DE102015120056B4 - RFID system for checking safety-relevant switching operations - Google Patents

Abstract

RFID system for checking safety-related switching operations, comprising a control unit (2) which is certified according to a predetermined safety standard according to a predetermined safety integrity level ("SIL") and provides a second communication path (II) for ensuring compliance with the predetermined safety integrity level; wherein the control unit (2) has a first data connection (21), wherein the RFID system further has an RFID reader (1) connected to the control unit (2) with this first data connection (21), wherein the RFID reader (1) further comprises an antenna (11) as an air interface with an associated transmission / reception area, characterized in that the RFID system further comprises a test RFID transponder (5) with a corresponding antenna (51) and in that the control unit (2 ) further comprises, for a second communication path (II), a second data port (22) via which si e is capable of transmitting test data to a corresponding data port (22) of the test RFID transponder (5) by data transfer means (4), the test RFID transponder (5) having its antenna (51) communicating with it the RFID reader (1) is arranged via the air interface in the transmission / reception area and the test data received from the control unit (2) via the antenna (51) to the RFID reader (1), which receives the received Sends test data to the control unit (2) via the first data port (21) and the control unit (2) compares the received test data with the transmitted test data to determine whether there is a secure data connection and a sensor switch (S2 ) and a sensor RFID transponder (6) with an associated antenna (61) for checking the switching state of the sensor switch (S2), wherein the sensor RFID transponder (6) at least during its communication with the RFID reader (1) ü Is arranged over the air interface in the transmission / reception area.

Description

The invention is based on an RFID system according to the preamble of independent claim 1.

Such RFID systems are required to control safety-relevant switching operations, in particular in connection with safety-relevant mechanical interlocks.

State of the art

In the prior art, safety-relevant switching operations and, in particular, associated safety-related mechanical interlocks are known. In particular, this problem with respect to door locks and the locking-relevant position of safety bars in particularly safety-critical areas is known, such as on gondolas or corresponding seats in the field of cable cars and / or ski lifts and the like.

Furthermore, it is known that, at least in Europe, according to the European safety standard EN 61508, originated from the international standard IEC 61508, such applications must comply with the second highest associated safety integrity level ("SIL"), namely the so-called "SIL 3". In any case, the relevant standard IEC 61508 applies internationally.

Depending on the design and application is to achieve this SIL 3 Certification of a corresponding control system for the transmission of safety-relevant data always a so-called "second communication path" and / or the use already SIL 3 - Certified devices required.

• - Einen Verbinder, der zum Anschließen an eine externe Vorrichtung konfiguriert ist,
• - eine Steuerung, die konfiguriert ist,
  • ◯ um zu bestimmen, ob das externe Gerät ein Oberflächenakustikwellen-Gerät (SAW-Gerät) ist, und um ein Anforderungssignal über den Verbinder an das SAW-Gerät auszugeben, wenn das externe Gerät das SAW-Gerät ist,
  • ◯ um ein dem Anforderungssignal entsprechendes Antwortsignal zu empfangen von der SAW-Vorrichtung durch den Verbinder und um das Antwortsignal zu verarbeiten; und
  • ◯ eine Ausgabeschnittstelleneinheit, die konfiguriert ist, um Daten gemäß einem Ergebnis der Verarbeitung des Antwortsignals auszugeben.

The publication US 2015/0 089 093 A1 discloses an electronic device comprising:

• A connector configured to connect to an external device,
• a controller that is configured
  • ◯ to determine whether the external device is a surface acoustic wave device (SAW device) and to output a request signal to the SAW device via the connector when the external device is the SAW device,
  • ◯ to receive a response signal corresponding to the request signal from the SAW device through the connector and to process the response signal; and
  • ◯ an output interface unit configured to output data according to a result of the processing of the response signal.

• - einen SAW-Device-Controller, der zum Senden des Anforderungssignals an das SAW-Gerät konfiguriert ist und das Antwortsignal von dem SAW-Gerät empfängt;
• - einen Schalter, der konfiguriert ist, einen Pfad eines Signals umzuschalten;
• - einen Prozessor, der konfiguriert ist, um den Schalter so zu steuern, dass eine Signaleingabe- / ausgabeeinheit mit dem Verbinder verbunden wird, wenn bestimmt wird, dass das externe Gerät das SAW-Gerät ist, basierend auf einem IDentification (ID) -Wert des externen Geräts, und um die Antwort zu verarbeiten Signal.

