WO2009155993A1

WO2009155993A1 - A safety system for a machine

Info

Publication number: WO2009155993A1
Application number: PCT/EP2008/058301
Authority: WO
Inventors: Roger Mellander; Johnny ÖBERG; Mats X KÄLLMAN; Per V Carlsson
Original assignee: Abb Research Ltd.
Priority date: 2008-06-27
Filing date: 2008-06-27
Publication date: 2009-12-30

Abstract

The present invention relates to a safety system for a machine (14), the system comprising two independent logic computing units (2, 2') for executing a safety function based on safety inputs from two redundant data transmission channels (10, 10') providing the same safety inputs to each of the logic computing units, and a fault detecting unit (4) configured to compare the outputs from each of the logic computing units and based on the result of the comparison detecting faults and sending safety control signal to the machine via another two redundant data transmission channels (8, 8'). The system comprises a programmable logic device (1) comprising a plurality of independent programmable building components, two of which are programmed to implement said logic computing units.

Description

ABB Technology AB

A SAFETY SYSTEM FOR A MACHINE

FIELD OF THE INVENTION

The present invention relates to a safety system for a machine. The system comprises two independent logic computing units for executing a safety function based on input data from two redundant data transmission channels providing the same safety inputs to each of the logic computing units, and a fault detecting unit configured to compare the outputs from each of the logic computing units and based on the result of the comparison detecting faults and sending safety control inputs to the machine.

PRIOR ART

A safety system for a machine performs one or more safety functions to ensure the safety of human working in the environment of an industrial process, and the machine as well. Such a system may include safety elements, one or more logic computing units for executing the safety functions. Typical safety ele- ments are, for example, sensors, switches or emergency push buttons. The logic computing units are, for example, general- purpose computers, microprocessors, and a set of electric circuits. When safety inputs from the safety elements are sent to the logic computing units, the safety functions on the computing units are carried out and depending on the result of the safety functions, a safety control input will be sent to the machine, for example, a stop input can be sent to the driving system of the machine to stop the operation of the machine. Such a machine could be a valve, a pump, or a robot.

Reliability is a desired feature for such safety control systems and can be measured by so-called safety levels. Such safety levels are defined in corresponding standards. For example, in standard IEC 61508 various safety integrity levels (SIL) are defined, whereas in standard EN 954-1 various safety categories are defined. A high reliability of a safety system, for example defined as SIL 2 in IEC 61508 or safety category 3 in EN 954-1 , is usually achieved by using two separate logic computing units to simultaneously execute the same safety function based on the same safety inputs from the safety elements. The operation results are then compared by a fault defecting unit in order to detect faults. Eventually the system generates a control input for controlling the operation of a machine, for example a stop signal may be sent to stop the operation of the machine. To achieve a high reliability, safety inputs to each of logic computing units are transmitted through two redundant data transmission channels. A safety system comprising two separate logic computing units and data inputs, transmitted via two redundant data channels, is denoted a safety system with dual data processing channels. Such a safety system enables a high level of safety because the system will continue to operate even in the event of a fault.

If a higher reliability is desired in order to detect more types of faults, the system is further extended with supervision/monitoring modules to be able to feed back safety inputs coming from the logic computing units to the safety functions.

Using two separate hardware logic computing units, such as two general-purpose computers or microprocessors to achieve a higher reliable safety system, is an expensive and complex solution due to the cost per hardware and the implementation cost of the safety system. Furthermore, such a safety system is not flexible in the way that it may take space, and consequently it could be difficult to be integrated into an industrial control system.

The recent development of computer architecture with multi-core provides another opportunity to implement such a safety system based on a multi-core architecture, which means that the safety system is not implemented on two separate hardware logic computing units. But such a solution is still complex and expensive.

A recent patent application DE102006012042 presents a solution based on dual core processor architecture. The application proposes a solution that uses a dual core processor as the logic computing units, the safety function carried out on each logic computing unit being implemented and executed on each core of the dual core processor. The problem with the solution is that a main storage is commonly used by the processor cores for storing the safety function and some intermediate results, which creates a single failure point in the system. Further, the dual core architecture on which the system based is still quite expensive.

