Safety related shutdown for functionally non-safe standard modules

Abstract

A distributed input / output (I / O) control system includes a controller, a power supply, a plurality of input / output (I / O) modules, wherein one of the plurality of I / O modules includes multiple ports configured to receive or transmit input signals or output signals, and a voltage port with multiple pins, wherein the multiple pins are configured as a safety-rated power source with separated voltage outputs to achieve safety shutdown applications.

Description

SAFETY RELATED SHUTDOWN FOR FUNCTIONALLY NON-SAFESTANDARD MODULESBACKGROUND1. Field

[0001] Aspects of the present disclosure generally relate to industrial and other automation systems, and more particularly to a safety related shutdown for functionally non-safe standard modules in connection with distributed input / output (I / O) modules.2. Description of the Related Art

[0002] Industrial automation systems are used in different industrial fields to automatically perform a plurality of tasks, for example in a manufacturing process or an assembly line of production facility. Industrial automation systems comprise a plurality of interconnected components, such as for example sensors, actuators, and control devices. The control devices can be for example programmable logic controllers for controlling and monitoring process parameters.

[0003] A programmable logic controller (PLC) is used to monitor input signals from a variety of input points (input sensors) which report events and conditions occurring in a controlled process. A control program stored in a memory within the PLC is configured to instruct the PLC what actions to take upon encountering particular input signals or conditions. In response to these input signals, the PLC derives and generates output signals which are transmitted via PLC output points to various output devices, such as actuators and relays, to control the process.

[0004] The input and output points referred to above are typically associated with input modules and output modules, respectively. Input modules and output modules are collectively referred to as I / O modules herein. Those skilled in the art alternatively refer to such I / O modules as I / O cards or I / O boards. The I / O modules are typically pluggable intorespective slots located on a backplane board of the PLC.

[0005] Standard I / O modules do not perform safety functions. Safety functions are executed by designated safety modules or relays configured to bring a whole system to a safe state.

[0006] In this context, the term ‘safety (related) shutdown’ is used to express a concept where an application using non-safety rated devices can achieve some level of safety ratings by controlling their source input power from a safety rated output. For example, standard non-safe outputs can become ‘safe’ when their input power is being sourced and controlled from a (fail-)safe output.SUMMARY

[0007] Briefly described, aspects of the present disclosure relate to industrial and other automation systems, and more particularly to a safety related shutdown for functionally non-safe standard modules in connection with distributed input / output (I / O) modules.

[0008] A first aspect of the present disclosure provides an input / output (I / O) module comprising multiple ports configured to receive or transmit input signals or output signals, and a voltage port with multiple pins, wherein the port and multiple pins are configured as a safety-rated power source with separated voltage outputs to achieve safety shutdown applications.

[0009] A second aspect of the present disclosure provides a distributed input / output (I / O) control system comprising a controller, a power supply, a plurality of input / output (I / O) modules, wherein at least one I / O module comprises multiple ports configured to receive or transmit input signals or output signals, and a voltage port with multiple pins, wherein the multiple pins are configured as a safety-rated power source with separated voltage outputs to achieve safety shutdown applications.BRIEF DESCRIPTION OF THE DRAWINGS

[0010] FIG. 1 illustrates a schematic diagram of a known control system comprising multiple modules in accordance with an exemplary embodiment of the present disclosure.

[0011] FIG. 2 illustrates a schematic diagram of a known control system with distributed I / O system in accordance with embodiments of the present disclosure.

[0012] FIG. 3 illustrates a schematic diagram of an I / O system in connection with a known safety related shutdown application in accordance with embodiments of the present disclosure.

[0013] FIG. 4 illustrates a schematic diagram of an I / O module with integrated safety shutdown feature in accordance with an exemplary embodiment of the present disclosure.

[0014] FIG. 5 illustrates a schematic diagram of an I / O system with integrated safety shutdown in accordance with an exemplary embodiment of the present disclosure.DETAILED DESCRIPTION

[0015] To facilitate an understanding of embodiments, principles, and features of the present invention, they are explained hereinafter with reference to implementation in illustrative embodiments. In particular, they are described in the context of industrial and other automation systems, and more particularly in the context of a safety related shutdown for functionally non-safe standard modules in connection with input / output (I / O) modules. Like reference numerals represent like elements throughout.

[0016] The components and materials described hereinafter as making up the various embodiments are intended to be illustrative and not restrictive. Many suitable components and materials that would perform the same or a similar function as the materials described herein are intended to be embraced within the scope of embodiments of the present disclosure.

[0017] FIG. 1 illustrates a schematic diagram of a known control system 100 comprising multiple modules in accordance with embodiments of the present disclosure.

