response, and when the difference between the first frequency response and the second frequency response exceeds a predefined threshold, a fault is identified in the first filter or the second filter.

[0014] According to yet another embodiment of the present invention, a method for testing a filter in a redundant signal path of an input module for an industrial controller is disclosed. The method includes: receiving an input signal from an external device at the input module; injecting a test signal into a first signal path by a processor when transmitting the input signal from the external device along a second signal path to the processor of the input module; periodically sampling an output of the first signal path by the processor when injecting the test signal into the first signal path; and determining a first frequency response of the first signal path based on the test signal and the output of the first signal path. The method further includes: injecting a test signal into a second signal path by the processor when transmitting the input signal from the external device along the first signal path to the processor of the input module; periodically sampling an output of the second signal path by the processor when injecting the test signal into the second signal path; and determining a second frequency response of the second signal path based on the test signal and the output of the second signal path. When a difference between the first frequency response and the second frequency response exceeds a predefined threshold, a fault is identified in the first signal path or the second signal path.

[0015] These and other advantages and features of the present invention will become apparent to those skilled in the art from the detailed description and the drawings. However, it should be understood that the detailed description and the drawings, although indicating preferred embodiments of the present invention, are given by way of illustration and not limitation. Many variations and modifications can be made within the scope of the present invention without departing from the spirit of the present invention, and the present invention includes all such modifications. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Various exemplary embodiments of the subject matter disclosed herein are shown in the drawings, wherein like reference numerals always denote like parts, and in the drawings:

[0017] Figure 1 is an environmental view of an exemplary industrial controller in conjunction with one embodiment of the present invention;

[0018] Figure 2 is Figure 1 a partial block diagram representation of the industrial controller;

[0019] Figure 3 is Figure 1 a partial block diagram representation of one embodiment of a redundant signal path of an input module used in the industrial controller;

[0020] Figure 4 is Figure 1 a partial block diagram representation of another embodiment of a redundant signal path of an input module used in the industrial controller;

[0021] Figure 5 isFigure 1 Partial block diagram representation of another embodiment of the redundant signal path of a pair of input modules used in an industrial controller;

[0022] Figure 6 is present in Figures 3 to 5 Block diagram representation of an embodiment of a filter in one of the redundant signal paths; and

[0023] Figure 7 is a graphical representation of the frequency response obtained by the Figure 4 filter.

[0024] In describing the various embodiments of the present invention shown in the drawings, specific terms will be employed for the sake of clarity. However, the present invention is not intended to be limited to the specific terms so selected, and it should be understood that each specific term includes all technical equivalents that operate in a similar manner to achieve a similar purpose. For example, the words "connected", "attached", or terms similar thereto are often used. They are not limited to direct connection, but include connection through other elements, where such connection is considered equivalent by those skilled in the art. Detailed Description

[0025] The various features and advantageous details of the subject matter disclosed herein are described more fully with reference to the non-limiting embodiments described in detail below.

[0026] Systems and methods for identifying the specific location of a fault along a redundant signal path are disclosed. More specifically, the detection of a fault within a filter connected in series along the signal path defines the specific location of the fault. Providing an indication of the detected fault alerts a technician that a particular component or subsystem along the signal path needs to be repaired or replaced. The redundant signal path includes at least a first signal path and a second signal path. The electronic components used in each signal path are identical such that the performance of each signal path is the same. A signal entering the first signal path or the second signal path produces the same signal within the manufacturing tolerances of the electronic components at the corresponding output of each signal path.

[0027] To achieve a desired SIL safety level, an application may need to send input signals along a first signal path and a second signal path. The application may also need to detect a fault condition during operation of the redundant path. That is, when the input signal is also conducted by the redundant path, the input module must test for the correct operation of each signal path. The input module in an industrial controller receives an input signal at a single input terminal, or optionally receives redundant signals at a first input terminal and a second input terminal. The input signal is sent along a first conduction path and a second conduction path. A processor in the input module is configured to generate a test signal at a predefined frequency. According to one aspect of the invention, the predefined frequency is selected as the crossover frequency of the filter under test. The processor is configured to inject the test signal into one of the signal paths at a time. The processor that generates the test signal is also configured to receive an input signal from the redundant signal path. When the processor injects the test signal along one signal path, the processor itself receives the input signal along the other signal path. Along the signal path under test, the test signal may be superimposed on the input signal. Optionally, it can also be contemplated that one or more electronic switching devices such as transistors can be controlled to temporarily disconnect the signal path from the input signal and the signal path itself sends the test signal. The processor receives the test signal output from the filter either separately or superimposed on the input signal and attenuated by the filter. Then, the processor generates a frequency response of the signal output from the filter relative to the original test signal to determine the operation of the filter. After obtaining the frequency response for one of the signal paths, the process is repeated for the other signal path. Since the first signal path and the second signal path are constructed to be identical to each other, the frequency response of the first signal path should match the frequency response of the second signal path. If the difference between the first frequency response and the second frequency response exceeds an allowable amount, the processor detects that one of the two filters along the corresponding signal path has failed.

