Safe_Networking

8/8/2019 Safe_Networking

1/12

Chapter 7

Safe Networking

Contents

7.0 Conventional bus systems

7.1 Safe bus systems

7.1.1 Structure of a safe bus system

7.1.2 Selecting a safe bus system

7.2 SafetyBUS p: the safe bus system

183SafeNetw

orking


2/12

184SafeNetw

orking


3/12

185SafeNetw

orking

7.0 Conventional bus systems

Great changes have taken place in the field of automation technologyover the last few years. This is especially true of fieldbus systemsthat enable plant and machinery to be modular and decentralised.The associated application options and benefits, such as increasinglyless wiring and the flexibility to adapt to changing requirements, arewell known.

As features such as data transfer requirements will vary from plant toplant, and fieldbus systems need to be optimised to meet differentcriteria, several different systems have become established asstandard". Basically, however, the advantages of a network increase

2

M M M

M MM M

VisualisationPLC

Factory bus(e.g. Ethernet)

Master

Plant bus(e.g. Interbus)

Sensor/Actuator Bus(e.g. AS-i-Bus)

Fig. 69: Typical bus arrangement


4/12

186SafeNetw

orking

the larger the plant or the machine, and the greater the number ofsubscribers that can be connected. A number of different functionsare likely to be required, for example, acquiring a machines sensorydata or transferring data between two sites, to name just two. Butwhatever your requirement, the capabilities of the fieldbus being usedwill be taken into account through a hierarchical bus structure. Atypical arrangement would include a factory bus, a plant bus andpossibly a separate bus system for the sensor/actuator area.

3


5/12

187SafeNetw

orking

4

7.1 Safe bus systems

In principle, a similar bus system would also be of interest to thesafety technology sector. After all, the requirement for a similarlycomplex connection of input devices (e.g. emergency stops or safetygate switches) to actuators (e.g. contactors or valves) is equally valid.

Fig. 70: Typical safety bus arrangement

However, none of the established bus systems for the standard sectorcan in any way meet the requirements of a safety-related network.This is why Pilz has decided to develop a safe bus system tosupplement the current range of fieldbuses. With the safety-relatednetwork, users will enjoy the same benefits they have come to expectfrom conventional, well-established fieldbus systems, such as lesswiring, universal diagnostics and greater flexibility and openness. Thesafe bus system has an open protocol, enabling different fieldmodules from other manufacturers to be connected.


6/12

188SafeNetw

orking

A safe bus system can also be used to network safety-related controlsystems such as the PSS-range of safety systems. In essence,users of programmable safety systems will notice little change: theywill use the same familiar software for programming, they will still beable to use the available software blocks and will also be able tocommunicate with the decentralised I/Os via their addresses.

Established fieldbus systems do not meet the requirements of asafe network. This is because of the requirements of the MachineryRegulations, in particular with regard to EN 292-1 (Safety ofmachinery. Basic concepts, general principles for design. Basicterminology, methodology), EN 1050 (Safety of machinery. Principlesfor risk assessment) and EN 954-1 (Safety of machinery. Safetyrelated parts of control systems. General principles for design). Forcategory 4, EN 954-1 states that a single fault in the control systemshall not lead to a loss of the safety function, and that the singlefault is detected at or before the next demand upon the safetyfunction. It goes on to say: If this is not possible, an accumulation offaults shall not lead to a loss of the safety function. In other words, itmust be possible to manage a variety of potential faults.

We need to start by acknowledging that on a physical, single-channelbus, the possibility of a communication error occurring can neverpositively be excluded. Given this background, the objective is to

reach the highest possible level of safety, not by avoiding errors (forthis is practically impossible), but by controlling them. The mechanisms

that lead to communication errors are well known. The measures thatcan be taken to counter a few isolated error types are also commonknowledge. The safe bus system has been developed with a packageof measures to ensure that each communication error on the bus isdetected and controlled. One such measure, for example, is EchoMode, which ensures that any data loss or delay is safely detected.


7/12

189SafeNetw

orking

Measures taken to ensure safety relate not only to datacommunication, but directly to the bus system itself. For example, if asubscriber fails, the ability to safely display this information within acertain period of time must be guaranteed. All things considered, anumber of measures targeting different aspects are required in orderto design a safe bus system. In general these will affect the busprotocol, the network management and the hardware of the buscomponents, which are normally designed to be both diverse andredundant.

