Method for the safe parameterization of an automation component
Patent Information
- Authority / Receiving Office
- DE · DE
- Patent Type
- Patents
- Current Assignee / Owner
- ROBERT BOSCH GMBH
- Filing Date
- 2013-06-20
- Publication Date
- 2026-07-09
AI Technical Summary
Existing commissioning methods for automation components, particularly drive controllers, are unsafe and prone to errors due to the need for manual intervention by less qualified personnel, which can lead to malfunctions and safety risks.
A method involving a commissioning device that verifies and manages parameter changes in automation components, ensuring safe operation by identifying parameters, displaying status information, and requiring user acknowledgment for verified parameters before operation, thereby preventing unsafe configurations.
Ensures safe and efficient commissioning by preventing incorrect parameter entries, reducing the risk of malfunctions, and meeting international safety standards, particularly in safety-relevant functions.
Smart Images
Figure 00000010_0000 
Figure 00000011_0000 
Figure 00000012_0000
Abstract
Description
[0001] The invention relates to automation components, specifically drive controllers or control units for electric machines. Typically, in addition to the control unit, a power unit is also present. The method is intended to enable initial commissioning, serial commissioning, or repeated commissioning of such automation components, for example, after maintenance work or the replacement of defective parts. Especially in conjunction with safety-relevant functions required in the field, safe and error-free commissioning is of paramount importance. Safe commissioning can protect human lives and prevent high consequential costs due to malfunctions.
[0002] Commissioning automation components requires an operator device. This is usually a PC or a display unit with an operator console, which is used by a skilled and experienced user to configure the machine control system for the machine and the relevant application environment via an interface. However, it can also be a device from the group of smartphones, tablet PCs, and similar devices.
[0003] More and more, the settings are being automated, i.e., largely self-adjusting or self-identifying; however, the basis for such identification is always commissioning by a skilled user or drive technology engineer who has previously informed himself about the possibilities and requirements of the application environment to be configured.
[0004] Information regarding the application environment can be stored in a memory according to EP 896 265 81, and this memory can be assigned to the motor. The non-volatile memory and its stored data are fed to a control module via a data output, so that the controlling device can automatically acquire knowledge of the motor to be controlled and can automatically adjust itself to the motor.
[0005] Another approach is to provide code cards; see DE 102 24 400 A, which concerns a mechatronic drive system with several components. Each component has a chip card that can be read by the drive controller, and this drive controller can configure itself during initial commissioning using the reader and the information fed from all the chip cards.
[0006] The EP 1 548 527 A control and regulation device, which deals with commissioning, allows the system to parameterize itself. The parameters to be changed via software can initially be default parameters, which are then improved during commissioning using a flash card or hard drive. This requires a macro, which is loaded as a script into the interpreter and then executed. This process is more or less unidirectional (for improving the default parameters) and cannot be executed in the other direction due to the one-way nature of the macro and the interpreter.
[0007] DE 10127803 A1 relates to an open drive controller and a method for generating software for an open drive controller. Drive controllers are defined therein as power converter devices and their software for operating electrical or hydraulic actuators (e.g., motors).
[0008] So-called intelligent drives for centralized and decentralized automation are also known from the state of the art. In these systems, various components of a plant take over the tasks of process control and regulation in a hierarchical structure. For example, a servo drive can report the relevant control data directly to a control system. If several controllers are located in a station, they are connected to each other via a communication bus, which ensures direct data synchronization. Intelligent drives are also used for special control and regulation tasks, e.g., in printing and winding technology. For these applications, an intelligent drive provides functions that can be adapted to the application's needs using operating software. To meet these application-specific requirements, the intelligent drive provides a library of various control and regulation elements.These are common building blocks of general control and automation technology, process controllers, technology controllers, monitoring / diagnostic algorithms and ramp-up encoders.
[0009] One object of the claimed invention is to make the commissioning of drive components known from the prior art safer.
[0010] The invention solves this problem by enabling a fast and safe procedure during commissioning, for example initial commissioning or series commissioning, and preventing incorrect entries by potentially less qualified operating personnel.
[0011] After the automation components have been parameterized and activated, a parameter verification will be performed before first use. The parameter verification is intended to check / verify the following points: – Checking whether the parameterization active in the drive matches the planned or projected parameters for this axis. – Verification of the active parameterization against a target specification in order to detect any transmission errors.
