Method and circuitry for operating a network or network section

Description

[0001] The present invention relates to a method for secure operation of a network or network section according to the preamble of claim 1 and an associated interconnection according to the preamble of claim 12.

[0002] With SPE (Single Pair Ethernet) or APL (Advanced Physical Layer), it is fundamentally possible to transmit a functionally safe protocol (e.g., PROFIsafe, CIPP Safety). The transmission path is used as a "black channel," with secure packets being sent over an insecure path.

[0003] For example, CN 210867687 U discloses such a mixed signal transmission, in which the DC voltage supply is also considered a signal. US 2012 / 317,426 A1 discloses classifying the power supply by adjusting a resistor in the PD (Powered Device). In the proposed method, however, the transmission of information about the power only concerns the initialization process for supplying the appropriate voltage. US 2019 / 342011 A1 discloses a method for transmitting information via the DC voltage supply, in which the functional blocks in the PD and the PSE are displayed, and an initialization process is performed. GB 2 517 727 A describes a method for data communication via a power line.

[0004] The main disadvantage of these solutions is that either the PD's status data is only sent discontinuously or the logic processing must also be carried out with a high level of security. This requires complex structures, such as redundant microprocessors. The secure transmission of digital information therefore requires considerable hardware and software effort.

[0005] It is the object of the present invention to propose a method and an associated circuit for data transmission which has a higher security (security level) in order to make reliable statements about a network or network section status.

[0006] This object is achieved according to the invention by a method for operating a network or network section according to the features of claim 1 and an associated interconnection according to the features of claim 12. Advantageous embodiments are specified in the respective associated subclaims.

[0007] According to this, the object is achieved by a method for operating a network or network section with a supply and signal transmission via two wires, comprising a first network side having a PSE (Power Sourcing Equipment) and a second network side having a PD (Powered Device), wherein the first and second network sides are connected via the supply and signal transmission, and wherein safety-relevant status data are transmitted to determine a safe status, wherein the status data are transmitted redundantly via the following two transmission paths: i) a digital data protocol, wherein a first transmission of the status data takes place by means of a serial, digital data packet, and ii) coding in the power transmission, wherein a second transmission of the status data takes place by means of an imposed characteristic of the current, namely by means of an analog characteristic of the current,where the redundant transmission of the status data on the two transmission paths is not physically correlated.,

[0008] Here, "safety-relevant status data" refers to information about potentially hazardous states of a machine or system identified as a result of a risk assessment. Hazardous states can include, for example, movements that could cause irreversible harm to the machine operator. Specifically, the possible states are divided into a safe and an unsafe state. In a safe state, the machine or system poses no hazard, while in an unsafe state, a potentially hazardous function is enabled. In the following, we will refer only to "status data," which refers to the aforementioned safety-relevant (status) data about the system's status.

[0009] Furthermore, the physical "non-correlation" or "no correlation" of the state data across the two transmissions means that they cannot be physically transferred into one another or derived from one another, such as by linear amplification, multiplication, superposition (addition / subtraction) of signals, etc.

[0010] The particular advantage is that the effort required to securely transmit a digital signal (e.g., emergency stop) is significantly lower than if a secure bus protocol were used. The effort required to achieve a high level of safety can be limited to safety-relevant units. This is achieved, for example, by having the measuring sensors, whose safety requirements only relate to a single switching point, fulfill only "simple" requirements for the measuring part, and only requiring the more complex safety requirements for the safety-relevant switching point. Overall, a significant degree of diversity is achieved because the digital serial protocol and the power consumption represent very different channels that use different components and principles.

[0011] An improved method variant provides that the status data represent safety-relevant states of the network or network section, whereby, in particular, a safe and an unsafe state can be determined. The first transmission of the status data takes place via a serial, digital data packet, which, for example, corresponds to one of the standardized protocols, in particular a serial signal according to IEEE 802.3cg:2019. The second transmission of the status data takes place as an imposed characteristic of the current, which can be achieved in particular by an analog characteristic of the current. This analog characteristic can, for example, be a defined current level for a defined period of time and / or a clocked current curve for a defined period of time.However, it can also be a sinusoidally oscillating current level with defined amplitudes and frequencies, whereby a certain oscillation characteristic is maintained for at least a defined period of time. Subsequently, a different oscillation characteristic is imposed.

