Method for monitoring a communication connection

Abstract

The invention relates to a method for monitoring a communication connection between a first subscriber (1) and a second subscriber (2), in which a first processing program (P1) is executed periodically at a first cycle time (ZT1), in order to monitor the communication connection, a first diagnostic unit (D1) having a first time counter (Z1) is operated in the first subscriber (1), the arrival of a first telegram (T1) from the second subscriber (2) activates a first time counter (Z1), and the arrival of a second telegram (T2) from the second subscriber (2) is monitored by means of the first time counter (Z1) within a predeterminable first monitoring time (WDT1), in the first diagnostic unit (D1), a difference between the first monitoring time (WDT1) and the first time counter (Z1) forms a remaining time limit (RLZ), and whether the remaining time limit (RLZ) is less than or equal to the first cycle time (ZT1) is checked, and if so, a monitoring signal (TO) is generated.

Description

Technical Field

[0001] The present invention relates to a method for monitoring a communication connection between a first subscriber and a second subscriber, wherein a first processing program having a first cycle time is periodically executed in the first subscriber, and in order to monitor the communication connection, a first diagnostic unit having a first time counter is operated in the first subscriber, so that the arrival of a first telegram from the second subscriber starts the first time counter, wherein the arrival of a second telegram from the second subscriber is monitored within a predeterminable first monitoring time by means of the first time counter. Background Art

[0002] Such a monitoring method is already known from EP 1 484 655 A1, in which, in response to a sent telegram, the receipt of a corresponding reply signal in a further telegram is monitored during a monitoring time.

[0003] For the communication between the F-CPU and the output element shown there, the "maximum reaction time in the event of an error" is the "maximum reaction time without error" (in the figure WCDT total) + monitoring time (PROFIsafe timeout) + cycle time of the output element - cycle time of the send unit. Summary of the invention

[0004] The object of the invention is to reduce the maximum reaction time in the event of an error.

[0005] This object is achieved in that in the first diagnostic unit a remaining period is formed from the difference between the first monitoring time and the first time counter and a check is made as to whether the remaining period is less than or equal to the first cycle time and, if this is the case, a monitoring signal is generated.

[0006] Until now, the arrival of a new telegram or a new correct safety PDU (Protocol Data Unit) at the F device driver has been monitored within a monitoring time, i.e., the watchdog time, so that an error reaction is initiated if the watchdog time expires. The receipt of a new telegram restarts the watchdog time. Before checking for a new telegram, a check is performed to see whether the watchdog time has expired.

[0007] According to the invention, a reaction is now initiated if the remaining duration of a time counter for a monitoring time, in particular for a device-specific monitoring time, is less than the cycle time or less than the device-specific cycle time.

[0008] The method is advantageously run in a safety-related system in the presence of a communication connection between a first subscriber and a second subscriber, and in this case a first processing program in the first subscriber switches from a received process value to a substitute value in the presence of a monitoring signal, wherein the switch is already carried out in a cycle in which a check shows that the remaining period is less than or equal to the first cycle time.

[0009] In the case of safety systems, reaction times must be taken into account not only for the worst case scenario, but also for the worst case scenario in the event of an error. For this purpose, the safety function response time (SFRT) is defined, which includes the bus runtime, the cycle time of the controller, the cycle time of the peripherals and the watchdog time.

[0010] In the subscriber or in the component, the monitoring time or WD time is run in the component, and the reaction is not only made when the WD time expires, but when the remaining period of the WD time is less than the cycle time of the component. Because even if a new telegram is received until the next cycle, it is necessary to react safely to the expired WD time. Due to this solution, the cycle time of the evaluation component can be saved, during which the WD time continues to run. Advantageously, the cycle time is now saved and the reaction time in the event of an error is therefore reduced. This makes it possible to reduce the size of the device, for example, to introduce a smaller safety distance, because, for example, the machine can be stopped more quickly.

[0011] This method also offers time advantages when used in a communication operation from a second subscriber as input device via a first subscriber as automation controller to a third subscriber as output device, whereby the maximum reaction time to error situations in the communication is minimized and error situations are reacted to safely.

[0012] The method can also be used to standardize communication protocols for transmitting safety-related data in automation applications with functional safety.