[0012] The invention solves this problem by providing a method for commissioning a drive component. The drive component comprises at least one processor and an internal or external parameter memory.
[0013] This is specifically a control unit or controller for an automation system, which can be commissioned using an external commissioning device. Operating software runs on the processor, accessing the parameter memory to configure the drive component using the parameters stored therein. The parameters stored in the parameter memory can be displayed and modified using the commissioning device.
[0014] To change the parameters, the commissioning device includes a display and a user input option, such as a keyboard. The commissioning device can be a standard PC.
[0015] The method according to the invention proceeds such that an initial data exchange takes place between the operating software of the drive component and the commissioning device. This data exchange initially occurs independently of parameters and serves to allow the commissioning device and the drive component to mutually identify each other in order to prepare for a subsequent data exchange regarding the parameters.
[0016] Subsequently, a parameter present in the parameter memory of the drive component is read out using the commissioning device and displayed visually.
[0017] Using the commissioning device, a parameter changed by the commissioning device is then stored in the parameter memory along with parameter status information using the operating software.
[0018] The operating software also reflects the changed parameter back to the commissioning device along with the parameter status information specific to each individual parameter.
[0019] Specific parameter status information for individual parameter groups would also be conceivable. Each parameter would thus have its own verification status.
[0020] The commissioning device visualizes the status information along with the changed parameter.
[0021] The user is thus always informed whether an individual parameter is stored in the drive component's parameter memory with the status "verified" or "not verified". Unverified parameters pose a security risk. The user is therefore aware of potential security risks and can prevent them by making corrective user inputs at the commissioning device.
[0022] If the user assesses the parameter as correct, they can manually acknowledge it via user input at the commissioning device. The commissioning device then transmits the acknowledgment signal to the operating software.
[0023] Therefore, only the individual parameters that have actually been modified need to be verified. A complete verification of all parameters is unnecessary. This saves time during the commissioning of the automation component. Series commissioning is thus faster than with conventional methods.
[0024] If the user judges the parameter to be incorrect, they can refrain from acknowledging it by omitting user input at the commissioning device, whereby the operating software prevents operation of the drive component in the absence of an acknowledgment signal.
[0025] The main objective of the invention is to ensure that systems and machines can be operated safely. Therefore, preventing dangerous failures of systems, operating equipment, and monitoring devices, as well as dangerous undetected failures of protective devices, is of fundamental importance.
[0026] If risk reduction is achieved using process control technology, the components used must meet the requirements of international standards. These standards provide general guidelines for preventing and controlling failures in electrical, electronic, or programmable electronic devices. They specify organizational and technical requirements for both device development and operation. Four safety levels are distinguished for systems and risk-reducing measures, ranging from SIL1 for low risk to SIL4 for very high risk. The higher the risk, the more reliably the risk reduction measures must be implemented. The requirements for the components used increase accordingly. The invention helps to meet these high safety requirements.
[0027] Because the commissioning device identifies itself to the operating software during the course of the inventive method, and the operating software generates a new drive component identifier each time the drive component is switched on, the security standard is further improved, as each session between the commissioning device and the drive component is thus uniquely identifiable. Accidental or intentional modifications to the parameters without the user's intervention are therefore virtually impossible.
[0028] The parameter status information can relate to individual parameters and / or a group of individual parameters, whereby the parameters are also used to parameterize, among other things, those functions of the drive component that ensure the safe operation of the automation system components that can be connected to the drive component.
[0029] At least the following safety functions integrated into the drive component are affected: braking of an electric motor and / or position control for an electric motor and / or movement of an electric motor and / or energy management and / or safe communication between components of the automation system and / or safe signal inputs and / or safe signal outputs of the drive component and comparable functions to ensure safe operation in accordance with applicable machinery directives.
[0030] Fig. Figure 1 shows a rough schematic flowchart of the process according to the invention.
[0031] Fig. Figure 2 shows an example of how user communication can be implemented.
[0032] Fig. 4 and Fig. Figure 4 shows examples of applications of the invention.
[0033] Fig.Figure 1 shows a procedure for commissioning a safety device using a software commissioning tool. To start the verification of a parameter value for the safety device, the commissioning tool must first generate a temporary commissioning identifier. 4 Write the data to the memory of the safety device. This informs the safety device which commissioning tool and commissioning session may subsequently accept parameter verifications.
