1.14 Designing Systems with Radio or CAN Communication

1.14.1 Radio and CAN communication safety notice

Safety Notice

Since neither CAN nor radio are 100% reliable ways of communication (a CAN cable can be cut off or disconnected at any time, a radio link can be disrupted by radio interference, or a node can simply lose power and stop communicating), the safety applications that use these types of communication must be developed with these problems in mind. Loss and return of radio communication must be considered the same as loss and return of power, and therefore must always result in all affected outputs and equipment going to safe state. Simplifier Manager helps to prevent some common errors when programming, but it is ultimately up to the developer to follow these principles when programming and installing the system.

The following sections discuss how to program systems that communicate via radio or CAN, and the most common errors and how to avoid them.

1.14.2 Radio

The Safety Simplifier can communicate to other Safety Simplifiers via the radio module. The wireless protocol that is used is a special protocol based on IEEE 802.15.4. This protocol shares the same frequency band as Wi-Fi (2.4 GHz) and has the same 16 channels as 802.15.4. Channels for Safety Simplifier systems are numbered 1–16, where the Simplifier channels 1–16 correspond to the IEEE 802.15.4 channels as seen in the table below (Simplifier channel + 10 = IEEE 802.15.4 channel).

Simplifier Channel	IEEE 802.15.4 Channel	Frequency (MHz)
1	11	2405
2	12	2410
3	13	2415
4	14	2420
5	15	2425
6	16	2430
7	17	2435
8	18	2440
9	19	2445
10	20	2450
11	21	2455
12	22	2460
13	23	2465
14	24	2470
15	25	2475
16	26	2480

Table 1.1: How Simplifier channels correspond to IEEE 802.15.4 channels.

To be able to communicate with other nodes, all the nodes must be running the same program, and all nodes must know the serial number of all other nodes in the system. This is to make sure that only the units that are in the system can share information with each other. In Simplifier Manager, before a program can be downloaded, all serial numbers must be specified by the user.

A disturbance in the radio will never cause a safe signal to go high, as a strong checksum is used on all information. A very strong disturbance for a long time, however, can disrupt the system for longer than the communication timeout specified for the system, which will cause a timeout, and affected memories will be set to 0 at the receiving nodes. Timeouts are discussed further in 1.14.5.2 Timeout and StartUp test.

When communicating via radio, the nodes send their packets in order from node 1 to node 16. A complete update cycle where all nodes have sent a packet once is called a frame. The frame time depends on how many nodes are in the system.

Nodes in system	Radio update cycle time (ms)
2	4.25
3	6.38
4	8.50
5	11.25
6	13.88
7	16.63
8	20.00
9	23.06
10	26.25
11	29.56
12	33.75
13	37.38
14	41.13
15	45.94
16	50.00

Table 1.2: Update time depending on number of nodes in the system.

Frame time is the minimum response time over radio. The maximum response time is determined by the long or short timeout specified in the project. The safety signals will never exceed the timeout specified.

The average response time always depends on the installation and radio environment at that location. Generally, with good radio quality, the average response time can be expected to be somewhere between one or two frame times. However, the radio quality is never constant, and disturbances can cause the average response time to vary over time.

The protocol does not implement any resending/acknowledgement functionality. Instead, all nodes in the system repeat all information they hear to each other, so if a node loses a packet from another node, it still has a chance to hear the repeated information from other nodes in the system. Each node also sends out the age of the information, so other nodes know how old the data is. This is so all the timeout deadlines can be met.

When node 1 starts up it starts sending packets immediately. The other nodes in the system scan all channels listening for information from node 1. If a node hears node 1 directly, or repeated information from node 1 via another node, they will join the network. This means a direct contact with node 1 is not necessary for a node to join the network, but node 1 must be in the network. Turning off node 1 will cause all nodes to stop repeating information from node 1 and go back to scanning mode. Turning off any other node only stops actions depending on the turned-off node.

1.14.3 Selecting radio channel for radio communication

The radio channel is selected before downloading a configuration to a system. To find the best channel for communication, the built-in channel scanner can be used. Note that this requires a Simplifier Monitor. The channel scanner checks all 16 channels for overlapping Wi-Fi signals and other radio disturbances that would make the channel unsuitable for communication.