[0013] Until now, the worst case delay time (WCDT) has been calculated and the maximum WD time has been added to the cycle time of the relevant component in which the WD time runs, as required in the PROFIsafe standard IEC 61784-3-3. With the present invention, this method can be implemented in the PROFIsafe F-IO driver so that the evaluation is performed automatically and the reaction time is therefore faster.

[0014] The method is also used to reduce the distance between an operator and a triggering device during operation of a hazardous machine.

[0015] Thanks to this solution, the cycle time for evaluating the components (in which the WD time runs) can be saved.

[0016] Example calculation:

[0017] CPU cycle = 100ms

[0018] Safety program runtime (FPROG) = 5ms

[0019] Bus time = 5ms

[0020] F-DI (DAT = 10ms, WCDT = 13ms)

[0021] F-DO (DAT = 10ms, WCDT = 16ms)

[0022] DAT = Device Acknowledgement Time

[0023] HAT = Host Acknowledgement Time

[0024] SFRT safety function response time

[0025] Bus operation time,

[0026] The controller cycle time,

[0027] Cycle time of peripheral devices

[0028] Watchdog time (WD time)

[0029] F-WD time: Fail-safe watchdog time

[0030] (-> Time when new telegrams must be received)

[0031] WCDT: Worst Case Delay Time

[0032] (Maximum response time without error)

[0033] SFRT: Safety Function Response Time

[0034] (Maximum reaction time in case of error)

[0035] MNR Monitoring Numbers (MNR)

[0036] Monitoring digital means ensuring the authenticity and correct sequence of transmitted security PDUs

[0037] DAT equipment confirmation time

[0038] HAT host confirmation time

[0039] Considerations for F-communication between F-DI and F-CPU or SFRT for safety functions in F-DI → F-CPU → F-DO

[0040] Formula for the minimum PROFIsafe monitoring time (WD_TIME)

[0041] WD_Time formula: = DAT + 2x bus + HAT ( CPU周期 ) + margin

[0042] Formula for maximum reaction time in the presence of error (SFRT)

[0043] The formula so far

[0044] SFRT 旧 :=WCDT + Max(WD_Time FDI←→CPU + Cycle CPU – Cycle FDI ; WD time CPU←→F-DO + Cycle FDO – Cycle CPU )

[0045] Formula to check if the current state has not expired

[0046] WD_time < HAT CPU周期

[0047] SFRT 新 :=WCDT + Max(WD_Time FDI←→CPU – Cycle FDI ; WD_Time CPU←→FDO – Cycle FDO )

[0048] Comparison of SFRT 旧 With SFRT 新 It is concluded that for SFRT 新 The reaction time of HAT is reduced CPU周期 or cycle FDO .

[0049] Example calculation A:

[0050] CPU cycle = 100ms, F program runtime (FPROG) = 5ms, ET200MP F-DI 16 (cycle = 5ms, DAT = 10ms, WCDT = 13ms), ET200MP F-DQ 8 (cycle = 5ms, DAT = 10, WCDT 16ms) and bus = 5

[0051] WD_Time:=100 CPU周期 + 2x5 bus + 10 DAT（FDI或FDO） + 10 余量 = 130 ms

[0052] WCDT := 13 WCDT-FDI + 5 总线 +100 CPU周期 + 5 FPROG + 5 总线 + 16 WCDT-FDO = 144ms

[0053] SFRT 旧 := 144 WCDT +Max (130 WD_时间 +100 CPU周期 – 5 周期-FDI；

[0054] 130 WD_时间 + 5 FDO周期 – 100 CPU周期 ) = 144ms + Max (225ms; 25ms) = 369ms

[0055] SFRT 新 :=144 WCDT +Max (130 WD_时间 -5 周期-FDI ; 130 WD_时间 -100 CPU周期 )=144ms + Max(125ms; 30ms)= 269ms → Save 100ms or 27%

[0056] Since in the current cycle the WD_time exists at 30ms (130-100) and the F cycle is 100ms, an immediate reaction can be made.