[0012] The second transmission of the status data is imprinted on the second network side, which contains the PD, and received and evaluated on the first network side, which contains or represents the PSE. The evaluation consists, in particular, in determining a so-called "safe" or "unsafe" state.

[0013] "Safe or unsafe state" means that the "unsafe" state enables a potentially hazardous function and is characterized by the fact that the unsafe state cannot technically occur accidentally. The "safe" state is achieved, in particular, by a simple error.

[0014] One improvement is when the second transmission of the status data is at least a defined current level that is at least 1.3 times, advantageously at least 1.5 times, the average non-modulated current profile, and wherein the at least one defined current level is kept constant or substantially constant for a defined period of time. Alternatively or additionally, it can also be provided that the second transmission of the status data is at least a defined current level that is at least 1.1 times, advantageously at least 1.3 times, the maximum possible non-modulated current profile, and wherein the at least one defined current level is kept constant or substantially constant for a defined period of time. The respective aforementioned characteristics of the current levels can also be used alternately at a certain frequency for the second transmission of status data.

[0015] In this case, the second transmission of the status data and / or the two parallel transmissions of status data with identical information content to the status data, in particular of the potentially dangerous operation, can advantageously not occur randomly during the intended operation of the method.

[0016] An improvement in the method is that the ratio of the defined time duration to the undefined time duration of the current waveform is a maximum of 1 / 1000, with the defined time duration being greater than 0.25 ms, in particular greater than 0.5 ms. This makes it possible to distinguish a clearly defined, controlled state from a general operating system state of the network or network section.

[0017] To detect a single fault, the first and second transmission of status data, particularly the potentially dangerous status, advantageously always provide the same information. Inequality between the redundantly transmitted status information is defined as a faulty status. To avoid false-negative signals, a further improvement can be seen in defining a maximum adjustment time to achieve equality between the two status information items. Exceeding this time until equality is achieved is considered an error and / or a safe status. In control terms, initiating a safe status (e.g., emergency stop) means that the potentially hazardous function is not enabled (e.g., shutdown of the machine or system).

[0018] The invention further encompasses an interconnection for a network or network section comprising a first network side having a PSE (Power Sourcing Equipment) and a second network side having a PD (Powered Device). The first and second network sides are connected using a two-wire technology, such as an SPE (Single Pair Ethernet) or, more generally, a PoDL (Power over Data Line) for power and signal transmission. The interconnection is designed such that the aforementioned method can be operated according to one of the described embodiments.

[0019] In one embodiment, a coupler designed as a passive component is provided on each network side, by means of which the serial, particularly digital, data transmission and the power transmission take place on the two wires. Furthermore, a physical layer (PHY) is provided as a transmitting and receiving module. An improvement of the couplers lies in the fact that the couplers are designed in such a way as to prevent any influence or correlation between the first and second transmission of the status data via the respective wire. "Correlate" or "correlation" is to be understood here as explained above. The voltage source of the network side comprising the PD is fed via the coupler from the power transmission, which takes place via the two wires. Advantageously, a circuit is introduced between the coupler and the voltage source, with which a current draw can be imposed according to a specified value.

[0020] The PD is advantageously configured either as a sensor that serves as the transmitter of the second logical signal of the status data or as an actuator that functions as the receiver of the status data, in particular the second transmission of the status data. On the first network side comprising the PSE, the port of a (hub) module, which includes an SPE connection and output power detection, can be configured to function with the same hardware as a secure port for sensors, as a secure input, and for actuators, as a secure output.

[0021] A further improvement in the interconnection is that at least one microprocessor (µC) is provided on each network side, with these microprocessors being designed to operate redundantly and perform a cross-comparison of all safety-relevant steps (decisions). Alternatively, or as an additional redundant security measure, a hardware interconnection can be provided on the second network side, comprising the PD, to imprint the status data for the second transmission in the power transmission, particularly instead of a microprocessor.