[0028] First, turning to Figure 1 , an exemplary industrial controller 10 incorporating an embodiment of the present invention is shown. The industrial controller 10 may be configured as a safety controller and includes redundant modules 16, 18 and other hardware configurations according to a desired safety level. The illustrated industrial controller 10 includes a power supply module 12 having a power cable 13 connected to a suitable power source (e.g., a public power grid). The processor module 14 includes at least one processor 30 configured to execute a control program 35 (also see Figure 2) Optionally, the processor module 14 may include: multiple processors arranged in a redundant manner; multiple processors, each configured to perform a dedicated processing task; multiple cores on a single processor chip, each core arranged in a redundant manner or configured to perform a dedicated processing task; or a combination thereof. The processor module 14 is shown connected to the network 15. It is contemplated that the network may be an Ethernet network, an industrial network, a standard network, a proprietary network, an external network, an internal network, a wired network, a wireless network, or any combination thereof. The network 15 may connect the processor module to an operator interface, a programming terminal, a remote rack, etc. Optionally, the industrial controller 10 may further include a dedicated network module (not shown) configured to connect to the network 15 and provide an interface between the processor module 14 and the network 15.

[0029] The first input module 16A and the second input module 16B are provided in a redundant manner. The first input module 16A is connected to the first set of input devices 20A, and the second input module 16B is connected to the second set of input devices 20B. Optionally, the first input module 16A and the second input module 16B may each be redundantly connected to the third set of input devices 21. The input devices 20A, 20B, or 21 may be, for example, switches, sensors, relays, etc. configured to generate input signals for the industrial controller 10. A single block is provided for ease of illustration of each set of input devices 20A, 20B, or 21. However, it is contemplated that many input devices 20A, 20B, or 21 may be located around the controlled machine or process. The first output module 18A and the second output module 18B are provided in a redundant manner. The first output module 18A is connected to the first set of output devices 25A, and the second output module 18B is connected to the second set of output devices 25B. Optionally, the first output module 18A and the second output module 18B may each be redundantly connected to the third set of output devices 28. Each output device 28 in the third set of output devices may include, for example, redundant input terminals, where each redundant input terminal receives one of the output signals 29A, 29B, and the output device 28 verifies that the redundant input signals are the same before responding to the output signal. The output devices 25A, 25B, or 28 may be, for example, valves, switches, solenoids, or other actuators configured to perform a desired control operation on the controlled machine or process in accordance with the output signal from the industrial controller 10. A single block is provided for ease of illustration of each set of output devices 25A, 25B, or 28. However, it is contemplated that many output devices 25A, 25B, or 28 may be located around the controlled machine or process.

[0030] Next, turning to Figure 2 , is shown at least partially in block diagram form Figure 1Industrial controller 10. The processor module 14 includes at least one processor 30 that communicates with a memory 32. The memory 32 can be a single device or multiple devices, and can include volatile memory, non-volatile memory, or a combination thereof. The memory 32 stores a control program 35 configured to be executed by the at least one processor 30. The control program includes a series of instructions for checking the current state of input signals to generate output signals. As is known in the art, the control program 35 can include ladder logic, where each rung 37 is sequentially executed to generate the desired output signal. Optionally, the control program 35 can include a set of instructions from any suitable language to implement the control of the industrial controller 10. The processor module 14 also includes a communication interface 34 configured to connect to a network 15, and a backplane connector 36 configured to connect to a backplane 38, where the backplane 38 extends between the modules in the industrial controller 10 to provide communication between the modules. Optionally, additional communication ports can also be included on one or more of the modules, where dedicated communication cables can be connected between the modules for communication.

[0031] Each input module 16 includes a set of input terminals 40, each input terminal 40 being configured to connect to one of the input devices 20 and receive an input signal 22 from one of the input devices 20. Logic circuitry 42 is connected between the input terminals 40 and a processor 44 within the input module 16. The logic circuitry 42 can perform some initial processing before passing the input signal 22 to the processor 44, such as filtering or converting an analog input signal to a digital signal. It is contemplated that the processor 44 can be: a single processing unit implemented on a single die; multiple processing units, each implemented on a different die; multiple processing units implemented on a single die, or a combination thereof. The processor 44 communicates with a memory 46 within the input module 16. The memory 46 can be a single device or multiple devices, and can include volatile memory, non-volatile memory, or a combination thereof. The memory 46 can include a series of instructions for execution by the processor 44. The memory 46 can also store the value of the input signal 22 for subsequent transmission to the processor module 14. Each input module 16 includes a backplane connector 36 configured to connect to the backplane 38 for communication between the modules.

