BACKGROUND OF THE INVENTION

[0001] This disclosure relates generally to programmable process controllers and, more particularly, to safety input output devices used with programmable process controllers.

[0002] At least some known process controllers include special purpose computers, for example, programmable logic controllers (PLCs) that are used for the control of industrial machines and processes. During execution of a stored control program, the process controller reads inputs from the controlled process and, in accordance with the logic of the control program, provides outputs to the controlled process.

[0003] PLCs are normally constructed modularly with a processor and I/O circuitry that are constructed as separate modules that may be inserted in a chassis and connected together through a common backplane. The I/O modules permit connection of the input and output field wiring to the processor through the backplane. The field wiring typically includes multi-conductor cables that extend from the PLC cabinet to a termination panel proximate a machine or process to be controlled. The multi-conductor cable may extend for significant distances and may be broken into several terminated segments as it is routed through a plant.

[0004] Some machines and/or processes include safety functions intended to protect operators and/or equipment from injury or damage due to a malfunction or intrusion into a field of operation of the machine. Safety systems, for use in providing such safety functions are generally embodied in a separate qualified safety system or incorporated into the control system by safety qualifying the entire control system.

[0005] Such discrete safety systems can be costly to install and maintain, especially for complex control applications and qualifying the entire control system incurs significant expense of initial safety qualification and continued maintenance of the system safety qualification. Additionally, long distances between the controlled process or machine and the process controller, intervening signal conditioning and processing devices, and the scan rate of the process controller may delay the actuation of the safety function due to the response time of the system.

BRIEF DESCRIPTION OF THE INVENTION

[0006] In one embodiment, a control device for controlling a process includes an input section configured to receive input signals from a controlled process, a first output section communicatively coupled to the input section wherein the first output section is configured to transmit the received input signals to a controller, and a second output section communicatively coupled to the controller, the second output section is configured to transmit control signals from the controller to the controlled process. The apparatus further includes a safety logic block communicatively coupled to the input section in parallel with the received input signals that are transmitted to the controller, the safety logic block is configured to generate a safety output signal using the received input signals, the safety logic block is further configured to transmit the safety output signal to the controlled process independent of the control signals.

[0007] In another embodiment, a method of controlling a process includes receiving an input signal from the controlled process relating to a safety function of the process, transmitting the input signal to a process controller that is remote from the process and a safety logic block that is local to the process, and generating, by a first safety logic block, an output signal that controls the safety function using the input signal, the output signal transmitted to the process independent of any control signal transmitted to the controlled process from the controller.

[0008] In yet another embodiment, a control system includes a plurality of input devices, a plurality of output devices, and a programmable controller configured to execute a control program to control the output status of the plurality of output devices based on the input status of the plurality of input devices. The system also includes a programmable input output device communicatively coupled to the programmable controller. The programmable input output device includes a programmable safety logic block circuit configured to generate a safety output signal using the input status of at least one of the plurality of input devices in parallel with the control program such that the safety output signal is received by a respective output device prior to a corresponding control from the programmable controller is able to be received by the respective output device.

BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 is a schematic block diagram of a control system in accordance with an exemplary embodiment of the present invention; and

[0010] Figure 2 is an expanded schematic block diagram of the programmable safety logic block circuit shown in Figure 1.

DETAILED DESCRIPTION OF THE INVENTION

[0011] The following detailed description illustrates embodiments of the invention by way of example and not by way of limitation. It is contemplated that the invention has general application to process controllers incorporating safety functions that facilitate reducing damage or injury during operation of a controlled machine or process.

[0012] As used herein, an element or step recited in the singular and proceeded with the word "a" or "an" should be understood as not excluding plural elements or steps, unless such exclusion is explicitly recited. Furthermore, references to "one embodiment" of the present invention are not intended to be interpreted as excluding the existence of additional embodiments that also incorporate the recited features.

[0013] Figure 1 is a schematic block diagram of a control system 100 in accordance with an exemplary embodiment of the present invention. In the exemplary embodiment, system 100 includes a programmable controller 102, for example, but not limited to a programmable logic controller (PLC). In the exemplary embodiment, programmable controller 102 includes a processor 103 configured to execute a control program. Programmable controller 102 is communicatively coupled to a plurality of input devices 104 and a plurality of output devices 106 through a safe input output termination device 108. In an alternative embodiment, programmable controller 102 is communicatively coupled to other input devices 129 and output devices 130 in parallel with the safety input output termination device. Programmable controller 102 is configured to execute a control program to control the output status of the plurality of output devices 106, 130 based on the input status of the plurality of input devices 104, 129. Safe input output termination device 108 is communicatively coupled to programmable controller through a link 110, for example, but not limited to a fiber optic, a hard- wired, or a wireless link. Link 110 is controlled, in safe input output termination device 108 by a communication link circuit 112. Communications between controller 102 and safe input output termination device 108 are processed and formatted by a control and communication programmable device 114. In the exemplary embodiment, communication programmable device 114 comprises a field programmable gate array (FPGA). Communication programmable device 114 is also communicatively coupled to a configuration flash memory 115 configured to stored logic instructions for communication programmable device 114.