[0057] Example calculation B:

[0058] CPU cycle = 30ms, F program runtime (FPROG) = 5ms, ET200MP F-DI 16 (cycle = 5ms, DAT = 10ms, WCDT = 13ms), ET200MP F-DQ 8 (cycle = 5ms, DAT = 10, WCDT 16ms) and bus = 5ms

[0059] WD_Time:=30 CPU周期 + 2x5 bus + 10 DAT（FDI或FDO） + 5 余量 = 55ms

[0060] WCDT := 13 WCDT-FDI + 5 总线 + 30CPU周期 + 2 FPROG + 5 总线 + 16 WCDT-FDO = 71ms

[0061] SFRT 旧 := 71 WCDT + Max (55 WD_时间 + 30 CPU周期 - 5 周期-FDI；

[0062] 55 WD_时间 + 5 周期-FD - 30 CPU周期 ) = 71ms + Max (80ms; 30ms) = 151ms

[0063] SFRT 新 := 71 WCDT + Max (55 WD_时间 - 5 周期-FDI ; 55 WD_时间 - 30 CPU周期 )

[0064] =71ms + Max (50ms; 25ms) = 121ms → Save 30ms or 20%

[0065] Since in the current cycle the WD_time exists at 25ms (55-30) and the F cycle is 30ms, an immediate reaction can be made.

[0066] Example calculation C:

[0067] CPU cycle = 10ms, F program runtime (FPROG) = 5ms, ET200MP F-DI 16 (cycle = 5ms, DAT = 10ms, WCDT = 13ms), ET200MP F-DQ 8 (cycle = 5ms, DAT = 10, WCDT 16ms) and bus = 5ms

[0068] WD_Time:=10 CPU周期 + 2x5 总线 + 10 DAT（FDI或FDO） + 5 余量 = 35ms

[0069] WCDT := 13 WCDT-DI + 5 总线 + 10 CPU周期 + 2 FPROG + 5总线 + 16 WCDT-FDO = 51ms

[0070] SFRT 旧 := 51 WCDT + Max (35 WD_时间 + 10 CPU周期 - 5 周期-FDI ;

[0071] 35 WD_时间 + 5 周期-FD - 10 CPU周期 ) = 51ms + Max (40ms; 30ms) = 91ms

[0072] SFRT 新 := 51 WCDT + Max (35 WD_时间 - 5 周期-FDI ; 35 WD_时间 - 10 CPU周期 )

[0073] = 51ms + Max (30ms; 25ms) = 81ms → Save 10ms or 11%

[0074] Since the WD_time exists at 5ms in the current cycle (35-3x10) and the F cycle is 10ms, the reaction can be immediate.

[0075] Example calculation D:

[0076] CPU cycle = 10ms, F program runtime (FPROG) = 5ms, ET200MP F-DI 16 (cycle = 5ms, DAT = 10ms, WCDT = 13ms), ET200SP F-DQ 4 (cycle = 16ms, DAT = 20, WCDT 32ms) and bus = 5ms

[0077] WD_Time FDI←→CPU :=10 CPU周期 + 2x5 总线 + 10 DAT（FDI） + 5 余量 =35ms

[0078] WD_Time CPU←→FDO :=10 CPU周期 + 2x5 总线 + 20 DAT（FDO） + 5 余量 =45ms

[0079] WCDT := 13 WCDT-DI + 5 总线 + 10 CPU周期 + 2 FPROG + 5 总线 + 32 WCDT-FDO = 67ms

[0080] SFRT 旧 := 67 WCDT + Max (35 WD_时间（FDI / CPU） + 10 CPU周期 - 5 周期-FDI ;

[0081] 45 WD_时间（CPU / FDO） + 16 周期-FD - 10 CPU周期 ) = 67ms + Max (40ms; 51ms) = 118 ms

[0082] SFRT 新 := 67 WCDT + Max (35 WD_时间（FDI / CPU） -5 周期-FDI ; 45 WD_时间（CPU / FDO） - 10 CPU周期 )

[0083] =67ms + Max (30ms; 35ms) =102 ms → Save 16ms or 13.6%

[0084] Since in the current cycle the WD_time exists at 13ms (45-2x16) and the F-DO period is 16ms, the reaction can be immediate.

[0085] Notes:

[0086] WCDT: Worst Case Delay Time or maximum response time in the absence of errors.