Without a Simplifier Monitor, a suitable channel can be found by analyzing the different Wi-Fi networks in the area to see which channels are occupied. There are several ways to do this. Smartphones running the Android operating system can download a Wi-Fi analysis application to scan the 2.4 G band for Wi-Fi networks (this is not available for Apple smartphones). Some programs exist for Windows that do this as well. This method, however, does not detect other disturbances that can disrupt radio communication. Using the Simplifier Monitor together with the built-in channel scanner is the most reliable way of finding a suitable radio channel.

Note

The Simplifier channels 1–16 do not correspond to the Wi-Fi channels 1–14. Each Wi-Fi channel is 22 MHz wide, covering several Simplifier channels.

Figure 1.61: Channel and frequency for Safety Simplifier.

Figure 1.62: Overlap of Wi-Fi (IEEE 802.11) channels and IEEE 802.15.4 channels. Note how, for example, Wi-Fi channel 6 overlaps 802.15.4 channels 16 through 19 (which means Simplifier channels 6 through 9).

1.14.4 Designing systems that communicate via radio

Where nodes in a system are placed greatly influences the quality of the radio communication. In general, to achieve good radio quality in a system, make sure that:

1. As many nodes as possible have direct line of sight between them.
2. The line of sight is not broken by people, vehicles, or other equipment.
3. Every node in the system has good radio connection to at least three other nodes in the system (i.e. satisfies points 1 and 2 above).
4. Every node has good radio connection to the previous node number (node 2 should hear node 1, node 3 should hear node 2, etc.).
5. Node 1 has good connection to the last node in the system.

For systems with 2, 3, or 4 nodes, every node should have a good radio connection to every other node in the system.

1.14.4.1 Radio quality

For the system in Figure 1.63, a very good radio quality can be expected. All nodes are within range of each other and hear each other directly. This means that no node in the system relies on repeated information.

If a radio disturbance makes, for example, node 3 miss the information sent by node 1, it still has a chance to hear the repeated information from node 2. This makes the system more resistant (but of course not immune) to random disturbances, and thus more reliable.

Figure 1.63: An example of a system with good radio quality. Blue circles indicate signal range, arrows indicate direct radio contact. Note that the recommended distance between nodes depends on walls and other obstructions between the nodes.

In Figure 1.64, nodes 1, 2, and 3 have direct radio contact to each other, and 3, 4, and 5 have direct radio contact to each other. This system will function. However, it violates some of the rules given in the beginning of this chapter: nodes 1, 2, 4, and 5 only hear two other nodes. This results in a less reliable system. It also violates the rule that node 1 should hear the last node in the system. The result of this is slower reaction times and less reliability.

Figure 1.64: A system that relies on the repeating function of node 3. If node 3 loses power, nodes 4 and 5 will lose connection to node 1 and will leave the network.

Reliability — if node 3 loses power or stops radio communication due to an error, no repeated information from node 1 will reach nodes 4 and 5, and these nodes will leave the network. This makes the network rely completely on node 3 to work.

Reaction Times — the information from nodes 4 and 5 to nodes 1 and 2 will be delayed by the repeating function of node 3, as it must repeat "backwards". This increases the average reaction times in the system, but it does not increase the maximum reaction time.

Solution — to solve these two issues for the system in Figure 1.64, the system must be changed to follow the rules given at the start of 1.14.4 Designing systems that communicate via radio. To achieve this, we can simply add a new node (node 6) and put it next to node 3 (see Figure 1.65). Now all rules are followed. Node 1 hears the last node in the system (node 6), and every node in the system hears at least 3 other nodes, where one is always the previous node.

Figure 1.65: This system still relies on the repeating function, but it has redundancy. If node 3 stops transmitting radio, nodes 4 and 5 will still be able to hear nodes 1 and 2 via node 6.

1.14.5 Global Memories

As mentioned in earlier chapters, Global Memories can be used to send safety information between nodes in a system via radio or CAN. The Global Memories are sent via both radio and CAN. A maximum of 16 Global Memories can be defined for each node. This means a maximum of 16 signals (bits) can be sent from each node via radio. All Global memories can be referenced by any node in the system.

