JP2014098985A - Safety slave unit, control method thereof, control program thereof, and safety control system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a safety slave unit capable of reducing processing load of a safety controller.SOLUTION: A safety slave includes a communication unit for communicating with a safety controller. The safety controller is configured to determine whether to execute a user program on the basis of a signal which is input. A control unit in the safety slave includes: a communication determination unit for determining whether communication with the safety controller is established; an abnormality determination unit for determining whether an abnormality exists on the basis of an input signal from an apparatus connected to the safety slave unit; and a communication control unit for transmitting execution control information for controlling execution of calculation of a function block in the safety controller and operation information on the apparatus, to the safety controller. The communication control unit transmits the execution control information and the operation information to the safety controller as an input signal to the safety controller.

Description

  The present invention relates to a safety slave unit, a control method thereof, a control program thereof, and a safety control system.

  In recent years, various safety units have been developed along with an increase in occupational safety awareness. The safety unit corresponds to a safety controller (safety controller), a safety I / O (input / output) terminal, or the like. For example, a safety controller ensures a high degree of safety and reliability in its control by incorporating a safety self-diagnosis function in addition to a logic operation function and input / output control function similar to a general programmable controller. It is a thing. The safety controller has a function (fail-safe function) for forcibly performing the control on the safe side so that the self-control does not lead to danger when an abnormality is detected from the self-diagnosis result.

  The safety I / O terminal also has a self-diagnosis function, and has a fail-safe function in which, when an abnormality is detected based on the self-diagnosis result, the self-control does not lead to danger. With this function, operations of a cutting machine, a cutting machine, an armed manufacturing machine robot, and the like connected via the safety unit are controlled so as not to pose a danger to an operator, for example.

  More specifically, the term “safety” here means to include standardized safety standards. Examples of standards include IEC61508 and EN standards. IEC61508 (International Electrotechnical Commission on Functional Safety of Programmable Electronic Systems) defines the probability of failure per hour (Probability of Failure per Hour), and the SIL level (Safety Integrity Level) is determined by this probability. There are four levels. Further, EN standards require that the risk level of a machine be evaluated and risk reduction measures be taken, and EN 954-1 specifies the safety categories. A safety controller or the like corresponds to one of these safety standards.

  Conventionally, a safety control system in which a safety controller and a safety I / O terminal are connected via a network is also known. In a safety control system, a safety controller has a communication master function for performing network communication with a safety I / O terminal, and is sometimes referred to as a safety master. The safety I / O terminal has a network communication function with the communication master function of the safety controller, that is, a communication slave function controlled according to the master, and is sometimes referred to as a safety slave.

  Also, at least one of a safety input device such as a switch that outputs an on / off signal and a safety output device that is driven by receiving a control signal output is connected to the connection terminal of each safety unit. Examples of the safety input device include an emergency stop switch, a light curtain, a door switch, and a two-hand switch. Examples of safety output devices are safety relays and contactors, and these safety input devices or safety output devices also comply with safety standards.

  The safety I / O terminal generates control data (input data) based on a signal input from the connected safety input device, and performs network communication of the generated control data to the safety controller. The safety I / O terminal receives control data from the safety controller through network communication with the safety controller. Then, the safety controller inputs the input signal of the safety input device received from the safety I / O terminal through network communication, and performs a logical operation on / off of the input signal by a pre-stored logic program. The safety controller outputs an output signal based on the calculation result to the safety I / O terminal through network communication. The safety I / O terminal outputs the output signal to the output device. By repeating this series of operations, the entire system is controlled by the safety controller. Note that the communication cycle between the safety controller and the safety I / O terminal may be synchronized with the cycle of repeated execution of the safety controller or may be asynchronous.

  A logic program to be subjected to logic operation processing in a safety controller or CPU (Central Processing Unit) unit is created in advance by a programmer. Examples of logic programs include ladders, function block diagrams, sequential function charts, structured text, and instruction lists. In terms of programming language, it may be an interpreted language, a script language, an assembly language, a high-level language, or a Java (registered trademark) language. Source code written in such a programming language is subjected to processing such as assembling and compiling to be executed by the CPU.

  Safety relays and contactors as safety output devices connected to the safety I / O terminal are connected to operating robots, processing machines, cutting machines, etc. The operation robots are in contact with the output device relays and contactors. Etc. operate and the operation robot etc. stops while the contacts are off. That is, the safety controller controls an operation robot or the like to be controlled by performing on / off control of the safety output device.

  Specifically, for example, when the safety controller inputs that the emergency stop switch SW has been normally operated by communication from the safety I / O terminal, the safety controller turns off the safety output device so that the control target does not perform a dangerous operation. Or, forcibly control to the safe state and immediately search for necessary safety measures. In addition, when the safety controller inputs a diagnosis result indicating that the emergency stop switch SW or other safety input device is abnormal, the safety controller operates in a dangerous manner regardless of whether the emergency stop switch SW is operated or the safety input device is on / off. The safety output device is turned off so as to stop the operation so that it does not occur, or the safety output device is forcibly controlled to find a necessary safety measure immediately.