[0087] Considerations for F-CPU to F-CPU or SFRT communication for safety functions in F-DI → F-CPU1 → F-CPU2 → F-DO

[0088] Formula for minimum monitoring time (WD_TIME) for CPU-CPU communication

[0089] WD_Time CPU-CPU Formula: =CPU1 cycle + 2x bus + CPU2 cycle + margin

[0090] Formula for the maximum reaction time in the presence of errors (SFRT, on transfer from CPU to CPU)

[0091] The formula so far

[0092] SFRT 旧 := WCDT + WD_time CPU-CPU +CPU2 cycles （接收器） – CPU1 cycles （发送器）

[0093] Has a formula to check if the current status has not expired

[0094] WD_time < CPU2 cycles （接收器）

[0095] SFRT 新 := WCDT + WD_time CPU-CPU – CPU1 cycles

[0096] SFRT 旧 With SFRT 新 The comparison of the results shows that for SFRT 新 The response time is reduced by CPU2 cycles.

[0097] Example calculation E:

[0098] CPU1 cycle = 50ms, F program runtime 1 (FPROG1) = 5ms, CPU2 cycle = 100ms, F program runtime 2 (FPROG2) = 5ms, ET200MP F-DI 16 (cycle = 5ms, DAT = 10ms, WCDT = 13ms), ET200MP F-DQ 8 (cycle = 5ms, DAT = 10, WCDT 16ms), Bus 1 FDI-CPU1 = 5ms, bus 2 CPU1-CPU2 = 5ms and bus 3 CPU2-FDO = 5ms

[0099] WD_Time2 CPU1-CPU2 := 50 CPU1周期 + 2x5 总线2 +100 CPU2周期 + 10 余量 = 170ms

[0100] WCDT := 13 WCDT-DI + 5 总线1 +50 CPU1周期 + 5 FPROG1 + 5 总线2 +100 CPU2周期 + 5 FPROG2+16 WCDT-DO = 199ms

[0101] SFRT 旧（超时CPU-CPU） := 199 WCDT + 170 WD_时间-CPU-CPU +100 CPU2周期 – 50 CPU1周期 = 419ms

[0102] SFRT 新（超时CPU-CPU） :=199 WCDT + 170 WD_时间-CPU-CPU -50 CPU1周期 = 319ms → Save 100ms or 21% due to SFRT 新（超时FDI-CPUs） Bigger

[0103] Since in the current cycle the WD_time exists at 70ms (170-100) and the F cycle is 100ms, an immediate reaction can be made.

[0104] SFRT 旧（超时FDI-CPU1） := 199 WCDT + 80 WD_时间（FDI / CPU1） +50 CPU1周期 - 5 周期-FDI = 324ms

[0105] SFRT 新（超时FDI-CPU1） :=199 WCDT + 80 WD_时间（FDI / CPU1） - 5 周期-FDI = 274ms → Smaller than SFRT 新（超时CPU-CPU） Therefore, SFRT 新（超时CPU-CPU） is decisive)

[0106] SFRT 旧（超时CPU2-FDO） := 199 WCDT + 130 WD_时间（CPU2 / FDO） + 5 周期-FDO - 100 CPU周期 = 234ms

[0107] SFRT 新（超时CPU2-FDO） :=199 WCDT + 130 WD_时间（CPU2 / FDO） – 100 CPU周期 = 229ms → Smaller than SFRT 新（超时CPU-CPU） Therefore, SFRT 新（超时CPU-CPU） is decisive)

[0108] Notes:

[0109] WCDT: Worst Case Delay Time or maximum response time in the absence of errors.

[0110] Further explanation of the term "timeout", a person skilled in the art understands that a timeout refers to a watchdog when using PROFIsafe. The watchdog checks whether a "new" valid Profisafe telegram arrives within the watchdog time. Telegrams are sent cyclically via Profinet (communication protocol), for example every 4ms. However, the PROFIsafe telegrams are only updated in the cycle of the F program in the CPU.

[0111] Assuming that the F program is initiated every 30ms and the bus cycle time is 4ms, then the Profisafe telegram is sent in 4ms intervals, but the Profisafe telegram is only updated every 30ms. Profinet continues to send old telegrams until there is a new telegram. Only when a new telegram arrives is the Profisafe watchdog reset.