[0018] In an exemplary embodiment, the control system 100 can be configured and / or comprises one or more programmable logic controllers (PLCs), which can comprise multiple modules. As noted, PLCs are typically used in combination with automation systems in different industrial fields to automatically perform a plurality of tasks, for example in a manufacturing process or an assembly line of production facility. PLCs are control devices for controlling and monitoring process parameters.

[0019] With further reference to FIG. 1, the control system 100 comprises a central processing unit (CPU) 110, an input module 120 comprising digital and / or analog input points 122, 124, an output module 130 comprising digital and / or analog output points 132, 134 and a power supply 140 which supplies power, specifically direct current (DC) power, to the CPU 110, the input module 120 and the output module 130. The input / output modules 120, 130 typically operate with 24 volts (V) direct current (DC) and the CPU 110 typically operates with 5V DC. The CPU 120 can further comprise one or more memories (ROM and / or RAM) 112 and one or more Ethernet interface(s) 114. The input module 120 and output module 130 can be configured such that they can either operate as input module or output module. The modules 120, 130 are collectively referred to as I / O modules herein.

[0020] The CPU 110 monitors input signals from the input points 122, 124, such as input sensors, which report events and conditions occurring in a controlled process. An application 150, herein also referred to as control program, is downloaded and stored within the CPU 110 and comprises instructions what actions to take upon encountering particular input signals or conditions. In response to the input signals, the CPU 110 derives and generates output signals which are transmitted via the output points 132, 134 to various output devices, such as actuators and relays.

[0021] Further components of the control system 100 may include operator terminals which provide interfaces to the control system for monitoring, controlling, and displaying information to an operator or end user. Operator terminals are also known as Human- Machine-Interface (HMI) devices which allow effective operation and control of thecomponents and devices of the automation system from the human end, i. e. the operator or end user, while the components / devices of the automation system feed information back to the operator / end user. It should be noted that those skilled in the art are familiar with such control system and PLCs.

[0022] FIG. 2 illustrates a schematic diagram of a known control system 200 with distributed I / O system in accordance with embodiments of the present disclosure.

[0023] A plant configuration often features multiple I / O components within a central automation system. Wiring of I / O components installed at a distance away from an automation system may soon become highly complex and susceptible to electromagnetic interference. Distributed I / O systems provide a solution for such configurations, because they include field devices with a wide range of I / O options, and the field devices (inputs and outputs) are operated locally in a distributed configuration. These field devices can include digital and analog channels, temperature measurements, counter inputs etc.

[0024] FIG. 2 illustrates a control system 200 comprising multiple distributed modules and components which together form the distributed system 200. The components include controller 210, multiple different I / O devices 220, 230, including analog and / or digital inputs / outputs, a human- machine-interface (HMI) device 240 and programming interface 250. The components are operably coupled via industrial ethernet 260, or other suitable communication networks, which ensures communication between sensors, actuators, and the I / O modules and components of the system 200. It should be noted that FIG. 2 illustrates a simplistic view of distributed control system 200, and further details will not be explained herein because one of ordinary skill in the art is familiar with such a control system 200.

[0025] FIG. 3 illustrates a schematic diagram of a distributed I / O system 300 in connection with a known safety related shutdown application including safety relay in accordance with embodiments of the present disclosure.

[0026] FIG. 3 illustrates distributed I / O system 300 comprising multiple distributed modules which together form the I / O system 300. The modules include several I / O modules,such as digital I / O module 310 (DIQ+DQ), digital input module 320 (DI), digital output module 330 (DQ), analog input module 340 (Al) and IO link master module 350 that ensures communication between sensors, actuators, components and the I / O modules 310, 320, 330, 340 and connects the I / O modules 310, 320, 330, 340 to a central automation system.

[0027] The modules 310, 320, 330, 340, 350 operate with grounded 24 volts (V) direct current (DC), labelled as “1L+” and “2L+”, wherein 1L+ designates non-switched supply voltage, and 2L+ designates switched load voltage. The terms “IM” and “2M” designate functional ground connections.

[0028] As noted earlier, standard I / O modules do not perform safety functions. Safety functions are executed by designated safety modules or relays configured to bring a whole system to a safe state. FIG. 3 illustrates safety relay 360 which is operably coupled between a power source and the respective power inputs of the modules 310, 320, 330, 340, 350. More specifically, safety relay 360 is coupled between load voltage 2L+ and the modules 310, 320, 330, 340, 350. The supply voltage 1L+ is provided by an external power source. In this example, safety shutdown applications are achieved by using the safety relay 360, i. e. a safety rated output, to control input power to the non-safety rated outputs of the modules 310, 320, 330, 340, 350. The respective outputs (load voltage) of the modules 310, 320, 330, 340, 350 are electrically isolated and include safe shutdown. The supply voltage for the modules 310, 320, 330, 340, 350, i. e. voltage to operate the modules themselves, is not electrically isolated and do not include safe shutdown.