[0022] Further details and advantages of the invention will now be explained in more detail with reference to an embodiment shown in the drawings.

[0023] They show: Fig. 1 an interconnection with SPE connection, Fig. 2 an analog transmission of status data.

[0024] The Figure 1The circuit shown for operating a network 1 has a PSE 8 assigned to the first network side 2 and a PD 9 assigned to the second network side 3. The two network sides 2, 3 are connected via the two wires 5, 6 of the SPE 4, via which both the power (supply) and data are transmitted. At the input of each of the two network sides 2, 3, a coupler 10, 20 is provided, which are designed as passive components and via which the serial data transmission and power transmission on the two wires 5, 6 takes place. Two PHY 14, 15, one on each network side 2, 3, serve as transmitting and receiving modules, with the data to be received or transmitted there being prepared and / or evaluated and processed in the respectively associated microprocessors 18, 19.The PD 9 has a supply unit 17 as a voltage source for the network side 3, which is fed via the coupler 20, and a circuit 22 with which a current draw can be imposed according to a specified value. In this way, power is drawn as a voltage supply for this network side, in particular for the microprocessor 19, the PHY 15, and a sensor unit (not shown).

[0025] In the embodiment shown, the status data are transmitted for the second time as described below in the Figure 2 shown, imprinted on the second network side 3 comprising the PD 9 and received and evaluated on the first network side 2 comprising the PSE 8. A safe or unsafe state is determined.

[0026] The definitions of which values ​​or data, or their sequence, are transmitted as state data, and which values ​​or data (sequence) are defined as a secure or unsafe state, are stored in memory elements 11, 21, which are assigned to the respective network sides. These values ​​or states must be generated by the sender and measured by the receiver in order to transmit them.

[0027] The definitions of the values ​​and value limits are ideally derived from known standards. For example, the voltage and current classes according to IEEE 802.3cg:2019 (Table 104) can be used for this purpose. According to the 12-36 V / 340 mA classes for 24 V sensors, there is a standard value of 340 mA, which can be drawn every 500 ms for at least 1 ms, for example, although tolerances may need to be observed.

[0028] The Figure 2shows a current curve over time. The operational currents in the curve shown and for the class shown are a maximum of approximately 60 mA and are limited to 70 mA due to the system. This current curve, which is characteristic of normal operation, is maintained for the (operating) time period dT of 500 ms. At times t1, t2, and t3, a defined current of 100 mA is impressed and maintained for the (state) time period dt of 1 ms. As mentioned above, during normal operation of network 1 or in the event of a fault, these state data for the two clocked time periods dt / dT can be achieved for the defined target current of 100 mA.

[0029] The second state value is a known digital serial signal, which is also transmitted in a clocked manner and superimposed onto the current curve. Both signals are completely independent of each other, as already explained above.

[0030] In this case, the inequality of the transmitted states is determined as a safe state, and for the detection of a single fault, both channels always provide the same information. Thus, an inequality is recognized as a faulty state. List of reference symbols

[0031] 1Network 2Network side, first 3Network side, second 4SPE (Single Pair Ethernet) 5Wire 6Wire 8PSE (Power Sourcing Equipment) 9PD (Powered Device) 10Coupler, first 11Data memory 12Current measuring unit 13Voltage measuring unit 14Physical Layer (PHY) 15Physical Layer (PHY) 16Voltage source 17Supply unit 18Microprocessor 19Microprocessor 20Coupler, second 21Data memory 22Interconnection dtDuration dTDuration

Claims

1. Method for operating a network or network section (1) with supply and signal transmission (4) over two wires (5, 6), comprising a first network side (2) having power sourcing equipment, PSE, (8) and a second network side (3) having a powered device, PD, (9), wherein the first network side (2) and second network side (3) are connected via the supply and signal transmission, and wherein safety-relevant state data for determining a safe state are transmitted, characterized in that the state data are transmitted redundantly via the following two transmission paths: - a digital data protocol, wherein a first transmission of the state data is carried out by means of a serial, digital data packet, and - a coding in the power transmission, wherein a second transmission of the state data is carried out by means of an impressed characteristic of the current, namely by means of an analogue characteristic of the current, wherein the redundant transmission of the state data on the two transmission paths does not correlate physically, in which case the first and second transmission cannot be physically transferred into each other or derived into each other.