[0014] Safe input output termination device 108 further includes a programmable safety device 116 communicatively coupled between communication programmable device 114 and a terminal block 118. In the exemplary embodiment, signals transmitted between programmable controller 102, input devices 104, and output devices 106 are transmitted through programmable safety device 116. In the exemplary embodiment, programmable safety device 116 comprises a complex programmable logic device (CPLD). In other embodiments, other types of programmable logics devices may be used. In still other embodiments a microprocessor may be used. As used herein, programmable safety device 116 includes a set of simple programmable safety logic block circuits 120 having inputs and outputs that are connected together by an interconnection matrix. Programmable safety device 116 has two levels of programmability: each programmable safety logic block circuits 120 can be programmed, and the interconnections between the programmable safety logic block circuits 120 can be programmed. Programmable safety device 116 uses internal memory, EEPROM, SRAM, and/or Flash memory to hold the interconnect information.

[0015] Programmable safety logic block circuits 120 are configured to generate a safety output signal using the input status of at least one of the plurality of input devices 104. The input status is transmitted to programmable safety logic block circuit 120 from one or more of the plurality of input devices 104 through terminal block 118 and one of at least two input signal buses 122 and 124. The input status is also transmitted to communication programmable device 114 through input signal buses 122 and 124 that pass through the programmable safety device 116.. In other embodiments the input signals may run in parallel to the programmable safety device 116. The safety output signal is transmitted to one or more of the plurality of output devices 106 through a respective safety output bus 126 and respective terminals of terminal block 118. A control output 128 bus is communicatively coupled between communication programmable device 114 and terminal block 118.

[0016] During operation, input devices 104 detect and/or monitor the input status of associated sensors and/or components. The input status is transmitted to programmable controller 102 through input signal buses 122 and 124 to communication programmable device 114. The input status signals are processed for transmission to programmable controller 102 through communication link circuit 112. In the exemplary embodiment, communication programmable device 114 packetizes the input status signals into network message packets for transmission through link 110 that is configured as a network bus.

[0017] Control signals are generated by controller 102 using the input status and a control program executing on processor 103. The generated control signals are transmitted to output devices 106 through link 110, communication link circuit 112, communication programmable device 114, and programmable safety device 116. In parallel with the processing of controller 102, programmable safety logic block circuit 120 receives the same input status signals transmitted to controller 102 through buses 122 and/or 124. Programmable safety logic block circuit 120 processes predetermined ones of the input status signals to generate safety output signals that are transmitted to output devices 106 through terminal block 118. Because the safety output signals are generated local to process 109 and output devices 106 and because programmable safety logic block circuit 120 comprises programmable logic rather than a program executing on a processor, the safety output signals are able to be received by output devices 106 faster than control signals generated by programmable controller 102. The shorter distance that the signals must transit and the speed of the simpler logic of programmable safety logic block circuit 120 make generating safety and emergency control functions in programmable safety logic block circuit 120 faster than generating the control signals in programmable controller 102.

[0018] For example, in an embodiment where process 109 comprises a metal punch machine, for personnel safety, the metal punch machine may be at least partially surrounded by a light curtain having input devices 104 positions to receive the light when the light curtain boundary is unbroken. Moving portions of the metal punch machine may be actuated by output devices 106 to control the operation of the metal punch machine in accordance with a program executing on programmable controller 102. A typical safety function of the program may be to emergency stop process 109 if input devices 104 associated with the light curtain detect that the light curtain has been broken, potentially by an operator's hand or arm. To ensure that process 109 is able to stop in sufficient time to prevent injury, a response time of process 109 to the determination that the light curtain has been broken should be as short as possible and at least shorter than the time it would take from the detection of the break in the light curtain to when a user's limb might enter the moving portions of process 109. Programmable safety logic block circuit 120 receives input status of the light curtain from input devices 104 associated with light detectors of the light curtain. Programmable safety logic block circuit 120 processes the input signals locally and generates safety output signals using relatively simple logic. The safety output signals are transmitted to respective output devices 106 to stop process 109 before the same input signals can make the round trip to programmable controller 102, the scan delay of programmable controller 102, and the return trip to the respective output devices 106.

[0019] Figure 2 is an expanded schematic block diagram of programmable safety logic block circuit 120 (shown in Figure 1). In the exemplary embodiment, includes programmable logic 202 that defines the operation of programmable safety logic block circuit 120. Programmable logic 202 includes standard logic implementations, for example, but not limited to an AND gate 204 and a NAND gate 206. Programmable logic 202 also includes a switch register 208 wherein each switch 210 may be expressed as a logical zero or a logical one. Programmable logic 202 also includes a decoder 212 for signals from a position encoder 214 associated with process 109. A plurality of precompiled safety certifiable logic blocks 202 are available to be programmed in safety block 120. Logic blocks utilize for example, a cyclic redundancy code (CRC) to verify the contents of the logic block were not changed during the transmission and storage to the programmable safety logic block 120. The contents of switch register 208 are separately programmable and is also certified using a cyclic redundancy code (CRC) to verify the contents of switch register 208 is not changed during a programming procedure.