[0029] FIG. 4 illustrates a schematic diagram of an I / O module 400 with integrated safety shutdown feature in accordance with an exemplary embodiment of the present disclosure.

[0030] As described with reference to FIG. 3, safety shutdown application can be achieved by using the safety relay 360, i. e. safety rated output, to control input power to the non-safety rated outputs of the modules. In other examples, safety shutdown applications can be achieved via specific switching mechanisms or via power distributors. However, there is no system solution with integrated safety shutdown. Separatecomponents, e. g. safety relays or power distributors, incur extra costs and / or require additional labor, e. g. installation and wiring of the components.

[0031] In an exemplary embodiment of the present disclosure, the I / O module 400 comprises an incorporated safety shutdown feature. The I / O module 400 comprises multiple ports 410 configured to receive or transmit input signals or output signals, or other type of signals or information.

[0032] Further, the module 400 comprises a voltage port 410A with multiple pins, wherein the port 410A and the multiple pins are configured as a safety -rated power source with separated voltage outputs to achieve safety shutdown applications. More specifically, the module 400 comprises two (2) voltage ports 410A, 410B with separated voltage outputs to achieve safety shutdown applications. Voltage port 410A may be considered as incoming port, and voltage port 410B may be considered as outgoing port. The voltage ports 410A, 410B can be according to the so-called AIDA (Automation Initiative of German Automobile Manufacturers) standard.

[0033] The module 400 operates with grounded 24 volts (V) direct current (DC), labelled as “1L+” and “2L+”, wherein 1L+ designates non-switched supply voltage, and 2L+ designates switched load voltage. The terms “IM’ and “2M’ designate functional ground connections.

[0034] A first set 420A of pins 1, 2 is configured to provide a first voltage (supply voltage 1L+, IM), and a second set 420B of pins 3, 4 is configured to provide a second voltage (load voltage, 2L+, 2M). The first set 420A of pins 1, 2 is configured to provide a supply voltage for operating the I / O module 400. In an embodiment, the first set 420A of pins 1, 2 can be configured to provide continuous non-switched power, that is directly in support of safety-shutdown applications. In another embodiment, the first set 420A of pins can be configured as Safety Integrity Level 3 (SIL 3) safety-rated output. The supply voltage provided by the first set 420A of pins (1L+) is now no longer needed to be provided from an external power source (see for comparison FIG. 3), because it is provided directly from the module 400 as a safety-rated power source. Reduced safety diagnostics are performed in this operating mode in order to prioritize safety shutdown operation.

[0035] The second set 420B of pins 3, 4 is configured to provide a load voltage for operating devices, systems or applications representing a load with respect to the I / O module 400. In an embodiment, the second set 420B of pins 3, 4 is configured to operate as a safety output with safety shutdown that controls source power. The load voltage outputs (2L+) can be operated normally as a safety output to control the 24V source power to the standard outputs; thereby exerting safety shutdown control when necessary. Pin 5, labelled as 420C, is configured to provide functional ground.

[0036] Summarizing, a pin assignment for each port 410A, 410B is as follows:

[0037] In another exemplary embodiment, the module 400 comprises a fault detection mechanism between the multiple pins 1 through 4, wherein the fault detection mechanism is configured to generate a diagnostic message when a fault is detected between two or more pins. An integrated fault detection mechanism is configured to detect faults or errors between pins, for example as listed below:

[0038] FIG. 5 illustrates a schematic diagram of an I / O system 500 with integrated safety shutdown in accordance with an exemplary embodiment of the present disclosure.

[0039] Distributed input / output (I / O) control system 500 comprises a controller, a power supply, and a plurality of input / output (I / O) modules. At least one I / O module 400 comprises multiple ports 410 configured to receive or transmit input signals or output signals, or other type of signals or information, and a voltage port 410A with multiple pins, wherein the multiple pins are configured as a safety-rated power source with separated voltage outputs to achieve safety shutdown applications. In an embodiment, the illustrated system 500 includes at least one module 400 as described with reference to FIG. 4.

[0040] Further, the system 500 may comprise several I / O modules, such as digital I / O module 510 (DIQ+DQ), digital input module 520 (DI), digital output module 530 (DQ), analog input module 540 (Al) and IO link master module 550 that ensures communication between sensors, actuators, components, and the I / O modules and connects the I / O modules to a central automation system.

