JP4238687B2 - Safety controller and system using the same - Google Patents

Description

  The present invention relates to a safety controller and a system using the safety controller, and more particularly to a safety controller suitable for a safety circuit of machine equipment such as a machine tool and an industrial robot, and a system using the safety controller.

  Conventionally, for example, in order to ensure occupational safety at a production site, a safety circuit using a relay unit incorporating a plurality of electromagnetic relays, that is, a machine tool, an industrial robot, etc. only when safety is ensured A safety circuit that supplies power to the power of mechanical equipment has been constructed (see, for example, Patent Document 1).

Such a relay unit monitors the state of the safety circuit based on the input signals from safety switches such as emergency stop switches and safety area sensors such as safety door switches. As long as it is shut off and the cause of the failure is not removed, it has a function of not restarting the mechanical equipment.
Japanese Patent Laid-Open No. 2003-140702

  In a system using a relay unit incorporating such an electromagnetic relay, a safety circuit is constructed by a relay sequence. Therefore, logic is assembled by wiring, and as the number of machine tools to be controlled increases, the number of wiring increases. It becomes complicated and the design is not easy.

  Furthermore, when it is desired to change a part of the system in response to a user request, for example, in a production line configured by arranging a plurality of machine tools in each work area, a machine tool in a certain work area Even when it is desired to control start / stop in association with a machine tool in the adjacent work area, the logic must be changed by wiring, which requires a lot of time and labor.

  The present invention has been made paying attention to such points, and an object of the present invention is to provide a safety controller that reduces the number of wires and that can easily construct a system, and a system using the safety controller.

  In order to achieve the above object, the present invention is configured as follows.

That is, the safety controller of the present invention provides a safety output corresponding to the safety side or the danger side to the safety output control target based on the input corresponding to the safety side or the danger side from the input device, and operates the mechanical equipment. A safety controller for controlling a plurality of safety output units for providing a semiconductor output as the safety output, and a connection output unit for providing a semiconductor output as an output for connection corresponding to the safety side or the dangerous side to another safety controller And a control unit that controls the safety output and the connection output according to a program based on the input from the input device, and the input, the plurality of safety outputs and the connection output are pulse signals. Yes, by making at least one of the pattern and timing of the pulse signal different With respect to the nature of the signal, in the safe state where the operation of the mechanical equipment is allowed, all of the input, the plurality of safety outputs, and the connection output are different from each other, and the control unit is configured to output the safety output. The safety output of the unit and the connection output of the connection output unit are monitored to detect an abnormality, and when any one of the safety output and connection output is detected, all safety outputs and connection outputs are dangerous To control.

  Here, the input device refers to a device that gives an input to the safety controller, such as an emergency stop switch, a safety door switch, a safety limit switch, and a safety light curtain.

  The safety output control target refers to a target controlled by a safety output that is an output of the safety controller, for example, a magnet contactor, a motor controller, a variable motor, a PLC, or the like.

  Mechanical equipment refers to various machine tools, industrial robots, and the like.

  The safe side means the side where the operation of the mechanical equipment is allowed, and the dangerous side means the side where the operation of the mechanical equipment is prohibited.

  Also, controlling the operation of the mechanical equipment means starting / stopping control of the mechanical equipment, operation speed control, and the like.

  The connection output is an output used for connection between the safety controller and another safety controller.

  The plurality of safety outputs corresponding to the dangerous side and the connection outputs corresponding to the dangerous side may be different or the same.

  According to the present invention, a conventional relay having a built-in electromagnetic relay includes a plurality of safety output units that give a safety output that is a semiconductor output to a safety output control target, and a control unit that controls the safety output according to a program. Unlike a unit, it is not necessary to build a safety circuit with a relay sequence, the number of wires can be reduced, and even if the manufacturer wants to change part of the system according to the user's request This can be easily handled by changing the software. In addition, it is possible to easily associate another safety controller with the safety controller by using the output for connection while duplicating by a plurality of safety outputs.

  Here, in order to clarify the effect of the present invention, the duplexing will be described. Duplexing is one of the methods for improving the reliability of the system, and means that the system is configured with two systems, for example.

  For example, FIG. 17 shows a configuration example in which the motor 85 is controlled via the switch 83 by the safety output from the safety unit 82 based on the input from the input unit 81 such as a start switch.

  FIG. 6B shows a single system configuration in which the motor 85 is controlled by one safety output via one switch 83, whereas FIG. 5A shows two switches by two safety outputs. Two systems that control the motor 85 via 83 and 84, that is, are duplexed.