  Here, in the master-slave type safety control system in which the above-mentioned safety controller is the communication master station and the safety I / O terminal is the communication slave station, the safety corresponding to the safety standard is achieved by the action of the self-diagnosis function of the safety slave. When an abnormality diagnosis result is obtained for the input terminal to which the application switch (SW) is connected, a countermeasure for ensuring operational safety on the safety master side is adopted for the safety slave.

  For example, in Japanese Patent Laid-Open No. 2006-323831 (Patent Document 1), an abnormality diagnosis result referred to in the course of input processing for generating control data from a raw input signal can also be referred to on the side using the control data. Thus, a safety slave unit that enables various safety controls based on control data is disclosed.

JP 2006-323831 A

  By the way, in the safety controller that supports the communication function, there may be a time lag between the execution of the program and the start of communication. In order to start communication, it is necessary to establish a connection with a communication partner (safety I / O terminal) prior to communicating actual data such as I / O data. This is to prevent a logic error from occurring in the function block when the safety controller executes the program without waiting for establishment of communication. And when communicating with many other parties, since connections are established in an appropriate order with respect to individual communication partners, it takes time to establish connections with all communication partners. On the other hand, when the initial setting of the safety controller is completed with the power on, and the user program is started to be executed cyclically, the connection with all communication partners is not necessarily established when the user program is executed. Not limited to this, the execution of user programs may proceed in a state where I / O data cannot be communicated with some communication partners.

  In order to solve such a problem, a safety controller having a function of executing a program after waiting for communication start (communication establishment) is known. However, even if a function for executing a program after waiting for the start of communication is used, if there is a partner whose connection cannot be established due to a failure or the like, the entire user program cannot be executed. In order to avoid this problem, the program is executed without waiting for the start of communication when a preset time has elapsed. However, in that case, the I / O data expected from the safety I / O terminal cannot be received, so the safety controller must blindly enter a safe state and detect unnecessary abnormalities. Become.

  Here, for example, in a safety controller programmed with a function block diagram, I / O data transmitted from a safety I / O terminal is taken in and a function block operation is performed. When there is an abnormality (short circuit, disconnection, etc.) related to the input terminal of the safety slave as described above and / or when communication between the safety controller and the safety slave is not established or there is a communication abnormality, the safety controller There is a possibility that I / O data that should not be used in the calculation (invalid) may be taken in. Therefore, in order to prevent this, on the safety controller side, by considering the solution to the abnormality related to the input terminal and the solution to the communication abnormality, the function block calculation is performed only when the I / O data is valid. A function to execute is needed.

  The present invention has been made to solve the above-described problems, and an object of one aspect thereof is a safety slave unit capable of reducing the processing load of the safety controller, a control method thereof, and a control program thereof. And providing a safety control system.

  A safety slave unit according to an embodiment includes a communication unit for communicating with a safety controller that outputs an output signal based on an input signal. The safety controller is configured to determine whether to execute the user program based on the input signal. The safety slave unit further includes a control unit that controls execution of the user program in the safety controller. The control unit is a communication determination unit that determines whether communication with the safety controller has been established, an abnormality determination unit that determines whether there is an abnormality based on an input signal from a device connected to the safety slave unit, Execution control information based on the determination result of the communication determination unit and the determination result of the abnormality determination unit, execution control information for controlling the execution of the user program in the safety controller, and operation information on the presence or absence of operation in the device And a communication control unit that transmits to the safety controller. The communication control unit transmits execution control information and operation information to the safety controller as input signals to the safety controller.

  Preferably, the control unit further includes an execution determination unit that determines whether to cause the safety controller to execute the user program based on the determination result of the communication determination unit and the determination result of the abnormality determination unit. The execution control information includes the determination result of the execution determination unit.

  Preferably, the execution determination unit loads the user program to the safety controller based on the determination result that the communication determination unit establishes communication with the safety controller and the abnormality determination unit determines that there is no abnormality in the device. It is determined to be executed.

  Preferably, the execution determination unit is based on at least one of a determination result that the communication determination unit has not established communication with the safety controller and a determination result that the abnormality determination unit has an abnormality in the device. It is determined that the user program is not executed.

  Preferably, when the execution determining unit determines that the user program is to be executed, the execution control information is set to a logical value on the high energy side, and when it is determined not to execute the user program, the execution is performed Set the logical value of the control information to the logical value on the non-high energy side.

  According to another embodiment, a method for controlling a safety slave unit is provided. The safety slave unit includes a communication interface for communicating with a safety controller that outputs an output signal based on an input signal according to a function block diagram. The safety controller is configured to determine whether to execute the user program based on the input signal. The safety slave unit further includes a processor that controls execution of the user program in the safety controller. A processor determining whether communication with the safety controller has been established; a processor determining whether there is an abnormality based on an input signal from a device connected to the safety slave unit; , Execution control information based on the determination result of whether or not communication has been established and the determination result of whether there is an abnormality, execution control information for controlling the execution of the user program in the safety controller, and the presence or absence of operation in the device And transmitting operational information on to the safety controller. The step of transmitting includes transmitting execution control information and operation information to the safety controller as input signals to the safety controller.

