Method for monitoring a first processor of a sensor module by a second processor

Description

[0001] The invention relates to a method for monitoring a first digital processor integrated into a sensor module of a field device for automation technology, with a first set of machine instructions on which an algorithm is executed to calculate a measured value based on supplied raw measured values ​​by a second digital processor integrated into a main electronics module of the field device.

[0002] In process automation technology, as well as in manufacturing automation technology, field devices are frequently used to measure and / or control process variables. Measuring devices or sensors, such as level gauges, flow meters, pressure and temperature gauges, pH / ORP meters, conductivity meters, etc., are used to measure process variables such as level, flow rate, pressure, temperature, pH value, and conductivity. Actuators, such as valves or pumps, are used to control process variables by changing the flow rate of a liquid in a pipe section or the fill level in a container.

[0003] A large number of such field devices are manufactured and distributed by the Endress+Hauser Group.

[0004] Such field devices typically incorporate an electronic sensor circuit, which is generally known. This electronic sensor circuit is used in the field devices to process raw measurement data. For example, a process variable is acquired as raw measurement data via an analog electrical converter, and this analog raw measurement data is then digitized by an analog-to-digital converter. Subsequently, the digitized raw measurement data can be processed by a digital processor using an algorithm. The digital processor can then perform a series of operations on the raw measurement data. For instance, temperature compensation of the raw measurement data can be performed to obtain a temperature-compensated digital output signal in the form of measured values.

[0005] To use such field devices in safety-critical applications, higher demands are placed on the functionality of the field device, ensuring that a fault in the field device does not go unnoticed. This includes, for example, the certification of field devices according to the so-called SIL standard of the international standard IEC 61508 for functional safety.

[0006] To achieve SIL 2, diagnostic measures in the form of redundant hardware and / or software are typically employed to maximize fault detection and the proportion of so-called safe failure fractions (SFF). For example, an additional digital processor is located alongside the sensor electronics' digital processor in the field device to further process the digitized raw measurement data. This additional processor also runs the algorithm used to process the raw measurement data. The same input data is fed to this additional processor as to the sensor electronics' processor, so its output data should match that of the sensor electronics' processor. This allows for a simple comparison of the two output data sets and thus enables monitoring of the sensor electronics' processor.

[0007] German patent applications DE 10 2016 125240 A1 and US 2006 / 236844 A1 are known from the prior art. DE 10 2016 125240 A1 discloses a method for testing a digital processor. US 2006 / 236844 A1 discloses a method for validating the operation of a control system.

[0008] The disadvantage of this is that the algorithm must be written to the additional processor every time the field device is started. This is particularly necessary if the algorithm on the sensor electronics processor changes.

[0009] The invention is therefore based on the objective of proposing a diagnostic measure necessary for achieving SIL2, which can be implemented in a simple way in a field device of automation technology.

[0010] The problem is solved according to the invention by the method according to claim 1.

[0011] The inventive method for monitoring a first digital processor integrated into a sensor module of a field device for automation technology, with a first set of machine instructions on which a first algorithm is executed to calculate a measured value based on supplied raw measured values, by means of a second digital processor integrated into a main electronics module of the field device, comprises the following method steps: a) Calculating verification data from predefined input data using a second test algorithm on an external computing unit independent of the field device, wherein the second test algorithm is divided into at least a start section and a finish section, the start section and the finish section comprising at least some, preferably all, of the opcodes of the first set of machine instructions used when executing the first algorithm on the first digital processor; b) Storing the predefined input data for calculating the verification data and the verification data calculated using the second test algorithm in the sensor module of the field device; c) Transferring the predefined input data and the verification data stored in the sensor module to the main electronics module; d) Transferring the predefined input data from the main electronics module to the sensor module during the measurement operation of the field device;e) Executing the second test algorithm on the first digital processor of the sensor module such that output data is calculated based on the specified input data transmitted by the main electronics module, and the first algorithm is executed between the start and end sections, so that after execution of the second test algorithm, it can be verified using the verification data whether the first algorithm has been completed; f) Making the output data calculated by the first digital processor available in the main electronics module; g) Checking the output data against the verification data made available by the sensor module using the second digital processor of the main electronics module and, if the output data does not match the verification data, detecting a malfunction.