[0112] The minimum watchdog time is therefore here -34 ms, whereby the system is fully "capable" of functioning even though a new telegram actually arrives every 4 ms.

[0113] However, if only one message is lost, the watchdog will be activated immediately. In order to achieve better availability here, the watchdog time should be calculated more generously (program runtime of the F program, its update time, bus cycle, time of missing telegrams, etc.). So instead of 34 ms, for example 100 ms can be used, as long as the safety requirements tolerate this situation.

[0114] If the watchdog cannot be increased, because the safety system must react so quickly, the cycle time of the safety program and the bus cycle time must be reduced, which may require faster hardware.

[0115] The parameter "F_WD_time" is the monitoring time in the fail-safe DP standard slave / IO standard device / PA field device. Within the monitoring time, a valid and current safety telegram must arrive from the target device. This ensures that failures and malfunctions are detected and corresponding reactions are triggered, which keep the F system in a safe state or convert it into a safe state. The monitoring time should be high enough on the one hand to be able to tolerate telegram delays caused by communication, but in the event of an error (e.g. interruption of the communication connection) the error response function should react quickly enough. The parameter "F_WD_time" is specified in steps of 1 ms and the value range of the parameter is limited by the GSD file.

[0116] The object mentioned at the outset is also achieved by an automation controller, which for this purpose comprises: a diagnostic unit for monitoring a communication connection with an input device, a processor, which is designed to execute a processing program cyclically with a first cycle time, the diagnostic unit in this case being designed to have a first time counter, which is started when a first telegram arrives, and is also designed to monitor the arrival of a second telegram from the input device within a predeterminable first monitoring time with the aid of the first time counter, the diagnostic unit being designed to form a remaining period from the difference between the first monitoring time and the first time counter, and also being designed to check whether the remaining period is less than or equal to the first cycle time and to generate a monitoring signal if this is the case.

[0117] In an improvement, the automation controller is designed as a controller designed for functional safety and is designed so that the processing program switches from the received process value to the substitute value when a monitoring signal is present, wherein the switch is already performed in a cycle and a check is performed in the cycle to determine that the remaining period is less than or equal to the first cycle time.

[0118] In the sense of the present invention, “functional safety” refers to the definition “Functional safety of safety-related electrical / electronic / programmable electronic systems” according to the IEC 61508 standard series. The use of different methods for controlling errors is described here.

[0119] For example, avoiding systematic errors during development, such as specification errors and implementation errors; monitoring during ongoing operation to identify random errors; and safely controlling identified errors and transitioning to a previously defined safe state.

[0120] The automation controller is also designed to have a bus connection for connecting input devices and output devices, wherein the diagnostic unit and the first processing program are designed to minimize a maximum reaction time to error situations in the communication by providing substitute values ​​and to react safely to error situations.

[0121] Advantageously, the automation controller is designed with a communication driver for a standardized communication protocol for the transmission of safety-related data in automation applications with functional safety.

[0122] The WD time runs in the component, and the system reacts not only when the WD time expires, but when the remaining period of the WD time is less than the cycle time of the component. Because, even if a new telegram is received until the next cycle, it must be safe to react to the expiring WD time. This will happen in the next cycle in any case, even if a telegram returns in the meantime, because the evaluation of the remaining period must occur at the beginning of the F program before the check for a new telegram occurs.

[0123] The object mentioned at the outset is also achieved by an output device which is designed to receive telegrams for outputting process values ​​and which is also designed to have a diagnostic unit which is designed to implement the method according to the invention and to switch from the process value to a substitute value when a monitoring signal is present.

