CONTROL DEVICE AND METHOD FOR CONTROLLING AN AUTOMATION SYSTEM - Patent application

Abstract

To provide a method and device for controlling an automated system.SOLUTION: A communication channel connects a first control module and a second control module for exchanging processing data of an automated system. The first control module creates processing data at a first time t1, sends it to the second control module via the communication channel, receives a response to the processing data from the second control module, and processes it at a fourth time t4. The second control module receives the processing data from the first control module, processes it at a second time t2, generates the response at a third time t3, and sends it to the first control module. A first minimum duration Δ1 between the first time t1 and the second time t2 can be guaranteed. A second minimum duration Δ2 between the second time t2 and the third tie t3 can be guaranteed. A third minimum duration Δ3 between the third time t3 and the fourth time t4 can be guaranteed.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a control device and a corresponding method for controlling an automation system. [Background technology]

[0002] Control devices are generally known in the field of automation technology. Their task is to control and regulate technical systems. The technical systems may be machines or processes. A control device is called a module if it is made up of individual components, each of which performs a different task. The individual components are also called control modules, which are combined to form a unit in a housing or housing frame. Typically, such a unit has at least one head module as a central processing unit and one or more modules for connection to the periphery of the technical system. The latter may be called input / output (I / O) modules.

[0003] The input modules acquire the state of the technical system by acquiring signals from sensors or input devices attached to the inputs of the modules. The central processing unit evaluates the acquired input signals and generates output signals that are output via the output modules depending on the input signals and the desired control or regulation action. Via the output signals, actuators are controlled to bring about a desired reaction of the technical system.

[0004] Special control devices are safety control devices, also called safety controllers or fail-safe (FS) controllers. These controllers perform the same functions as normal control devices, but differ in that they can additionally perform safety-related tasks. Safety-related tasks can lead to safety-related reactions in the technical system. For this purpose, safety controllers are equipped internally with additional hardware and software that enable the execution of safety-related functions. The safety-related functions ensure the safe operation of the technical system according to the relevant standards for machinery safety (in particular EN 61508, EN 62061 and / or ISO 13849-1).

[0005] An essential quality criterion for a safety controller is its reaction time. The reaction time refers to the time required between the detection of a safety-relevant event and the execution of a corresponding safety-oriented reaction. The reaction time therefore represents the time span between, for example, the actuation of an emergency stop button and the resulting stopping of a hazardous drive. The shorter the reaction time, the higher the quality of the safety controller. When calculating the reaction time, the most unfavourable time behaviour is estimated. Communication between the modules therefore plays a decisive role.

[0006] For communication, the individual modules of the control device are linked with one another via communication channels and therefore must fulfill certain requirements to provide fail-safe communication (FS communication). However, the specific requirements for fail-safe communication can have a negative effect on reaction times. For example, for fail-safe communication, the data to be transmitted is transmitted uniformly redundantly, which increases the insensitivity of the fail-safe communication to electromagnetic interference. However, redundant transmissions cannot guarantee any time characteristics. For the calculation of the reaction times of the safety functions, the most unfavourable time behaviour has to be estimated. A redundant transmission therefore leads to a longer reaction time, since the time required for the redundant second transmission has to be taken into account.

[0007] One way to improve the response time of a safety control system is to have the communication take place over a communication channel specifically designed for secure communication. A further option is to provide securely synchronized clocks in the individual control modules so that defined time characteristics can be guaranteed within and between modules. However, both options require significant effort and are expensive to implement. Summary of the Invention [Problem to be solved by the invention]

[0008] Against this background, it is an object of the present invention to provide a control device and method that allows better consideration of response times without the use of fail-safe communication devices or fail-safe synchronized clocks. [Means for solving the problem]

[0009] According to one aspect of the present disclosure, the present invention provides a control device for controlling an automation system, comprising: a. a first control module; b. a second control module; c. a communication channel through which the first control module and the second control module exchange process data of the automation system; The control device includes: d. the first control module is configured to create processed data at a first time t1, send the processed data to the second control module via the communication channel, receive a response to the processed data from the second control module, and process the processed data at a fourth time t4; e. the second control module is configured to receive the processed data from the first control module, process the processed data at a second time t2, generate the response at a third time t3, and send the response to the first control module; f. The times t1, t2, t3, and t4 are in time series; The control device further comprises: g. the first control module and the second control module are jointly configured to ensure a first minimum duration Δ1 between the first time t1 and the second time t2; h. the second control module is configured to ensure a second minimum duration Δ2 between the second time t2 and the third time t3; i. the first control module and the second control module are jointly configured to ensure a third minimum duration Δ3 between the third time t3 and the fourth time t4; The problem is solved by a control device having at least one of the following features.

[0010] According to another aspect of the present disclosure, the present invention provides a control device for controlling an automation system, comprising: a. a first control module; b. a second control module; c. a communication channel through which the first control module and the second control module exchange process data of the automation system; The control device includes: d. the first control module is configured to create processed data at a first time t1, send the processed data to the second control module via the communication channel, receive a response to the processed data from the second control module, and process the processed data at a fourth time t4; e. the second control module is configured to receive the processed data from the first control module, process the processed data at a second time t2, generate the response at a third time t3, and send the response to the first control module; f. the times t1, t2, t3, and t4 are in time series; g. the first control module processes the process data according to a first local period; h. the first control module sends the first instance and at least a second instance of the process data to the second control module within the first local period. The above-mentioned problems are also solved by a control device having the above-mentioned features.