[0012] According to the invention, it is proposed that verification data be calculated using a test algorithm on an external computing unit, e.g., a manufacturing computer. This can be done, for example, using a numerical calculation tool. To obtain the verification data, the test algorithm is executed with specific input data. Subsequently, both the input data and the verification data calculated from the input data are stored on a memory element, e.g., in the form of a lookup table. This is done, in particular, during the manufacturing of the sensor module by the sensor module manufacturer. By calculating and storing the input and verification data in advance, i.e.,Before the actual use of the field device in measurement mode, the parallel execution of the test algorithm on the second processor, which monitors the first processor, can be omitted during the subsequent execution of the test algorithm in the actual measurement mode. Instead, the test algorithm only needs to be executed on the first processor being monitored during measurement mode. Subsequently, the input and verification data stored in the sensor module can be used to check whether the output data calculated by executing the test algorithm on the first processor matches the verification data previously transferred from the sensor module to the main electronics module. In the event of a discrepancy, a malfunction is detected.

[0013] Another advantageous embodiment of the method according to the invention provides that the method steps d) to g) are carried out cyclically in the measuring operation of the field device.

[0014] Another advantageous embodiment of the method according to the invention provides that the method step c) is carried out during a system start-up of the field device.

[0015] Another advantageous embodiment of the method according to the invention provides that the method step b) is carried out during the manufacture of the sensor module, in particular by the field device manufacturer.

[0016] Another advantageous embodiment of the method according to the invention provides that, in the actual measurement operation of the field device, raw measurement values ​​are cyclically supplied to the first digital processor and the raw measurement values ​​are cyclically processed by the first digital processor using the first algorithm in the actual measurement operation.

[0017] Another advantageous embodiment of the method according to the invention provides that, in the actual measurement operation of the field device, the raw measurement values ​​are supplied to the first digital processor at a higher clock rate and further processed using the first algorithm than the execution of the second test algorithm with the specified input data.

[0018] Another advantageous embodiment of the method according to the invention provides that the first algorithm is divided into several sections C1...Cn and that, during execution, the several sections of the first algorithm are executed between the initial section and the final section. In particular, the embodiment can provide that the second test algorithm is also divided into several sections S1...Sn and that, during execution, the sections of the first algorithm C1...Cn and of the second test algorithm S1...Sn are executed alternately.

[0019] Another advantageous embodiment of the method according to the invention provides that the verification data are calculated on a production computer by the sensor module manufacturer during the manufacturing process. In particular, the verification data can be calculated using a numerical calculation tool on the production computer.

[0020] The invention is explained in more detail with reference to the following drawings. They show: Fig. 1 : a schematic block diagram of a field device with an electronic field device circuit known from the prior art, Fig. 2 : a schematic block diagram of an embodiment of a field device comprising an electronic field device circuit set up using the method according to the invention, Fig. 3 a schematic representation of the algorithm that runs on the first processor of the sensor module during the actual measurement operation, e.g. for temperature compensation, Fig. 4 a schematic representation of the test algorithm which, according to the invention, runs on the first processor of the sensor module for monitoring the first processor, and Fig. 5 a schematic representation of an advantageous variant of the test algorithm which, according to the invention, runs on the first processor of the sensor module for monitoring the first processor.

[0021] The in Fig. 1 The depicted field device 100 comprises an electronic field device circuit consisting of a sensor module 10 and a main electronics module 20, and a complementary digital communication interface 16, 24. The sensor module and the main electronics 20 are designed such that different sensor modules can be connected to the main electronics 20, depending on the physical quantity to be measured, or that they are compatible with each other. The main electronics 20 is always identical; only the sensor module differs in its design depending on the physical quantity to be measured, e.g., whether a pressure or a fill level is to be measured.

[0022] The sensor module 10 comprises a transducer element 11, for example, a capacitively or resistively operating pressure transducer element, and sensor electronics 12, wherein raw measured values ​​in the form of a primary signal are fed from the transducer element to an analog sensor input 14 of the sensor electronics 12. These raw measured values ​​are digitized by the sensor electronics 12 and subsequently processed or prepared into corresponding measured values ​​by a first digital processor 1, for example, a digital signal processor (DSP), using an algorithm Comp running on this processor 1. Typically, temperature compensation of the raw measured value is performed by means of the algorithm Comp running on the digital signal processor 1. Fig. 3 This illustrates the algorithm's process on the first processor, which further processes the raw measurement values ​​into a compensated measurement value. The raw measurement value can be processed by the first processor at intervals ranging from a few milliseconds (ms) to several tens of milliseconds. The processed measurement value is then made available to the main electronics module 20 via a first digital communication interface 16.