7.1.1 Structure of a safe bus system

Safe bus systems are designed in the same way as conventionalfieldbus systems. Typically they will have a central processing unit(CPU), several decentralised input and output modules with digital oranalogue I/Os, and field modules that are connected directly, such aslight curtains. Generally the CPU will only have a few I/Os to coverthe local requirement in the control cabinet. It will also look after thenetwork configuration, in which information such as the number ofsubscribers, the data communication rate or the addresses of thesubscribers is stored. No additional knowledge is required toprogram the actual safety program. Even the connection to theconventional fieldbus is made in familiar fashion, either throughappropriate interface cards or by means of interface modules housedwithin the safety system.

The decentralised I/O modules have fewer I/Os in comparison toconventional controllers, enabling the network to be finelypartitioned at a local level. The decentralised I/O-modules aremainly used to connect safety devices such as emergency stopswitches or safety gates, but complex field modules may also beconnected to the safety bus via the decentralised inputs and outputs.Where the bus has an open protocol (e.g. SafetyBUS p), field


8/12

190SafeNetw

orking

modules from other manufacturers can easily be integrated directlyinto the safety bus via the available interface electronics.

From the point of view of safety, it may be sensible to partition theplant into sub-sections. This takes into account the ability to formgroups within the safe bus system (see Fig. 71), enabling safety-related data from a whole plant to be controlled through a singlesafety bus. Sub-sections, however, may be assigned to differentgroups. Should a fault occur, only the respective group would needto switch to a safe condition. It is also possible to form supervisorygroups. A typical example of this would be in emergency stopapplications, where the emergency stop function is valid for the wholeplant, irrespective of the location of the relevant emergency stopbutton. In a case such as this, where a signal group has beenformed, the emergency stop function must be operative for the wholeplant, even if a section of the plant (signal group) is in a group stop,e.g. for maintenance work.

Fig. 71: Emergency stop function via a safe network


9/12

191SafeNetw

orking

7.1.2 Selecting a safe bus system

Conventional controllers have a number of different bus systemsavailable, each of which is optimised with regard to the requirementsof the particular plant. In the same way, the demands on the bussystem will differ within the safety section of the control system. Theamount of safety-related data on plants that mainly have emergencystop functions is relatively small, whereas time-critical applications,such as monitoring for a broken shearpin on a press, will involvelarge amounts of safety data.

The operation of the plant, however, may require a combination ofsafety functions requiring both large and small amounts of data. Thistype of requirement would clearly benefit from a bus procedure that isevent-driven. This would only access the bus when information hadchanged, in contrast to a bus that sends out data as part of eachcycle. The selection of an appropriate safe bus system may alsodepend on which conventional fieldbus is already installed, as userswill be able to rely on a certain amount of knowledge as regardsdiagnostics or maintenance, and will also be familiar with thenecessary tools.


10/12

192SafeNetw

orking

7.2 SafetyBUS p: the safe bus system

SafetyBUS p is based on an event-driven bus procedure, i.e. data isonly sent when the status at the I/O or field module has changed.This means that SafetyBUS p is particularly suitable for networkingplants that combine functions with variable signal frequencies andfast reaction times. SafetyBUS p is a multi-master system based onthe proven CAN bus system. 64 subscribers can be connected viaSafetyBUS p using the PSS-range of programmable safety systems.

Subscribers may include not only the PSS programmable safetysystems but also decentralised I/O modules or field modules (e.g.light curtains) that are connected to SafetyBUS p directly. Cable runsof up to 1,000 m can be installed. The decentralised I/O modules (8inputs/8 outputs) can be used to poll input devices (emergency stop,safety gate or two-hand devices) or control actuators (e.g.contactors). The system has been developed to meet therequirements of category 4 in accordance with EN 954-1, and AK6 inaccordance with DIN 19250. Whether the connection is centralisedor decentralised, users view the plant configuration as a normalprocess image of inputs and outputs. This means that all theBG/TV-tested software blocks available for the PSS safety systems(emergency stop, two-hand, etc.) can still be used.

The ability to incorporate optoelectronic protective devices such aslight curtains into SafetyBUS p provides additional benefits. Forexample, not only can the standard reports on the status of theprotected field be transmitted, but also additional diagnosticinformation such as a reduction in the quantity of light received, sothat contamination or misalignment can be detected early.SafetyBUS p also enables light curtains to be configured via the safe


11/12

193SafeNetw

orking

bus system, making it relatively easy to blank individual light beamsor mute safety devices in order to move material in and out.

The security and flexibility of a safe, open bus system willundoubtedly be the next step forward in the fast-changing world ofsafety technology.


12/12

194SafeNetw

orking

Documents

Safe_Networking