Furthermore, the controller may include:

• a SAW device controller configured to send the request signal to the SAW device and receive the response signal from the SAW device;
• a switch configured to switch a path of a signal;
• a processor configured to control the switch so that a signal input / output unit is connected to the connector when it is determined that the external device is the SAW device based on an IDentification (ID) value the external device, and to process the response signal.

• - eine Antenneneinheit;
• - ein mit der Antenneneinheit gekoppeltes Schaltmodul;
• - eine erste drahtlose Kommunikationsschaltung, die mit der Antenneneinheit gekoppelt ist, um eine Funkfrequenzidentifikations (RFID) -Kommunikation über die Antenneneinheit durchzuführen; und
• - eine zweite drahtlose Kommunikationsschaltung, die mit dem Schaltmodul gekoppelt ist, um einen Zustand des Schaltmoduls zu steuern, um eine RFID-Kommunikation über die Antenneneinheit durchzuführen; wobei sowohl die erste als auch die zweite drahtlose Kommunikationsschaltung die Antenneneinheit verwenden.

The publication US 2009/0 212 917 A1 discloses a wireless communication device comprising:

• an antenna unit;
• a switching module coupled to the antenna unit;
• a first wireless communication circuit coupled to the antenna unit to perform radio frequency identification (RFID) communication via the antenna unit; and
• a second wireless communication circuit coupled to the switching module for controlling a state of the switching module to perform RFID communication via the antenna unit; wherein both the first and second wireless communication circuits use the antenna unit.

In the prior art it is still, for example from the publications EP 920 740 B1 and US 6,259,353 B1 , known to perform a self-test with an RFID reader. For this purpose, the RFID reader can check its own receiving unit by means of a test signal via a connected test RFID transponder.

To such an arrangement but as a second communication path in the sense of the required security level (SIL 3 However, in the prior art, the RFID reader also has to be SIL certified in accordance with SIL (ie possibly double), which means a high outlay and corresponding costs. Finally, the use of a simple and not Sil-certified RFID reader would still be the danger that just this RFID reader could cause a mistake. This is however with the given safety level SIL 3 not compatible.

This requires an associated control system according to its structure and application a correspondingly high hardware and certification effort.

task

The object of the invention is to specify an RFID system which, with the lowest possible hardware and certification effort, such safety-critical switching operations, in particular according to SIL 3 supervised.

This object is achieved with an RFID system of the type mentioned by the features of the characterizing part of the independent claim 1.

The RFID system for checking safety-relevant switching processes comprises a control unit which is certified according to a predetermined safety standard according to a predetermined safety integrity level ("SIL") and has a first data connection, the RFID system also having a data transmission to the control unit with the latter the RFID reader further has an antenna as an air interface with an associated transmission / reception area, wherein the RFID system further comprises a test RFID transponder with an associated antenna and wherein the control unit further comprises a second data port, via which it is capable of transmitting test data to a corresponding data port of the test RFID transponder by data transmission means, wherein the test RFID transponder with its antenna for communication with the RFID reader via the air interface e is arranged in the transmission / reception area.

The mark that "the RFID system further has an RFID reader connected to the control unit with this first data connection for data transmission" in this context means that the RFID reader can transmit data to the control unit. In particular, bidirectional data exchange between the control unit and the RFID reader via the first data connection may also be possible, which has the advantage that the control unit specifically interrogates the RFID reader and / or, where appropriate, for better data separation between the simultaneous signals of a plurality of RFID tags. Transponder can communicate at least parts of the test data. The data exchange between the RFID reader and the control unit can preferably take place via a connecting line because this represents a particularly inexpensive and secure data connection. But there are also other data transmission methods conceivable, such. B. a radio connection, z. B. Bluetooth or the like.

Among other things, the invention serves to simulate the function of the sensor RFID transponder and the associated so-called "first communication path" by means of the test RFID transponder via a so-called "second communication path".

Advantageous embodiments of the invention are specified in the subclaims.

In particular, the given safety standard according to which the control unit ( 2 ), is distinguished by the fact that it prescribes a second communication path for securing for the said predetermined security level for all security-relevant areas.