  According to yet another embodiment, a control program for the safety slave unit is provided. The safety slave unit includes a communication interface for communicating with a safety controller that outputs an output signal based on an input signal according to a function block diagram. The safety controller is configured to determine whether to execute the user program based on the input signal. The safety slave unit further includes a processor that controls execution of the user program in the safety controller. The control program includes a step of determining whether or not communication with the safety controller is established in the processor, a step of determining whether there is an abnormality related to an input terminal to which an input signal from a device connected to the safety slave unit is provided, , Execution control information based on the determination result of whether or not communication has been established and the determination result of whether there is an abnormality, execution control information for controlling the execution of the user program in the safety controller, and the presence or absence of operation in the device And transmitting the operation information on the safety controller to the safety controller. The step of transmitting includes transmitting execution control information and operation information to the safety controller as input signals to the safety controller.

  A safety control system according to yet another embodiment includes a safety controller that outputs an output signal based on an input signal according to a function block diagram, and a safety slave unit. The safety slave unit includes a communication unit for communicating with the safety controller and a control unit for controlling execution of the function block in the safety controller. The control unit includes a communication determination unit that determines whether communication with the safety controller is established, and an abnormality determination unit that determines whether there is an abnormality related to an input terminal to which an input signal from a device connected to the safety slave unit is given. Execution control information based on the determination result of the communication determination unit and the determination result of the abnormality determination unit, the execution control information for controlling the execution of the user program in the safety controller, and the operation information on the presence or absence of the operation in the device And a communication control unit that transmits to the safety controller. The communication control unit transmits execution control information and operation information to the safety controller as input signals to the safety controller. The safety controller includes a receiving unit that receives execution control information and operation information, and a calculation unit that executes a user program based on the received execution control information and operation information. The computing unit determines whether or not to execute the user program based on the execution control information, and executes the function block based on the operation information when determining to execute the user program.

  According to a certain situation, it becomes possible to reduce the processing load of the safety controller.

It is the schematic which shows the whole structure of the safety control system according to this Embodiment. It is a schematic block diagram which shows the internal hardware constitutions of the safety slave according to this Embodiment. It is a general flowchart which shows the whole process of the central processing part of the safety slave according to this Embodiment. It is a block diagram showing the structure of the function implement | achieved by the safety control system according to this Embodiment. It is a figure for demonstrating the function of the function block according to this Embodiment. It is a flowchart which shows the control processing procedure performed in the safety control system according to this Embodiment.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. In the following description, the same parts are denoted by the same reference numerals. Their names and functions are also the same. Therefore, detailed description thereof will not be repeated.

<A. System configuration>
FIG. 1 is a schematic diagram showing an overall configuration of safety control system 100 according to the present embodiment.

  Referring to FIG. 1, here, there is shown a safety control system 100 comprising a bus network in which a safety controller 1 and a safety I / O terminal (hereinafter also referred to as “safety slave”) 3 are connected by a bus 6. It is shown.

  In this example, a plurality of safety input devices 4 and safety output devices 5 are wired to the safety controller 1 and the safety slave 3.

  The safety controller 1 is a building block type configured by connecting a plurality of units such as a CPU unit, a power supply unit, an I / O unit, and a communication master unit. Each unit is connected to a common internal bus, and can perform data communication by performing bus communication between the CPU unit that controls the entire safety controller and other units.

  The safety controller 1 inputs the input signal of the safety input device 4 input from the safety slave 3 through network communication via the communication master unit, and performs a logical operation on / off of the input signal by a previously stored logic program. An output signal based on the calculation result is output to the safety slave 3 by network communication via the communication master unit. The safety slave 3 outputs the output signal to the safety output device 5. By repeating this series of operations, the entire system is controlled by the safety controller 1. The communication cycle between the safety controller 1 and the safety slave 3 may be synchronized with the repeated execution cycle of the safety controller 1 or may be asynchronous.

  The safety input device 4 includes an emergency stop switch, a light curtain, a door switch, a limit switch, and the like, and the safety output device 5 includes a safety relay, a contactor, and the like.

  In this example, the configuration in which the safety slave 3, the safety input device 4, and the safety output device 5 are connected will be mainly described. However, the safety input device 4 is connected to the safety controller 1 via the I / O unit. And the safety output device 5 may be connected. The safety input device 4 and the safety output device 5 are also collectively referred to as a safety input / output device.

  The safety slave 3 performs the communication operation for the communication master function in the same manner as the slave unit of a normal PLC (note that a normal PLC is a controller used in a normal application other than a safety application and does not include a safety controller). In addition to a function to perform, an input operation to a connected safety input device, a function to perform an output operation to a connected safety output device, a function to perform self-diagnosis for each of the input / output terminals is provided.

  The self-diagnosis function that each safety slave 3 has is self-diagnosis related to various functions such as diagnostic functions for its own input terminal part and other communication functions, and wiring between input / output terminals and safety input / output devices. Self-diagnosis can also be performed due to a short circuit or disconnection. As another example, the self-diagnosis function sends a signal from the test output terminal to the corresponding safety input / output device to each safety slave 3 through a test output terminal different from the input / output terminal. It may be a function of monitoring whether the state of the corresponding safety input device 4 is normal or abnormal by reading whether the signal is correctly returned via the corresponding safety input device 4.