  In the configuration of one system in FIG. 5B, for example, if the switch 83 is turned on and fails, the motor 85 cannot be stopped even if the input unit 81 is operated. In the dual configuration of a), even if one switch 83 is turned on and fails, the motor 85 can be stopped by the other switch 84, and the safety level is high.

  Therefore, in the present invention having a plurality of safety outputs, a high level of safety can be ensured by duplication.

  Moreover, the input, the plurality of safety outputs, and the output for connection are different from each other on the safety side where the operation of the machine equipment is allowed, so for example, by monitoring the input state and the output state, When a short circuit occurs between the input and the safety output, between the input and the connection output, or between the safety output and the connection output, or an abnormality such as a circuit failure in the input section or output section occurs. In this case, pulse signals that differ from each other will change, and based on this, it is possible to detect abnormalities such as short circuits and prohibit the operation of machinery and equipment, so a high safety level that requires short circuit protection Can be secured.

In one embodiment of the present invention, it comprises a connection input unit to which a connection output output from another safety controller is given as a connection input, and the control unit receives the input from the input device and the connection input unit. Based on the connection input, the safety output and the connection output are controlled , and the state of the input from the input device and the connection input of the connection input unit is monitored to detect an abnormality. When an abnormality is detected in the input and connection input, all safety outputs and connection outputs are controlled to the dangerous side .

  According to this embodiment, it is possible to associate the safety output of the safety controller and the output state of the connection output with the connection input given from another safety controller.

  In a preferred embodiment of the present invention, the output for connection is an output for logical connection, and the control unit is based on an input from the input device and an input for connection from the connection input unit according to the program. Then, a logic operation is performed to control the safety output and the connection output.

  Here, “for logical connection” refers to a connection for connecting other safety controllers connected to the safety controller in association with logic such as logical product or logical sum.

  According to this embodiment, the logical operation of the input from the input device and the connection input from the connection input unit can be performed, and the result can be used as a safety output or a connection output. The safety output and connection output with the controller can be related by logic such as logical product or logical sum.

  In another embodiment of the present invention, a plurality of the connection output units are provided, and at least two connection outputs of logical product and logical sum are provided.

  According to this embodiment, since two connection outputs of logical product and logical sum are provided, the safety output and connection output between the safety controller and another safety controller are related by logic such as logical product or logical sum. For example, the logical product of the input from the input device and the connection input from the connection input unit can be taken and the result can be used as a safety output or a connection output. The safety controller only when the state is a safe state where it is allowed to operate the machinery and the connection input state from another safety controller is also in the safe state It is possible to change the output state of the safety output to a safe state.

  In one embodiment of the present invention, the control unit controls the output state of the connection output to the safety side or the dangerous side, which is the same as the output state of the safety output, according to the program. .

  According to this embodiment, since the output state of the connection output is the same as the output state of the safety output, the other safety controller to which the connection output of the safety controller is given can output the safety output of the safety controller. It can be related to the safety output by a logical operation.

  In one embodiment of the present invention, the control unit includes two CPUs.

  According to this embodiment, the same processing can be performed by two CPUs to be duplicated, thereby improving safety.

  The system of the present invention is formed by connecting a plurality of the safety controllers of the present invention via the connection input unit and the connection output unit.

  According to the present invention, unlike the conventional relay unit incorporating an electromagnetic relay, it is not necessary to construct a safety circuit by a relay sequence, and the number of wires can be reduced. Even when it is desired to change a part of the system, it can be easily handled by changing the software. In addition, other safety controllers can be associated with each other by using logic such as logical product or logical sum by using the output for connection, and the expandability of the system is improved.

  In addition, the safety outputs of the multiple safety outputs and connection outputs are different from each other on the safe side, so abnormalities such as short circuits between outputs and circuit faults in the output section occurred due to multiple safety outputs. In such a case, the operation of the mechanical equipment can be prohibited by detecting it.

  As described above, according to the present invention, a plurality of safety output units that give a safety output that is a semiconductor output to a safety output control target, a connection output unit that gives an output for connection to another safety controller, and a safety output and a connection Since it is equipped with a control unit that controls the output according to a program, it is not necessary to build a safety circuit with a relay sequence like a conventional relay unit with a built-in electromagnetic relay, and the number of wires can be reduced. Even if the manufacturer wants to change a part of the system in response to the user's request, it can be easily handled by changing the software.

  In addition, a plurality of safety controllers can be easily associated with each other using the connection output, and the expandability of the system is improved.