[0032] According to the illustrated embodiments, each input device 20, 21 is connected to a pair of terminals 40, and the input signals 22, 23 from the input devices are connected to a first input terminal and a second input terminal. According to one aspect of the present invention, the input device 20 may be a paired device, as shown, where the first input device 20A is paired with the second input device 20B. The first input signal 22A from the first sensor arrives at the first terminal 40 and the second input signal 22B arrives at the second terminal. The first input signal 22A and the second input signal 22B are compared by the processor 44 to verify that the two input signals 22A, 22B are the same. Optionally, the two paired input devices (20A, 20B) may each connect their respective input signals 22A, 22B to the pair of input terminals 40, and redundant input signals may be utilized according to application requirements to achieve a desired safety level. According to another aspect of the present invention, a single input device 21 may provide redundant input signals 23A, 23B to two different input modules 16A, 16B. The redundant input modules 16A, 16B communicate with each other via the backplane 38 or via a dedicated communication interface. One or both of the input modules 16A, 16B may be configured to compare the redundant input signals 23A, 23B to verify correct operation. As can be observed in Figure 2 and as will be discussed in more detail in Figures 3 to 5 , it is contemplated that redundant signal paths may be established in many different configurations without departing from the scope of the present invention.

[0033] Each output module 18 includes a set of output terminals 50, each output terminal 50 being configured to connect to one of the output devices 25 and send an output signal 27 to one of the output devices 25. A logic circuit 52 is connected between the processor 54 and the output terminals 50 within the output module 18. The logic circuit 52 may perform some processing before sending the output signal 27 from the processor 54 to the output device 25, such as splitting the output signal to paired output terminals or converting a digital value to an analog signal. The processor 54 communicates with a memory 56 in the output module 18. The memory 56 may be a single device or multiple devices, and may include volatile memory, non-volatile memory, or a combination thereof. The memory 56 may include a series of instructions for execution by the processor 54. The memory 56 may also store the value of the output signal 27 for subsequent use by the processor 54 or by the processor module 14. Each output module 18 includes a backplane connector 36 configured to connect to the backplane 38 for communication between modules.

[0034] Next, turning to Figure 3, a portion of the logic circuit 42 for one embodiment of the redundant signal paths established in a single input module 16 is shown in further detail. Each input signal 22 is connected to the redundant signal paths. According to the embodiment shown, the input signals 22 are each connected to a pair of input terminals 40. The first terminal to which the input signal 22 is connected at least partially defines a first signal path 60, and the second terminal to which the input signal 22 is connected at least partially defines a second signal path 62. The first signal path 60 and the second signal path 62 are each connected to the logic circuit 42 within the input module 16. Within the logic circuit 42, a first filter 70 is connected in series in the first signal path 60, and a second filter 72 is connected in series in the second signal path 62. Each filter 70, 72 can be configured according to application requirements; however, for the same input signal 22, the first filter 70 for each first signal path 60 is configured in the same manner as the corresponding second filter 72 in the second signal path 62. The filters 70, 72 can be, for example, low-pass filters, band-pass filters, notch filters, or high-pass filters. It is contemplated that the filters can be first-order filters, second-order filters, or filters of other configurations. For purposes of illustration herein and without limiting the scope of the invention, the filters 70, 72 will be discussed as second-order low-pass filters. The output terminals 76 of each filter 70, 72 are connected to the processor 44 for comparison between the input signals and for measurement of the input signals.

[0035] If a higher SIL rating and improved diagnostic coverage are desired, the processor 44 can be split into two processors 44, 45, where the output of the first filter 70 is provided to the first processor 44 and the output of the second filter 72 is provided to the second processor 45. The processors 44, 45 can communicate with each other via the backplane 38 or can have a dedicated communication interface 47 established between the two processors. Turning next to Figure 4 and Figure 5 , two exemplary embodiments of the redundant signal paths established for the separate processors are shown.

[0036] In Figure 4 , the single input module 16 includes redundant processors. Similar to Figure 3, the input signals 22 are each connected to a pair of input terminals 40. The first terminal to which the input signal 22 is connected at least partially defines a first signal path 60, and the second terminal to which the input signal 22 is connected at least partially defines a second signal path 62. The first signal path 60 and the second signal path 62 are each connected to a logic circuit 42 within the input module 16. Within the logic circuit 42, a first filter 70 is connected in series in the first signal path 60, and a second filter 72 is connected in series in the second signal path 62. Each of the filters 70, 72 can be configured according to application requirements; however, for the same input signal 22, the first filter 70 for each first signal path 60 is configured in the same manner as the corresponding second filter 72 in the second signal path 62. However, instead of the output terminals 76 of each of the filters 70, 72 being connected to a single processor 44 as shown in Figure 3 , the output terminal 76 of the first filter 70 for each first signal path 60 is connected to a first processor 44, and the output terminal 76 of the second filter 72 for each second signal path 62 is connected to a second processor 45. A dedicated communication interface 47 is provided between the processors 44, 45 and can be, for example, a communication bus on a circuit board on which both processors 44, 45 are mounted.