  In the system configuration shown in FIG. 1, the case where the safety controller 1 and the safety slave 2 communicate with each other via a bus network has been described, but the present invention is not limited to this, and the safety controller 1 and the safety slave 2 may communicate with each other via a backplane bus. More specifically, a backplane bus (BUS) is laid on a rigid plate called a backplane, and unit mounting connectors are arranged on the backplane bus at appropriate intervals. You may comprise so that it can mutually communicate by mounting | wearing a controller and several safety slaves. Moreover, the structure which provides a wireless communication function in the safety controller 1 and the safety slave 2, and communicates mutually wirelessly may be used.

  The bus 6 may be connected to a PLC (programmable logic controller) program design support device for constructing a system. The program design support apparatus is provided so that, for example, an interactive support program using an I / O wizard can be executed. The program design support apparatus is not limited to the general-purpose notebook personal computer shown in the figure, and is a PDA (Personal Digital) that can be connected to a network. It may be a portable terminal device such as Assistant) or a desktop personal computer.

  In this case, the program design support apparatus corresponds to at least a CPU that controls and controls the entire program design support apparatus, an input operation unit including a mouse operation and a keyboard operation, and a display screen of an image display included in the program design support apparatus. A display unit that performs display processing, a work RAM that is used for operation input processing, predetermined arithmetic processing, image processing on a display screen, and the like, a communication unit that functions as an external communication interface, and a storage device are included. These are configured in a form connected to the internal bus of the program design support apparatus. For example, an I / O wizard program is stored in a predetermined storage area of the storage device.

<B. Hardware configuration>
Next, the internal hardware configuration of the safety slave 3 will be described.

  FIG. 2 is a schematic block diagram showing an internal hardware configuration of safety slave 3 according to the present embodiment.

  Referring to FIG. 2, safety slave 3 includes a communication interface (I / F) unit 21 that transmits and receives data to and from safety master (safety controller) 2 connected to bus 6 or a program design support device, and various arithmetic functions. A central processing unit 20 that executes a fault diagnosis function and the like and controls and controls the entire safety slave 3, a terminal abnormality diagnosis unit 22a, 22b, an input terminal unit 23a, an output terminal unit 23b, and a setting unit 25 The display unit 26 is included.

  The central processing unit 20 includes a microprocessor (MPU) 20a, a RAM (Random Access Memory) 20b, and a ROM (Read Only Memory) 20c. These microprocessor (MPU) 20a, RAM 20b, and ROM 20c are duplicated in order to guarantee operational reliability.

  FIG. 3 is a general flowchart showing the entire processing of central processing unit 20 of safety slave 3 according to the present embodiment.

  Referring to FIG. 3, the entire central processing unit 20 is composed of two CPUs (CPUA and CPUB). These CPUs operate in parallel with each other in synchronization with each other immediately after the power is turned on. (Steps S10a and S10b), initial processing and self-diagnosis processing (Steps S12a and S12b) are executed. These CPUs perform synchronous processing (steps S14a and S14b), self-diagnosis processing (steps S16a and S16b), peripheral processing (steps S18a and S18b), and I / O refresh processing (steps S20a and S20b) in parallel. Is configured to run on.

  Here, “initial processing” is processing for initializing devices and data, reading stored data, and the like, and “self-diagnosis processing” is processing for performing hardware diagnosis (steps S12a and 12b). The “synchronization process” (steps S14a and S14b) is a process for performing a temporal synchronization process between two CPUs (including a wait process for making the cycle time constant), a data matching confirmation process, and the like. The self-diagnosis process (steps S16a and S16b) is a process for performing hardware diagnosis and the like. The peripheral processing (steps S18a and S18b) is processing for performing access processing for external media (memory card, RTC, etc.), communication processing with external devices, tools, and the like. The I / O refresh process (steps S20a and S20b) is a process for updating local input / output (including input / output units), updating remote I / O input / output data, and the like.

  Referring to FIG. 2 again, the input terminal portion 23a is provided with one or more input terminals (terminal 1, terminal 2,... Terminal) to which an input signal from the safety input device 4 designed for safety specifications is given. n). Here, each terminal is composed of one or more terminals. The safety input device 4 has safety specifications, and specifically refers to a so-called safety application switch. The emergency stop switch for safety use is pressed when a dangerous state is reached, the contact is opened and turned OFF, and a LOW signal is output. Conversely, the switch is not pressed in a safe state, and the contact is closed and an ON signal (HIGH signal) is output. Thus, the safety application switch is designed to output a LOW signal when it is dangerous.

  The terminal abnormality diagnosis unit 22a is used for diagnosing the presence / absence of an abnormality related to each input terminal (terminal 1, terminal 2,..., Terminal n) of the input terminal unit 23a. Various self-diagnostic circuits are included as shown in Japanese Patent No. 299797. Here, the “abnormality relating to each input terminal” includes not only an abnormality of the safety input device 4 connected to the input terminal but also an abnormality of the terminal itself and various other abnormalities. If the safety input device 4 side has a self-diagnosis function, the terminal abnormality diagnosis unit 22a takes in the self-diagnosis result of the safety input device 4 corresponding to each terminal and determines whether each input device has an abnormality individually. Diagnose. Moreover, the terminal abnormality diagnosis part 22a diagnoses each terminal separately whether there is abnormality (disconnection, a short circuit, etc.) in the wiring between an input terminal and the safety input device 4. FIG. In other words, the terminal abnormality diagnosis unit 22a diagnoses the state (status) of the presence / absence of abnormality separately for each input terminal of one system.