Further, the input, the plurality of safety outputs, and the connection output are pulse signals, and the safety of the operation of the mechanical equipment is permitted with respect to the nature of the signals by making the pattern and timing of the pulse signals different. Since the input, multiple safety outputs, and connection outputs are all different from each other in the state of the side, abnormalities such as short-circuit between outputs and circuit failure of the output section while duplicating with multiple safety outputs If this occurs, it can be detected and the operation of the mechanical equipment can be prohibited, and a high safety level can be secured.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a diagram illustrating a configuration example of a system using a safety controller according to an embodiment of the present invention.

  The safety controller of this embodiment constitutes a safety circuit that supplies power to the power of machine equipment such as machine tools and industrial robots (not shown) only when safety is ensured.

  The safety controller of this embodiment is connected to a single function unit 3 to which an input device such as the emergency stop switch 2 is connected, and to an input device such as the safety door switch 1 as well as to the single function unit 3. There are three types: a high-function unit 4 and an extension unit 5 connected to the high-function unit 4 via a cable 6.

  The single-function unit 3 receives input from an input device such as the emergency stop switch 2 and outputs safety to a magnetic contactor as a safety output control target for supplying / cutting off electric power to a motor that drives a machine tool or the like And an internal safety output as an output for logical connection to the high-function unit 4.

  Here, the logic connection output means an output for logically connecting the single function unit 3 that outputs the logic connection output and the high function unit 4 to which the logic connection output is given.

  In this embodiment, the safety output output from the single function unit 3 to the safety output control target and the logical connection output have the same output state, that is, the safety output controls the operation of the mechanical equipment. When the safety-side output state is allowed, the logical connection output is also the safe-side output state. When the safety output is a dangerous-side output state that prohibits the operation of the mechanical equipment, the logical connection output Becomes the dangerous output state.

  Therefore, an output for logical connection that has the same output state as an original safety output for a safety output control target such as a magnetic contactor is called an internal safety output.

  The high-function unit 4 is provided with inputs from input devices such as an emergency stop switch and safety door switch 1 and an internal safety output output from the single-function unit 3 and the preceding high-function unit 4 as internal safety inputs. Outputs safety output to a magnetic contactor, etc., as a safety output control target that supplies and cuts off electric power to a motor that drives a machine, etc., and an internal safety output as an output for logical connection to a high-performance unit 4 in the subsequent stage. is there.

  Similarly to the above, the internal safety output, which is a logical connection output output from the high function unit 4, is also an output for logically connecting the preceding high function unit 4 and the subsequent high function unit 4.

  Further, the safety output output from the high-function unit 4 to the safety output control target and the internal safety output have the same output state. The high-function unit 4 can output a safety instantaneous output and a safety off-delay output, but the internal safety output is in the same output state as the safety instantaneous output.

  Here, the instantaneous safety output is a safety output that instantly switches to the dangerous side when the safety input switches from the safe side to the dangerous side when the safety output is on the safe side. Is the safety that switches to the dangerous side with a delay after continuing the safe state for the set time when the safety input switches from the safe side to the dangerous side when the safety output is on the safe side The output.

  In FIG. 1, the internal safety output given from the single-function unit 3 to the high-function unit 4 and the internal safety output given from the preceding high-function unit 4 to the subsequent high-function unit 4 are indicated by broken arrows. However, in this embodiment, the high function unit 4 is given an internal safety output from either the single function unit 3 or the preceding high function unit 4.

  The extension unit 5 is connected to the high-function unit 4 via the cable 6, and the safety output synchronized with the high-function unit 4 is used as a safety output control target for supplying / cutting off power for driving a machine tool or the like. This is output to a magnet contactor or the like.

  The single-function unit 3 is equipped with a CPU that constitutes a control unit as will be described later, and can input two safety inputs, as well as two safety instantaneous outputs that are semiconductor outputs (transistor outputs) and one internal safety output. Can be output. In this embodiment, the internal safety output for logical connection is the internal safety output for AND connection. The two safety inputs are given inputs from one emergency stop switch or the like for duplication according to safety standards.

  Further, the single function unit 3 can output a monitor output synchronized with the instantaneous safety output and an error output at the time of an internal error. Further, the single function unit 3 can input a feedback / reset input.

  As shown in the front view of FIG. 2, the single-function unit 3 includes a plurality of input / output terminals 7 on the top and bottom, as well as a power source (PWR), an error state (ERR), and safety inputs 1 and 2 (T1 , T2) and a safety instantaneous output (EI) state are respectively provided with a display unit 8 for displaying with LEDs.

  Like the single function unit 3, the high function unit 4 is equipped with a CPU as a control unit, and can input two safety inputs and one internal safety input, and two semiconductor outputs (transistor outputs). An instantaneous safety output, two safety off-delay outputs, and one internal safety output as an output for logic connection. In this embodiment, an internal safety output for AND connection can be output.

