Basic Principles of Safety-Related Communication

Safety-related communication has replaced the long tradition of parallel wiring in many of today's mechanical  engineering applications. There are many reasons for this: it reduces complex wiring, simplifies diagnostics and troubleshooting and increases the availability of the whole application. The following chapter explains how safe communication operates, using SafetyBUS p and SafetyNET p as an example, and also demonstrates some applications.

Principle of decentralized safety technology
Depending on the desired safety level, periphery devices such as E-STOP switches are generally connected to a safety control system in a dual-channel configuration. The redundancy and additional cable tests mean that faults such as short circuits or open circuits can be detected and managed. A bus cable uses single-channel, serial  communication, which does not provide physical line redundancy. That's why additional measures in the protocol are needed to cover faults such as a disconnected bus cable or communication problems.

Handling communication errors
The sections below describe typical errors and measures which may occur when safety-related data is  communicated via an industrial communication system, and ways in which these can be handled.

Message repetition
Malfunctions within the bus subscriber can lead to telegram repetition. Each message is given a sequential number so that repeated messages are detected. The receiver is "expecting" the sequential number, so it will detect repeated telegrams and initiate appropriate measures.

Message loss
Messages may be deleted as a result of a malfunction on a bus subscriber or the receiver may stop receiving telegrams because the bus cable has been disconnected, for example. The receiver uses a sequential number to detect the loss of data packets. A timeout on the receiver also monitors the latest time by which a new message must arrive. Once this timeout has elapsed, the receiver is able to bring the application to a safe condition.

Message insertion
Additional messages may creep in as the result of a malfunction on a bus subscriber. As with message repetition, the sequential number can be used to detect and manage this situation.

Incorrect message sequence
Errors on a bus subscriber or on telegram-storing elements such as switches and routers can corrupt the telegram sequence. However, this will be detected through the sequential numbers.

Message corruption
Malfunctions on a bus subscriber or faults on the communication medium, e. g. problems due to EMC, can corrupt messages: A data security mechanism (check sum) applied to the safety related telegram content will recognize this and detect the corrupted message.

Message delay
A malfunction on the bus subscriber or an incalculable data volume in the bus system can lead to delays: A timeout on the receiver will detect the delays and initiate appropriate measures.

Combining safety-related and non- safety-related communication functions
In mixed systems containing safety-related and nonsafety-related subscribers, receivers will sometimes interpret a telegram from a standard subscriber as a safety-related telegram. Such mistakes on the part of the receiver can be avoided using measures such as unique IDs across the network and varied data security features for safety-related and non-safety-related messages.

Errors and measures, using SafetyNET p as an example, taken from BIA GS-ET 26.

Modularization of the automation function

Modularization as an approach to solving the control technology requirement of the future ultimately involves division of the control technology into corresponding units or modules, and decomposition right down to the technology functions.

Modularization of a machine and distribution of tasks across various control systems.

 

Even when division into modules and mechatronic units makes sense, it's important not to lose sight of the overall picture: Programming models which keep the units together and represent them as a whole are a much greater benefit to customers than those that merely provide components with interfaces and ultimately expect the user to look after these interfaces.

Using safety control systems to achieve safe control technology: Safe control technology

The model of safety technology as a pure “monitoring function” is changing drastically: Safety technology may have been almost exclusively associated with emergency off/emergency stop, light curtains and interlocks for a long time, but it would now be unthinkable not to regard the issue of safety on drives, for example. Other areas will include safe pneumatics and hydraulics. Applications will emerge from areas which are not yet the focus of our attention, but one thing is clear: Safety is an integral part of the overall plant and machine function, so it must
be considered appropriately, right from the start. In simple language, safe control technology means: Make the control function safe! Safe control technology becomes reality when safety enjoys the same mechanisms, the same handling and the same flexibility as the standard section, at all levels of automation technology.

This does not mean that safety and standard functions have to be combined inside one device. What's important is that they work together to process tasks as a system, without impeding each other. Each device, each control system, should do what it does best. The system's backbone is an extremely powerful bus system, which manages data traffic in the background. The result of this technological development is a system which uses the intrinsic benefits of technology control systems. For example, it makes no sense for a safety control system to have to carry out motion functions, when that's a specific task of the motion technology control system.

Safety and standard control systems combined in one system.

Ultimately however, this means that all the control systems have to be able to share access to the same data, without the user being required to organize it this way. The system must perform this task automatically in the background. In future, even the tools must have the same look and feel, plus standardized handling. Whether it's motion, control or visualization: Handling of the various functions and tasks must be seamless.