[0037] In Figure 5In [the figure], paired input modules 16A and 16B provide redundant processors. According to the illustrated embodiment, a third set of input devices 21 is shown, where each input device provides a first input signal 23A to the first input module 16A and a second input signal 23B to the second input module 16B. It is contemplated that the first set of input devices 20A and the second set of input devices 20B can similarly generate a first input signal 22A and a second input signal 22B for the first input module 16A and the second input module 16B, respectively. The first input signal 23A from each input device 21 at least partially defines a first signal path 60, and the second input signal 23B from each input device 21 at least partially defines a second signal path 62. The first signal path 60 and the second signal path 62 are each connected to corresponding logic circuits 42 within the respective input modules 16A, 16B. Within the logic circuit 42 of the first input module 16A, a first filter 70 is connected in series in the first signal path 60, and within the logic circuit 42 of the second input module 16B, a second filter 72 is connected in series in the second signal path 62. Each filter 70, 72 can be configured according to application requirements; however, for the same pair of input signals 23A, 23B, the first filter 70 for each first signal path 60 is configured in the same manner as the corresponding second filter 72 in the second signal path 62. The output terminal 76 of each first filter 70 is provided to the processor 44 in the first input module 16A, and the output terminal 76 of each second filter 72 is provided to the processor 44 in the second input module 16B. A dedicated communication interface 47 is provided between the processors 44 and can be, for example, a backplane 38, a dedicated communication link, or an industrial network 15 connected between the input modules.

[0038] Also referring to Figure 4 , each filter 70, 72 receives an input signal 22 at the input terminal 74 of the filter. The impedances (Z1 to Z4) of the filters 70, 72 are selected to achieve the desired performance of the filters. For convenience and without limitation, the discussion of the illustrated filters 70, 72 will be for low-pass filters with a cut-off frequency at approximately 10 kilohertz (10 kHz). It should be understood that the filters can have various configurations and can be configured to operate at various frequencies according to application requirements. The input signal 22 passes through the filters 70, 72, and the undesired electrical components present on the input signal 22 are attenuated according to the characteristics of the filters. The filtered signal appears at the output terminal 76 of the filters. Then, the filtered signal is used according to application requirements. It is contemplated that the logic circuit 42 can also include additional processing such as analog-to-digital conversion of the analog input signal to a digital value, which is received at the processor 44. Optionally, the logic circuit 42 can include comparators, summing devices, etc., and perform additional processing on the filtered signal before providing the signal to the processor.

[0039] The processor 44 can also be configured to supply a test signal 79 and / or a control signal to the filters 70, 72. The test signal 79 can be added to the input signal 22 at a summing point 80 at the input terminal 74 of the filter. It is contemplated that the test signal will be at least one cycle or a pulse signal of a desired frequency. The desired frequency can be selected according to the characteristics of the filters 70, 72 being evaluated. For a low-pass filter having a cut-off frequency at approximately 10 kilohertz, the desired frequency can be 10 kilohertz. Optionally, the test signal can include multiple frequencies. For example, in order to evaluate the operation of the passband and stopband regions of the filter, in addition to the 10-kilohertz frequency, other frequencies such as 1 kilohertz (1 kHz) and 100 kilohertz (100 kHz) can also be selected. A test signal 79 of at least one complete cycle of each of the desired frequencies, such as a sine signal, can be generated and injected into each of the filters 70, 72 to evaluate the operation of the filter. In some applications, it may be desirable to disconnect the input signal 22 from the filters 70, 72 when the test signal 79 is injected into the filter. A control signal can be generated by the processor 44 and provided to an electronic switch (e.g., a transistor) to disconnect the input signal 22 from the input terminal 74 of the filter when the test signal 79 is applied. Similarly, the output terminals 76 of the filters 70, 72 can be connected to additional processing within the logic circuit 42 for a common input with other signal paths in a redundant signal path, etc., and it may be desirable to disconnect the output terminals 76 of the filters 70, 72 from the additional processing to prevent the test signal 79 from passing through or cross-coupling with the additional processing. Another control signal can be generated from the processor 44 and provided to an electronic switch (e.g., a transistor) to disconnect the output terminals 76 of the filters 70, 72 from the additional processing when the test signal 79 is applied to the filters 70, 72.

[0040] To achieve a desired level of safety, it is desirable to detect a fault in the system soon after the fault occurs in the system and preferably before a second fault that may cause the redundant signal paths to stop working. In some applications, the analog input signal 22 provided to the input module 16 changes frequently. For example, when a product is loaded into a package, the analog input signal can be used to detect the quantity of the product. The signal can be generated by a scale, a level sensor, a pressure sensor, or other sensors that detect the presence of the product when the package is being filled. When the input signal corresponds to the desired fill level, a new package is conveyed to the filling station and the process is repeated. In other applications, the analog input signal 22 provided to the input module 16 can remain generally constant. For example, the analog input signal can be used to measure the temperature in a commercial oven where the product is cured in the commercial oven and the desired temperature is to remain substantially constant. In those applications where the analog input signal changes frequently, the input module 16 can be configured to use the analog input signal 22 as a test signal, monitor the input signal at the inputs of the filters 70, 72, and monitor the filtered output to determine the frequency response of the filters. However, the changing analog input signal may not include electrical components at all the desired frequencies of interest. In addition, in those applications where the analog input signal remains generally constant, the redundant signal paths can be compared to each other to verify the DC level of the analog signal; however, the operation of the filters 70, 72 cannot be verified. A fault in an electronic component such as a resistor or capacitor that defines the impedance (Z1 to Z4) in the filters 70, 72 can affect the dynamic response of the filters. Although some faults can be detected using a variable analog signal, the faults can be frequency-dependent and not all faults can be detected. Similarly, the constant DC value of the analog signal passing through the filters 70, 72 has no dynamic content and cannot detect faults in many of the electronic components within the filters.