[0023] To achieve increased flexibility in the manufacturing of the field device, the sensor module is designed as an interchangeable module. This allows different sensor modules to be combined with the main electronics module during production, enabling the field device to be specifically configured for a measurement task.

[0024] In the illustrated embodiment, the main electronics module 20 comprises a logic unit, a current regulator 32, a HART modem 34 and a communication interface, e.g. a controlled current source 36.

[0025] The logic unit 22 comprises a second digital processor, for example a microprocessor, and a second digital communication interface 24, which communicates with the first digital communication interface 16. During normal measurement operation, the digital measured value is transmitted via this digital communication interface, and the logic unit 22 instructs the current controller 32, via a third digital communication interface 26, to regulate the controlled current source 36 so that it provides an analog current signal representing the digital measured value or a measured quantity derived therefrom.

[0026] Furthermore, the logic unit 22 includes a fourth digital communication interface 30, via which the HART modem 34 is controlled in order to modulate digital information, such as status information, onto the analog current signal.

[0027] The electronic circuits known from the prior art are arranged such that the algorithm Comp is executed on the first processor 1 using at least some of the machine instructions available for the first processor 1.

[0028] To comply with the aforementioned SIL measures, the Comp algorithm is also installed on the second processor 2. This installation, in accordance with current best practices, occurs during the startup of the field device or during an initialization phase before it switches to actual measurement operation. The algorithm is transferred from the sensor module to the main electronics module via the internal communication interfaces 16 and 24. Both the algorithm on the first and second processors are then executed in parallel during runtime, i.e., during the actual measurement operation of the field device.

[0029] On the second processor, the algorithm calculates the output verification data V using the machine instructions of the second processor 2. For this purpose, the input data E from the sensor module is transmitted to the main module, for example, via communication interfaces 16 and 24. The verification data V obtained by the second processor 2 is then compared, according to the state of the art, with the output data A obtained by the first processor 1 to enable verification of the first processor 1. If the two results do not match, an error is detected and signaled. By redundantly executing the algorithm on both the first and second processors, SIL Level 2 is achieved.

[0030] Figur 2 Figure 1 shows a schematic block diagram of an embodiment of a field device according to the invention. The field device shown here has the same components as the one described in Figure 2. Figur 1 The field device shown is shown. Identical components are named with the same reference symbols.

[0031] At the in Fig. 2 In the illustrated embodiment, the sensor module of the field device additionally has a non-volatile memory in which a table (Look up Table) is stored.

[0032] The table stores input data and verification data. According to the invention, the input data and verification data are calculated externally, i.e., outside the field device, for example during manufacturing, using appropriate software on a computing unit. A numerical calculation tool or software such as MATLAB or similar software can be used for this calculation. Here, corresponding verification data is calculated based on predefined input data. Subsequently, the input data and verification data are stored in the sensor module's memory during manufacturing, so that they are available later during the actual measurement operation of the field device.

[0033] Therefore, it is no longer necessary to transmit the entire algorithm via the internal communication interfaces 16 and 24 to fulfill the aforementioned SIL measures; only the input and verification data stored in the memory need to be transmitted. The transmission of the input and verification data from the sensor module to the main electronics module preferably occurs during system startup of the field device, before the field device begins its actual measurement operation.

[0034] The execution of the test algorithm is initiated by the second processor of the main electronics module. This can occur, for example, cyclically during the actual measurement operation. This means that during the actual measurement operation, in which the algorithm for compensating the raw measurement value is executed on the first processor of the sensor module, the second processor starts the execution of the test algorithm on the first processor. To do this, the second processor first transfers the input data, which was made available in the main electronics module at system startup, to the sensor module.

[0035] In the next step, initiated by the second processor, the test algorithm is executed on the first processor. For this, output data is calculated using the previously transmitted input data. The test algorithm is designed in such a way that it uses all machine instructions, or rather all opcodes, required to execute the Comp algorithm at least once. This test algorithm is a so-called opcode test, in which at least parts of the first processor's opcodes are tested.

[0036] The test algorithm can, as in Fig. 4 As illustrated by example, the algorithm can be divided into at least a start and a finish section, OPCT1 and OPCT2. The first processor 1 is further configured such that at least part of the algorithm Comp, preferably the entire algorithm Comp, is executed between the start section OPCT1 and the finish section OPCT2.