[0011] According to another aspect of the present disclosure, the object is to provide a method for controlling an automation system, comprising: a. a communication channel connects the first control module and the second control module for exchanging process data of the automation system; b. the first control module creates processing data at a first time t1, sends it to the second control module via the communication channel, receives a response to the processing data from the second control module, and processes it at a fourth time t4; c. the second control module receives the processed data from the first control module, processes it at a second time t2, and creates the response at a third time t3 and sends it to the first control module; d. The times t1, t2, t3, and t4 are in time series; The method comprises: e. the first control module and the second control module jointly ensure a first minimum duration Δ1 between the first time t1 and the second time t2; f. the second control module ensures a second minimum duration Δ2 between the second time t2 and the third time t3; g. the first control module and the second control module jointly ensure a third minimum duration Δ3 between the third time t3 and the fourth time t4. The above-mentioned problems are also solved by a method having at least one of the following characteristics.

[0012] According to another aspect of the present disclosure, the object is to provide a method for controlling an automation system, comprising: a. a communication channel connects the first control module and the second control module for exchanging process data of the automation system; b. the first control module creates processing data at a first time t1, sends it to the second control module via the communication channel, receives a response to the processing data from the second control module, and processes it at a fourth time t4; c. the second control module receives the processed data from the first control module, processes it at a second time t2, and creates the response at a third time t3 and sends it to the first control module; d. the times t1, t2, t3, and t4 are in a time series; g. the first control module processes the process data according to a first local period; h. the first control module sends the first instance and at least a second instance of the process data to the second control module within the first local period. The above-mentioned problems are also solved by a method having the following features.

[0013] It is therefore an idea of ​​the invention to configure the control modules in such a way that they ensure a certain minimum duration between selected events when communicating with each other, i.e. they can guarantee a predefined minimum time interval between two events. By specifying these minimum intervals, the actual response time cannot be reduced, but it will be shown that the guaranteed time characteristics do influence the calculation of the worst case temporal behavior.

[0014] Without specifying said minimum time interval, there is no guaranteed functionally safe time interval shorter than the full turnaround time of the processed data from the sender to the receiver and back to the sender. On the other hand, specifying a minimum time interval guarantees certain time characteristics in the turnaround of the processed data that can be taken into account in the analysis of the worst case scenario and leads to assumptions that are better than the full turnaround time.

[0015] The events between which the control modules guarantee a minimum time interval are selected in such a way that the control modules can guarantee only this minimum interval or that the two control modules can guarantee an interval to each other without synchronizing in time for this purpose. Hence, both variants do not require a functionally safe synchronization between the modules. Likewise, both variants can be implemented completely in software without requiring additional hardware equipment. Thus, an improved worst-case analysis can be realized by the device or by a retrofit system, which is implemented in a simple and cost-effective manner. In this way, the object mentioned at the beginning is completely solved.

[0016] According to a further refinement, the control device comprises: a. the first control module and the second control module have the further feature of guaranteeing the first minimum duration Δ1 and / or the third minimum duration Δ3 by redundantly transmitting the processing data and ensuring certain time characteristics.

[0017] According to this embodiment, the control modules communicate with each other by redundantly transmitting process data. Moreover, in addition to the redundant transmission, certain time characteristics of the redundant transmission are guaranteed by the respective module. In this way, a minimum time interval between the creation and processing of process data in two different control modules can be easily ensured.

[0018] According to a further refinement, the control device comprises: a. the first control module transmits a first instance of the processed data at a time t a and by moving the second instance of the processed data to a transmit buffer of the communication channel at time t b to the transmit buffer of the communication channel; b. The first control module a and t band initiating time monitoring to move the second instance of the processed data to the transmit buffer only if the time interval exceeds a specified minimum value, thereby ensuring the specified time characteristic.

[0019] According to this refinement, the first control module ensures a minimum time interval between sending a first instance of the processed data and sending a second instance of the processed data by monitoring the time interval by time monitoring and sending the second instance of the processed data only if the minimum time interval is met, whereby the first control module, in interaction with a correspondingly designed second control module, can ensure a minimum time interval (minimum duration Δ1 or Δ3) between creation of the processed data and processing of the processed data on the different control modules, without a functionally safe synchronization of the different control modules being required.

[0020] It is understood that the second control module, being a transmitter of processing data, may be designed in a similar manner. Thus, according to a further refinement, the control device comprises: a. the second control module transmits a first instance of the response at a time t a and shifting a second instance of the response to the transmit buffer of the communication channel at time t b redundantly transmitting a response to the transaction data by shifting the response to the transaction data into the transmission buffer of the communication channel; b. The second control module a and t b and by moving the second instance of the response to the transmission buffer only if the time interval exceeds a specified minimum value.

[0021] In this way, replies can also be sent redundantly, according to this embodiment.

[0022] According to a further refinement, the control device comprises: a. the second control module has the further feature of ensuring the time characteristic by initiating time monitoring to determine a time interval between receipt of the first instance of the processed data and receipt of the second instance of the processed data only when the second control module receives the first instance of the processed data.