[0041] In operation, the processor 44 in the input module 16 can be configured to test the operation of the filters 70, 72 in the redundant signal paths in real time without interrupting the operation of the input module 16. Both the first signal path 60 and the second signal path 62 receive the input signal 22. The processor 44 generates a test signal 79 that is used to verify the operation of the filters 70, 72 in the corresponding signal paths 60, 62. To allow the operation of the industrial controller 10 to continue without interruption during testing, the processor 44 is configured to test one of the signal paths 60, 62 at a time, and the input signal 22 is continuously conducted to the processor 44 through the other of the redundant signal paths. First, the processor 44 can generate the test signal 79 and inject the test signal into the first signal path 60. The input signal 22 is conducted through the second signal path 62 in the absence of the test signal. The processor 44 measures the output 76 of the first filter 70 and determines the frequency response of the first filter 70 based on the test signal and the output signal from the first filter. The processor 44 stops injecting the test signal 79 along the first signal path 60 and can then start injecting the test signal 79 along the second signal path 62. The input signal 22 is conducted through the first signal path 60 in the absence of the test signal. The processor 44 measures the output 76 of the second filter 72 and determines the frequency response of the second filter 72 based on the test signal and the output signal from the second filter. The electronic components selected for each of the filters 70, 72 have nominal values and expected resulting performance. As a result, within the manufacturing tolerances of each of the components, the frequency response determined for the first filter 70 should match the frequency response determined for the second filter 72. Taking into account certain variations such as due to manufacturing tolerances or measurement resolution, the first frequency response is compared with the second frequency response. If the difference between the magnitude of the first frequency response and the magnitude of the second frequency response exceeds a predefined threshold, the processor 44 identifies a fault in either the first filter 70 or the second filter 72. The processor 44 in the input module 16 can send a signal via the backplane 38 to the processor module 14 such that the control program 35 executed in the processor module 14 is aware of the fault and can take any necessary action to place the controlled machine or process in a safe operating state and / or notify a technician of the fault.

[0042] Generate a test signal at a desired frequency, where the desired frequency can be selected based on the characteristics of the filters 70, 72 being evaluated. The electronic components selected for the filters have nominal values and expected resulting performance. For a low-pass filter, one operating point of the filter that can be tested is the cut-off frequency. When a signal is input to the filters 70, 72 at the cut-off frequency, the filters 70, 72 attenuate the input signal 22 by 3 decibels (3 dB). The 3 dB attenuation of the input signal 22 is achieved by A factor of or approximately 0.707 reduces the amplitude of the signal. At this amplitude, the attenuation of filters 70, 72 is significant, but the amplitude of the signal is still sufficient such that changes in amplitude are readily detectable.

[0043] Also refer to Figure 7 , a graphical representation 100 of the performance of filters 70, 72 in one of the signal paths connected in the signal path is shown. A baseline curve 102 corresponding to the expected operation of the filter is shown. An operating point 105 corresponding to the cut-off frequency is shown. Four additional curves 104, 106, 108, 110 are also shown, which demonstrate the exemplary operation of filters 70, 72, where at least one of the electronic components constituting the filter has failed completely or partially such that the actual resistance or capacitance of the component is outside the expected manufacturing tolerances of the corresponding component. A comparison of the amplitudes of the frequency responses at the operating point 105 shows the difference in the amplitude of the frequency response of the baseline curve 102 compared to the amplitudes of the four additional curves 104, 106, 108, 110.

[0044] According to one aspect of the present invention, the baseline frequency response 102 can be stored in the memory 46 and accessed by the processor 44 of the input module. The baseline frequency response can be determined based on the nominal values of the components present in filters 70, 72 during the manufacture of the input module 16. Optionally, the baseline frequency response 102 can be determined during the debugging process of the input module 16. The initial frequency response of filters 70, 72 can be measured and stored in the memory 46 such that the baseline frequency response 102 corresponds to the actual values of the electronic components used in filters 70, 72 of each input module 16.