1.14.5.1 Choosing Memory Numbers

There is no difference between the memories in the radio communication. Either all memories from a node are received, or no memories are received, and all memories are received at the same time. This means that no memory number is better than another, and there are theoretically no rules for assigning memory numbers. There are, however, some good guides to follow, to make debugging easier.

It is recommended that similar functions are assigned to the same memory number in every node. For example, it is good practice to put all E-Stops on GM1, and all Reset buttons on GM6 for all nodes that have these functions. This makes debugging easier with the display, as the status of all E-Stops is displayed in the same position for all nodes.

It is also recommended that the memory numbers follow the I/Os. If a Push Button is assigned to terminal 6, it is recommended to send this signal on GM Number 6 as well.

These are only guidelines and cannot always be followed for all applications. The user is free to make their own rules for how memories are assigned, but it should be as consistent in the whole project as possible and make sense for the application.

Avoid memory group loops

Global memories are sent in groups of 16 with one shared age stamp. If a signal leaves a group, passes through other nodes and returns into the same group, the system never leaves the timed-out state. See 4 Avoiding Memory Group Loops for how to assign memory numbers in tiers.

1.14.5.2 Timeout and StartUp test

For every Global or CAN memory, apart from Memory Number, two more properties exist: Timeout and StartUp test. These properties are important for the safety communication and determine how the receiving node uses the Memory signal. There is also a third property for Global memories called Do Not Repeat, which is discussed further down in this chapter.

Timeout

The maximum response time of a complete function that is sent over radio (Input → Logic → Output) is given by T_input + T_logic + T_timeout + T_logic + T_output. The T_timeout time is given by the timeout specified on the memory that is being used to send the signal. Generally, the longer the communication timeout, the more reliable and fault-tolerant radio communication between nodes. Setting a shorter timeout guarantees shorter maximum response times for safety signals sent over radio, but also results in less robust communication over radio.

The question that should determine the timeout values is: "What is the maximum theoretical allowed response time for the safety device I am using?" For an E Stop, the maximum response time can be set to higher values (between 500 ms and 1000 ms is acceptable). For a Light Curtain / ESPE device, the response time requirement is much stricter, so a timeout of 200 ms or less can be required. This means that the E Stop would be more resistant to radio disturbances than the ESPE but would also have a longer theoretical maximum reaction time than the ESPE. Reaction time must always be weighed against communication robustness when choosing radio timeouts.

Two different values for timeout can be set for a project: Long and Short. These are by default set to Long = 500 ms and Short = 200 ms. For each global or CAN memory one of these values can be specified. This is so that safety devices that require shorter timeouts (such as light curtains) can use the short timeout value, and other devices that allow longer reaction times can use the long timeout value.

Imagine that a node (A) receives a radio packet from another node (B). Two countdowns start internally in node (A): one for the long timeout and one for the short timeout. When the timer for short timeout reaches zero, all memories from node (B) with short timeout are internally set to zero at the receiver node (A). The same happens when the long timeout reaches zero for the memories with long timeout. Every time a packet is received from node (B), both timers are restarted at their initial values.

Repeated information does not change this behavior, as the timing information about all data is repeated as well. If a third node (C) sends data to node (B), and node (B) repeats it to node (A), node (A) sets its countdown timers for node (C) according to when the data was sent, and not when it was received.

The Long and Short times are defined in the Project Settings window. The Timeout values are used for both the radio and CAN communication. These values determine the maximum reaction time over the radio and CAN link (via radio, however, the average reaction time could be much lower, depending on the radio quality and installation).

When calculating response times from an input to an output on another node, the Timeout value specified for the memory must be added to the total reaction time.

It can be tempting to set the Timeout values to very short times, but while a lower Timeout will lower the maximum reaction times on paper, the average reaction time will still be the same. Shorter timeouts will also result in less reliable communication. To achieve the shortest possible reaction times, use fewer nodes in the system, and use CAN instead of radio. For CAN communication the timeout can be set to lower values, since CAN communication is often much more reliable than radio communication. Generally, for systems using only CAN, the short timeout can be set to 2 × NodeCount + 5 and be used on all memories without any issues.