In particular, the safety standard may be the European standard EN 61508. It may also be the international standard IEC 61508, from which the safety standard EN 61508 was created. The security integrity level may be the associated second highest security integrity level ("SIL") 3.

It is particularly advantageous that said RFID reader neither SIL itself 3 certified must still be secured via a second RFID reader and that the entire RFID system still SIL 3 can be certified. The second communication path is finally realized on the much cheaper test RFID transponder.

It is particularly advantageous if the said data transmission means, which serve for transmitting test data from the control unit to the test RFID transponder, exist in a wired data line, because this increases the data security compared to a wireless data transmission and is also particularly inexpensive , In other words, it is particularly advantageous to carry out a transmission of test data from the control unit to the test RFID transponder in a wired fashion, because this ensures particularly good data security and furthermore the costs and outlay for wireless transmission be saved. In special applications but are also other data transmission methods, eg. B. wireless data transmission methods, such. B. Bluetooth, conceivable.

It is particularly advantageous that the entire RFID system in this way with a single and very simple and inexpensive constructed second communication path as redundancy, the second communication path as additional components only the test RFID transponder and a single, especially wired, Data line needed. This is possible because the control unit in which it is preferably a so-called programmable logic controller ("PLC") can act, in turn, already SIL 3 is certified, which is mandatory in any case due to their function, in particular the control of safety-critical applications such as cable cars or the like anyway. Thus, the RFID system to be integrated into such an application can check its function via the test RFID transponder, ie via the second communication path, in the form of a self-test and in the first communication path the actual useful signal, namely information about the safety-relevant switching operation, received from the sensor RFID transponder. As a result, the entire signal path from the sensor RFID transponder to the control unit can be secured by the second communication path, said second communication path, in simple words, controlling the signal flow in a complete loop, ie "everything", and thus also the complete first communication path, which in this case runs from the sensor RFID transponder to the control unit, maps. About this very simple "second communication path" so the entire way from the sensor RFID transponder on the antenna and the radio link, via the antenna of the RFID reader to the RFID reader and the RFID reader z. B. via an additional connection line to the SIL 3 secured by a certified control unit. This solution is, as already mentioned, thus particularly inexpensive, compared with a double hedge, in which in particular the RFID reader to achieve the SIL 3 would have to be duplicated.

In an advantageous embodiment, the RFID system can have a sensor RFID transponder with an associated antenna for checking the switching state of an associated sensor switch. The sensor RFID transponder is characterized in that it has a sensor input via which in particular its activity status can be switched. The sensor switch is characterized in that it is connected to the sensor input of the sensor RFID transponder. In particular, the sensor switch can be a sensor which mechanically detects the locking status of the locking device and converts this mechanical into an electrical variable and forwards it to the sensor transponder.

In a preferred embodiment, the sensor switch may internally have a second communication path that may contribute to the SIL 3 to reach. For example, it can be designed such that it signals the locked and the unlocked state of the locking device at two different outputs. The sensor RFID transponder can accordingly have two sensor inputs, one of which is connected to one of the outputs of the sensor switch. Thus, each locking state can be signaled twice, not only by the presence of the one, but at the same time by the absence of the other signal, for. B. a switching voltage. If both signals are present at the same time or if there is no signal, this is a clear indication of an error.

The sensor RFID transponder is arranged with its antenna at least during its communication with the RFID reader via the air interface in the transmission / reception area. Advantageously, the distance between their antennas may be smaller than the distance between the antenna of the test RFID transponder and the antenna of the RFID reader. This is particularly advantageous because the correct reception of the test data enables the transmission of the switching signal to be regarded as safe even against possible interference with the wireless RFID communication.

Furthermore, the RFID system may include a test switch capable of activating or deactivating the test RFID transponder.

The test switch can, for. External, d. H. outside the control unit, be arranged in the data line between the control unit and the test RFID transponder. For example, it can be opened or closed by the control unit via a particular separate first control line. However, in another preferred embodiment, the test switch can be part of the control unit and switch from there the data stream of the control unit to the test RFID transponder.