[0034] The operating software of the safety device generates a random and system-wide unique device identification number each time the device is switched on or upon request. This number can only be read once. This ensures that the data sent by the commissioning tool during parameter verification is not stored statically and cannot be used multiple times. The commissioning tool requests a new device identification number from the operating software for each verification process to prevent erroneous verifications caused by unintended telegram repetitions. Before the first verification in a session for configuring a drive controller, for example, only the commissioning ID and axis ID are read. The axis ID is renewed before each acknowledgment is written.
[0035] The parameter is first retrieved from the parameter memory of the safety device using the commissioning tool in the form of a normal parameter read operation. 5 read and displayed visually for the user via a display 10 displayed by the commissioning tool.
[0036] Any subsequent parameter changes initially also take place as a normal parameter write operation, using the commissioning tool. 2 A parameter that has now changed compared to the read and displayed parameter is stored in the parameter memory using the operating software. 6 becomes.
[0037] The write process updates the internal parameter status information. 7 The security device's operating software has been modified for this parameter so that it is now marked as "unverified". 1reads the changed parameter from the parameter memory of the security device. 1 together with the parameter status information from 7 , 8 and transmits it to the commissioning facility 1 . On the display of the commissioning tool 2 This can be signaled to the operator, for example, in the form of a graphic identifier, e.g., a "yellow exclamation mark". 9 become.
[0038] Operation of the safety device 1 The operating software of the security device uses unverified parameters. 1 prevented.
[0039] The following steps are required to change the parameter status information from "not verified" back to "verified".
[0040] The parameter value is determined by the commissioning tool. 2 The data was read back using a diverse approach and presented to the operator.
[0041] The data block for the diverse feedback includes: # element Description 1 EIDN Unique parameter identifier 2 Attribute / Unit Interpretation information (number of NK places, type of parameter, unit) for parameter value 3 Value Parameter value 4 CKS Checksum of elements 1..3, as well as the “device identifier (C)”
[0042] The user interface of the commissioning tool 2 waits for user input. If the user confirms that their originally entered parameter (i.e., the parameter with parameter status information "not verified," see above) matches the parameter read back and displayed, then the commissioning tool transmits the result. 2 to the operating software of the security device 1 an acknowledgment signal 3 .
[0043] The commissioning tool 2The commissioning tool checks the diversely read EIDN and compares the diversely read parameter value with the normally written parameter value. If the comparison fails, an error is displayed and user confirmation is prevented. The commissioning tool also checks the checksum. If the check fails, an error is displayed and user confirmation is prevented.
[0044] The acknowledgment signal 3 will be connected to the security device 1 transmitted: # element Description 1 EIDN Unique parameter identifier 2 Attribute / Unit Interpretation information (number of NK places, type of parameter, unit) for parameter value 3 Value Parameter value 4 CKS Checksum over elements 1-3, as well as the –“Commissioning identifier” (A) – “Device ID” (B) –“Device identifier (C)”
[0045] The operating software of the security device ( 1 ) checks for receipt of the acknowledgment signal 3 by following these steps: – EIDN correct – Interpretation data correct – Value corresponds to the originally written value of the parameter – Checksum verification, including verification of correctness – Commissioning identifier – Device ID – Device identifier
[0046] If the test result is positive, the parameter's verification status is reset to "verified." The safety device can then be operated. If no acknowledgement signal is received... 3 However, the individual parameter is considered unverified and the operating software prevents the safety device from operating. 1 .
[0047] In Fig. Figure 2 shows how the commissioning tool's display can signal and display parameter status information to the operator, for example, in the form of a graphical identifier such as a "yellow exclamation mark". The operating software of the safety device thus reliably prevents operation of the safety device with unverified parameters.
[0048] In order for the parameter status information to be set from "unverified" back to "verified", the user must initiate the sending of an acknowledgment signal to the operating software of the safety device. This can be achieved by manually accepting the parameter.