OBJECTS AND SUMMARY OF THE INVENTION

One object of the present invention is to provide a safety system for a machine which is compact and economic in construction.

This object is achieved by a system as defined in claim 1 .

Such a safety system comprises a programmable logic device comprising a plurality of independent programmable building components, two of which are programmed to implement two independent logic computing units for executing a safety function based on safety inputs from two redundant data transmission channels.

A programmable logic device, denoted PLD, is an electronic component including a plurality of independent programmable building components which can be used to build reconfigurable digital circuits. Commonly, a PLD has an undefined function at the time of manufacture and before it can be used it must be programmed. Examples of PLD devices are a complex programmable logic device, denoted CPLD, and a field- programmable gate array, denoted FPGA. The building components of a PLD can be hard processor units embedded in the PLD, soft processor units, and programmable logic blocks and interconnects which can be hardware programmed to perform logic functions. Most of PLD devices include memory.

A safety function is one or more logic operations performed on the inputs, such as safety signals, to the safety function and the output of the safety function is the result of the logic operations on the safety signals.

By implementing the computing units on two independent programmable building components on a programmable logic device, it is possible to provide two redundant computing units on a single chip, and still achieve the same safety integrity level or safety category as the prior art, in this case a safety integrity level 2 defined in IEC 61508 or safety category 3 in EN 954-1 .

One of the advantages with the programmable logic device is compactness since it makes it possible to implement a safety system with two independent logic computing units on a single chip. Another advantage is economic, meaning that a highly reliable safety system with dual data processing channels can be achieved at a cheaper hardware cost. Such a safety control sys- tern according to invention is cost-effective per hardware. Yet another advantage is, compared with a general-purpose computer or a microprocessor which usually has an operating system, that a programmable logic device has much less instructions, which means programming the safety function is easier than the one built on the general-purpose computer or a microprocessor.

According to an embodiment of the invention, each of the building components programmed to implement the logic computing units has its own memory. On the market there are some PLD devices including the above mentioned building blocks having embedded memories. For example, a hard processor usually includes a program memory and a data memory, whereas, a soft processor may be configured to have its own memory too. Even logic blocks have memory elements, for example, simple flip- flops or more complete blocks of memory. Having separate memories for the logic computing units achieves two totally separate logic computing units. Therefore, the problem with single failure point of a common used memory is eliminated.

According to an embodiment of the invention, the building component configured to implement each of the logic computing units is any of the following types: a hard processor unit, a soft processor unit, or at least one logic block programmed by hardware description language. A hard processor unit can be, for example, an embedded microprocessor. A soft processor is implemented within the programmable logic device and such a soft processor is reconfigurable to suit a specific program. The third variant is when a hardware description language, denoted HDL, is used to create a hardware implementation of the software ap- plication.

Different variants of building components provide the possibility of building independent and different implementations of a safety function. With the third variant, a designer or developer of the safety function can get down to the hardware level of the system to implement hardware in the way he wants exactly, therefore the generated code will be safer and simpler compared with a software implementation. This is particularly critical for a safety system.

According to a preferred embodiment of the invention, two different types of building components are used to program the safety logic on each of the logic computing units. For example, one of the building components, implementing one of the com- puting units, may include one or more logic blocks programmed by hardware description language, and the other building com- ponent, implementing the other computing unit, can be a soft processor, or the building components programmed to implement the two computing units can be a soft processor unit and a hard processor unit, or any combination of the above mentioned types of building components. Using two different types of building components to implement the safety logic increases the safety of the system. For example, the system provides an ability to detect common mode faults/failures or systematic faults such as software design, coding defects that could be repro- duced on both computing units. Therefore a high reliability is achieved.

According to an embodiment of the invention, one of the building components is configured to implement the fault detecting unit. To be able to detect faults, one of building components on the same programmable logic device is configured to perform a fault detecting function.

According to an embodiment of the invention, one of the building components on the same programmable logic device is programmed to synchronize the logic computing units. The execution of the safety function on the two logic computing units is parallel, which means that the generated outputs from the two logic computing units may not come out simultaneously. The synchronization unit ensures that the fault detecting unit compares the results generated by the computing units based on the same safety inputs.