  The output terminal portion 23b has one or more output terminals (terminal 1, terminal 2,..., Terminal m) to which an output signal to the safety output device 5 designed to safety specifications is given.

  The terminal abnormality diagnosis unit 22b is used for diagnosing the presence / absence of abnormality related to each output terminal (terminal 1, terminal 2,..., Terminal m) of the output terminal unit 23b. If the safety output device 5 for each terminal has a self-diagnosis function, the terminal abnormality diagnosis unit 22b also takes in the self-diagnosis result from each device and determines whether each output device has an abnormality individually. Diagnose. Moreover, the terminal abnormality diagnosis part 22b diagnoses each terminal separately whether there is any abnormality in the wiring between the output terminal and the safety output device 5. That is, simultaneously with the input system, the presence / absence of abnormality (status) is separately diagnosed for each terminal of one system.

  The setting unit 25 is for performing various settings related to the operation of the safety controller, and is configured by a numeric keypad, function keys, key switches, and the like.

  The display unit 26 is for performing various displays related to the operation of the safety controller, and includes a liquid crystal display of an appropriate size, a lamp for operation display, and the like.

  Note that the internal hardware configuration of the safety controller 1 can be the same as the internal hardware configuration of the safety slave 3. However, the general flowchart showing the entire processing of the central processing unit of the safety slave 3 described in FIG. 3 is slightly different. Specifically, the two CPUs included in the central processing unit of the safety controller 1 further execute the arithmetic processing in parallel after the I / O refresh processing (steps S20a and S20b) in FIG. It is different in the configuration. The “arithmetic processing” is processing for executing a user program arbitrarily created by the user.

<C. Functional configuration>
FIG. 4 is a block diagram showing a configuration of functions realized by safety control system 100 according to the present embodiment. In this example, a case will be described in which a logic program (a user program created by a user) that is a target of logic operation processing in the safety controller 1 is a function block diagram (hereinafter also referred to as “FBD”). Each of the at least one function block for configuring the FBD has at least one signal obtained by performing a predetermined process corresponding to a function predetermined for the function lock on the input at least one signal. Output. The user program is not limited to the FBD, and may be programmed with a ladder, a sequential function chart, a structured text, an instruction list, C language, or the like.

  First, the functional configuration of the safety slave 2 will be described with reference to FIG. The safety slave 2 includes a communication determination unit 202, an abnormality determination unit 204, an acquisition unit 206, a communication control unit 208, an execution determination unit 210, and a data storage unit 212 as main functional configurations. These functions are basically realized by the central processing unit 20 of the safety slave 2 executing a program and giving a command to the constituent elements of the safety slave 2. That is, the central processing unit 20 has a function as a control unit that controls the entire operation of the safety slave 2. Note that some or all of these functional configurations may be realized by hardware.

  The communication determination unit 202 determines whether communication with the safety controller 1 has been established. More specifically, when the communication determination unit 202 receives communication setting information (for example, identification information for identifying the safety controller 1) transmitted from the safety controller 1 via the communication interface 21, If it is determined that communication has been established and the communication setting information has not been received, it is determined that communication has not been established.

  The abnormality determination unit 204 determines whether there is an abnormality based on an input signal from a device connected to the safety slave 2. In one aspect, the abnormality determination unit 204 determines whether there is an abnormality related to the input terminal to which the input signal from the safety input device 4 is given. More specifically, the abnormality determination unit 204 performs the abnormality determination by causing the terminal abnormality diagnosis unit 22a to perform the abnormality diagnosis as described above.

  The acquisition unit 206 acquires operation information regarding the presence / absence of an operation in the safety input device 4 from the safety input device 4. More specifically, the acquisition unit 206 acquires operation information (operation presence / absence signal) regarding each on / off operation of each safety input device 4 via the input terminal unit 23a.

  The communication control unit 208 is execution control information based on the determination result of the communication determination unit 202 and the determination result of the abnormality determination unit 204, and includes execution control information for controlling the execution of the user program in the safety controller 1, The operation information of the input device 4 is transmitted to the safety controller 1. The execution control information includes a determination result of an execution determination unit 210 described later. Note that the communication control unit 208 may store execution control information and operation information in the data storage unit 212.

  The execution determination unit 210 determines whether to cause the safety controller 1 to execute the user program based on the determination result of the communication determination unit 202 and the determination result of the abnormality determination unit 204. More specifically, the execution determination unit 210 determines that the communication determination unit 202 has established communication with the safety controller 1 and the abnormality determination unit 204 determines that there is no abnormality in the safety input device 4. Based on the above, it is determined that the safety controller 1 is to execute the user program. The execution determination unit 210 is at least one of a determination result that the communication determination unit 202 has not established communication with the safety controller 1 and a determination result that the safety input device 4 has an abnormality in the abnormality determination unit 204. Based on the above, it is determined that the safety controller 1 does not execute the user program.