StartUp Test

When a node loses and regains communication to a node with a memory with StartUp test enabled, it must receive an active 0 from the sender before it can set the memory to 1 again. This can be used, for example, for using Two-Hand devices via two Safety Simplifiers. If radio contact is lost and regained while the Two-Hand device is actuated, the receiver will not start the machine again before the Two-Hand device is released and actuated again.

Generally, this setting is used for active signals that require an operator to keep high (for example actuating a button or Two-Hand device). StartUp test should also be enabled when a memory is directly controlling an output on another unit. Losing and regaining radio connection stops the machine, and it will not turn on again until an active 0 has been received from the sending node.

Do Not Repeat

The Do not repeat setting disables repeating of a global memory and makes the function instead work "point-to-point" between the transmitter and receiver. The main purpose of the "Do not repeat" setting is to optimize PFH-d value calculation for a specific safety function. For networks with many nodes, the PFH-d value for the logic is multiplied by the number of nodes. By enabling "Do not repeat" on a global memory, the PFH-d logic value is only counted 2 times (once for the transmitter and once for the receiver) for that safety function. This is useful when the PFH-d value is too high for the SIL/PL required by the application, and the transmitter and receiver are within range of each other, so the repeating function is not necessary.

This setting can also be useful for some specific safety requirements specified by the user.

Notice

The "receiver" in this context is the node/nodes where a reference to the global memory is used. The "transmitter" is the node in which the global memory is defined.

Notice

The "Do not repeat" setting disables the repeating function of that global memory. Make sure that the transmitter and receiver are within range of each other for a reliable radio connection.

Technical implications of Do Not Repeat — there are two functional differences that occur when enabling "Do not repeat" on a global memory:

1. The receiver must be within range of the transmitter to establish a direct connection (since the signal can no longer be repeated), and
2. the positive signal edge on the receiver will always occur before the negative signal edge of the transmitter — i.e. the output on the receiver will never turn on after the input signal on the transmitter has gone low.

Notice

The "Do not repeat" setting does not affect the reaction time.

During normal operation with repeating enabled, there are certain scenarios where the positive flank of a memory is delayed after the negative flank from the input. This can occur when a disturbance on the radio link delays the information that a global memory is high/ON. When "Do not repeat" is enabled, the receiver must hear the transmitter directly, and thus cannot have the positive edge delayed after the input to the transmitter goes low.

Notice

The radio timeout specifies the maximum time between the input negative flank (to the memory source in the transmitter) and the output negative flank (from the memory reference in the receiver). The "Do not repeat" function only affects when the output positive flank can occur.

1.14.5.3 Best Practices

For the best safety communication response times, it is crucial that safety signals only go over radio once. Using a global memory from another node in logic and sending the result on a new memory effectively doubles the reaction time added from radio, as the memory must go via the radio twice.

1.14.5.4 Controlling outputs directly via radio or CAN

When using any type of communication, the idea that loss and return of communication must not result in dangerous function must be applied to all Simplifier safety systems. When a hold-to-run device is controlling a safety output directly using a Global or a CAN memory, it is crucial to enable the start-up function for the memory. This way, one must release and activate the hold-to-run device in case of communication or power failure in the Safety Simplifier which uses the memory.

For other safety devices it is not recommended to use the start-up memory for the same action. In case a stop is initiated from communication or power failure in the Safety Simplifier unit controlling a machine function, a new start is normally required. This can easily be done by using a reset function in that unit and having start (reset) buttons in any of, or in all of, the Safety Simplifier units. To require a new start is a common requirement after communication or power failure.

Figure 1.66: Driving a relay output directly using a global memory from node 1. This logic violates the de-energization principle, as loss and return of power to node 1 would turn on the output.

Figure 1.67: Driving a relay output in node 2 via a reset block using a global. A timeout requires a new reset before the relay can close again.

Communication between separate systems

To send safety data between different Simplifier projects, or to a Simplifier Gateway (for example ProfiNET), use 3 SimpleCAN.