[0041] The system 500 further comprises a connector for operably coupling the plurality of I / O modules with each other and / or with other devices or systems. The connector includes a cable 560 configured to plug into the voltage port of a first I / O module and a voltage port of a second I / O module. In an example, the cable 560 is configured as AIDA (Automation Initiative of German Automobile Manufacturers) compliant cable. In our example, the cable 560 connects module 400 via its (outgoing) port 410B to (incoming) port 510A of module 510, module 510 via its (outgoing) port 510B to (incoming) port 520A of module 520, and so on.

[0042] In another exemplary embodiment, a user can select a pin assignment as described herein from a module’s parameter set. For example, the user can select the 1L+ (pin 1) output to provide continuous non-switched power, which is directly in support of safety-shutdown applications. Alternatively, the 1L+ output can also be configured to operate as a SIL 3 safety-rated output. The use case can be selected explicitly by the user.

[0043] The described module 400 and system 500 provide integrated safety shutdown.As illustrates, the uniquely separated voltage outputs 1L+ and 2L+ (pins 1, 4) are safe power sources that are designed to be incorporated into a single cable 560 in order to conveniently achieve and support safety shutdown applications. The cable 560 can be connected from the port 410A (or 41 OB) of module 400 directly into power inputs of modules 530 etc. As noted earlier, supply voltages 1L+ (pin 1) is now no longer needed to be provided from an external power source (see for comparison FIG. 3), because it is provided directly from the module 400. A separate safety relay or special wiring diagram is no longer needed.

Claims

CLAIMS1. An input / output (I / O) module comprising: multiple ports configured to receive or transmit input signals or output signals, and a voltage port with multiple pins, wherein the port and multiple pins are configured as a safety-rated power source with separated voltage outputs to achieve safety shutdown applications.

2. The I / O module of claim 1, wherein a first set of pins is configured to provide a first voltage, and wherein a second set of pins is configured to provide a second voltage.

3. The I / O module of claim 2, wherein the first set of pins is configured to provide a supply voltage for operating the I / O module.

4. The I / O module of claim 2, wherein the second set of pins is configured to provide a load voltage for operating devices, systems or applications representing a load with respect to the I / O module.

5. The I / O module of claim 2, wherein one of the multiple pins is configured to provide functional ground.

6. The I / O module of claim 1, further comprising: a first voltage port with multiple pins and a second voltage port with multiple pins, wherein the first and second voltage ports are each configured to achieve safety shutdown applications.

7. The I / O module of claim 3, wherein the first set of pins is configured to provide continuous non-switched power that is directly in support of safety-shutdown applications.

8. The I / O module of claim 3, wherein the first set of pins is configured as SIL 3 safety-rated output.

9. The I / O module of claim 4, wherein the second set of pins is configured as a safety output to control source power.

10. The I / O module of claim 1, further comprising: a fault detection mechanism between the multiple pins, wherein the fault detection mechanism generates a diagnostic message when a fault is detected between two or more pins.

11. A distributed input / output (I / O) control system comprising: a controller, a power supply, a plurality of input / output (I / O) modules, wherein at least one I / O module comprises: multiple ports configured to receive or transmit input signals or output signals, and a voltage port with multiple pins, wherein the multiple pins are configured as a safety-rated power source with separated voltage outputs to achieve safety shutdown applications.

12. The I / O system of claim 11, wherein the at least one I / O module comprises a plurality of voltage ports with multiple pins, and wherein the plurality of voltage ports is safety-rated and configured to achieve safety shutdown applications.

13. The I / O system of claim 11, further comprising: a connector for operably coupling the plurality of I / O modules with each other and / or with other devices or systems.

14. The I / O system of claim 13, wherein the connector includes a cable configured to plug into the voltage output port of a first I / O module and a voltage input port of a second I / O module.

15. The I / O system of claim 14, wherein the cable is configured as AIDA compliant cable.

16. The I / O system of claim 11, wherein a first set of pins is configured to provide a first voltage, and wherein a second set of pins is configured to provide a second voltage.

17. The I / O system claim 16, wherein the first set of pins is configured to provide continuous non-switched power that is directly in support of safety-shutdown applications.

18. The I / O system of claim 16, wherein the voltage port is configured as SIL 3 safety-rated output.

19. The I / O system of claim 18, wherein the first set of pins is configured as SIL 3 safety-rated output, and wherein the second set of pins is configured to operate as a safety output to control source power.

20. The I / O system of claim 11, wherein the at least one I / O module comprises a fault detection mechanism between the multiple pins, and wherein the fault detection mechanism generates a diagnostic message when a fault is detected between two or more pins.

Images