  As with the single function unit 3, the two safety inputs are given inputs from one emergency stop switch, one safety door switch, or the like for duplication.

  One internal safety input is an input of the internal safety output from the single-function unit 3 or the preceding high-function unit 4, and this internal safety input causes the single-function unit 3 or the preceding high-function unit 4 to perform logic. Connection In this embodiment, an AND connection is made.

  That is, in this embodiment, this internal safety input and the two safety inputs of the high-function unit 4 are logically connected by AND, and the input state of the internal safety input is a safe side state. And when the input state of two safety inputs is the safe input state, the safe output of the safe output state is output.

  Further, the high-function unit 4 can output a monitor output synchronized with the instantaneous safety output and an error output at the time of an internal error. Further, the high-function unit 4 can input a feedback / reset input.

  As shown in the front view of FIG. 3, the high-function unit 4 includes a plurality of input / output terminals 9 at the top and bottom, as well as a power source (PWR), an error state (ERR), and safety inputs 1 and 2 (T1 , T2), an internal safety input (AND), a feedback input (FB), a safety instantaneous output (EI), and a safety off-delay output (ED). The high-function unit 4 includes a connector 11 for connecting five extension units, and up to five extension units 5 can be connected.

  Via this connector 11, instantaneous safety output, safety off-delay output, feedback input / output of the extension unit 5 and ground signals are exchanged.

  Further, as shown in the rear view of FIG. 4, the high-function unit 4 has an opening formed in a portion attached to the DIN rail, and the dip switch 12 and the rotary switch 13 so as to face the opening. The type of input devices connected, such as an emergency stop switch, safety door switch, or safety light curtain, and settings such as off-delay time are set.

  In addition, a switch as a setting unit for enabling or disabling the internal safety input for logical connection is also provided. When invalidity is set by this switch, it is given from the other units 3 and 4. The internal safety input is disabled and no logical connection is made.

  The expansion unit 5 is expanded as necessary when the number of output points is insufficient with the high-function unit 4 alone, and incorporates a plurality of electromagnetic relays. This extension unit 5 has an instantaneous type that outputs three safety outputs, which are relay outputs in synchronization with the safety instantaneous output from the high-function unit 4, and a relay output in synchronization with the safety off-delay output from the high-function unit 4. There is an off-delay type that outputs three safety outputs.

  As shown in the front view of FIG. 5, the extension unit 5 includes a plurality of input / output terminals 14 on the upper and lower sides, as well as a power source (PWR), an error state (ERR), a safety instantaneous output (EI), or a safety A display unit 15 for displaying each state of the off-delay output (ED) with LEDs is provided. The extension unit 5 includes a connector 16 for connecting to the high function unit 4 or for connecting the extension unit 5.

  FIG. 6 is a block diagram of the high-function unit 4. In the same figure, 17 and 18 are two 1st and 2nd CPU which comprises a control part, and each CPU17 and 18 performs the same process, and is duplexed. The CPUs 17 and 18 communicate with each other for synchronizing software processing via an inter-CPU communication port.

  20 is a non-volatile memory for storing the setting contents from the setting switch 19 such as the above-described dip switch, 21 is an LED for displaying each state such as the power supply (PWR) and error state (ERR), and 22 is a delay IC. The watchdog timer 23 used is a monitoring circuit that monitors the state of the power supply circuit 24 that supplies power to each section.

  Reference numerals 25 and 26 each represent one system of duplicated safety inputs. For example, inputs from one safety door switch are given. Reference numeral 27 denotes a reset input circuit to which a feedback input or a reset input is given.

  28 is an AND input circuit to which an internal safety input as a logical connection input from the single-function unit 3 or the preceding high-function unit 4 is given, and 29 and 30 are RS232C circuits and a changeover switch for communication with an external personal computer or the like. is there.

  31 is an instantaneous safety output circuit, 32 is an off-delay safety output circuit, 33 is a duplex output line control circuit, and 34 is an internal safety output circuit that outputs an internal safety output to the subsequent high-function unit 4 , 35 is a monitor output circuit that outputs an instantaneous safety output for monitoring to a programmable controller (PLC), etc., 36 is an error output circuit that gives an error output when an internal error occurs, and 37 is a connector for connecting the extension unit 5. .

  The first and second CPUs 17 and 18 as the control unit are configured to output the safety output circuits 31 and 32 and the internal circuits according to a program based on the safety input from the safety input circuits 25 and 26 and the internal safety input from the AND input circuit 28. The safety output circuit 34 is controlled to control the safety output and the internal safety output which are semiconductor outputs (transistor outputs). The internal safety output circuit 34 includes a transistor for semiconductor output.

