10/04/02 - Article - Safety at Work? Of Course! And Convenient!
For "Safety at Work", the safety oriented version of AS-Interface, generally any master can be used. But working with a master that offers additional features planning, commissioning, operation and maintenance of a Safety at Work network can be made even easier by means of new application functions and convenient data management on the master level.
"Safety at Work" means using AS-Interface in safety oriented applications up to category 4, the highest level of the relevant European standard EN 954-1. Its central element, the safety monitor, has now been certified by the TÜV-Nord, an official authority in Germany for safety related products. Consequently "Safety at Work" can be used without limitations and is offered by several manufacturers.
The issue is no longer whether or not Safety at Work can be used. It is now how comfortably it can be implemented in an AS-Interface network. The user is supported by the fact that the interoperability of all components, one of the highlights of AS-Interface, is maintained in Safety at Work despite its higher requirements. Masters (gateways), safe slaves and standard slaves of different manufacturers can be combined with the new safety monitor within one network as the user likes. This gives the user the opportunity to choose from a wide range of products which differ in terms of functionality, ease of operation and other characteristics.
The concept
of Safety at Work (1):
In its
standard version AS-Interface uses a highly protected data transmission system,
which does not have to be altered for safety applications. This results in two
specialties for Safety at Work:
|
AS-Interface masters and
gateways (“links”) with application functions
Using the example of a master family we will show how one can make use of AS-Inter-face’s inherent interoperability and a clever data management and evaluation system on the master level. Key ideas are application functions and a human-machine-interface (HMI).
The principle of Safety at Work is familiar by now (see Figure 1 and the box above), so there is no need to explain it in detail here. Due to the higher requirements of the safety technique, however, a Safety at Work network produces additional data, so additional solutions must be considered. The most different stop situations need to be analyzed. The monitor records (or generates) this data and provides it for evaluation. According to the concept the data is read, through the master, by the higher control (or host) by means of a function block. This data can then be evaluated by the host.
It is, however, more sophisticated to add additional functions to the system by allocating them to the master as “application functions”. This approach is based on the following ideas:
Bihl+Wiedemann’s new generation of masters and gateways (“links”) (2) offers this support to the user (figure 2). They are provided with all standard AS-Interface functions, additional application functions and either a standard or enhanced graphical display. Their benefits can be seen in Safety at Work networks particularly because they enable easy integration of safety features into an AS-Interface system, but they apply generally to any master.
All of the functions of the extended AS-Interface specification (V. 2.11), which was introduced about the same time as Safety at Work, are implemented. These functions include the data describing the slaves (I/O, ID, ID1 and ID2), input and output data images, slave parameters, the extended address range of up to 62 slaves, the integrated input and output of analog data complying with profile S-7.3, input and output of long messages complying with profile S-7.4, handling of peripheral faults, etc. See figure 3 for an overview. Details of these functions have already been described in previous documents (1).
Additionally Bihl+Wiedemann has implemented extra application functions which go beyond the standard functions of the general AS-Interface specification:
Human-machine interface in
the master
Fig. 4: All master functions can be displayed with the menu on the graphical display. Figure 4 shows the first two menu levels. Figures 5, 6 and 8 show further levels. |
The masters are
additionally provided with a display (figure 2) for the communication with the
user (exception: PC cards, as here the PC monitor can be used for this
purpose). This function also exceeds the general AS-Interface specification. In
the simple, classic version the addresses of all connected slaves can be
displayed, configuration errors indicated and addresses changed.
The version
provided with a graphic display goes far beyond this:
|
Thus the graphic display allows a complete and easy in place diagnosis. It becomes a Human-Machine Interface (HIM) which is independent of any control or fieldbus. This is another characteristic of the new master family, above the application functions.
Intelligent
solutions through application functions
The main reason for using AS-Interface is cost reduction. A proof of this is the widespread use of modules that support multiple “conventional” sensors and actuators. Integrated slaves are used less often, even though they enable new and intelligent automation solutions (which can greatly benefit the user) by providing additional data. Therefore some of the advantages of the bus technology – more information obtained from the process – are to a large extent neglected. One reason for this may be that until now the relevant information had to be integrated into the application program bit by bit.
Safety at Work will change this. More often the end user needs the option to react individually to certain situations to increase the availability of his or her system without having to cut back on safety. The application functions of the new master family make this easier than ever:
The application programmer is supported by the application functions of the master. Consequently it becomes much easier for him or her to realize an intelligent solution and programming for any particular application will become less time consuming. For Safety at Work systems a clear differentiation between causes for a stoppage is more straightforward (see figure 7). This information can be used to enable restart situations. Thus the inherent advantage of the bus technology – the increase in available information – helps achieve high system availability and simple handling.