[0023] According to this refinement, the second control module has a further time monitoring device, which may be designed independently from the time monitoring device of the first control module. By starting this time monitoring only when the second control module is receiving the first instance of the process data, the second control module is enabled to interact with the correspondingly designed first control module to guarantee a minimum time interval between the creation of the process data and the processing of the process data (minimum duration Δ1 or Δ3) on the different control modules, without the different control modules being safety-relatedly synchronized in time. In this case, the first control module, being a receiver of the process data, can also be designed similarly.

[0024] A response to the transmitted processing data can also be transmitted in this way in the manner described above. a. the first control module may have the further feature of ensuring the time characteristic by initiating a time monitor to determine a time interval between receipt of the first instance of the response and receipt of the second instance of the response only when the first control module receives the first instance of the response.

[0025] According to a further refinement, the control device comprises: a. the first instance of the processed data and the second instance of the processed data are redundant data telegrams of the processed data; b. The first control module has the further feature of assigning consecutive instance numbers to the first instance of the process data and the second instance of the process data.

[0026] Furthermore, according to another refinement, a. the first instance of the response and the second instance of the response are redundant data telegrams of the response; b. The second control module assigns consecutive instance numbers to the first instance of the response and the second instance of the response.

[0027] According to these refinements, an instance number is introduced for the transmission of redundant data packets. The instance number refers to the redundant instance or redundant packet of a particular processing data object of processing data that is transmitted redundantly. The instance number is used to make the instances distinguishable and classifiable. By using the instance number, the control module can easily determine whether the first instance or a subsequent instance of processing data is being received. It is understood that the invention is not limited to a first and a second instance, but that three or more instances can be transmitted, used in pairs or in whole to ensure a minimum spacing.

[0028] According to a further refinement, the control device comprises: a. the second control module begins time monitoring at the second time t2 to determine a time interval relative to the third time t3; b. said second control module has the further feature of generating said response at said third time t3 only after said second minimum duration Δ2 has elapsed.

[0029] According to this refinement, the second control module can easily guarantee the second minimum duration Δ. For this purpose, it is sufficient for the second control module to monitor the time interval between two events that are within the second control module's range of influence. Time monitoring of this period can thus be realized particularly easily and independently of other modules. This embodiment further contributes to ensuring the defined time characteristics in an easy manner.

[0030] According to a further refinement, the control device comprises: a. the first control module has the further feature of periodically sending and receiving the processed data, monitoring a number of periods between the first time t1 and the fourth time t4 as a turnaround time, and initiating a safety-related action if the turnaround time exceeds a specified value.

[0031] In this way, the first control module can monitor the turnaround time and initiate a corresponding safety-related reaction if the processing data is not processed within a defined turnaround time.

[0032] According to a further refinement, the control device comprises: a. the first control module processes the process data according to a first local period; b. the second control module processes the process data according to a second local period; c. the first local period and the second local period have the same duration; d. The first minimum duration Δ1, the second minimum duration Δ2 and the third minimum duration Δ3 are each shorter than said period.

[0033] According to this refinement, each of the minimum durations Δ1 to Δ3 is made shorter than the duration of the respective processing cycle and can therefore be easily integrated into the processing cycle as a fixed time characteristic.

[0034] According to a further refinement, the control device comprises: a. the first control module has the further feature of sending the first instance and at least a second instance of the process data to the second control module within the first local period.

[0035] According to this refinement, the first control module transmits the processed data at least twice within a single local period, whereby a minimum interval can be easily achieved together with the receiving module.

[0036] According to a further refinement, the control device comprises: a. the second control module has the further feature of sending the first instance and at least a second instance of the response of the process data to the first control module within the second local period.

[0037] According to this refinement, the second control module also transmits a response at least twice within a single local period, whereby a minimum interval can again be easily achieved with the first control module as receiving module.

[0038] According to a further refinement, the control device comprises: a. The first control module and the second control module each have a fail-safe implemented processing unit enabling fail-safe execution of user programs and / or fail-safe input / output of the processing data.

[0039] A fail-safe implemented processing unit may for example be an IEC 61131 PLC resource of the head module of the control device which allows a fail-safe execution of a user program generated by the user. With respect to an input / output module, a fail-safe implemented processing unit can ensure a fail-safe input and output of process data.

[0040] According to a further refinement, the control device comprises: a. Each fail-safe implemented processing unit has the further feature that it is configured to ensure fail-safe communication over said communication channel regardless of the design of said communication channel.

[0041] According to this refinement, the first and second control modules are configured to enable fail-safe communication via a non-fail-safe communication channel (black channel principle), while measures to ensure defined time characteristics can also be used when applying this principle, as described above.

[0042] According to a further refinement, the control device comprises: a. each fail-safe implemented processing unit is further configured to provide fail-safe time monitoring in each of said first and second control modules.

[0043] According to this refinement, the control module can provide fail-safe time monitoring, for example by redundant time monitoring by two separate processing units which compare and monitor their results with each other. In this way, defined time characteristics can be provided in a simple manner.

[0044] It is understood that the features mentioned above and those to be described below can be used not only in the combinations shown in each case, but also in other combinations or on their own, without departing from the scope of the invention.