[0124] Particularly in robotics, the output device is designed as an integrated component of an actuator in automation technology, which is then, for example, a drive motor. BRIEF DESCRIPTION OF THE DRAWINGS

[0125] The accompanying drawings illustrate embodiments of the present invention and further explanations. Herein, it is shown:

[0126] Figure 1 shows a communication between a first subscriber and a second subscriber according to the prior art,

[0127] Figure 2 shows a communication between a first subscriber and a second subscriber using a diagnostic unit according to the invention,

[0128] Figure 3 A graph is shown to illustrate the reduction in safety function response time (SFRT),

[0129] Figure 4 Showing the effect of reducing SFRT,

[0130] Figure 5 An automation controller is shown, and

[0131] Figure 6 A motor with an integrated output device is shown. DETAILED DESCRIPTION

[0132] according to Figure 1 The communication between a first subscriber 1 and a second subscriber 2 is shown. The second subscriber 2 sends a telegram T to the first subscriber 1. With the receipt of the telegram T, a monitoring time is started for the first subscriber 1 and the watchdog time WD_T expires. If a further telegram is not received by the first subscriber 1 within the expiration of the watchdog time WD_T, a reaction is made with a function that affects safety. This means that a reaction to an event that affects safety is not made until the watchdog time WD_T expires in the first subscriber 1. The first processing program P1 is executed with a first cycle time ZT1.

[0133] use Figure 2 Describe the method according to the present invention in Figure 1The communication between the first subscriber 1 and the second subscriber 2 known in the art is described in detail. The first subscriber 1 is now designed in such a way that a method for monitoring a communication connection between the first subscriber 1 and the second subscriber 2 can be carried out with it. A first processing program P1 is periodically executed in the first subscriber 1 with a first cycle time ZT1. In order to monitor the communication connection, a first diagnostic unit D1 with a first time counter Z1 is operated in the first subscriber 1, so that the arrival of a first telegram T1 from the second subscriber 2 starts the first time counter Z1. The arrival of a second telegram T2 from the second subscriber 2 is monitored within a predeterminable first monitoring time WD_T1 by means of the first time counter Z1.

[0134] In the first diagnostic unit D1, the remaining period RLZ is formed from the difference between the first monitoring time WD_T1 and the first time counter Z1. Now, it is continuously checked whether the remaining period RLZ is less than or equal to the first cycle time ZT1. In the case where the remaining period RLZ is less than or equal to the first cycle time, a monitoring signal TO is generated. The first subscriber 1 then switches from the process value S to the substitute value EW.

[0135] An essential advantage of carrying out the method mentioned is that a reaction can already be made if the remaining period RLZ of the time counter Z1 for a monitoring time, in particular a device-specific monitoring time, is smaller than the cycle time or smaller than the device-specific cycle time of the device.

[0136] Here, in Figure 2 In the example of FIG. 5 , the comparison between the remaining time limit RLZ and the first cycle time ZT1 is used for the execution of the first processing program P1 .

[0137] The switchover from process value to substitute value can now be carried out in the cycle in which the check shows that the remaining period is less than or equal to the first cycle time. The entire cycle time is now saved in terms of a fast reaction for the safety evaluation.

[0138] Figure 3A flow chart showing the communication from the input device F-DI to the automation controller CPU and the communication of the instructions from the automation controller CPU to the output device F-DO is shown. The input device F-DI is connected to the automation controller CPU via the first bus 11 and the output device F-DO is connected to the automation controller CPU via the second bus 12. The input device F-DI receives, for example, a process value S, which can be S=1 or S=0. The process value S can be, for example, a safety function for triggering the device LG. The second diagnostic unit D2 is run in the input device F-DI and the second processing program P2 is run. In the automation controller CPU, the first diagnostic unit D1 is run and the first processing program P1 expires. In the output device F-DO, the third diagnostic unit D3 is run and the third processing program P3 expires. The aforementioned method for monitoring the communication connection is implemented in the mentioned diagnostic units D1, D2, D3. The input device F-DI sends a telegram to the automation controller CPU via the first bus 11. The telegram contains the process value S. From the starting point a, the telegram with the process value S=1 is sent to the automation controller CPU via the first bus 11. The input device F-DI has a device-specific cycle time and accordingly leaves the telegram with the process value S=1 at point b. The first bus 11 again has a bus delay time or telegram cycle time, so that a telegram from point b to point c requires a certain bus runtime. The automation controller CPU also has a device-specific cycle time and can therefore forward the received process value S=1 to the output device F-DO via the second bus 12 only after the cycle time at point d.

[0139] In the automation controller CPU, the last detected signal S=1 starts a first monitoring time WD_T1.