According to an embodiment of the invention, two of the building components are configured as monitoring units for monitoring the current safety states from the computing units, each of the monitoring unit is configured to receive safety inputs from one of the computing units and provide feedback to the other computing unit. Since a computing unit itself can also generate faults, one building component is configured to monitor the faults coming from one computing unit. The safety inputs then will be sent back to another computing unit, which enables two computing units to monitor each other. Due to the fact that the programmable logic device includes a plurality of building components, the monitoring units can also be programmed on the same pro- grammable logic device. Therefore, the safety system may achieve high reliability and be compact in size.

According to an embodiment of the invention, the machine is an industrial robot comprising a control unit configured to generate safety inputs including an emergency stop input as the safety input to the logic computing units. Consequently such a safety system can be used as an industrial robot safety system to provide a solution that is highly reliable and economic and flexible as well. This feature increases the competition capability of a robot system.

According to one aspect of the invention, a control unit for controlling an industrial robot comprising a safety system of the present invention is provided. The control unit is configured to gen- erate safety inputs including an emergency stop input to the logic computing units. The safety system according to the invention is very suitable for use in a control unit of an industrial robot. Due to the fact that the safety system built on a programmable logic device has a compact size, it makes it easier to in- tegrate such a safety system into the control unit of a robot.

According to a preferred embodiment of the invention, the programmable logic device is a field-programmable gate array, denoted FPGA, device.

According to an embodiment of the invention, a cyclic redundancy check, denoted CRC, is implemented to verify the contents on the whole or on parts of the field-programmable gate array in order to detect faults. Parts that can be verified with the CRC can for example be the soft processor instead of jogging the instruction set as is done in a hard processor to verify if the hard processor is working as expected. With an FGPA chip it is even possible to partially reconfigure the FPGA chip to correct errors that has been detected by the cyclic CRC. Furthermore, a cyclic CRC check on the entire FPGA can be implemented with, for example, an external small CPLD, or an internal CRC macro may be used to ensure a reliable safety system built on the FPGA chip.

According to an embodiment of the invention, at least one of the programmable building components is a soft processor. The soft processor is provided with an internal register, and a parity check is implemented to detect bit errors on the internal register. With an FPGA chip, it is possible to add one or more parity bits together with a parity check to detect bit errors on the inter- nal registers used by the soft processor, which enables to instantly detect any soft errors and eventually take corrective measures. This is yet another advantage over a safety system based on multi-core architecture where essentially two hard processors are used, and it is not possible today to perform a parity check to detect bit errors within the hard processors. This means that by using such a feature existing with an FPGA chip, it is possible to build a safety system that has higher reliability based on a single FPGA chip than the one based on hard processors, since the safety system built on an FPGA chip has a higher fault tolerance.

Because a programmable logic device comprises a plurality of building components, it can be used to build a safety system with a compact size but it is still at least as reliable as the prior art. Such a safety system can be integrated with a control unit of a machinery system, for example an industrial robot system.

BRIEF DESCRIPTION OF THE DRAWINGS The invention will now be explained more closely by the description of different embodiments of the invention and with reference to the appended figures.

Fig. 1 shows a safety system for a machine implemented on a programmable logic device, according to an embodiment of the invention.

Fig. 2 shows an FPGA chip that includes a plurality of pro- grammable logic blocks and interconnects, and a periphery of input and output blocks.

Fig. 3 shows one possible combination of building components on a PLD device.

Fig. 4 shows another example of a proposed safety system, implemented on a programmable logic device, where the safety system is extended with two monitoring units implemented by the building components on the same programmable logic device.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS OF THE INVENTION

In the following the safety system of the invention will be explained in connection with a field-programmable gate array, denoted FPGA, implementation; however the invention can also be implemented on other types of programmable logic device, such as a complex programmable logic device, denoted CPLD.