  In another aspect, when the execution determination unit 210 determines that the safety controller 1 executes the user program, the execution determination unit 210 sets the logical value of the execution control information to “1” (“HIGH”) on the high energy side, If it is determined not to execute the user program, the logical value of the execution control information is set to “0” (“LOW”) on the side that is not on the high energy side.

  Next, the functional configuration of the safety controller 1 will be described. The safety controller 1 includes a communication control unit 102, a calculation unit 104, and a data storage unit 106 as main functional configurations. The safety controller 1 also includes a communication interface 11 for communicating with the safety slave 2 as a hardware configuration. These functions are basically realized by the central processing unit 10 of the safety controller 1 executing a program and giving commands to the components of the safety controller 1. That is, the central processing unit 10 has a function as a control unit that controls the entire operation of the safety controller 1. Note that some or all of these functional configurations may be realized by hardware.

  The communication control unit 102 receives execution control information and operation information via the communication interface 11 when communication between the safety controller 1 and the safety slave 2 is established. The communication control unit 102 stores the received execution control information and operation information in the data storage unit 106.

  The computing unit 104 executes the user program based on the received execution control information and operation information. More specifically, the calculation unit 104 determines whether to execute the user program based on the received execution control information. If the arithmetic unit 104 determines to execute the user program, the arithmetic unit 104 executes the user program based on the received operation information. More specifically, the calculation unit 104 executes a calculation of a function block having a function as shown in FIG.

  FIG. 5 is a diagram for describing the function of the function block according to the present embodiment.

  Referring to FIG. 5, when the logic value of the “Activate” input is “1” (“HIGH”), the calculation unit 104 performs the calculation of the function block, and calculates the logic of the “Activate” input. When the value is “0” (“LOW”), the calculation of the function block is not executed. The calculation unit 104 uses the execution control information as an input signal to “Activate” and uses the operation information as an input signal to “Input0”. Therefore, when the logical value of the execution control information is “1”, the arithmetic unit 104 executes the function block based on the operation information input to “Input 0”, and the logical value of the execution control information is “ When it is 0 ″, the function block is not executed.

  More specifically, the arithmetic unit 104 is input to “Input 0” when there is no abnormality with respect to the input terminal of the safety input device 4 and communication between the safety controller 1 and the safety slave 2 is established. Since the signal (operation information) is valid, the operation of the function block is executed. On the other hand, when there is an abnormality with respect to the input terminal of the safety input device 4 and / or communication between the safety controller 1 and the safety slave 2 has not been established, the arithmetic unit 104 is a signal input to “Input 0”. Since (operation information) is invalid (not to be used), the operation of the function block is not executed.

  Referring to FIG. 4 again, in another aspect, when communication control unit 102 determines that communication has not been established or communication abnormality has occurred, the communication control unit 102 sets the logical value of the received operation information. “0” may be set (operation information may be cleared). Thereby, the safety control system 100 can be held in a safe state.

<D. Processing procedure>
The flow of processing until safety controller 1 executes the function block calculation in safety control system 100 according to the present embodiment will be described.

  FIG. 6 is a flowchart showing a control processing procedure executed in safety control system 100 according to the present embodiment. In the following steps, the central processing unit 20 of the safety slave 2 executes a program stored in a memory (ROM, RAM, etc.), and the central processing unit 10 of the safety controller 1 executes a memory (ROM, RAM, etc.). This is realized by executing the program stored in the.

  Referring to FIG. 6, central processing unit 20 of safety slave 2 determines whether or not communication with safety controller 1 has been established (step S102). More specifically, the central processing unit 20 performs the determination by determining whether or not the communication setting information transmitted from the safety controller 1 is received via the communication interface 21.

  If the central processing unit 20 determines that communication has not been established (NO in step S102), the central processing unit 20 executes processing in step S110 described later. On the other hand, if the central processing unit 20 determines that communication has been established (YES in step S102), the input data indicating the actual operating state of the safety input device 4 connected to the safety slave 2 ( (Operation information) is acquired (step S104).

  Next, the central processing unit 20 determines the presence / absence of an abnormality related to the input terminal via the terminal abnormality diagnosis unit 22a (step S106). More specifically, the central processing unit 20 obtains a self-diagnosis result signal on the safety input device 4 side individually for each input terminal and determines whether there is an abnormality, or determines whether there is an abnormality on the wiring, etc. To do. In the abnormality determination process, not only the abnormality of the safety input device 4 but also the abnormality of each input terminal of the terminal unit and various necessary abnormalities are determined.

  If there is an abnormality in the input terminal (YES in step S106), the central processing unit 20 sets the logical value of the execution control information for controlling the execution of the function block calculation in the safety controller 1 to "0" (" LOW ") (step S110). That is, the central processing unit 20 receives the determination result that the communication with the safety controller 1 is not established or the determination result that there is an abnormality in the input terminal, and executes the function block calculation on the safety controller 1. The logical value of the execution control information is set so as not to cause it.