  FIG. 7 is a block diagram showing the configuration of the instantaneous safety output circuit 31, the off-delay safety output circuit 32, and the output line control circuit 33 of FIG. 6, and parts corresponding to those in FIG. A sign is attached. In FIG. 7, the signal from the first CPU 17 and the signal to the first CPU 17 are indicated by dashed arrows, and the signal from the second CPU 18 and the signal to the second CPU 18 are indicated by dashed-dotted arrows, respectively. Show.

  The instantaneous safety output circuit 31 includes two instantaneous output control units 38 and 39, and the off-delay safety output circuit 32 includes two off-delay output control units 40 and 41. Each of the output control units 38 to 41 includes a semiconductor output transistor.

  The output line control circuit 33 for duplexing the safety output includes a driving signal S1, S2 from the first and second CPUs 17, 18, a WDT signal from the watchdog timer 22, and a monitoring circuit 23 for monitoring the power supply circuit 24. PSM signals are respectively provided.

  When the driving signals S1 and S2 are both turned on, a voltage is applied to the power supply line VL and power is supplied to the output control units 38 to 41.

  The WDT signal from the watchdog timer 22 is also given to the output control units 38 to 41. When the watchdog timer 22 is not reset, this WDT signal is turned off and all the output control units 38 to 41 are turned on. Therefore, the safety output can be turned off, which is a danger side prohibiting the operation of the mechanical equipment, and safety can be ensured.

  The PSM signal from the monitoring circuit 23 for monitoring the power supply is also given to the output control units 38 to 41. When a power supply abnormality is detected, the PSM signal is turned off and all the output control units 38 are turned off. The safety output of .about.41 is turned off, which is a danger side prohibiting the operation of the mechanical equipment, and safety can be ensured.

  The output line control circuit 33 outputs monitoring signals S4 and S5 to the first and second CPUs 17 and 18, respectively. The monitoring signals S4 and S5 cause a failure (abnormality) in the output line control circuit 33. ) Or when the above-mentioned WDT signal or PSM signal is turned off.

  Instantaneous output drive signals S6 and S7 are respectively supplied from the first CPU 17 to the instantaneous output control units 38 and 39 of the instantaneous safety output circuit 31, and by these drive signals S6 and S7, a safe instantaneous output is provided. The logic of ON (safe side) / OFF (danger side) is controlled. That is, when the driving signals S6 and S7 are turned on and the above-described power supply line VL is turned on, the safety instantaneous outputs that are on the safe side are output from the instantaneous output terminals 42 and 43, respectively. To do.

  The instantaneous output control units 38 and 39 output monitor signals S9 and S10 to the first and second CPUs 17 and 18, respectively, and the instantaneous output control units 38 and 39 are normal. For example, the monitoring signals S9 and S10 are inverted logic signals of the driving signals S6 and S7.

  The off-delay output control units 40 and 41 of the off-delay safety output circuit 32 are supplied with off-delay output driving signals S12 and S13 from the second CPU 18, respectively. By the driving signals S12 and S13, The logic of the safety off-delay output on (safe side) / off (dangerous side) is controlled. That is, when the driving signals S12 and S13 are turned on and the above-described power supply line VL is turned on, an on-safety off-delay output which is a safe state is output from the off-delay output terminals 45 and 46. Output each.

  The off-delay output control units 40 and 41 output monitor signals S14 and S15 to the first and second CPUs 17 and 18, respectively. The off-delay output control units 40 and 41 are normal. If so, the monitoring signals S14 and S15 are inverted logic signals of the driving signals S12 and S13.

  The output line control circuit 33 for redundant safety output turns off the power supply line VL and outputs an instantaneous output terminal when a failure (abnormality) occurs in the instantaneous output control units 38, 39 or the off-delay output control units 40, 41. The safety outputs of 42 and 43 and off-delay output terminals 45 and 46 are all turned off to ensure safety.

  On the contrary, when a failure (abnormality) occurs in the output line control circuit 33, the instantaneous output terminals 42 and 43 and the off-delay output terminal are output by the instantaneous output control units 38 and 39 and the off-delay output control units 40 and 41, respectively. All safety outputs 45 and 46 are turned off to ensure safety.

  FIG. 8 is a block diagram of the single function unit 3, and parts corresponding to those in FIG.

  The single function unit 3 is not provided with the above-described AND input circuit 28, the off-delay safety output circuit 32, the setting switch 19, and the connector 37 for the extension unit. The same as 4.