In each of the two cases, it is particularly advantageous that the test switch in the switched-off, ie open state interrupts the test data stream, because this faulty function information for the control unit is almost impossible. Finally, the SIL compares 3 The control unit certifies the test data it sends through its second data port with the data it receives via its first data port, and only if it matches a trusted data link. In this case, the test data may in particular include a globally unique code in order to identify the signal of the test RFID transponder in particular one-to-one and thus to produce a particularly high level of security. Preferably, these test data can also be regenerated for each data transfer, possibly also on the basis of predetermined data, eg. B. by a redundant mathematical modification, such as multiplication with a random number known only to the control unit.

In a further preferred embodiment, the RFID system has an additional sensor for detecting the arrival of a means of transport. This additional sensor can in particular be connected to the control unit via a second control line.

The sensor RFID transponder and the associated sensor switch can be arranged on the transport.

The means of transport, which may be, for example, a cabin, a gondola, an armchair, etc., ie a means of transport for a cable car, a ski lift, a chairlift or the like provided for the transport of persons, comprises one according to SIL 3 safety-critical locking device whose locking state is controlled by the sensor switch, that is, for example mechanically coupled thereto. In particular, this locking device may belong to a bracket or a door or any comparable lockable device, which prevents in the locked state, for example, that people fall from the moving means of transport.

Furthermore, the means of transport may also be provided for transporting material, provided that its locking as safety-critical in the sense of SIL 3 Certification is viewed. Accordingly, it may also be a material basket, a bucket, a lore, a Hunte, etc. act.

embodiment

• 1 a, b einen grundsätzlichen Aufbau eines RFID-Systems ohne und mit einem Sensor-RFID-Transponder;
• 2 a, b das RFID-System mit dazugehörigen Sensor- und Test-Schaltern;
• 3 a, b das RFID-System mit einem intergierten Test-Schalter;
• 4 a das RFID-System mit einem zusätzlichen Sensor;
• 4 b das RFID-System mit dem zusätzlichen Sensor und einem dazugehörigen Transportmittel;
• 5 einen Sensor-Schalter mit zwei Kommunikationspfaden.

An embodiment of the invention is illustrated in the drawings and will be explained in more detail below. Show it:

• 1 a, b a basic structure of an RFID system without and with a sensor RFID transponder;
• 2 a, b the RFID system with associated sensor and test switches;
• 3 a, b the RFID system with an integrated test switch;
• 4 a the RFID system with an additional sensor;
• 4 b the RFID system with the additional sensor and an associated means of transport;
• 5 a sensor switch with two communication paths.

The figures contain partially simplified, schematic representations. In part, identical reference numerals are used for the same but possibly not identical elements. Different views of the same elements could be scaled differently.

The 1a and 1b show a basic structure of an RFID system according to the invention. The basis is a basic system 3 comprising an RFID reader 1 with an associated antenna 11 as an air interface and at least one data interface 12 , Furthermore, the base system includes 3 a control unit 2 , which may be in particular a so-called programmable logic controller ("PLC"). The control unit 2 is according to the SIL 3 certified.

The control unit 2 has a first data port 21 about which they are from the RFID reader 1 via its data interface 12 at least receive data. In particular, the control unit 2 with the RFID reader 1 also in bidirectional data exchange. In the present embodiment, the data transmission takes place via a common connection line 41 instead of. It could in principle but also other transmission methods, eg. B. wireless transmission method, such. As Bluetooth and the like, apply.

Furthermore, the control unit has 2 a second data port 22 with which they have a data line 4 to a data input 52 a test RFID transponder 5 connected. The test RFID transponder 5 has an antenna 51 with which he is in a transmitting / receiving area of the RFID reader 1 is located to with this RFID reader 1 via its air interface, ie via its antenna 11 , like in the 1a shown to communicate. Here, too, the use of the data line is particularly cost-effective and safe and therefore particularly advantageous. However, it could be in other versions but for other transmission methods, eg. B. wireless transmission method, such. As Bluetooth and the like, apply.

Thus, the basic system 3 being able to do a self-test via their second communication deposit II To perform: The control unit 2 sends test data, especially a special code, over the data line 4 to the test RFID transponder 5 , The test RFID transponder 5 sends this test data with its antenna 51 directly or in processed form via the air interface to the RFID reader 1 about which she ultimately returns to SIL 3 certified control unit 2 get to the control unit 2 can match them with the original test data sent by her. Thus, by this closed signal path a so-called "second communication path" II guaranteed as a redundant signal path.