  On the other hand, when there is no abnormality in the input terminal (NO in step S106), the central processing unit 20 sets the logical value of the execution control information to “1” (“HIGH”) (step S108). . That is, the central processing unit 20 performs the function block calculation on the safety controller 1 based on the determination result that the communication with the safety controller 1 is established and the determination result that the input terminal is normal. To set the logical value of the execution control information.

  Next, the central processing unit 20 transmits the execution control information and the operation information acquired from the safety input device 4 to the safety controller 1 through the communication interface 21 as input signals input to the function block in the safety controller 1. (Step S112).

  Next, the central processing unit 10 of the safety controller 1 receives execution control information and operation information via the communication interface 11 (step S114). Next, the central processing unit 10 determines whether or not the logical value of the execution control information is set to “1” (step S116). That is, the central processing unit 10 determines whether or not the execution control information is set to execute the function block calculation.

  If the logical value of the execution control information is set to “1” (YES in step S116), central processing unit 20 executes the function block calculation (step S118). On the other hand, when the logical value of the execution control information is not set to “1” (that is, the logical value is set to “0”) (NO in step S116), the central processing unit 20 Does not execute the operation of the function block (step S120). Then, the central processing unit 20 ends the processing up to the execution of the function block calculation.

  When the central processing unit 20 executes the calculation of the function block, the central processing unit 20 thereafter transmits an output signal as the execution result of the function block to the safety slave 2, and the safety slave 2 outputs the received output signal to the safety output device 5. Output to.

  In the above description, “execute the function block calculation” is associated with “1” (“HIGH”) on the high energy side of the logical value of the execution control information. For this reason, the logical value of the execution control information is “high-energy-side” unless it is determined that the communication is actually established and the input terminal is confirmed to be normal and the function block operation is positively executed. Since it is not 1 ″, the execution control information has high reliability. For example, in a state where the above determination has not been made, such as immediately after the power is turned on, data indicating that the calculation of the function block is executed is not erroneously transmitted to the safety controller 1.

  In the above description, the case where the central processing unit 20 executes the operation establishment process and the input terminal abnormality diagnosis process in steps S104 and S106 after executing the communication establishment determination process in step S102 has been described. However, it is not limited to this. The central processing unit 20 may execute step S102 after executing the processes of steps S104 and S106. Alternatively, the central processing unit 20 may execute the communication determination process in step S102 and the abnormality determination process in step S106 simultaneously in parallel.

<E. Effects of the embodiment>
According to the present embodiment, since the function block is executed using only valid input data on the safety controller side, it is not necessary to generate an unnecessary execution error of the function block, so that the operation rate of the apparatus is maintained. be able to.

  In addition, since the safety slave sends the input data for which the validity has been determined after taking into consideration the communication establishment judgment result and the input terminal abnormality judgment result, the safety controller side newly increases the validity of the input data. A function block for determination is unnecessary. Therefore, the processing load on the safety controller side is reduced. In particular, even when a large number of safety slaves are connected to a single safety controller on the network, the processing load on the safety controller side does not increase excessively. In addition, it is possible to prevent user's programming error and incorrect programming. Furthermore, the memory consumption of the safety controller is not increased.

<F. Other Embodiments>
In the above-described embodiment, the case where the safety input device 4 is connected to the safety slave 2 has been described. However, the present invention is not limited to this. For example, as an input device connected to the safety slave 2, an encoder input device, a temperature sensor, or the like may be connected. In this case, the safety slave 2 determines whether there is an abnormality related to the input terminal to which the input signal from these input devices is given. The safety slave 2 may acquire operation information regarding the presence / absence of operation in the input device from the input device, and may transmit execution control information and operation information to the safety controller 1.

  Moreover, although embodiment mentioned above demonstrated the case where the safety input device 4 was connected to the terminal abnormality diagnostic part 22a via the input terminal part 23a, it is not restricted to this. For example, the safety input device 4 may be connected to the terminal abnormality diagnosis unit 22a and the input signal from the safety input device 4 may be directly acquired.

  The safety slave 2 may determine whether there is an abnormality based on an input signal from the safety output device 5 (or the output device). The safety slave 2 may acquire operation information regarding the presence / absence of an operation in the output device from the output device, and may transmit execution control information and operation information to the safety controller 1.

  It is also possible to provide a program that causes a computer to function and execute control as described in the above flowchart. Such a program can be recorded on a non-transitory computer-readable recording medium such as a flexible disk, a CD-ROM, a ROM, a RAM, and a memory card attached to the computer and provided as a program product. Alternatively, the program can be provided by being recorded on a recording medium such as a hard disk built in the computer. A program can also be provided by downloading via a network.

  The program may be a program module that is provided as a part of an operating system (OS) of a computer and that calls necessary modules in a predetermined arrangement at a predetermined timing to execute processing. In that case, the program itself does not include the module, and the process is executed in cooperation with the OS. A program that does not include such a module can also be included in the program according to the present embodiment.

  The program according to the present embodiment may be provided by being incorporated in a part of another program. Even in this case, the program itself does not include the module included in the other program, and the process is executed in cooperation with the other program. Such a program incorporated in another program can also be included in the program according to the present embodiment.