  In this way, the control unit having the first and second CPUs 17 and 18 controls the safety output, which is a semiconductor output, in accordance with a program, so that the safety circuit is configured by a relay sequence as in a conventional relay unit incorporating an electromagnetic relay. There is no need to construct the system, and the number of wirings can be reduced. In addition, when the manufacturer wants to change a part of the system, it can easily cope with the change of the software.

  Furthermore, in this embodiment, when an abnormality such as a short circuit occurs in the input / output, it has a short circuit protection function for detecting the abnormality and prohibiting the operation of the mechanical equipment.

  Hereinafter, the short-circuit protection function will be described in detail based on some use examples.

  FIG. 9 is a diagram showing a connection state when the high-function unit 4 is used alone, and FIG. 10 is a time chart thereof. In FIG. 10, the safety input and the safety output indicate the safety-side state in which the operation of the mechanical equipment is allowed as an ON state, but this ON state is configured by a pulse signal as described later. .

  In this example, for example, two contacts of one safety door switch are connected to the safety input 1 of the terminals T11 and T12 of the high-function unit 4 and the safety input 2 of the terminals T21 and T22, and the feedback loop 47 The b contacts of the magnet contactors 54 and 55 are connected in series, and the reset button 50 is connected in series.

  The instantaneous output terminals S13 and S23, that is, the safety outputs 1 and 2 are connected to the magnet contactors 54 and 55.

  When the door equipped with the safety door switch is closed, as shown in FIGS. 10 (a) and 10 (b), the two safety inputs 1 and 2 of the high-function unit 4 are turned on. As shown in c), when the reset input is turned off, on, and off, the safety outputs 1 and 2 of the high-function unit 4 are turned on as shown in FIGS. As a result, the magnet contactors 54 and 55 are turned on, and the motor 63 is driven to operate the mechanical equipment.

  In this state, for example, when the door is opened, the two safety inputs 1 and 2 are turned off as shown in FIGS. 10 (a) and 10 (b), as shown in FIGS. 10 (d) and 10 (e). Then, the safety outputs 1 and 2 of the high-function unit 4 are turned off, whereby the magnetic contactors 54 and 55 are turned off, the power supply to the motor 63 is cut off, and the operation of the mechanical equipment is stopped.

  FIG. 11 is a diagram illustrating signal waveforms of the safety inputs 1 and 2 and the safety outputs 1 and 2 of FIG. 10 and shows an enlarged time axis as compared with FIG.

  In this embodiment, the safety inputs 1 and 2 and the safety outputs 1 and 2 in the on state in FIG. 10, that is, the safety side state in which the operation of the mechanical equipment is allowed, are different from each other. Specifically, in this embodiment, the safety inputs 1 and 2 and the safety outputs 1 and 2 are pulse signals having different periods. Furthermore, the safety inputs 1 and 2 have a duty ratio of 3/4, and the timing thereof is a pulse signal with a 1/2 cycle shift. The safety outputs 1 and 2 have a duty ratio of 5/6. Thus, the timing is a pulse signal with a half cycle shift.

  The OFF period in one cycle of these pulse signals is, for example, about several hundred μsec.

  In this way, by making each pulse signal different from each other, when a short circuit occurs, for example, as shown in FIG. The safety input 2 shown in FIG. (B) continues to be in an unexpected ON state, and the first and second CPUs 17 and 18 of the high function unit 4 immediately detect the abnormality of the input signal. The safety outputs 1 and 2 are switched to a dangerous output state that prohibits the operation of the mechanical equipment at time t2, that is, an off state.

  The first and second CPUs 17 and 18 of the high-function unit 4 monitor the output states of the safety outputs 1 and 2 in the same manner as the monitoring of the input states of the safety inputs 1 and 2. Similarly, when an unexpected output state occurs, it is detected as an abnormality such as a short circuit.

  As described above, the first and second CPUs 17 and 18 of the high-functional unit 4 monitor the pulse signal pattern for the safety input and the safety output, and are different from the assumed safety input or safety output pattern. In some cases, the safety output and the internal safety output are output as a dangerous state that prohibits the operation of the mechanical equipment by judging that the abnormality is a short circuit or a failure of the input circuit or the output circuit.

  This detection of abnormalities such as short-circuits by monitoring the pulse signal monitors whether the pulse signal is OFF at the timing to be turned OFF in the ON state, that is, in the safe state that allows the operation of the machine equipment. However, when it is not OFF, it is preferable to determine that it is abnormal.