A so-called "first communication path" I is in the 1b shown. To the test RFID transponder 5 is within the transmission / reception range of the RFID reader 1 a sensor RFID transponder 6 Joined, via his antenna 61 with the RFID reader 1 via its antenna 11 communicated. The transmitted data are security-relevant user data and are processed for further processing via the data interface 12 of the reader 1 to the control unit 2 passed.

The in the 2a and 2 B The structure shown differs from the preceding representations in that the test RFID transponder 5 via a test switch S1 and the sensor RFID transponder via a sensor switch S2 be switched. In the example shown, the test switch is located S1 in the data line 4 that switch over this test S1 to a data input 52 of the test RFID transponder 5 is connected and thus switches its activity state. Alternatively, however, it could also be connected to a possibly existing separate sensor input of the test RFID transponder 5 be connected to this test RFID transponder 5 to activate or deactivate.

The sensor switch S2 is to the sensor RFID transponder 6 connected. In particular, the sensor switch S2 to a sensor input 62 of the sensor RFID transponder 6 connected to it about the state of activity of the sensor RFID transponder 6 to switch, ie the sensor RFID transponder 6 to activate or deactivate.

The switch positions are chosen in this example so that only one of the two RFID transponders 5 . 6 is active. Although this would not be necessary for the function of the RFID system, if the RFID reader 1 For example, it includes collision protection, but it simplifies the corresponding method and presentation. By a short-term switching of the two switches S1 . S2 can thus be a safety according to SIL 3 be guaranteed. The measurement period can be adapted to the requirement. It can, for example, between the successive data transmissions of several different sensor RFID transponders 6 to the RFID reader 1 one test each via the test RFID transponder 5 occur. It can also be in the entire period between the data transmissions of the sensor RFID transponder 6 to the RFID reader 1 with an even higher frequency, for example, every second, such a test measurement can be performed. However, in contrast, if desired according to the particular application, such a test may take place only once a day.

Alternatively, using the collision protection, but also both communication paths I . II be operated simultaneously. Then, in particular, the RFID reader should also have a corresponding data separation between the signals of the test RFID transponder 5 and the sensor RFID transponder, for example, with knowledge of the test data or at least relevant parts thereof, which the RFID reader 1 for example, from the control unit 2 can be transmitted. For security reasons, the control unit 2 while still holding back some of the test data to a possible error by the uncertified RFID reader 1 excluded.

The test switch S1 is in the second communication path II namely in the data line 4 arranged. If this test switch S1 is closed, receives the corresponding data input 52 of the test RFID transponder 5 the said data from the control unit 1 , In the present case, the test switch S1 from the control unit 2 via a control line C1 controlled, ie closed or opened. Is the test switch S1 , like in the 2a shown, closed, so can the test RFID transponder 5 the test data from the control unit 2 get and test this data via its antenna 51 and over the air interface 11 to the RFID reader 1 transfer.

Is, like in the 2 B shown, the test switch S1 On the other hand, the test RFID transponder transmits 5 no data to the RFID reader 1 , At the same time, however, is the sensor switch S2 closed and the sensor RFID transponder 6 sends data via the air interface to the RFID reader 1 ,

The 3a and 3b differed from the 2a and 2 B only by the fact that the test switch S1 Part of the control unit 2 is and therefore the first control line C1 is saved.

The 4a also shows an additional sensor 8th which is intended for the control unit 2 the arrival or the presence of a means of transport 7 For example, a cabin, a gondola, an armchair, a basket of material, a bucket, a lorry, a Hunte, etc., ie a driving means of a cable car, a ski lift, a chairlift or the like to signal. Via a control line C2 is the additional sensor 8th with the control unit 2 connected. Thus, in particular, the switch position of the test switch S1 from the presence of the means of transport 7 be made dependent. In particular, the test switch S1 Be closed whenever there is no means of transport 7 from the additional sensor 8th is detected. Thus, it can be ensured that only one RFID transponder at a time, so either the test RFID transponder 5 or the sensor RFID transponder 6 , with the RFID reader 1 communicated.

Furthermore, has the means of transport 7 one in the 4b Locking device shown in the form of a lock symbol 9 , which, in particular mechanically, with the sensor switch S2 is coupled. For example, the sensor switch S2 always be closed when the locking device 9 closed is. At the sensor switch S2 it can be a sensor that locks the locking device 9 detected mechanically and converted into an electrical variable. The sensor switch S2 activates the RFID transponder 6 that with the RFID reader 1 appropriately communicated and the control unit 2 about the switch position and thus the locking state of the locking device 9 with very high safety, according to the SIL 3 , notifies.