[0049] The following are some applications of the invention relevant to the invention in connection with drive control devices in the Fig. 3 and Fig. 4 described in more detail: A – Initial commissioning (Fig. 3)
[0050] After the system has been set up and functionally commissioned, the commissioning engineer activates the safety technology and performs a completely new configuration and initial parameterization of the safety technology (including assigning the SI axis identifier, selecting the safety functions, defining encoder and weighting parameters, and setting monitoring thresholds). Afterwards, the safety technology is locked (SI parameters are then write-protected).
[0051] This use case is typically implemented when a customer wants to commission an axis from scratch, e.g. to build the prototype machine for a new machine series.
[0052] The process consists of the following activities: Security technology Urladen
[0053] The procedure described in this use case assumes that the axis to be put into operation has not yet been put into safe operation or is put into this state by reloading the safety parameters. Activate security technology
[0054] Reloading the security technology sets it to "SI_not_active". Assigning an SI password activates the security technology, after which it is in the "SI_PM_configuration_mode" state. Enter SI axle identifier and 4 – Confirm new SI axle identifier
[0055] Each axis is assigned a unique identifier that is consistent across the entire safety system. This identifier allows subsequent parameterization actions to be clearly referenced to the corresponding machine axis. If safe bus communication is active, the unique identification identifier for safe bus communication is also assigned in this step. Change and verify the configuration
[0056] Configuration parameters influence fundamental properties of safety technology, such as the way parameters are displayed (weighting) and the detection of axis movement (sensor evaluation). This data is entered and verified. Change and verify parameters
[0057] Other basic settings, such as Secure Bus Communication active, IO linking logic, standstill window setting, etc., are parameterized and can only be changed in SI_PM_Configuration mode.
[0058] Once these settings are complete, the system switches to SI_PM_Parameter mode. During this state, configuration checks and adjustments are performed by the safety technology firmware. Parameterization parameters that can also be changed in SI_PM_Parameter mode, such as setting a speed threshold for the "safe maximum speed" function, are now entered and verified. Validate axis configuration
[0059] As part of the axis configuration validation, it is checked whether the weighting and encoder parameterization (setting of mechanical gear, feed constant, polarity, data reference, encoder mounting location, encoder resolution, encoder polarity) results in correct detection of the axis movement by the safety function in the drive. Correct detection occurs when the safety function in the drive identically reflects the actual axis movement. Machine acceptance
[0060] The acceptance of the machine consists of activities such as – Verification of the safety technology function with regard to selection and acknowledgement. If necessary, the parameterized limit values are also tested and the effectiveness of the parameterized monitoring functions is tested. – Checking the axis's error response – Review of the additional and auxiliary functions. B – Series commissioning (Fig. 4)
[0061] During series production commissioning, a configuration and parameterization previously created on a prototype axis and approved for safety purposes is transferred to production devices. The safety configuration (encoder and weighting settings) is always adopted 1:1, as it is mechanically identical to the prototype axis. The axis's validation status is therefore retained.
[0062] The following cases must be distinguished during series production: – B1) identically adopted parameterization of the original including the axle identifier (“Clone with identical axle identifier”) This approach makes sense, for example, – for the series production of independent systems – in case of loss or defect of the programming module – B2) Parameterization adopted from the original, but with change of the axis identifier (“copy with new axis identifier”) This approach makes sense, for example, – for axes of identical machine modules in a connected system – B3) Parameterization adopted from the original, but with change to the axis identifier and parameterization, but retaining the configuration (weighting and encoder settings) (“extended series commissioning”) This approach makes sense, for example, – for axles with identical axle mechanics but modified safety parameterization (e.g. axle-specific monitoring thresholds).
[0063] This use case is typically executed when a customer wants to commission an axis based on a parameter image of a template axis. The process consists of the following activities: Security technology Urladen
[0064] The procedure described in this use case assumes that the axis to be put into operation has not yet been put into safe operation or is put into this state by reloading the safety parameters. Load parameter image
[0065] The parameter image of the sample axis is part of the entire parameter set of the axis to be saved and is written to the drive when it is loaded. The parameter image includes the proposed axis identification data, such as... – P-0-3235.0.2, SMO: Suggested axle identifier – S-0-1800.0.18, SSO Proposed TUNID (when CSoS is active) Activate parameter image
[0066] The loaded image is applied using the command "Activate parameter image". Since the SI password is also contained in the parameter image, the security option is simultaneously activated by the data transfer, and the security memory is locked against changes. The image identifier parameters are regenerated and saved directly to an SI option card. Enter SI axle identifier
[0067] In case – B2 – Copy with new axle identification – B3 – Extended series commissioning involves modifying the proposed axis identification data compared to the prototype axis by modifying the parameters listed above, including their verification. In the case of “B1 – Clone with identical axis identifier”, this is not necessary, as the proposed axis identification data is adopted unchanged from the prototype machine. Confirm new SI axle identifier
[0068] The identification data that has been changed in cases B2 and B3 compared to the sample axis, or the proposed identification data that remains unchanged in case B1, are adopted by the command "Accept identification data". Change and verify parameters
[0069] In the case – B3 – Extended series commissioning involves an adjustment of the safety-related parameterization along with its verification compared to the prototype axis.