  As described above, the high-function unit 4 changes the pulse signal waveform when a short circuit occurs between safety inputs, between safety outputs, or between safety inputs and safety outputs, or when an abnormality such as a circuit failure occurs. Based on this, it is detected and the operation of the mechanical equipment is prohibited, that is, the mechanical equipment can be stopped.

  FIG. 13 is a diagram showing a connection state of the two high-function units 4-1 and 4-2, and FIG. 14 is a time chart thereof. The two safety inputs and the two safety outputs of the second high-functional unit 4-2 are referred to as safety inputs 3 and 4 and safety outputs 3 and 4 for convenience. The internal safety outputs output from the first and second high-function units 4-1 and 4-2 are referred to as internal safety outputs 1 and 2, respectively. In FIG. 14, the safety input, safety output, internal safety output, and internal safety input indicate the safety-side state in which the operation of the mechanical equipment is permitted in the ON state, as in FIG. 10 described above. The state is composed of a pulse signal as described above.

  In this example, for example, two contacts of one safety door switch are connected to the safety input 1 of the terminals T11 and T12 and the safety input 2 of the terminals T21 and T22 of the first high-function unit 4-1. The feedback loop 47 is connected to the b contacts of the magnet contactors 54 and 55 in series and to the reset button 50 in series.

  The instantaneous output terminals S13 and S23, that is, the safety outputs 1 and 2 are connected to the magnet contactors 54 and 55. The internal safety output terminal LO is connected to the internal safety input terminal LA of the second high function unit 4-2. That is, the internal safety output 1 of the first high function unit 4-1 is given as the internal safety input 1 (AND input) of the second high function unit 4-2 at the subsequent stage.

  The safety input 3 of the terminals T11 and T12 of the second high-function unit 4-2 and the safety input 4 of the terminals T21 and T22 are different from, for example, the safety door switch of the first high-function unit 4-1 Are connected to the feedback loop 69. The contact b of the magnetic contactors 71 and 72 is connected in series to the feedback loop 69, and the reset button 70 is connected in series.

  The instantaneous output terminals S13 and S23, that is, the safety outputs 3 and 4 are connected to the magnet contactors 71 and 72.

  As shown in FIGS. 14A and 14B, the door of the safety door switch connected to the first high-function unit 4-1 is closed, and the two safety inputs 1 and 2 are turned on. As shown in FIGS. 14D and 14E, the reset input is turned off, on, and turned off as shown in FIG. The outputs 1 and 2 are turned on, whereby the main contacts of the magnetic contactors 54 and 55 of the first high-function unit 4-1 are turned on and the motor 63 is driven. Also, the internal safety output 1 shown in FIG. 14 (f) which is the same as the safety output of the first high function unit 4-1 is given as the internal safety input 1 (AND input) of the second high function unit 4-2. It is done.

  The second high-function unit 4-2 is in a state where the internal safety input 1 shown in FIG. 14 (g) is turned on and the second high-function unit 4-2 is on the safe side. Turn on the safety output. In FIG. 14, when the internal safety input 1 is turned on, the door of the safety door switch connected to the second high-function unit 4-2 is closed, as shown in FIGS. 14 (h) and (i). As shown in FIG. 14 (j), the AND condition is established when the reset input is turned off, on, and off, as shown in FIG. 14 (j). k) and (l), the safety outputs 3 and 4 of the second high-function unit 4-2 are turned on, whereby the magnetic contactors 71 and 72 of the second high-function unit 4-2 are turned on. Is turned on and the motor 79 is driven. The second high-function unit 4-2 outputs the same internal safety output 2 (AND output) as the safety outputs 3 and 4 as shown in FIG.

  In this state, for example, when the door of the safety door switch connected to the first high function unit 4-1 is opened, as shown in FIGS. 14 (a) and 14 (b), the first high function The two safety inputs 1 and 2 of the unit 4-1 are turned off. As shown in FIGS. 14D and 14E, the safety outputs 1 and 2 of the first high-function unit 4-1 are turned off. The magnet contactors 54 and 55 are turned off to cut off the power supply to the motor 63, and the internal safety output 1 for the second high function unit 4-2 is also turned off as shown in FIG. 14 (f).

  The second high function unit 4-2 turns off the internal safety input 1 from the first high function unit 4-1 as shown in FIG. As shown in l), the safety outputs 3 and 4 are turned off, the magnet contactors 71 and 72 are turned off, and the power supply of the motor 79 is shut off. The internal safety output 2 is also turned off as shown in FIG.

  In this way, the safety output of the second high-function unit 4-2 can be easily associated with the safety output of the first high-function unit 4-1 by logical connection using the internal safety output.