Fig. 1 shows a safety system for a machine according to an embodiment of the invention implemented on a programmable logic device 1 , in this example an FPGA device. The system comprises a first logic computing unit 2 and a second logic comput- ing unit 2', a fault detecting unit 4, and a synchronization unit 6. Fig. 1 shows also a signal generation unit 12 that generates the safety inputs to the safety system and a machine 14 that is the safety controlling target of the system. The machine 14 is, for example, an industrial robot. The signal generation unit 12 can be, for example, be a teach pedant unit (TPU) connected to the control unit of the industrial robot. The TPU may include an emergency stop button generating an emergency stop signal and an enabling button generating an enabling signal. In this case the safety input to the safety system includes the emergency stop signal and enabling signal from the TPU. Other safety inputs can be a protective stop or other types of safety inputs.

When a safety input is generated by the signal generation unit, for example, an emergency stop button has been pressed by an operator; the emergency stop signal is transmitted via dual redundant data channels 10, 10' to each of the computing units 2, 2', which means the same safety input is simultaneously transmitted through the data channels 10 and 10', to both computing units, and both computing units receive the same safety inputs when both channels work correctly. Dual data channels prevent loss of data when being transmitted via a single data channel. For example, if the channel 10 fails to transmit the safety inputs, the safety inputs may still be transmitted thorough the channel 10'. The computing units 2, 2' are programmed to execute the same safety function. Upon receiving the safety input, the logic computing units 2, 2' execute the same safety function in parallel based on the same safety inputs. A safety function may be, for example, a logic calculation of the states of several safety inputs, for example, an emergency stop button may be repre- sented in two states: ON or OFF. The output of the safety function is the result of the logic calculation.

The function of the fault detecting unit 4 is to compare the results generated by the computing units. If the generated result from one of the computing units is not the same as from the other one, a fault is detected, and consequently a safety control signal may be sent to the machine 14, for example a stop signal to stop the operation of the machine. Because the execution of the computing units is performed in parallel, the results generated by the computing units are synchronized by the synchroni- zation unit 6, which ensures that the results compared by fault detecting unit 4 are generated by the computing units 2, 2' based on the same safety inputs. To synchronize the results, for example, a timer may be used, meaning that the results should be compared within the time limit that the timer is set. Other- wise, a fault is considered to occur and a safety control signal could be generated. As shown in Fig. 1 , safety control signals are sent to the machine 14 via dual data channels 8, 8'. The function of the dual data channels 8, 8' is similar to that of the dual data channels 10, 10', meaning that the same safety con- trol signal is redundantly transmitted to the machine 14 to retain the safety function.

A PLD comprises a plurality of building components. Building components used to implement the computing units 2,2', the synchronization unit 6, and the fault detecting unit 4 can be any of the following types: a hard processor embedded in the PLD, a soft processor, or hardware implementation though hardware description language.

Fig.2 shows an FPGA chip 50 that includes a plurality of programmable logic blocks 52 and programmable interconnects 54, as well as a periphery of input and output blocks 56. Logic blocks can be programmed to perform the functions of basic logic gates such as AND, XOR, or more complex combinational functions such as decoders or mathematical functions. In most FPGAs, the logic blocks also include memory elements, for example simple flip-flops. A hierarchy of programmable interconnections allows logic blocks to be interconnected as needed in the field by the system designer to perform desired functions. To program a desired function, a hardware description language is used to specify how to interconnect a set of logic blocks by working with the logic circuit diagram, or the source code of the function. Therefore the logic blocks and programmable interconnects form a building block to perform the desired function. In this way a building component is configured to perform the de- sired safety function. Further, a cyclic redundancy check, denoted CRC, may be implemented on the FPGA device to verify the contents on the whole or on parts of the FPGA in order to detect faults.

Fig. 3 shows one possible combination of building components on a PLD device 26, wherein the PLD device comprises an embedded hard processor 20, two reconfigurable soft processor 22, 22', and one building components 24 configured by a plurality of programmable logic blocks interconnected by a plurality of pro- grammable interconnects on a single chip. There may be still a plurality of unconfigured logic blocks and programmable interconnects on the same chip, and they can be programmed as building components, for example, the building components 24', 24" to perform some other logic functions if needed. How a building component is configured by a plurality of programmable logic blocks interconnected by a plurality of programmable interconnects depends on the function of the logic implements. Fig. 3 just gives one example of how a PLD device can be configured with a plurality of building components. However, a PLD device may have other combinations; for example, it may comprise a soft processor and one and more building components configured by a plurality of programmable logic blocks interconnected by a plurality of programmable interconnects on a single chip; or two embedded hard processors and an array of soft processors and one and more building components configured by a plurality of programmable logic blocks interconnected by a plurality of programmable interconnects on a single chip. The configuration is depending on the need of a system.