[0140] However, the following situation now occurs, that is, the first bus 11 fails or has an error, or the input device F-DI fails and no new data or telegrams are forwarded to the bus. This is illustrated by a small triangle with a process value S=0. The error flag F is displayed below point b. Therefore, there is a signal change of the process value S from S=1 to S=0, which is no longer connected to the automation controller CPU. At point d, the watchdog time or the first monitoring time WD_T1 starts. At point e, the remaining period RLZ of the monitoring time WD_T1 has not yet expired, but it is less than the first cycle time ZT1 or the watchdog of the automation controller CPU. Therefore, a reaction has now been made, because the monitoring time WD_T1 will definitely expire in the next cycle. It follows that the signal S=1 must be set to a safe substitute value EW=0. Now, the automation controller CPU also sends a telegram to the output device F-DO with a safe substitute value EW=0 or S=0 before the actual monitoring time expires. This signal must be transmitted via the second bus 12 with a certain amplification time. If a certain delay time also elapses in the output device F-DO until a signal or a safe substitute value EW=0 can be output, this safe output occurs at point h. Without the method according to the invention which checks whether the remaining time limit RLZ is less than or equal to the first cycle time ZT1, the safe substitute value is not provided by the automation controller CPU until point g.

[0141] According to the old evaluation of the monitoring time, the reaction does not take place until after the monitoring time WD_T1 has expired and therefore in the worst case not until a later cycle. The automation controller CPU does not react until point g, i.e. it must send a safe substitute value EW=0 or S=0; this substitute value also requires its own runtime via the second bus and is finally processed in the output device F-DO and can be safely output at point i with a delay. This results in a safe error response for the error situation SFRT 旧 The old maximum reaction time and the SFRT for the error case 新 The new maximum reaction time is shown in Figure 1. It can be clearly seen that the 95 ms error case SFRT 新 New maximum reaction time for error cases less than 110 ms SFRT 旧 The old maximum response time.

[0142] With the help of Figure 4 The effect of reducing the maximum reaction time for an error situation SFRT is explained on a system example. For example, a safety distance S must be maintained from a press. The safety distance S is measured between the danger zone G and the installation location of the triggering device LG, in this example a light barrier. Now, for example, a person wants to reach into the press from the approach direction A with a hand, in which case a signal is triggered via the triggering device LG. Figure 3As shown, the signal must be transmitted to the output device with a delay through various components and buses. Figure 4 In the communication calculation of the described system operation, the SFRT in the example is reduced from 369 ms to 269 ms. Due to the reduction of SFRT by 100 ms, the safety distance S of the triggering device LG to the danger zone G can be reduced by 200 mm.

[0143] The safety distance S can be calculated using the formula S = K • 8 + P + 8 • (D-14). Assume that the approach speed K is 2000 m / s. This corresponds to the penetration speed of a human hand. T is calculated as the maximum required stopping time of the machine plus the response time of the triggering device or the detection capability D of the light curtain.

[0144] use Figure 5 Again, schematically shown in Figure 4 The automation controller CPU described in . The automation controller CPU includes a diagnostic unit D1 for monitoring a communication connection with an input device FDI; in addition, the automation controller CPU includes a processor P, which is designed to cyclically execute a processing program P1. The processing program P1 is executed in the automation controller CPU with a first cycle time ZT1. The diagnostic unit D1 is designed to have a first time counter Z1, which is started when a first telegram T1 arrives. The diagnostic unit D1 is also designed to monitor the arrival of a second telegram T2 from the input device F-DI by means of the first time counter Z1 within a predeterminable first monitoring time WD_T1. Now, in order to reduce the maximum reaction time to the error situation SFRT, the diagnostic unit D1 is designed so that the difference between the first monitoring time WD_T1 and the first time counter Z1 forms a remaining period RLZ and is also designed to check whether the remaining period RLZ is less than or equal to the first cycle time ZT1, and if this is the case, a monitoring signal TO is generated. It is now possible to switch from the process value S to a safe substitute value EW in advance.

[0145] according to Figure 6 The output device F-DO is shown as an integrated component for a servomotor M of the robot. If the output device F-DO with its third diagnostic unit D3 is designed directly or integrated into the motor of the robot, an even faster reaction to the stop signal is possible.