[0045] Embodiments of the invention are illustrated in the drawings and are explained in more detail in the following description. [Brief description of the drawings]

[0046] [Figure 1] FIG. 2 shows a schematic diagram of an embodiment of a control module having a first control module and a second control module. [Diagram 2] FIG. 2 shows a schematic diagram of communication between two control modules according to a first aspect. [Diagram 3] 4 shows a schematic diagram of communication between two control modules according to a second aspect. [Figure 4] FIG. 13 is a schematic diagram of data processing in a control module according to a third aspect. [Diagram 5] 1 shows a sequence diagram of redundant transmission of processing data of a first instance and a second instance. [Figure 6] FIG. 6 shows a sequence diagram of redundant transmission according to FIG. 5 when the processing data of the first instance is lost. [Figure 7] FIG. 6 shows a sequence diagram of redundant transmission according to FIG. 5 when the processing data of the second instance is lost. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0047] 1 shows a schematic diagram of a control device according to an embodiment of the present invention, the control device being generally designated by the reference numeral 10.

[0048] The control device 10 is in the embodiment shown as a modular control device comprising three separate modules: A first control module 12 is the central processing unit of the control device 10 (head module), a second control module 14 and a third control module 16 are input / output modules via which the control device 10 is connected to technical systems.

[0049] The modules 12-16 are separate assemblies arranged together in a housing 18 or housing frame. Typically, the modules are separate units that are plugged together to form the control device 10, whereby the control device 10 can be assembled separately and adapted to the respective control and regulation tasks. Here, expandability is indicated by further module slots 20 as placeholders for additional modules. Thus, the control device 10 is not limited to the number of modules shown here but can be expanded by additional modules.

[0050] Typically, a control device 10 of this kind is housed in a control cabinet (not shown here) and the input / output modules 14, 16 are connected directly or indirectly (e.g. via a fieldbus) to the periphery 22 of the technical system. The periphery 22 may include input devices such as a light barrier 24 or an emergency stop button 26, and output devices acting as actuators. The actuators may for example be motors 28 or contactors 30. It is understood that the invention is not limited to the particular peripheral elements shown here.

[0051] In this embodiment, the second control module 14 and the third control module 16 each have connections to input and output devices. In other words, both control modules 14, 16 now have respective inputs and outputs 32 through which the modules are connected to the peripherals 22. It will be appreciated that in other embodiments, the control modules may only have inputs or only outputs. The inputs and outputs 32 of the modules are preferably located in a separate module part (connection module part 34).

[0052] Processing of the input and output signals applied to the inputs and outputs 32 takes place in a logic module part 36 of the control module. In a preferred embodiment, the logic module part 36 includes a fail-safe processing unit 38, for example with two separate processing units 40a and 40b. The processing units 40a, 40b may preferably be microcontrollers, ASICs or FPGAs of various kinds. In addition, the logic module part 36 has an interface 42 to a communication bus 44. As well as the processing units 40a, 40b, the interface 42 may be redundant. In principle, the control modules 12-16 have a fail-safe design in the sense of SIL2 or higher according to EN 61508 and / or PL d or higher according to ISO 13849-1.

[0053] The communication bus 44 allows the control modules of the control device 10 to establish communication channels with each other. In particular, the control modules 14, 16, which function as input / output modules, may communicate with the head module via the communication bus 44. The communication bus 44 may be formed by bus module parts 46 belonging to the individual control modules 12-16. The bus module parts 46 arranged in a row may form a so-called modular backplane. Alternatively, the communication bus 44 may also be formed by a fixed rear panel of the housing 18 of the control device 10.

[0054] The first control module 12 serves as a head module in this embodiment and has a similar logic module part 36 as an input / output module. A processing unit 38 implemented in a fail-safe manner in the head module is configured to process a user program. The user program may be stored, for example, in a memory 48 in the logic module part 36. The user program may be processed according to the input-process-output (IPO) principle. In a first step, the processing unit 38 implemented in a fail-safe manner generates a processed image of the input (PII), and then sequentially executes the instructions of the user program based on the PII. Finally, the processing unit 38 implemented in a fail-safe manner in the head module writes a processed image of the output (PIO), based on which the output is controlled.

[0055] Inputs are read via the input modules and outputs are set via the output modules. A fail-safe implemented processing unit 38 for the input / output modules is arranged to provide the inputs and outputs in a fail-safe manner. Communication between the modules is achieved by a communication bus 44. Thus, in this embodiment, the first control module 12 is not directly provided with inputs and outputs 32 to the periphery and can therefore dispense with its own connection module part 34. However, the first control module 12 may have an additional interface 50 that can be used to establish a connection to other control devices or diagnostic equipment.

[0056] The communication between the two control modules is described below using Fig. 2 as an example. Fig. 2 shows, in a schematic diagram, an example of the transmission of input processed images between the head module (first control module 12) and the input / output module (second control module 14) via a communication bus 44. Fig. 2 particularly shows a worst-case analysis of the fail-safe transmission of PII (FS-PII).