[0045] The baseline frequency response 102 can be used to detect a second fault condition. As discussed above, the processor 44 is configured to sequentially inject a test signal into each of the signal paths of the redundant signal paths. The frequency response obtained from the first signal path is compared with the frequency response obtained from the second signal path. If the difference between the first frequency response and the second frequency response exceeds a first predefined threshold, this indicates an error in one of the two filters 70, 72 along the corresponding signal path. However, if the two filters 70, 72 experience a common fault mode, for example due to an unexpected input signal that damages the two filters 70, 72 in a similar manner, the comparison of the two frequency responses may not detect a fault in the two filters 70, 72. Therefore, the processor 44 can also be configured to compare the first frequency response and the second frequency response with the baseline frequency response. The baseline frequency response may have been stored during the manufacturing or commissioning of the input module 16. If the difference between the first frequency response or the second frequency response and the baseline frequency response exceeds a second predefined threshold, the processor 44 identifies a fault in the filter 70, 72 corresponding to the frequency response whose change amount relative to the baseline frequency response is greater than the predefined threshold. It is conceivable that the second predefined threshold can be configured to be the same value or a different value as the first predefined threshold. In addition to detecting sudden changes in the two filters 70, 72, the comparison of the first frequency response and the second frequency response with the baseline frequency response can be used to detect a gradual change in the electronic component values over time.

[0046] It is conceivable that the processor 44 is configured to periodically test the operation of the redundant signal paths. As discussed previously, certain applications generate generally constant analog input signals to the input module 16. The processor 44 can generate a test signal and inject the test signal into each signal path periodically. The frequency at which the processor 44 generates the test signal can be defined by a parameter stored in the memory 46 of the input module and can be configured according to the application requirements. It is conceivable that the test signal can be generated at intervals that range, for example, from a few seconds to several minutes or even daily. Each time the test signal is injected into each signal path, the processor 44 determines the frequency response and checks whether a fault has occurred in the filters 70, 72 in either signal path. Therefore, even in the presence of a constant input signal, the processor 44 can detect a fault in the signal path, such that the processor 44 can take appropriate measures according to the desired safety level to place the controlled machine or process in a safe operating state.

[0047] In some applications, it may not be desirable to conduct the input signal 22 through the signal path when testing the signal path. Depending on the application requirements and the design of the redundant signal paths, there is a possibility of transmitting or coupling the injected test signal to a signal path that is not currently being tested. One or more electronic switches can be operably connected to each signal path. When a test signal is injected into a signal path, the electronic switch can be used to disconnect the input signal from the input of the filter. In some applications, each signal path can be connected to a common connection, where cross-coupling via the common connection may occur, and it may be desirable to disconnect the signal path from the common connection. It should be understood that electronic switches can be added to the signal path as needed to isolate one signal path from another during the injection of the test frequency.

[0048] For a low-pass filter having a cut-off frequency at approximately 10 kilohertz, the desired frequency can be 10 kilohertz. Optionally, the test signal can include multiple frequencies. For example, to evaluate the operation of the passband and stopband regions of the filter, in addition to the 10 kilohertz frequency, other frequencies such as 1 kilohertz (1 kHz) and 100 kilohertz (100 kHz) can also be selected. A test signal 79 of at least one complete cycle of each frequency in the desired frequencies, such as a sine signal, can be generated and injected into each of the filters 70, 72 to evaluate the operation of the filter. The test signals of each frequency can be sequentially injected into the first signal path, and the frequency response can be determined for the first signal path at each frequency. Then, the test signals of each frequency can be sequentially injected into the second signal path, and the frequency response can be determined for the second signal path at each frequency. The frequency response of the first signal path is compared with the frequency response of the second signal path at each frequency. When a difference between the frequency responses of the two signal paths is detected at any of the test frequencies, a fault in one of the filters 70, 72 in the signal path can be identified. For example, when one signal path is operating normally and exhibits a frequency response similar to the baseline frequency response 102 shown in Figure 7 while the other signal path has experienced a fault that results in a frequency response similar to the frequency response shown by the curve 104 in Figure 7 , injecting signals of multiple frequencies may be particularly useful. Although the shapes of the frequency responses 102 and 104 are substantially different, the amplitudes of the frequency responses at 1 kilohertz (1 kHz) and 10 kilohertz (10 kHz) are quite consistent. The difference at this frequency in the passband and at the cut-off frequency may not be sufficient to exceed a predefined threshold, and thus, the fault will be overlooked. However, the amplitudes of the frequency responses 102 and 104 at 100 kilohertz (100 kHz) in the stopband are substantially different, and the processor 44 will identify the fault in the filter presenting the frequency response shown by the curve 104.

[0049] The present invention has been discussed above with respect to a pair of redundant signal paths. The above invention is not intended to be limiting, but is used as an embodiment of the present invention for convenience. The concepts discussed above can also be applied to more than two redundant signal paths. Test signals can be sequentially injected into the first signal path, the second signal path, the third signal path, and any other signal paths. The comparison between the signal paths can still identify the differences between the signal paths, which indicates that a filter in at least one of the signal paths has failed.

[0050] In some applications, three signal paths can be configured for redundant operation. If at least two of the three signal paths operate correctly, the operation can be allowed to continue. As an initial check, the signal paths can be compared with each other. If the frequency responses of all three paths are the same, it is possible that all three paths operate correctly. However, there is a possibility that each of the three signal paths has experienced a common failure and each operates in the same (but incorrect) manner. If the signal paths are not only compared with each other, but also with a baseline frequency response, the processor 44 can detect such a failure. In addition, if the initial check indicates that at least one of the signal paths has failed, the processor 44 can compare the frequency response of one of the two matching signal paths with the baseline frequency response. Then, the processor 44 can determine whether the two matching signal paths operate correctly, or whether both signal paths have failed and only a single path operates correctly. The processor 44 in the input module 16 can generate a report message accordingly and send the message to the processor module 14, so that the control program executed on the processor module can place the controlled machine or process in a safe operating state if necessary.