Increased
network stability due to diagnostic strings and protocol
analysis
The classic AS-Interface network generally reacts in a well-natured manner. Even if there are occasional faults on the system (as would be expected from any bus system) it continues to work reliably and in most cases the user will not even notice there was a fault. Typical examples are problems with extrem electromagnetic noise at a slave’s place or in an area of the network, a loose contact, slight violation of network layout rules (e.g., maximum length) or missing features in a non-certified slave. Faulty telegrams caused by one of these reasons are recognized automatically, repeated and in most cases resolved before the user could even notice them. Standard slaves may take up to three successive network cycles to correct this type of fault. The master only sends a message (“Configuration Error”) to the application program if the fault still exists for three cycles. This means that occasional faults will not interfere with system stability, but that serious faults are clearly identified and reported.
(2) Stop after emergency shutdown (3) Stop after response of a safety element (e.g. light curtain interrupted) (4) Stop after communication error of a safe slave (5) Stop after failure of a safe slave (6) Stop after peripheral fault (7) Stop after configuration fault (8) Stop after power failure in the network (9) Stop after warning message |
Figure 7: Possible stop situations of a Safety-at-Work network. If the application program makes use of the detailed information, it can react specifically.
With a Safety at Work network, however, the user needs to be a bit more careful, since in this case if a “real” fault occurs the machine must be stopped quickly. To realize this the safety monitor only waits two cycles, instead of three, before it stops the system in reaction to a communication fault with a safe slave. This is the only way to guarantee a latency period of less than 40 milliseconds between the occurrence of the fault and the stoppage of the system. A possible disadvantage of this is that the system could be stopped erroneously in reaction to temporary instabilities. These erroneous stoppages are technically harmless, since they don’t reduce the safety of the system at all. However, they can present an annoyance by reducing the availability of the system. Therefore the user must take care to detect and avoid any of these kinds of instabilities when setting up the system.
For this the user is aided by the application functions “diagnosis string” and “protocol analysis”. The latter contains the number of telegram repetitions for each slave tolerated by the specification. This tells the user which slaves are still complying with the specification, even though they are experiencing communication errors. In this way possible instabilities in the network can be detected and eliminated. If during commissioning or maintenance the user pays extra attention to telegram repetitions of safe slaves he or she will be able to significantly increase the availability of a Safety at Work system. The counters are easily read out from the graphical display, with no need for any extra program (see figure 8).
This process is additionally supported by the diagnostic values of the safety monitor. They provide a more detailed description of the reason for a stoppage than other master data. This is because the safety monitor has a latency period of up to 40 milliseconds before its outputs are disconnected. During this period the application and the AS-Interface network continue to work. The network itself, in fact, is in many cases stopped even later. This makes it more difficult to analyze the situation using the standard master data since the master has continued collecting data for several more cycles. The safety monitor, however, captures its data immediately prior to the stoppage. Making this data available to the master enables analysis especially in cases where a stoppage is caused unintentionally by the safety monitor (i.e. when an emergency shutdown has not been activated). The fact that this data is directly available via the HMI display eliminates the need to connect a separate output device.
Summary:
AS-Interface is rightly considered the easiest networking solution in automation. The same applies to the Safety at Work version. It is also true that any master – new or old version – can generally be used for safety applications. This is the main reason for introducing a safety monitor which can be used in any system, is used by all manufacturers and has all required official approvals. The master family presented here, however, goes beyond this. With their application functions and fully developed HMI these masters are the first to make explicit use of the Safety at Work concept. In so doing they support the user to a great extent in the different life cycle phases of an automated plant. They provide support during planning (support of intelligent application programs), commissioning (network independence and improved network quality), operation (high system availability) and maintenance (in place diagnosis and network analysis). Users working in automation systems will readily see this high degree of convenience.
Literature
(1) Madelung, O.W.: Addenda to the
AS-Interface Handbook (2 nd edition), German and English; 2001, download file
under www.madelung-online.de
(2) Bihl + Wiedemann: Overview over the
gateways, see www.bihl-wiedemann.de
Author
Dr. Otto W. Madelung, Technical
Consultancy Dr. Madelung,
www.madelung-online.de
This article has been published in following periodical: SPS-Magazin 4+5/2002