[0057] In the flow diagram according to FIG. 2, the time t is plotted longitudinally. The first control module 12 (top) and the second control module 14 (bottom) operate with a fixed local cycle 52 with a defined cycle time. The cycle time is the time for processing the cycle including all communication operations. "Local" in this context means that the cycles of the first control module 12 and the second control module 14 do not necessarily have to be synchronized. In particular, the cycles do not have to be synchronized in a functionally safe manner. In other words, the cycles may be uniformly synchronized, but this does not necessarily have to be done in a fail-safe manner to carry out the method according to the present disclosure. In general, it is considered that there is a certain time offset 54 between the local cycles 52 of the individual control modules 12, 14.

[0058] The control module 12 creates a processed data frame and prepares it for transmission, as indicated here by reference number 56. The processed data frame is then moved to an output buffer of the communication channel provided by the communication bus 44 and is thereby transferred to the jurisdiction of the communication bus 44 (time t1). Transmission to the second control module 14 via the communication bus 44 then occurs. Reception of the data is now indicated by reference number 58. Time t2 indicates the start of processing of the processed data by the second control module 14 (i.e. reading the processed data from the received frame and evaluating it). The first control module 12 and the second control module 14 are jointly configured to provide a minimum duration Δ1 between the two times t1 and t2. This can be achieved, for example, by preparing and sending the processed data from the control module 12 not only once but twice within a local period. Such a process will be explained in more detail with reference to figures 5 to 7.

[0059] The second control module 14 generates a response to the received data and places the response in the output buffer of the communication channel provided by the communication bus 44 at time t3. Generating the response involves reading the input of the second control module 14 and writing the appropriate status in the frame for dispatch. After being received by the first control module 12, the response is processed by the first control module 12 at time t3. The first control module 12 and the second control module 14 also guarantee a minimum duration Δ3 between the two times t3 and t4 for the response. This can be realized in the same way as for sending processed data, i.e. the response is arranged and sent by the second control module 14 several times (at least twice) within the local period of the second control module.

[0060] For the analysis of the worst case, the event 60 in FIG. 2 is analyzed below (here indicated by an arrow). The event 60 may for example be the actuation of an emergency stop button, which changes the state of an input of the second control module 14. For this analysis, the event 60 is timed in such a way that the processing of the event (here indicated by reference number 62) can no longer be considered for the response at time t3 and therefore takes place entirely in the following period (reference number 62'). This premise is acceptable, since the signal must be present at the input for at least two local period times. Hence, in the present case, the event 60 is not considered until the following period, and the corresponding state of the input is saved and sent in response to the processing data 58'. This response is then also sent to the first control module 12 and processed by it at time t4.

[0061] In a worst case analysis of FS-PII transmission times, the duration from the occurrence of event 60 to (guaranteed) processing by the first control module 12 is considered. Taking into account redundant transmissions, the latter time in this illustration becomes time t4'. Without the additional guaranteed time characteristics of transmission or processing, the full loop 64 from time t1 to time t4' will be used for the worst case analysis.

[0062] For a better worst case analysis, the control modules 12, 14 are configured, as mentioned above, jointly or individually to guarantee certain minimum intervals (minimum durations) between individual actuations. In the present case, the first control module 12 and the second control module 14 are configured jointly to guarantee a minimum duration Δ1 between times t1 and t2 and a minimum duration Δ3 between times t3 and t4 (or t3' and t4'). Furthermore, the second control module 14 can itself guarantee a minimum duration Δ2 between times t2 and t3.

[0063] By setting the minimum intervals as described above, additional time characteristics of transmission and processing are guaranteed to be known so that they can be taken into account in the worst case analysis. In the present case, this means that period 65 (time t1 to time t3) can be ignored in the analysis, since this period is required at least until a response is generated and is therefore fixed. One way of ensuring these minimum intervals by transmitting processing data multiple times is described in more detail below with reference to Figures 5 to 7.

[0064] Before that, however, an example of the transmission of a processed image of an output PIO (FS-PIO) between a head module (first control module 12) and an input / output module (second control module 14) will be described with reference to Fig. 3. As in Fig. 2, the flow diagram of Fig. 3 also shows time t plotted longitudinally. As in Fig. 2, the control module 12 creates a processed data frame and prepares it for transmission, here indicated by reference numeral 66. The processed data frame is then moved to an output buffer of a communication channel provided by the communication bus 44 and thus transferred to the jurisdiction of the communication bus 44 (time t1).

[0065] After receipt 68 of the process data by the second control module 14, the second control module 14 starts processing the process data at a second time t2. An output generated at an output is indicated by reference numeral 70. Following the output 70, a desired state 72, such as a stop of the machine, is deduced by the machine. At a third time t3, the second control module 14 generates a corresponding response and prepares it for transmission 74. After receipt 76 of the response by the first control module 12, the response is evaluated at a fourth time t4.

[0066] With respect to the worst-case analysis of FS-PIO transmission duration, the duration between sending transaction data and receiving the corresponding response is relevant if other time characteristics cannot be guaranteed. In other words, the entire turn 78 is primarily relevant to the analysis herein.

[0067] For better worst case analysis, a minimum interval between the individual actuations is also guaranteed here, where the second minimum duration Δ2 between the second time t2 and the third time t3 corresponds to the second minimum duration Δ2 shown above with reference to Fig. 2. Furthermore, a third minimum duration Δ3 can be guaranteed by the interaction of the first control module 12 and the second control module 14. The third minimum duration Δ3 relates to the time span between the third time t3 and the fourth time t4.