2. Method according to Claim 1, characterized in that the state data represent safety-relevant states of the network or network section (1), wherein in particular a safe and an unsafe state can be determined.

3. Method according to Claim 1 or 2, characterized in that the serial signal is formed according to IEEE 802.3cg:2019.

4. Method according to one of the preceding claims, characterized in that the characteristic of the current as the second transmission of the state data is a defined current level for a defined time period and / or a clocked current profile for a defined time period.

5. Method according to one of the preceding claims, characterized in that the second transmission of the state data is impressed on the second network side (3) comprising the PD (9) and is received and evaluated on the first network side (2) comprising the PSE (8), in particular thereby determining a safe or an unsafe state.

6. Method according to one of the preceding claims, characterized in that the transmission of the state data is at least one defined current level which is at least 1.3 times, advantageously at least 1.5 times, the mean unmodulated current profile, and wherein the at least one defined current level is kept constant or substantially constant for a defined time period (dt).

7. Method according to one of the preceding claims, characterized in that the second transmission of the state data is at least one defined current level which is at least 1.1 times, advantageously at least 1.3 times, the maximum possible unmodulated current profile, and wherein the at least one defined current level is kept constant or substantially constant for a defined time period (dt).

8. Method according to one of the preceding claims, characterized in that - the second transmission of the state data and / or - the two parallel transmissions of state data with identical information content, in particular relating to potentially dangerous operation, cannot occur randomly during intended operation of the method.

9. Method according to Claim 7 or 8, characterized in that the ratio of defined time period (dt) to the undefined time period (dT) of the current profile is at most 1 / 1000, wherein the defined time period (dt) is greater than 0.25 ms, in particular greater than 0.5 ms.

10. Method according to one of the preceding claims, characterized in that, in order to detect a single error, the first and second transmission of the state data, in particular the potentially dangerous state, always provide the same information, wherein a disparity of the information in the first and second transmission defines a faulty state.

11. Method according to Claim 10, characterized in that a maximum adjustment period is defined for achieving equality of the two items of information in the first and second transmission, wherein exceeding the maximum adjustment period until the equality is achieved is evaluated as an error.

12. Circuit for a network or a network section (1) comprising a first network side (2) having power sourcing equipment, PSE, (8) and a second network side (3) having a powered device, PD, (9), wherein the first network side (2) and second network side (3) are connected by means of SPE (4) as synchronous supply and signal transmission, characterized in that the circuit is designed such that the method according to one of the preceding claims can be operated herewith.

13. Circuit according to Claim 12, characterized in that on each network side (2, 3) respectively - a coupler (10, 20) in the form of a passive component is provided and is used to perform the serial data transmission and power transmission on the two wires (5, 6), and - a PHY (14, 15) is provided as transmitting and receiving modules.

14. Circuit according to Claim 13, characterized in that the couplers (10, 20) are designed in such a way that there is no influence or correlation between the first and second transmission of the state data over the respective wire (5, 6).

15. Circuit according to one of Claims 12 to 14, characterized in that the second network side (3) comprising the PD (9) comprises a supply unit (17) as a voltage source, which is supplied in particular via the coupler (20).

16. Circuit according to one of Claims 12 to 15, characterized in that the PD (9) - is in the form of a sensor and is the transmitter of the second logical signal of the state data, or - is in the form of an actuator and is the receiver of the state data, in particular the second transmission of the state data.

17. Circuit according to one of Claims 12 to 16, characterized in that at least one microprocessor (18, 19) is provided on each network side (2, 3), these microprocessors being designed to work redundantly and to carry out a cross-comparison of all safety-relevant steps.

18. Circuit according to Claim 17, characterized in that a hardware circuit is provided, instead of the microprocessor (19), on the second network side (3) comprising the PD (9) for impressing the state data for transmission in the power transmission.