Method for operating safety control in an automation network, and automation network having such safety control allowing mixed safety integrity levels

Patent metadata

Field	Value
Publication number	US-10732594-B2
Application number	US-201715419661-A
Country	US
Kind code	B2
Filing date	Jan 30, 2017
Priority date	Aug 8, 2014
Publication date	Aug 4, 2020
Grant date	Aug 4, 2020

Abstract

A method operates a safety control in an automation network having a master subscriber which carries out the safety control, at least one first slave subscriber which is assigned a first safety integrity level, and at least one second slave subscriber which is assigned a second safety integrity level. The first safety integrity level and the second safety integrity level differ from each other. A first safety code determination method is assigned to the first slave subscriber and a second safety code determination method is assigned to the second slave subscriber. The first safety code determination method and the second safety code determination method differ from each other. The master subscriber and the first slave subscriber use the first safety code determination method for interchanging a safety data block. The master subscriber and the second slave subscriber use the second safety code determination method for interchanging a safety data block.

First claim

What is claimed is:

1. A method for operating safety control in an automation network having a master subscriber which carries out the safety control, at least one first slave subscriber which is assigned a first safety integrity level, and at least one second slave subscriber which is assigned a second safety integrity level,
wherein the master subscriber, the first slave subscriber and the second slave subscriber are connected to one another via a data transmission path and have encapsulated safety and data link layers,
the first safety integrity level and the second safety integrity level differing,
a first safety code determination method being assigned to the first slave subscriber and a second safety code determination method being assigned to the second slave subscriber, and
the first safety code determination method and the second safety code determination method differing,
wherein the master subscriber and the first slave subscriber use the first safety code determination method for interchanging a first safety data block, the first safety data block containing a first item of address information, the first item of address information including an address allocation for the first slave subscriber,
wherein the master subscriber and the second slave subscriber use the second safety code determination method for interchanging a second safety data block, the second safety data block containing a second item of address information, the second item of address information including an address allocation for the second slave subscriber,
wherein the interchanging of the first safety data block comprises:
determining a first safety code for the first safety data block by the first safety code determination method, the first safety code being appended to the first safety data block,
embedding the first safety data block and the first safety code being appended to the first safety data block in a first standard data block,
determining a first standard code for the first standard data block by a standard code determination method, the first standard code being appended to the first standard data block to form a first data packet,
transmitting the first data packet,
verifying the first standard code for the first standard data block by the standard code determination method,
extracting the first safety data block and the first safety code being appended to the first safety data block from the first standard data block, and
verifying the first safety code for the safety data block by the first safety code determination method, and

wherein the interchanging of the second safety data block comprises:
determining a second safety code for the second safety data block by the second safety code determination method, the second safety code being appended to the second safety data block,
embedding the second safety data block and the second safety code appended to the second safety data block in a second standard data block,
determining a second standard code for the second standard data block by a standard code determination method, the second standard code being appended to the second standard data block to form a second data packet,
transmitting the second data packet,
verifying the second standard code for the second standard data block by the standard code determination method,
extracting the second safety data block and the second safety code being appended to the second safety data block from the second standard data block, and
verifying the second safety code for the second safety data block by the second safety code determination method.

2. The method as claimed in claim 1 , the first and second safety code determination methods carrying out a cyclic redundancy check, a first safety code generator polynomial being assigned to the first safety code determination method and a second safety code generator polynomial being assigned to the second safety code determination method,
the master subscriber and the first slave subscriber using the first safety code generator polynomial for the cyclic redundancy check for interchanging the first safety data block, and the master subscriber and the second slave subscriber using the second safety code generator polynomial for the cyclic redundancy check for interchanging the second safety data block.

3. The method as claimed in claim 2 , different residual error probabilities for the occurrence of an error being assigned to the first and second safety integrity levels, and the Hamming distance of the first safety code generator polynomial differing from the Hamming distance of the second safety code generator polynomial.

4. The method as claimed in claim 1 , address allocation for the at least first slave subscriber having the first safety integrity level and address allocation for the at least second slave subscriber having the second safety integrity level being carried out independently of one another.

5. A method for operating safety control in an automation network having a master subscriber which carries out the safety control, at least one first slave subscriber which is assigned a first safety integrity level, and at least one second slave subscriber which is assigned a second safety integrity level, the first safety integrity level and the second safety integrity level differing,
the master subscriber, the first slave subscriber and the second slave subscriber being connected to one another via a data transmission path and each having a safety layer and a data link layer, wherein the safety layer and the data link layer are encapsulated in the subscribers completely from one another,
wherein in a transmission mode, the safety layer uses a safety code determination method to determine a safety code for a safety data block to be transmitted, and the data link layer forms a data packet containing the safety data block and the safety code for transmission on the data transmission path, and
wherein in a reception mode, the data link layer extracts a safety data block and an associated safety code from a data packet received via the data transmission path and the safety layer verifies the safety code for the safety data block using the safety code determination method,
a first safety code determination method being assigned to the first slave subscriber and a second safety code determination method being assigned to the second slave subscriber,
the first safety code determination method and the second safety code determination method differing, and
the master subscriber and the first slave subscriber using the first safety code determination method for interchanging a first safety data block, and the master subscriber and the second slave subscriber using the second safety code determination method for interchanging a second safety data block,
wherein the first and second safety code determination methods carry out a cyclic redundancy check, a first safety code generator polynomial being assigned to the first safety code determination method and a second safety code generator polynomial being assigned to the second safety code determination method,
wherein the master subscriber and the first slave subscriber use the first safety code generator polynomial for the cyclic redundancy check for interchanging the first safety data block, and the master subscriber and the second slave subscriber uses the second safety code generator polynomial for the cyclic redundancy check for interchanging the second safety data block, and
wherein different residual error probabilities for the occurrence of an error being assigned to the first and second safety integrity levels, and the Hamming distance of the first safety code generator polynomial differing from the Hamming distance of the second safety code generator polynomial, wherein the first safety code generator pol

Assignees

• Beckhoff Automation Gmbh

Inventors

• Sachs Jens
• Schiller Frank
• Büttner Holger

Classifications

• G05B2219/24008

  Safety integrity level, safety integrated systems SIL SIS · CPC title

• G05B19/054

  Input/output · CPC title

• G05B2219/25157

  Checksum CRC · CPC title

• G05B19/0425 Primary

  Safety, monitoring · CPC title

• G05B2219/33273

  DCS distributed, decentralised controlsystem, multiprocessor · CPC title