[0068] As before, by guaranteeing these minimum intervals, a better worst case analysis can be achieved with respect to the transmission to the output processed image. Because of these guaranteed time characteristics, the time span 79 starting at the second time t2 and going to the fourth time t4 can be ignored in the analysis.

[0069] Having demonstrated above the beneficial effect of minimum spacing on worst case analysis of PII and PIO transmission durations, we now turn to show how to configure the control module to ensure said minimum spacing.

[0070] As shown above, the three minimum intervals Δ1 to Δ3 are related. The minimum interval Δ2 can be ensured by a single control module. On the other hand, the minimum duration Δ1 and the minimum duration Δ3 can only be ensured by the interaction of two modules. The latter can take advantage of redundant (multiple) transmissions of the processed data to guarantee the minimum intervals. In the following, with reference to Fig. 4, we will consider how the minimum duration Δ2 can be guaranteed by a single control module.

[0071] Figure 4 is a detailed view of Figure 2 or Figure 3, showing only the second control module 14. The same reference signs refer to the same parts in Figures 2 and 3.

[0072] This detailed view shows two local periods 52 of the second control module 14. As mentioned above, after receiving processing data from another control module, the second control module 14 starts processing the data at time t2. At the same time, the control module 14 starts a timer for time monitoring, which defines a period during which the control module 14 prevents sending processing data (i.e. a response to the received processing data). Only after a certain period has elapsed is the control module 14 able to generate and send a response back to the other control module. The period during which the second control module 14 is prevented from sending a response corresponds to a second minimum duration Δ2.

[0073] The time monitoring can be realized by a timer with a fixed duration. Such a timer can be easily implemented by a fail-safe implemented processing unit 38 provided in the control module. In this regard, the redundant design of the fail-safe implemented processing unit 38 also allows the timer to be set up in a fail-safe manner. For example, each processing unit of the second control module may run a timer to ensure a minimum duration. The timer is usually already built into a common microcontroller or can be easily emulated in software. Hence, no additional hardware is needed for the implementation of the time monitoring, so that it can also be retrofitted to existing control modules by software updates.

[0074] With reference to figures 5 to 7 it will be explained below how the two modules can interact in order to ensure a minimum interval between the individual operations. One possibility is to send the processing data multiple times within a period time, so that a first instance and at least a second instance of the processing data are always transmitted within a single period.

[0075] To make these instances recognizable, distinct and classifiable, the control module can be configured to assign consecutive instance numbers to redundant instances (i.e., redundant packets of a particular process data object (PDO)). The instance numbers serve to make the redundant instances distinct and, as such, can be added to an existing sequence of process data. It is understood that other measures may be taken to achieve this distinctiveness.

[0076] With the aid of distinguishability of individual instances and by utilizing redundant transmissions, as described in more detail below, a minimum duration can be guaranteed between the creation of processing data in one control module and its processing in another control module.

[0077] 5 shows a sequence diagram of the transmission of redundant processed data from the first control module 12 to the second control module 14. The control module 12 includes a fail-safe processed image generator 82 and a send buffer 84. The control module 14 includes a receive buffer 86 and a fail-safe processed image consumer 88. The processed image generator 82 generates processed images for transmission, whereas the processed image consumer 88 evaluates the received processed images. The processed image generator 82 and the processed image consumer 88 are fail-safe devices. On the other hand, the send buffer 84 and the receive buffer 86 may be non-fail-safe devices (also called standard devices) of the communication bus.

[0078] It will be understood that control module 12 may include a receiving buffer and a processed image consumer, as may control module 14. Similarly, control module 14 may include a transmitting buffer and a processed image producer. In this manner, bidirectional communication between the two modules may be achieved. However, for the sake of simplicity, these components are omitted here.

[0079] Figure 5 illustrates the redundant transmission of a first and second instance of process data. More specifically, Figure 5 illustrates the transmission of a first instance of a process data object (FS-PDO Instance 1) followed by a second instance of a process data object (FS-PDO Instance 2). The first and second process data objects have the same control-related content but are differentiated by the instance numbering described above.

[0080] In the following it will be explained how a minimum time interval can be maintained in such a transmission (compare Fig. 2 and Fig. 3: minimum duration Δ1 and minimum duration Δ3). Fig. 5 shows the case where all processed data objects reach the receiver (second control module 14) and none of the redundant processed data objects are lost.

[0081] In step S100, the fail-safe processed image generator 82 creates a first instance of a processed data object and saves the object at time t in step S102. a The processed data object is then present in the send buffer 84 (S103) and can be sent via the communication bus 44. From this point on, the fail-safe processed image generating device 82 can no longer influence when and how the processed data object is sent via the communication bus 44. Thus, after storing the processed data object of the first instance (FS-PDO instance 1) in the send buffer 84, the first control module 12 starts a time monitoring in order to ensure a minimum interval for the creation of the second processed data object (FS-PDO instance 2). The time monitoring can be performed by a timer set to a defined period (timer execution). In addition, the first control module 12 is configured not to create another processed data object or not to move such an object to the send buffer if the defined period has not yet expired. Thus, the processed data object of the second instance is placed in the send buffer 84 only if the timer has expired (i.e., no unexpired time has been detected). Preferably, the second instance of the process data object is also created (S106) only after the timer has expired.