[0037] Alternatively, both the test algorithm Opcode can be divided into a multitude of sections C1...Cn and the algorithm Comp into a multitude of sections S1...Sn, and the first processor can be set up so that, when executed, a part of the test algorithm and then a part of the actual algorithm are executed alternately until all parts of the algorithm Comp and all parts of the test algorithm have been executed. Fig. 5 This illustrates one such variant, in which output data is calculated by the first processor 1 using the previously transmitted input data.

[0038] In the next step, the output data calculated by the first processor 1 is made available in the main electronics module so that the second processor can access it. This can be done, for example, by transferring the output data from the first to the second processor via the internal communication interfaces 16 and 24. For this purpose, the output data can first be stored in an internal register 18 of the first processor 1, so that the second processor can access it via the communication interfaces 16 and 24.

[0039] The second processor then checks whether the available output data matches the verification data transmitted from the sensor module to the main electronics module, preferably during system startup of the field device. If a data discrepancy is detected, the second processor also issues an error message.

Claims

1. A method for monitoring a first digital processor (1) integrated into a sensor module (10) of an automation technology field device (100) with a first set of machine commands on which a first algorithm (Camp) is run in order to calculate a measured value based on supplied raw measured values, using a second digital processor (2) integrated into a main electronic module (20) of the field device (100), exhibiting the following process steps: a) Calculating verification data based on specified input data (E) using a second test algorithm (OPCT1, OPCT2) on an external processor unit (40) independent of the field device, wherein the second test algorithm (OPCT1, OPCT2) is divided into at least one start section (OPCT1) and one end section (OPCT2), wherein the start section (OPCT1) and the end section (OPCT2) comprise at least some of, preferably all, opcodes of the first set of machine commands, which are used when running the first algorithm (Camp) on the first digital processor; b) Saving the specified input data (E) for calculating the verification data (V) and the verification data (V) calculated using the second test algorithm (OPCT1, OPCT2) in the sensor module (10) of the field device (100); c) Transmitting the specified input data (E) and verification data (V) stored in the sensor module (10) to the main electronic module (20); d) Transmitting the specified input data (E) from the main electronic module (20) to the sensor module (10) when the field device (100) is in measuring mode; e) Running the second test algorithm (OPCT1, OPCT2) on the first digital processor (1) of the sensor module (10) in such a way that output data (A) is calculated based on the specified input data (E) transmitted by the main electronic module (20), wherein the first algorithm (Camp) is run between the start section (OPCT1) and the end section (OPCT2) so that, after running the second test algorithm, the verification data can be used to check whether the first algorithm has been run in full; f) Providing the output data calculated by the first digital processor in the main electronic module; g) Checking the output data (A) with the verification data (V) made available by the sensor module (10) using the second digital processor (2)of the main electronic module (20) and, in the event that the output data (A) does not correspond to the verification data (V), detecting a malfunction.

2. The method as claimed in claim 1, wherein process steps d) to g) are performed cyclically when the field device (100) is in measuring mode.

3. The method as claimed in claim 1 or 2, wherein process step c) is performed upon a system start of the field device (100).

4. The method as claimed in one or more of the preceding claims, wherein process step b) is carried out during production of the sensor module (10), in particular by the field device manufacturer.

5. The method as claimed in one or more of the preceding claims, wherein when the field device (100) is in measuring mode, raw measured values are cyclically supplied to the first digital processor (1) and in measuring mode the raw measured values are cyclically further processed by the first digital processor (1) using the first algorithm (Camp).

6. The method as claimed in one or more of the preceding claims, wherein when the field device (100) is in measuring mode, a higher cycle rate is used to supply the raw measured values to the first digital processor (1) and to further process these by means of the first algorithm (Camp) than is used to run the second test algorithm (OPCT1, OPCT2) with the specified input data (E).

7. The method as claimed in one or more of the preceding claims, wherein the first algorithm is divided into multiple sections (C1 to Cn) and, during implementation, the multiple sections of the first algorithm are run between the start section (OPCT1) and the end section (OPCT2).

8. The method as claimed in the preceding claim, wherein the second test algorithm (OPCT1, OPCT2) is also divided into multiple sections (S1 to Sn) and, during implementation, the sections of the first algorithm (C1 to C2) and the second test algorithm (S1 to Sn) are run alternately.

9. The method as claimed in one or more of the preceding claims, wherein the verification data (V) is calculated on an industrial PC (40) by the manufacturer of the sensor module (10) during production of the sensor module (10).

10. The method as claimed in the preceding claim, wherein the verification data is calculated using a numerical calculation tool on the industrial PC (40).