  The embodiment disclosed this time should be considered as illustrative in all points and not restrictive. The scope of the present invention is defined by the terms of the claims, rather than the description above, and is intended to include any modifications within the scope and meaning equivalent to the terms of the claims.

  1 safety controller, 2 safety slave, 4 safety input device, 5 safety output device, 6 buses, 10, 20 central processing unit, 11, 21 communication interface, 20a MPU, 20b RAM, 20c ROM, 21 communication interface unit, 22a 22a, 22b, 22b Terminal abnormality diagnosis unit, 23a input terminal unit, 23b output terminal unit, 25 setting unit, 26 display unit, 100 safety control system, 102, 208 communication control unit, 104 arithmetic unit, 106, 212 data storage Unit, 202 communication determination unit, 204 abnormality determination unit, 206 acquisition unit, 210 execution determination unit.

Claims (8)

A safety slave unit,
A communication unit for communicating with a safety controller that outputs an output signal based on an input signal,
The safety controller is configured to determine whether to execute a user program based on an input signal,
The safety slave unit is
A control unit for controlling execution of the user program in the safety controller;
The controller is
A communication determination unit for determining whether communication with the safety controller is established;
Based on an input signal from a device connected to the safety slave unit, an abnormality determination unit that determines whether there is an abnormality,
Execution control information based on the determination result of the communication determination unit and the determination result of the abnormality determination unit, the execution control information for controlling the execution of the user program in the safety controller, and the operation of the device A communication control unit that transmits operation information on presence / absence to the safety controller,
The communication control unit is a safety slave unit that transmits the execution control information and the operation information to the safety controller as the input signal to the safety controller. The control unit further includes an execution determination unit that determines whether to cause the safety controller to execute the user program based on a determination result of the communication determination unit and a determination result of the abnormality determination unit,
The safety slave unit according to claim 1, wherein the execution control information includes a determination result of the execution determination unit.   The execution determination unit determines whether the communication determination unit has established communication with the safety controller, and the abnormality determination unit determines whether the device has no abnormality based on the determination result. The safety slave unit according to claim 2, wherein the safety slave unit is determined to execute the user program.   The execution determination unit is based on at least one of a determination result that communication with the safety controller is not established in the communication determination unit, and a determination result that the device has an abnormality in the abnormality determination unit, The safety slave unit according to claim 2 or 3, wherein the safety controller is determined not to execute the user program.   When the execution determination unit determines that the user program is to be executed, the execution control information is set to a logical value on the high energy side, and when the user program is determined not to be executed, The safety slave unit according to any one of claims 2 to 4, wherein a logical value of the execution control information is set to a logical value on a non-high energy side. A method for controlling a safety slave unit,
The safety slave unit includes a communication interface for communicating with a safety controller that outputs an output signal based on an input signal,
The safety controller is configured to determine whether to execute a user program based on an input signal,
The safety slave unit is
A processor for controlling execution of the user program in the safety controller;
The processor determining whether communication with the safety controller has been established;
The processor determines whether there is an abnormality based on an input signal from a device connected to the safety slave unit; and
The execution control information for controlling execution of the user program in the safety controller, wherein the processor is execution control information based on a determination result of whether or not the communication is established and a determination result of the presence or absence of the abnormality Transmitting information and operation information regarding the presence or absence of operation in the device to the safety controller,
The step of transmitting includes transmitting the execution control information and the operation information to the safety controller as the input signal to the safety controller. A safety slave unit control program,
The safety slave unit includes a communication interface for communicating with a safety controller that outputs an output signal based on an input signal,
The safety controller is configured to determine whether to execute a user program based on an input signal,
The safety slave unit is
A processor for controlling execution of the user program in the safety controller;
The control program is stored in the processor.
Determining whether communication with the safety controller has been established;
Determining whether there is an abnormality based on an input signal from a device connected to the safety slave unit; and
Execution control information based on a determination result on whether or not the communication has been established and a determination result on whether or not there is an abnormality, the execution control information for controlling execution of the user program in the safety controller, and Transmitting the operation information regarding the presence or absence of operation in the device to the safety controller,
The transmitting step includes transmitting the execution control information and the operation information to the safety controller as the input signal to the safety controller. A safety control system,
A safety controller that outputs an output signal based on an input signal and a safety slave unit are provided.
The safety slave unit is
A communication unit for communicating with the safety controller;
A control unit that controls execution of a user program in the safety controller,
The controller is
A communication determination unit for determining whether communication with the safety controller is established;
Based on an input signal from a device connected to the safety slave unit, an abnormality determination unit that determines whether there is an abnormality,
Execution control information based on the determination result of the communication determination unit and the determination result of the abnormality determination unit, the execution control information for controlling the execution of the user program in the safety controller, and the operation of the device A communication control unit that transmits operation information on presence / absence to the safety controller,
The communication control unit transmits the execution control information and the operation information to the safety controller as the input signal to the safety controller,
The safety controller is
A receiving unit for receiving the execution control information and the operation information;
Based on the received execution control information and the operation information, a calculation unit that executes the user program,
The arithmetic unit determines whether to execute the user program based on the execution control information, and when determining to execute the user program, executes the user program based on the operation information; Safety control system.

Images