[0070] In these cases – B1 – Clone with identical axle identification – B2 – Copy with new axis identifiers: this is not necessary, as the safety-related parameterization is adopted unchanged from the prototype machine.
[0071] In all cases, however, the safety configuration (encoder and weighting settings) is adopted 1:1, as it is mechanically identical to the prototype axis. Therefore, unlike during initial commissioning, step 7 – Validating the axis configuration – can be omitted. Machine acceptance
[0072] The acceptance of the machine consists of activities such as – Verification of the safety technology function with regard to selection and acknowledgement. If necessary, the parameterized limit values are also tested and the effectiveness of the parameterized monitoring functions is tested. – Checking the axis's error response – Review of the additional and auxiliary functions. QUOTES INCLUDED IN THE DESCRIPTION
[0073] This list of documents cited by the applicant was automatically generated and is included solely for the reader's convenience. The list is not part of the German patent or utility model application. The DPMA accepts no liability for any errors or omissions. Cited patent literature
[0074] EP 89626581
[0004] DE 10224400 A
[0005] EP 1548527 A
[0006] DE 10127803 A1
[0007]
Claims
[1] Method for commissioning a drive component ( 1 ), in particular a control unit or a control device, with a processor and with a parameter memory for an automation system by means of a commissioning device ( 2 ), whereby operating software runs on the processor, which accesses the parameter memory to control the drive component ( 1 ) to configure using the parameters stored in the parameter memory, whereby the parameters stored in the parameter memory are configured using the commissioning device ( 2 ) are representable and modifiable, whereby – between the operating software of the drive component ( 2 ) and the commissioning equipment ( 1 ) a data exchange ( 4 ) takes place, – a parameter memory in the drive component ( 2 ) existing parameters using the commissioning device ( 1 ) read out ( 5) and visually ( 10 ) is shown, – using the commissioning device ( 1 ) a modified parameter using the operating software in the parameter memory together with parameter status information ( 7 ) filed ( 6 ) becomes, – the operating software retrieves the changed parameter from the parameter memory along with the parameter status information ( 7 ) reads out ( 8 ) and to the commissioning facility ( 1 ) transmitted, – the commissioning equipment ( 1 ) the parameter status information ( 7 ) together with the changed parameter visualized ( 9 ). [2] Method according to claim 1, wherein by means of the commissioning device ( 2 ) an acknowledgment signal ( 3 ) for the changed parameter is transmitted to the operating software. [3] Method according to one of the preceding claims, wherein the operating software, in the absence of an acknowledgement signal ( 3 ) an operation of the drive component ( 1 ) prevented. [4] Method according to one of the preceding claims, wherein the commissioning device ( 2 ) itself identified to the operating software. [5] Method according to one of the preceding claims, wherein the operating software is activated each time the drive component is switched on ( 1 ) generates a new drive component identifier that cannot be changed, at least temporarily. [6] Method according to any one of the preceding claims, wherein the parameter status information ( 7 ) concerns individual parameters and / or a group of individual parameters. [7] Method according to one of the preceding claims, wherein the parameters are used to determine the functions of the drive component ( 1) are parameterized to ensure safe operation of the drive component ( 1 ) connectable automation system components. [8] Method according to claim 7, wherein the parameters at least the following are incorporated into the drive component ( 1 ) Integrated functions include: braking of an electric motor and / or position control for an electric motor and / or moving an electric motor and / or energy management and / or safe communication between components of the automation system and / or safe signal inputs and / or safe signal outputs of the drive component and comparable functions to ensure safe operation in accordance with applicable machinery directives.