The 5 shows a sensor switch S2 ' having an internal second communication path. Thus he can work on two different outputs A1 and A2 respectively signal the locked and the unlocked state of the locking device by depending on the switch position, for example, a switching voltage U _S at the first exit A1 or the second exit A2 is transferable.

The sensor RFID transponder can accordingly have two separate sensor inputs 621 . 622 each of which has one of the outputs A1 . A2 of the sensor switch S2 ' connected is. Thus, each locking state can be signaled twice, not only by the presence of the one, but at the same time by the absence of the other signal. If both signals are present at the same time or there is no signal at all, this is a clear indication of an error.

LIST OF REFERENCE NUMBERS

1

RFID Reader

11

Antenna of the RFID reader

12

Data interface of the RFID reader

2

control unit

21

first data port of the control unit

22

second data port of the control unit

3

base station

4

Data line for test data

41

connecting line

5

Test RFID transponder

51

Antenna of the test RFID transponder

52

Data input of the test RFID transponder

6.6 '

Sensor RFID transponder

61

Antenna of the sensor RFID transponder

62

Sensor input of the sensor RFID transponder

621.622

separate sensor inputs of the sensor RFID transponder

7

Mode of Transport

8th

additional sensor

9

Verrigelungseinrichtung

S1

Test switch

S2, S2 '

Sensor switch

A1, A2

separate outputs of the sensor switch

C1, C2

first, second control line

U _S

switching voltage

I, II

first, second communication path

Claims (9)

RFID system for checking safety-related switching operations, comprising a control unit (2) which is certified according to a predetermined safety standard according to a predetermined safety integrity level ("SIL") and provides a second communication path (II) for ensuring compliance with the predetermined safety integrity level; wherein the control unit (2) has a first data connection (21), wherein the RFID system further has an RFID reader (1) connected to the control unit (2) with this first data connection (21), wherein the RFID reader (1) further comprises an antenna (11) as an air interface with an associated transmission / reception area, characterized in that the RFID system further comprises a test RFID transponder (5) with an associated antenna (51) and in that the control unit (2) furthermore has, for a second communication path (II), a second data connection (22) via which it is transmitted by data transmission means (4) for transmitting test data to a corresponding data connection (22) of the test RFID. Transponder (5) is capable, wherein the test RFID transponder (5) with its antenna (51) for communication with the RFID reader (1) via its air interface in the transmission / reception area is arranged and the control unit ( 2) transmits the test data received via the antenna (51) to the RFID reader (1), which sends the received test data via the first data connection (21) to the control unit (2) and the control unit (2) received test data with the transmitted test data to determine whether a secure data connection is present and a sensor switch (S2) and a sensor RFID transponder (6) with an associated antenna (61) for checking the switching state of the sensor switch (S2), wherein the sensor RFID transponder (6) is arranged at least during its communication with the RFID reader (1) via its air interface in its transmission / reception range. RFID system according to the preceding claim, characterized in that the data transmission means in a data line (4), via which the second data terminal (22) of the control unit (2) for wired data transmission to the corresponding data terminal (52) of the test RFID transponder (5) is connected. RFID system according to one of the preceding claims, characterized in that the RFID system comprises a test switch (S1) which is able to activate or deactivate the test RFID transponder (5). RFID system according to one of the preceding claims, characterized in that the sensor switch (S2 ') internally has a second communication path. RFID system according to Claim 3 , characterized in that the test switch (S1) is part of the control unit (2). RFID system according to one of the preceding claims, characterized in that the RFID system has an additional sensor (8) for detecting the arrival of a means of transport (7). RFID system according to Claim 6 , characterized in that the sensor RFID transponder (6) and the associated sensor switch (S2) on the transport means (7) are arranged. RFID system according to Claim 7 , characterized in that the transport means (7) comprises a safety-critical locking device (9) according to the SIL 3 whose locking state is controlled by the sensor switch (S2). RFID system according to one of the preceding claims, characterized in that the control unit (2) is a programmable logic controller ("PLC").

Images