[0020] Safe input output termination device 108 provides for local safety functions to be incorporated in control system 100, without having to qualify the entire control system 100 for safety operation. Safe input output termination device 108 also eliminates the need for a second independent safety control system to implement the safety functions. Safe input output termination device 108 provides a downloadable and configurable safety function, or functions, located local to process 109. During operation control system 100 operates normally unless an undesirable condition exists. Upon identification of an undesirable state, safe input output termination device 108 generates a safe output signal that executes a safety function in process 109. The execution of the safety function occurs independently from the commands of controller 102. Safe input output termination device 108 hardware and downloadable logic are certified for safety operation. Safe input output termination device 108 permits a user to implement local safety functions while utilizing input/output devices that are remote from control system 100. Safe input output termination device 108 eliminates the need for a separate safety system, or for having to qualify the entire safety system for safety operation.

[0021] Safe input output termination device 108 is also configured to implement a "Permissive Output." During normal operation a permissive output receives commands from a logic solver and executes those commands. If safe input output termination device 108 detects an undesirable state, on the inputs, the permissive output will be driven to the safe state. The execution of the safety function occurs independently from control outputs 128. During a system startup, the output safe state is programmable (i.e. energized or de-energized) and safe input output termination device 108 powers up in the safe state. Safe input output termination device 108 is also configured to only be modified in a program mode.

[0022] Safe input output termination device 108 provides a safety monitoring function in the same enclosure as the input output circuitry and diversity between control and safety functions that facilitates limiting the opportunity of common mode failures from preventing the operation of a safety function. The response time of a safety function is relatively faster than a response time of the control function. Because the safety logic is local, the system does not have to wait for the logic solver to read the inputs, process the logic, and then send the output commands.

[0023] In an alternative embodiment, a control system includes a plurality of input devices including motion (speed) inputs, a plurality of output devices including motion outputs (motors), and a programmable controller configured to execute a control program to control the output status of the plurality of output devices based on the input status of the plurality of input devices. The system also includes a programmable input output device communicatively coupled to the programmable controller. The programmable input output device includes a programmable safety logic block circuit configured to generate a safety output signal using the input status of at least one of the plurality of input devices and the speed of at least one of the plurality of motion devices in parallel with the control program such that the safety output signal is received by a respective output device if the input speed of a device exceeds a configurable set point. For example if a robot cell safety door is open and the robot is traveling faster than the configured safety speed, a robot emergency stop signal is transmitted.

[0024] In another alternative embodiment, link 110 and communication link circuit 112 are replaced with a back plane connector and driver circuitry (both not shown in Figure 1) to form a safety module. Replacement and/or maintenance to the safety module does not require certification of the entire system and facilitates eliminating the time delay due to scan speed.

[0025] The term processor, as used herein, refers to central processing units, microprocessors, microcontrollers, reduced instruction set circuits (RISC), application specific integrated circuits (ASIC), logic circuits, and any other circuit or processor capable of executing the functions described herein. As used herein, the terms "software" and "firmware" are interchangeable, and include any computer program stored in memory for execution by processor 103, including RAM memory, ROM memory, EPROM memory, EEPROM memory, and non-volatile RAM (NVRAM) memory. The above memory types are exemplary only, and are thus not limiting as to the types of memory usable for storage of a computer program.

[0026] As will be appreciated based on the foregoing specification, the above-described embodiments of the disclosure may be implemented using computer programming or engineering techniques including computer software, firmware, hardware or any combination or subset thereof, wherein the technical effect is a means to perform a process safety function within an input output module, while providing process inputs and outputs to a process control system without having to utilize a second control system, or certify the entire control system for safe operation. Any such resulting program, having computer-readable code means, may be embodied or provided within one or more computer-readable media, thereby making a computer program product, i.e., an article of manufacture, according to the discussed embodiments of the disclosure. The computer readable media may be, for example, but is not limited to, a fixed (hard) drive, diskette, optical disk, magnetic tape, semiconductor memory such as read-only memory (ROM), and/or any transmitting/receiving medium such as the Internet or other communication network or link. The article of manufacture containing the computer code may be made and/or used by executing the code directly from one medium, by copying the code from one medium to another medium, or by transmitting the code over a network.

[0027] The above-described embodiments of a method and system for controlling a process provides a cost-effective and reliable means of executing a safety function independently from control commands of a process controller. More specifically, the methods and systems described herein facilitate executing a safety function when an undesirable process condition is identified. In addition, the above- described methods and systems facilitate implementing a "Permissive Output" that during normal operation receives commands from the process controller and executes the commands. When an undesirable state on the inputs is detected, the permissive output is driven to a predetermined safe state. As a result, the methods and systems described herein facilitate controlling a process in a cost-effective and reliable manner.

[0028] While the disclosure has been described in terms of various specific embodiments, it will be recognized that the disclosure can be practiced with modification within the spirit and scope of the claims.