Automation system for monitoring a safety-critical process
AssigneePilz GmbH & Co. KG
InventorsMatthias Schweiker, Daniel Bakovic, Uwe Schoch
Life of this patent
Estimating the term…
Abstract
An automation system for monitoring a safety-critical process includes a platform, a fail-safe peripheral module, and a safe runtime environment. The platform executes user programs. The user programs include a first user program and a second user program, which together implement a safety function. The second user program is diversitary with respect to the first user program. The fail-safe peripheral module couples the user programs with the safety-critical process. The safe runtime environment is implemented on the platform independently of the user programs and provides the user programs with safe resources independent of the platform.
Claims14
An automation system for monitoring a safety-critical process, comprising:
- a non-safe platform serving as a data processing device for executing user programs that implement a safety function;
- a safe runtime environment implemented as a software layer between the data processing device and the user programs and configured to form a first safety instance that monitors the user programs;
- a fail-safe peripheral module coupled to the data processing device for fail-safe input from the safety-critical process and fail-safe output to the safety-critical process;
- and
- a hardware dongle configured to form a second safety instance that tests the first safety instance by selective error injection, wherein:
- the user programs include a first user program and a second user program, which together implement the safety function,
- the safety function transfers the safety-critical process into a safe state in event of danger,
- the first user program and the second user program are executed in parallel, and
- the safe runtime environment is implemented on the non-safe platform independently of the user programs and provides the user programs with safe resources independent of the non-safe platform.
A method for monitoring a safety-critical process, the method comprising:
- providing a non-safe platform having a data processing device for executing a first user program and a second user program in parallel;
- implementing a safety function by the first user program and the second user program;
- forming a first safety instance by a safe runtime environment implemented as a software layer between the data processing device and the first and second user programs;
- monitoring the first and second user programs by the first safety instance;
- receiving fail-safe input from the safety-critical process;
- processing the fail-safe input by the first user program and the second user program in parallel;
- providing fail-safe output to the safety-critical process based on the processing;
- according to the processing, transferring the safety-critical process into a safe state in response to danger;
- forming a second safety instance on a hardware dongle;
- and
- testing the first safety instance with the second safety instance by selective error injection.
Dependencies are inferred from the claim text.