wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

47-6 Industrial Communication Systems
CPU1
Fail
safe
unit
Integrated
silicon
switch
First
switch
CPU2
Second
switch
Output
Safe output
FIGURE 47.4
Schematic of safety-related output.
By performing this procedure, the microcontroller is able to check the switching capability of the input
optocoupler and the functional connectivity of all components.
According to the two-channel architecture, the output stage is split into two switching elements as
shown in Figure 47.4. Only if both stages switch on, the output is activated. It is preferable that both
switching elements use different technologies in order to avoid common cause failures. Hence, the decision
to switch on must be done from both channels together. Only then the output is switched on. For
testing purpose the state of the two stages is read back and additional in one state the output is switched
off for a short period of time in order to test the switching capability. Obviously, the off-time must be
shorter than the reaction time of the switched element.
Even if there are two stages that are able to switch off, there is the possibility that both channels are not
able to perform any actions but are stuck at on state (e.g., due to a common cause of power supply failure).
To overcome that static issue, a frequently triggered control element is added. The fail safe unit only
enables its output if it is permanently triggered from the controlling device. The output of the fail safe
unit supplies the two switching elements of the output stage. Hence, if the fail safe unit is not triggered
anymore, there is no supply control voltage for the switching elements and the output is switched off. So
it is guaranteed that the output enters the safe state if both control channels are stuck at one state and are
not able to perform any more operations. A simple way to design the fail safe unit is to use a transformer
in combination with a capacitor on the output. In order to charge the output capacitor the input signal for
the transformer must periodically change the signal. Both controllers are involved in generating the input
signal of the transformer. One controller is applying the supply voltage and the other one ties the transformer
to ground. Thus, both controllers are able to switch off the fail safe unit if one detects a failure. On
the other hand, if the controller that creates the periodical signal does not work correctly, the periodical
signal fails and as a result the output described in Figure 47.5 switches off automatically.
The 1oo2 hardware structure also affects external devices. Similar to the internal 1oo2 structure all
external devices are connected via two channels. On these channels short test pulses are applied in order
to detect a wiring failure (e.g., no connection or a shortcut between two wires). Therefore, test pulses
must be generated in such a way that one channel is tested at a time. If the emitted test pulse is not
detected or detected on several lines a failure has occurred. Intelligent devices that are not supplied by
the SafetyLon node have to send their own test pulses which are detected by the SafetyLon node.
Figure 47.5 shows how to connect a simple two-channel switch. The two-channel switch is supplied
by the SafetyLon node. In normal operation the switch is closed and a high level is detected on the
input pins of the SafetyLon device. Then the external wiring and the switch are tested. Periodically,
one of the two channels is switched off for a very short time. So all failures are detected that occur on
the external wiring from and to the switch. The switch itself is implicitly checked as the same signal
level must be detected on both inputs. In case of an opened switch, no tests are necessary because
low signals on both inputs are defined as the safe state. In that state, the SafetyLon device has to enter
© 2011 by Taylor and Francis Group, LLC