[0051] It should be understood that the present invention is not limited in its application to the details of the construction and arrangement of the components set forth herein. The present invention is capable of other embodiments and of being practiced or carried out in various ways. The foregoing variations and modifications are within the scope of the present invention. It should also be understood that the invention as disclosed and defined herein extends to all alternative combinations of two or more separate features mentioned or evident from the text and / or drawings. All such different combinations constitute various alternative aspects of the present invention. The embodiments described herein illustrate the best-known mode of practicing the present invention and will enable other technicians in the art to utilize the present invention.

Claims

1. A method for testing filters in a redundant signal path, the method comprising the following steps: Generating a test signal at a predefined frequency; Injecting the test signal into a first signal path; Measuring a first output signal from a first filter operably connected in the first signal path; Determining a first frequency response of the first filter based on the test signal and the first output signal; Injecting the test signal into a second signal path; Measuring a second output signal from a second filter operably connected in the second signal path; Determining a second frequency response of the second filter based on the test signal and the second output signal; Comparing the first frequency response with the second frequency response; And Identifying a fault in the first filter or the second filter when a difference between the first frequency response and the second frequency response exceeds a predefined threshold.

2. The method according to claim 1, further comprising the following steps: Receiving an input signal on the second signal path when injecting the test signal into the first signal path; And Receiving the input signal on the first signal path when injecting the test signal into the second signal path.

3. The method according to claim 2, wherein, The first filter and the second filter are part of an input module of an industrial controller, and the method further comprises the following steps: Executing a control program on a processor module of the industrial controller, wherein: When the control program is executed, the control program receives the input signal from the first signal path or the second signal path, and When the processor module executes the control program, the input module generates the test signal and injects the test signal into the first signal path and the second signal path.

4. The method according to claim 2, wherein, Both the first signal path and the second signal path are connected to a common input terminal, and the method further comprises the following steps: Disconnecting the first signal path from the common input terminal when injecting the test signal into the first signal path; and Disconnecting the second signal path from the common input terminal when injecting the test signal into the second signal path.

5. The method according to claim 1, wherein The test signal is a periodic signal, and at least one period of the periodic signal is generated and injected into both the first signal path and the second signal path.

6. The method according to claim 1, wherein, The test signal includes a plurality of predefined frequencies, and the method further comprises the following steps: Generating the test signal at each of the plurality of predefined frequencies; Injecting the test signal into the first signal path at each of the plurality of predefined frequencies; Measuring the first output signal from the first filter at each of the plurality of predefined frequencies; At each of the plurality of predefined frequencies, determining the first frequency response of the first filter based on the test signal at each of the plurality of predefined frequencies and the corresponding first output signal; Inject the test signal into the second signal path at each of the plurality of predefined frequencies; Measure the second output signal from the second filter at each of the plurality of predefined frequencies; Determine the second frequency response of the second filter based on the test signal and the corresponding second output signal at each of the plurality of predefined frequencies; Compare the first frequency response with the second frequency response for each of the plurality of predefined frequencies; and Identify a fault in the first filter or the second filter when the difference between the first frequency response and the second frequency response exceeds the predefined threshold at any of the plurality of predefined frequencies.

7. The method according to claim 1, further comprising the steps of: Store at least one of an initial first frequency response or an initial second frequency response; Compare at least one of the first frequency response or the second frequency response with the stored initial first frequency response or initial second frequency response, respectively; Identify a fault in the first filter when the difference between the first frequency response and the initial first frequency response exceeds a second predefined threshold; and Identify a fault in the second filter when the difference between the second frequency response and the initial second frequency response exceeds the second predefined threshold.

8. A system for testing filters in a redundant signal path, the system comprising: A first signal path including a first input terminal and a first output terminal, wherein the first input terminal is configured to receive an input signal from an external device and the first output terminal is configured to provide a first output signal to at least one processor; A first filter connected in series along the first signal path between the first input terminal and the first output terminal, wherein the first filter is configured to receive the input signal and generate the first output signal; A second signal path including a second input terminal and a second output terminal, wherein the second input terminal is configured to receive the input signal from the external device and the second output terminal is configured to provide a second output signal to the at least one processor; A second filter connected in series along the second signal path between the second input terminal and the second output terminal, wherein the second filter is configured to receive the input signal and generate the second output signal; and A processor configured to: Generate a test signal at a predefined frequency; Inject the test signal into the first signal path; Measure the first output signal from the first filter; Determine the first frequency response of the first filter based on the test signal and the first output signal; Inject the test signal into the second signal path; Measure the second output signal from the second filter; Determine the second frequency response of the second filter based on the test signal and the second output signal; Compare the first frequency response with the second frequency response; and When the difference between the first frequency response and the second frequency response exceeds a predefined threshold, a fault is identified in the first filter or the second filter.