Using safety control systems to achieve safe control technology: An overview

In which direction is safety technology developing? Which control systems provide the highest user benefits? How will the various disciplines of safety, control, motion, CNC and visualization work together in future? Will it be possible to implement economical solutions, despite the increasing complexity? Even in future there will be a number of different approaches to take to resolve requirements. One potential approach is to modularize plant and machinery into functional units. This is already happening today, albeit primarily for the mechanical part of plant and machinery. This approach has only partially been used in control technology as yet.

Whether the issue is safety-related or automation functions: The demands on plant and machinery continue to grow, so there's an increasing need for techniques which will allow applications to be well structured and therefore manageable. The requirement for minimum effort and associated cost reductions is increasingly the focus. The aim is to reduce engineering times still further.

The graphic below illustrates the compromise that has previously been reached between minimum costs, maximum quality and rapid implementation:

However, excellent support during the engineering phase, through an appropriate programming model, a user-friendly programming environment and an extensive library, can lead to higher quality in shorter time and at a lower overall cost.

Today's safety control systems

Function blocks in safe control systems

Function blocks for safety-related functions are key to the success of safety control systems. Although initially they were more or less an image of the functions and properties found on safety relays, gradually the range has been developed to include blocks for special uses such as press applications or burner management. Today, function blocks are available for almost every conceivable safety-related application. All of these have been tested by certified bodies and offer users optimum safety for everyday use.

The concept of function blocks was originally intended for the safety control system, but was then developed to form configurable function blocks for configurable safety relays as described, making applications more customer-friendly. This approach of using configurable function blocks will also be part of a continually developing programming environment for the safety control systems. The user can choose between classic programming e.g. in IEC 61131 and a configuration similar to that of the configurable safety relays.

Certified function blocks in hardware and software.

Safe Decentralization and Enable Principle

As explained already, in many cases safety technology follows the developments made in standard control technology. The benefits from transferring the input/output level to the field via decentralization have resulted in the same process being applied to safety related inputs and outputs. This was followed by the development of a safety bus system, which not only allows field inputs and outputs but also a safety related connection between safety control systems.

The diagram below illustrates a typical application in which the enable principle has been implemented.

Circuit diagram for the enable principle

The safety control system switches the safety-related outputs, and the standard PLC transfers the switch command for the corresponding output to the safety control system via fieldbus.

Essentially it is a really simple principle, if you ignore the disadvantage that the switch command from the standard control system must be considered in the program for the safety control system. Graphically speaking the situation is this: The standard control system must place the switch command on the fieldbus, from where the failsafe control system retrieves it before inserting it into the output's control program as an AND function.

Programming becomes unclear, because the control task and safety function are mixed within the safety control system. A further development of the field transfer principle helps to simplify this case.

The diagram below illustrates the extension of the enable principle. The enable for the control command from the standard control system now takes place directly at input/output level. Handling is simplified tremendously as a result; both control systems can be programmed and tested independently. Performing the enable in the I/O system means there are no delay times from processing within the safety control system, and it's no longer necessary to pass on the control commands via the fieldbus.

Extending the enable principle

Integration of safe control technology within the automation environment

Cycle times are becoming ever shorter, while productivity and the demands on plant and machine control systems are increasing. In addition to the technical control requirements, the need for information regarding process and machine data is constantly growing. As a result, communication technologies from the office world are increasingly making their mark on control technology. One consequence of this trend, for example, is the growth of Ethernet-based bus systems in automation technology, right down to field and process level.

Until now safety technology has been characterized more or less as a “monitoring function” and has been incorporated as such into the automation chain. The process control system dominates and defines the actual process stages. As a “monitoring instrument”, the safety control system either agrees or disagrees with the decisions of the process control system.

Monitoring is limited to safety-relevant control functions, as is the enable. Process outputs without a safety requirement are unaffected. A distinct benefit of such a procedure is the fact that the tasks, and therefore the responsibilities, are clearly separated. A separate system is responsible for the design and monitoring of the safety technology; another separate control system manages the machine and the process. This way it is possible to guarantee the absence of feedback: Changes made primarily in the standard control system will not adversely affect the safety control system. This is an essential safety requirement of a safety system.

The division of duties also has a number of positive aspects: firstly it increases overall performance, because each unit simply concentrates on the matters for which it has been designed and configured. Productivity increases do not just impact positively on the output of the plant or machine: they can also be beneficial in terms of handling, if faster reaction times enable safety distances to be minimized, for example. Separation can also be used to transfer responsibility for the individual systems to different individuals. That helps both sides, because everyone can concentrate on the task in hand.

“Enable” operating principle, with safety relay or safety control system.