A soft processor commonly uses an internal register. If at least one of the programmable building components is a soft proces- sor, it is advantageous that the soft processor is provided with a parity check is implemented to detect bit errors on the internal register.

With such an architecture, to implement the safety system shown in Fig. 1 , the soft processor 22 can be configured as the first computing logic unit 2, and the building components 24 can be configured as the second computing logic unit 2'; the fault detecting unit 4 can be implemented by another soft processor 22', and the synchronization unit 6 can be implemented on the hard processor 20.

The PLD device may be an FPGA chip, which itself is in the form of a complementary metal-oxide-semiconductor denoted CMOS. The advantage with CMOS is that it is energy-efficient and allows a high density of logic functions on a single chip.

Fig. 4 shows another example of a proposed safety system, implemented on a PLD device, according to an embodiment of the invention, where the safety system is extended with two monitoring units 40, 40'. To implement this example, the safety system may program another two building components on the same PLD device, for example the building blocks 24' 24" shown in Fig. 3 to implement the monitoring units 40, 40'. The other building components shown in the Fig. 3 are configured as the same as the example shown in Fig .1 . The function of the monitoring units is to detect if there is any fault coming from the computing units themselves. As shown in Fig. 4, each of the monitoring units is configured to receive the outputs from one of the computing units 2, 2' and feed back the results to the other computing unit. The results could be the same safety inputs as received by the computing units or the signals generated by the monitoring units based on the safety inputs. With the monitoring units, the computing units can monitor each other to enable detecting more types of faults.

Claims

1 . A safety system for a machine (14), wherein the system comprises two independent logic computing units (2, 2') for execut- ing a safety function based on safety inputs from two redundant data transmission channels (10, 10') providing the same safety inputs to each of the logic computing units, and a fault detecting unit (4) configured to compare the outputs from each of the logic computing units and based on the result of the comparison de- tecting faults and sending safety control signals to the machine, characterized in that the system comprises a programmable logic device (1 ;26) comprising a plurality of independent programmable building components (20,22,24), two of which are programmed to implement said logic computing units.

2. A safety system according to claim 1 , wherein each of said two building components programmed as said logic computing units has its own memory.

3. A safety system according to claim 1 or 2, wherein each of said two building components programmed to implement said logic computing units is any of the following types: a hard processor unit embedded on the programmable logic device (20), a soft processor unit (22), or at least one logic block (24;52) pro- grammed by a hardware description language.

4. A safety system according to any of claims 1 -3, wherein each of said two building components programmed to implement said logic computing units is of a different type.

5. A safety system according to any of previous claims, wherein one of said building components (20,22,24) is configured to implement said fault detecting unit (4).

6. A safety system according to any of previous claims, wherein one of said building components (6) is configured to synchronize said logic computing units.

7. A safety system according to any of previous claims, wherein two of said building components (20,22,24) are configured as monitoring units (40, 40') for monitoring the current safety states from said computing units, wherein each of the monitoring units is configured to receive safety inputs from one of said computing units (2,2') and feed back the safety inputs to the other computing unit.

8. A safety system according to any of previous claims, wherein said machine (14) is an industrial robot comprising a control unit configured to generate safety inputs including an emergency stop input as said input data to said logic computing units.

9. A safety system according to any of the previous claims, wherein said programmable logic device is a field-programmable gate array device.

10. A safety system according to claim 9, wherein a cyclic redundancy check is implemented to perform an error check on said field-programmable gate array.

1 1 . A safety system according to claim 9 or 10, wherein at least one of said programmable building components is a soft processor (22, 22') having an internal register, and a parity check is implemented to detect bit errors on said internal register.

12. A control unit for controlling an industrial robot comprising a safety system according to any of claims 1 -1 1 , wherein said control unit is configured to generate safety inputs including an emergency stop input as said safety input to said logic comput- ing units.