[0082] Thus, the processed data object of the second instance maintains the minimum interval in step S108 and is then placed in the transmission buffer 84 while being ready for transmission (S109). In this way, the first control module 12 ensures that a minimum interval Δa is maintained between the creation of the processed data object of the first instance and the creation of the processed data object of the second instance.

[0083] If none of the processed data objects are lost during transmission, the second control module 14 first receives the first instance of the processed data object stored in the receive buffer 86, which has been prepared by the processed image consumer 88 in step S110. The processed data object is then evaluated in step S112.

[0084] The second control module 14 then starts time monitoring in order to ensure a minimum interval for the processing and evaluation of the processed data object of the second instance (S114). The time monitoring can be configured similarly to the time monitoring of the first control module, so that when the timer runs, the processing and evaluation of the processed data object, but not its transmission, is prevented. This can be achieved in that the second control module 14 is configured to read the processed data object of the second instance placed in the receiving buffer 86, but to process and evaluate this object only if no unexpired time is detected and therefore the minimum interval Δb can be ensured. In other words, the evaluation of the processed data object of the second instance is conditionally performed in step S116 depending on whether the timer has expired (S115).

[0085] By having the two control modules 12, 14 guarantee a minimum interval Δa and Δb respectively, it is possible for the processed image generator 82 in the first control module 12 and the processed image consumer 88 in the second control module 14 to jointly guarantee that there is a minimum time interval between the production (S100) and processing (S116) of the processed data. This minimum time interval corresponds to the minimum durations Δ1 and Δ3 as explained with reference to Figures 2 and 3. By utilizing redundant transmissions, the required minimum durations (minimum durations Δ1 and Δ3) can thus be easily ensured by ensuring a defined time span between the operations in the individual control modules.

[0086] As will be shown below, these minimum durations can also be guaranteed even if one of the two processed data objects is lost: Figure 6 illustrates the case where the processed data object of the first instance is lost during transmission; Figure 7 then illustrates the case where the processed data object of the second instance does not reach its destination.

[0087] 6 and 7, the operation of the first control module 12 is the same as that of the first control module 12 according to Fig. 5, and the first control module 12 transmits redundant processing data according to steps S100 to S108 mentioned above. Therefore, a description of these steps will be omitted.

[0088] However, unlike Fig. 5, the transmission of the processed data object of the first instance (FS-PDO instance 1) is lost in the case according to Fig. 6. Therefore, the processed data object of the first instance does not reach the receiving buffer 86 of the second control module 14 or the processed image consumer 88 cannot read the processed data object of the first instance from the receiving buffer 86. In this case, the processed data object of the first instance is not processed and evaluated by the processed image consumer 88. Similarly, no time monitoring is started. Meanwhile, the second control module 14 receives the processed data object of the second instance. The processed data object of the second instance is read by the processed image consumer 88 in step S118 and directly processed in step S120. Since the processed image consumer 88 realizes that it is processing the processed data object of the second instance, no time monitoring is started.

[0089] This process ensures a minimum time interval between creation and processing, even if the process data object of the first instance is lost.

[0090] The same result occurs if the process data object of the second instance is lost. This case is illustrated in Figure 7. Again, the steps taken by the first control module 12 are initially identical to those of the first control module 12 of Figure 5.

[0091] Thus, the second control module 14 receives the processed data object of the first instance and executes steps S110 to S114 as already explained with reference to Fig. 5. Thus, the processed image consumer 88, after evaluating the processed data object of the first instance (S112), starts a time monitoring (S114), but then does not receive another processed data object after a certain period of time has elapsed (S122). Thus, the processed image consumer 88 re-evaluates the processed data object of the first instance after the time monitoring has ended in order to complete the processed data evaluation (S124). The new evaluation of the processed data object of the first instance is also delayed by a minimum duration Δb, so that a minimum interval between the creation of the processed data (S100) and the final evaluation of the processed data (S124) is again ensured.

[0092] It is understood that the above techniques for establishing a minimum interval between transmissions are merely examples, and that other variations are contemplated for this purpose. Thus, the subject matter of the present disclosure is not limited by this description. Rather, the subject matter of the present invention is defined solely by the following claims.

Claims

1. A control device (10) for controlling an automation system, the control device comprising: a first control module (12), a second control module (14), and a communication channel through which the first control module (12) and the second control module (14) exchange process data of the automation system; the first control module (12) is configured to create process data at a first time t1, send the process data to the second control module (14) via the communication channel, receive a response to the process data from the second control module (14), and process the process data at a fourth time t4; the second control module (14) is configured to receive the process data from the first control module (12), process the process data at a second time t2, generate the response at a third time t3, and transmit the response to the first control module (12); The times t1, t2, t3, and t4 are in time series, said first control module (12) and said second control module (14) are configured to ensure a defined minimum duration between selected events when communicating with each other, thereby ensuring a predetermined minimum time interval between two events; A control device configured with either or both of the following: (A) and (B); (A) the first control module (12) and the second control module (14) are configured in cooperation to ensure a first predetermined minimum duration Δ1 between the first time t1 and the second time t2, and / or a third predetermined minimum duration Δ3 between the third time t3 and the fourth time t4; (B) the second control module (14) is configured to ensure a second predetermined minimum duration Δ2 between the second time t2 and the third time t3.