Claims

1. A method for monitoring a communication connection between a first subscriber (1) and a second subscriber (2), wherein: A first processing program (P1) having a first cycle time (ZT1) is cyclically executed in the first subscriber (1), and in order to monitor the communication connection, a first diagnostic unit (D1) having a first time counter (Z1) is operated in the first subscriber (1) so that the arrival of a first telegram (T1) from the second subscriber (2) starts the first time counter (Z1), wherein the arrival of a second telegram (T2) from the second subscriber (2) is monitored within a predeterminable first monitoring time (WD_T1) by means of the first time counter (Z1), Characterized in that in the first diagnostic unit (D1), a remaining period (RLZ) is formed from the difference between the first monitoring time (WD_T1) and the first time counter (Z1) and a check is made as to whether the remaining period (RLZ) is less than or equal to the first cycle time (ZT1), and if the remaining period is less than or equal to the first cycle time, a monitoring signal (TO) is generated.

2. The method according to claim 1, wherein: The communication connection between the first subscriber (1) and the second subscriber (2) is operated in a safety-related system and, in the presence of the monitoring signal (TO), the first processing program (P1) in the first subscriber (1) is switched from a received process value (S) to a substitute value (EW), wherein the switching is performed in a cycle in which the check shows that the remaining period (RLZ) is less than or equal to the first cycle time (ZT1).

3. The method according to claim 1 or 2, for application in a communication operation from the second subscriber (2) as an input device (F-DI) via the first subscriber (1) as an automation controller (CPU) to a third subscriber (3) as an output device (F-DO), so that a maximum reaction time to an error situation (SFRT) in the communication is minimized and a safe reaction is performed to the error situation. 4 . The method according to claim 1 , which is used in a standard for a communication protocol for transmitting safety-related data in automation applications with functional safety. 5 . The method according to claim 1 , for reducing the distance between an operator (B) and a triggering device (LG) during operation of a hazardous machine.

6. An automation controller (CPU), comprising: Diagnostic unit (D1) for monitoring the communication connection to the input device (F-DI), a processor (P) designed to cyclically execute a processing program (P1) having a first cycle time (ZT1), the diagnostic unit (D1) being designed to have a first time counter (Z1) which is started when a first telegram (T1) arrives, and the diagnostic unit being designed to monitor the arrival of a second telegram (T2) from the input device (F-DI) within a predeterminable first monitoring time (WD_T1) by means of the first time counter (Z1), Characterized in that the diagnostic unit (D1) is designed to form a remaining time limit (RLZ) from the difference between the first monitoring time (WD_T1) and the first time counter (Z1), and the diagnostic unit is also designed to check whether the remaining time limit (RLZ) is less than or equal to the first cycle time (ZT1), and if the remaining time limit is less than or equal to the first cycle time, a monitoring signal (TO) is generated.

7. The automation controller (CPU) according to claim 6, which is also designed as a controller designed for functional safety and causes the processing program (P1) to switch from the received process value (S) to the substitute value (EW) when the monitoring signal (TO) is present, wherein: The switching has been performed in a cycle in which the checking showed that the remaining period (RLZ) was less than or equal to the first cycle time (ZT1).

8. The automation controller (CPU) according to claim 6 or 7, which is designed with a bus connection (10) for connecting input devices (F-DI) and output devices (F-DO), wherein: The diagnostic unit (D1) and the first processing program (P1) are designed to minimize a maximum reaction time to an error situation (SFRT) in the communication by providing the substitute value (EW) and to react safely to the error situation. 9 . The automation controller (CPU) according to claim 6 , which is designed with a communication driver for a standardized communication protocol for transmitting safety-related data in automation applications with functional safety.

10. An output device (F-DO) designed to receive a telegram for outputting a process value (S), the output device also being designed to have a diagnostic unit (D3) for carrying out the method according to claims 1 to 5, and being designed to implement a switch from the process value (S) to a substitute value (EW) when the monitoring signal (TO) is present. 11 . The output device (F-DO) according to claim 10 , which is designed as an integrated part of an actuator in automation technology.

Images