The IO-Link technology for connecting intelligent sensors and actuators to automation systems is now firmly established in mechanical and plant engineering: 5.3 million nodes had already been installed by the end of 2016 and over 8 million by the end of 2017. Originally developed for communication in non-safety-related applications, the community behind IO-Link has also been systematically addressing the topic of 'functional safety' for a few years now. Version 1.0 of the technical specification 'IO-Link Safety - System Extensions' was finally published in April 2017. Prior to this, the corresponding concept of safe communication had been confirmed by TÜV-SÜD.

Figure 1: Functionally safe modules on the remote I/O: IO-Link Safety will make it possible to reduce the large number of FS module types to one FS master in future. This is particularly advantageous for compact remote I/O with a higher degree of protection - for example IP67.

© Profibus user organization

For a better understanding, the technology of IO-Link Safety and some important advantages are briefly presented. The starting point is the classic connection of simple safety devices to remote I/O systems on the fieldbus with a functionally safe communication profile (FSCP), as shown in Figure 1, left: Depending on the type of sensor or actuator, an FS-AE (analog input), FS-AA (analog output), FS-DE (digital input) or FS-DA (digital output) is required in order to implement modern safety solutions. As with basic IO-Link, IO-Link Safety reduces the variety of I/O modules to one type - the FS-Master (see Figure 1, right).

Until now, functional safety in automation has been characterized by shutdown functions such as 'emergency stop' or 'emergency stop', and corresponding binary sensors such as pushbuttons, light grids or laser scanners are widely used. With IO-Link Safety, it is now possible to safely record more analog measurements and then let the safety controller decide whether to switch off or safely stop.

In principle, such applications can also be solved at fieldbus level with an FSCP using safe field devices. However, there are now already more than ten FSCPs worldwide with a regional focus. For device manufacturers aiming for global marketing, the development effort for the communication interfaces would therefore be greater than for the actual safety technology.

Why IO-Link Safety?

Figure 2: Universal FS-Device for all FSCPs: One FS-Device can handle both OSSDe operation on classic FS-DE modules and secure communication on FS masters.

© Profibus user organization

Figure 2 shows the solution with IO-Link Safety. One universal FS-Device with IO-Link Safety fits all FSCPs, provided there is at least one FS-Master for this FSCPx. As it is usually specialized manufacturers who deal with IO-Link masters on certain fieldbuses, it is also obvious for these specialists to dedicate themselves to the FS-Master variant. FS device manufacturers, on the other hand, can concentrate fully on the safety task of their devices. It will take a while for this market to establish itself. However, the general migration strategy of IO-Link will help here: There is the transition from so-called SIO mode (standard I/O switching signal) to IO-Link communication mode. This means that a device can be operated both in switching mode on a classic DE module and in communication mode on the new IO-Link master. The migration strategy for IO-Link Safety is very similar. However, the switching mode is not limited to a switching signal. Safe switch-off sensors are also called OSSD (Output Switching Sensing Device). These are redundant switching signals that were initially driven by relay outputs and switched antivalently to detect cable faults. In the course of the changeover to electronic solutions, the equivalent switching signals were introduced because an antivalent state is no longer possible in the event of a power failure. Short, offset test pulses, which are read back and evaluated by the device, are now used to detect faults.

IO-Link Safety has decided to limit the large number of existing test pulse solutions to a type 'C' and class '1' defined in the ZVEI position paper CB24I, which covers a very large number of product types on the market. Due to the maximum cable length of 20 m with IO-Link, the electrical properties are well-defined and allow this simplification. IO-Link Safety expects this to result in very stable operation and simplification for the user by eliminating filter and discrepancy time settings (offset of the two signals). The solution is referred to as OSSDe.

With IO-Link Safety, the second OSSDe signal is assigned to pin 2 of the M12 connector. This assignment conforms to the specifications of the automation initiative of the German automotive industry (AIDA).