2. 2. The control device according to claim 1, wherein the first control module (12) and the second control module (14) are configured to transmit the process data redundantly and to ensure certain time characteristics, thereby guaranteeing the first predetermined minimum duration Δ1 and / or the third predetermined minimum duration Δ3.

3. the first control module (12) is configured to shift a first instance of the process data into a transmission buffer (84) of the first control module of the communication channel at a first time ta and to shift a second instance of the process data into the transmission buffer (84) of the first control module of the communication channel at a second time tb, thereby transmitting process data redundantly; 3. The control device of claim 2, wherein the first control module (12) is configured to initiate a first time monitor to determine a first time interval between the times ta and tb, and to shift the second instance of the process data to a transmit buffer (84) of the first control module only if the determined first time interval exceeds a specified minimum value.

4. the second control module (14) is configured to shift a first instance of the response to a transmission buffer (84) of the second control module (14) of the communication channel at a third time ta and to shift a second instance of the response to a transmission buffer (84) of the second control module (14) of the communication channel at a fourth time tb, thereby redundantly transmitting a response to the process data; 3. The control device of claim 2, wherein the second control module (14) is configured to initiate a second time monitor to determine a second time interval between the third point in time ta and the fourth point in time tb, and to shift the second instance of the response to a transmission buffer (84) of the second control module (14) only if the determined second time interval exceeds a specified minimum value.

5. 3. The control device of claim 2, wherein the second control module is configured to initiate a third time monitor to determine a time interval between receipt of the first instance of the process data and receipt of the second instance of the process data only when the second control module receives the first instance of the process data, thereby ensuring the specific time characteristic.

6. 3. The control device of claim 2, wherein the first control module is configured to initiate a fourth time monitor that determines a time interval between receipt of the first instance of the response and receipt of the second instance of the response only when the first control module receives the first instance of the response, thereby ensuring the time characteristic.

7. the first instance of the process data and the second instance of the process data are a redundant data telegram of the process data; 3. The control device of claim 2, wherein the first control module is configured to provide consecutive instance numbers to the first instance of the process data and the second instance of the process data.

8. the first instance of the response and the second instance of the response being redundant data telegrams of the response; 3. The control device of claim 2, wherein the second control module is configured to assign consecutive instance numbers to the first instance of the response and the second instance of the response.

9. the second control module (14) is configured to initiate a fifth time monitor at the second time t2 to determine a time interval relative to the third time t3; 2. The control device of claim 1, wherein the second control module (14) is configured to generate the response at the third time t3 only after the second predetermined minimum duration Δ2 has elapsed.

10. 2. The control device according to claim 1, wherein the first control module (12) is configured to periodically transmit and receive the process data, monitor a number of periods between the first time t1 and the fourth time t4 as a turnaround time, and initiate a safety-related operation if the turnaround time exceeds a specified value.

11. the first control module (12) is configured to process the process data according to a first local period; the second control module (14) is configured to process the process data according to a second local period; the first local period and the second local period have the same duration; 2. The control device of claim 1, wherein the first predetermined minimum duration Δ1, the second predetermined minimum duration Δ2 and the third predetermined minimum duration Δ3 are each shorter than the period.

12. 12. The control device of claim 11, wherein the first control module (12) is configured to send the first instance and at least a second instance of the process data to the second control module (14) within the first local period.

13. 12. The control device of claim 11, wherein the second control module (14) is configured to transmit the first instance and at least a second instance of the response of the process data to the first control module (12) within the second local period.

14. 2. The control device according to claim 1, wherein the first control module (12) and the second control module (14) each have a fail-safe implemented processing unit (38) enabling a fail-safe execution of a user program and / or a fail-safe input / output of the process data.

15. The control system of claim 14, wherein each fail-safe implemented processing unit (38) is configured to ensure fail-safe communication over the communication channel regardless of a design of the communication channel.

16. 15. The control system of claim 14, wherein the fail-safe implemented processing unit (38) is configured to provide fail-safe time monitoring in each of the first and second control modules (12, 14).

17. 1. A method for controlling an automation system, comprising: connecting a first control module (12) and a second control module (14) through a communication channel for exchanging process data of the automation system; the first control module (12) creating process data at a first time t1, transmitting the process data to the second control module (14) over the communication channel, receiving a response to the process data from the second control module (14), and processing the process data at a fourth time t4; the second control module (14) receiving the process data from the first control module (12), processing it at a second time t2, generating the response at a third time t3, and transmitting the response to the first control module (12); The times t1, t2, t3, and t4 are in a time series, the first control module (12) and the second control module (14) ensure a defined minimum duration between selected events when communicating with each other to guarantee a predetermined minimum time interval between two events; A method comprising either or both of the following steps (A) and (B): (A) the first control module (12) and the second control module (14) jointly ensure a first predetermined minimum duration Δ1 between a first time t1 and a second time t2 and / or a third predetermined minimum duration Δ3 between a third time t3 and a fourth time t4; (B) the second control module (14) ensures a second predetermined minimum duration Δ2 between the second time t2 and the third time t3.

Images