9. The system according to claim 8, wherein The processor is further configured to:[[]] When injecting the test signal into the first signal path, receive the input signal on the second signal path; and When injecting the test signal into the second signal path, receive the input signal on the first signal path.

10. The system according to claim 9, wherein The first filter, the second filter, and the processor are part of an input module of an industrial controller, and wherein the processor is further configured to:[[]] When a processor module in the industrial controller executes a control program, send the input signal from the first signal path or the second signal path to the processor module, and When the processor module executes the control program, generate the test signal and inject the test signal into the first signal path and the second signal path.

11. The system according to claim 9, further comprising:[[]] A first electronic switch configured to isolate the first signal path at least in part in response to a first control command generated by the processor, wherein the processor is further configured to, when injecting the test signal into the first signal path, isolate the first signal path using the first control command; and A second electronic switch configured to isolate the second signal path at least in part in response to a second control command generated by the processor, wherein the processor is further configured to, when injecting the test signal into the second signal path, isolate the second signal path using the second control command.

12. The system according to claim 8, wherein, The test signal is a periodic signal, and at least one period of the periodic signal is generated and injected into both the first signal path and the second signal path.

13. The system according to claim 8, wherein, The test signal includes a plurality of predefined frequencies, and wherein the processor is further configured to:[[]] Generate the test signal at each of the plurality of predefined frequencies; Inject the test signal into the first signal path at each of the plurality of predefined frequencies; Measure the first output signal from the first filter at each of the plurality of predefined frequencies; At each of the plurality of predefined frequencies, determine the first frequency response of the first filter based on the test signal and the corresponding first output signal at each of the plurality of predefined frequencies; Inject the test signal into the second signal path at each of the plurality of predefined frequencies; Measure the second output signal from the second filter at each of the plurality of predefined frequencies; At each of the plurality of predefined frequencies, determine the second frequency response of the second filter based on the test signal and the corresponding second output signal at each of the plurality of predefined frequencies; For each of the plurality of predefined frequencies, compare the first frequency response with the second frequency response; and When the difference between the first frequency response and the second frequency response exceeds the predefined threshold at any one of the plurality of predefined frequencies, a fault is identified in the first filter or the second filter.

14. The system according to claim 8, further comprising a memory communicating with the processor, wherein, The processor is further configured to: Store at least one of an initial first frequency response or an initial second frequency response in the memory; Compare at least one of the first frequency response or the second frequency response with the stored initial first frequency response or initial second frequency response, respectively; When the difference between the first frequency response and the initial first frequency response exceeds a second predefined threshold, a fault is identified in the first filter; And When the difference between the second frequency response and the initial second frequency response exceeds the second predefined threshold, a fault is identified in the second filter.

15. A method for testing filters in a redundant signal path of an input module for an industrial controller, the method comprising the steps of: Receiving an input signal from an external device at the input module; When transmitting the input signal from the external device along a second signal path to a processor of the input module, injecting a test signal into a first signal path by the processor; When injecting the test signal into the first signal path, periodically sampling the output of the first signal path by the processor; Determine a first frequency response of the first signal path based on the test signal and the output of the first signal path; When transmitting the input signal from the external device along the first signal path to the processor of the input module, injecting the test signal into the second signal path by the processor; When injecting the test signal into the second signal path, periodically sampling the output of the second signal path by the processor; Determine a second frequency response of the second signal path based on the test signal and the output of the second signal path; And When the difference between the first frequency response and the second frequency response exceeds a predefined threshold, a fault is identified in the first signal path or the second signal path.

16. The method according to claim 15, wherein: The first signal path includes a first filter; Inject the test signal into the first signal path at an input of the first filter; The first frequency response corresponds to the operation of the first filter; The second signal path includes a second filter; Inject the test signal into the second signal path at an input of the second filter; and The second frequency response corresponds to the operation of the second filter.

17. The method according to claim 15, wherein: the test signal is a periodic signal, inject at least one period of the periodic signal into the first signal path, and inject at least one period of the periodic signal into the second signal path.

18. The method according to claim 15, wherein: the test signal includes a plurality of predefined frequencies, for each of the plurality of predefined frequencies, inject the test signal into the first signal path and the second signal path, for each of the plurality of predefined frequencies, determine the first frequency response and the second frequency response, and when the difference between the first frequency response and the second frequency response exceeds the predefined threshold at any one of the plurality of predefined frequencies, identify a fault in the first signal path or the second signal path.

19. The method according to claim 15, further comprising the steps of: store at least one of the initial first frequency response or the initial second frequency response; compare at least one of the first frequency response or the second frequency response with the stored initial first frequency response or initial second frequency response, respectively; when the difference between the first frequency response and the initial first frequency response exceeds a second predefined threshold, identify a fault in the first signal path; and when the difference between the second frequency response and the initial second frequency response exceeds the second predefined threshold, identify a fault in the second signal path.

Images