  FIG. 15 shows signal waveforms of safety inputs 1 and 2, safety outputs 1 and 2, internal safety output 1 (internal safety input 1), safety inputs 3 and 4, safety outputs 3 and 4 and internal safety output 2 of FIG. It is a figure shown, and it expands and shows the time axis similarly to the above-mentioned FIG.

  The safety inputs 3 and 4 and the safety outputs 3 and 4 are the same as the safety inputs 1 and 2 and the safety outputs 1 and 2 described above.

  In this embodiment, the internal safety output in the ON state in FIG. 14, that is, in the state on the safe side where the operation of the mechanical equipment is allowed, is different from the safety input and the safety output.

  Specifically, in this embodiment, the internal safety output is a pulse signal having a duty ratio of 2/3 having a period different from that of the safety input and the safety output.

  In this way, by making the safety input, safety output and internal safety output signals different from each other, a short circuit occurs between them, or when an abnormality such as a failure of the input circuit or output circuit occurs, a pulse signal Based on the change in the waveform, the safety output and the internal safety output are switched to a dangerous output state that prohibits the operation of the mechanical equipment.

  As described above, units can be logically connected by internal safety output while being duplicated by two safety outputs 1 and 2, and the machine can detect abnormalities such as short circuits and circuit failures in input and output. The operation of the equipment can be prohibited to ensure a high safety level.

  The safety inputs 1 and 2 and the safety outputs 1 and 2 of the single function unit 3 are also pulse signals similar to the safety inputs 1 and 2 and the safety outputs 1 and 2 of the high function unit 4. Similarly to the high function unit 4, the first and second CPUs 17 and 18 of the single function unit 3 monitor the safety input and the safety output, and when an abnormality such as a short circuit occurs, the waveform of the pulse signal Based on the change, this is detected and the safety output is switched to a dangerous output state that prohibits the operation of the mechanical equipment.

(Other embodiments)
In the above-described embodiment, on the safety side, all of the plurality of safety inputs, the plurality of safety outputs, and the internal safety output are made different from each other. Absent.

  In the above embodiment, the internal safety output (internal safety input) for logical connection is only AND, but an internal safety output (internal safety input) for OR connection may be added. The internal safety output for OR connection is an output in the same state as the safety output of the high-function unit that outputs the internal safety output for OR connection. That is, when the safety output of the high-function unit is an output in the safe state, the internal safety output for OR connection is also an output in the safe state.

  In this way, by providing the internal safety output (internal safety input) for AND connection and OR connection, the internal safety output (internal safety input) for AND connection can be used as needed, or OR connection Internal safety output (internal safety input) can be used.

  Further, for example, a system as shown in the schematic configuration diagram of FIG. 16 using both the internal safety output (internal safety input) for AND connection and OR connection can be configured.

  In FIG. 16, a safety input is given to the first high function unit 4-1 from the emergency stop switch 2, for example, and a safety input is given to the second high function unit 4-2 from the enable switch 80, for example. Is given.

  The internal safety output for AND connection of the first high function unit 4-1 is given to the internal safety input (AND input) for AND connection of the third high function unit 4-3, while the second high function The internal safety output for OR connection of the unit 4-2 is given to the internal safety input (OR input) for OR connection of the third high function unit 4-3. For example, a safety input is given from the safety door switch 1 to the third high-functional unit 4-3.

  The third high-functional unit 4-3 performs the following logical operation to give a safety output.

(AND input) ∩ (OR input ∪ safety input)
Therefore, when performing a test run or maintenance, the enable switch 80 can be turned on even when the door equipped with the safety door switch 1 is opened, that is, the safety input is not on, while the emergency stop switch is enabled. Can be used to work.

  The internal safety output for OR connection is made different from the above-mentioned safety input, safety output and pulse signal for AND connection by making the pulse signal in the safe side state of the internal safety output for OR connection (internal safety input). Abnormalities such as short circuit of output (internal safety input) can be detected.

  In the above-described embodiment, each of the single function unit 3 and the high function unit 4 includes two CPUs. However, as another embodiment of the present invention, the number of CPUs may be one.

  Of course, the number of safety inputs, safety outputs, internal safety outputs (internal safety inputs) and pulse signals of the single-function unit 3 and the high-function unit 4 are not limited to the above-described embodiments.

  In the above-described embodiment, the safety input, the safety output, and the internal safety output in the dangerous state where the operation of the mechanical equipment is prohibited are all off and common. Even in the dangerous state, the safety input, the safety output, and the internal safety output may be different.

  The present invention is useful for building a safety system.

It is a figure which shows the structural example of the system which concerns on one embodiment of this invention. It is a front view of the single function unit of FIG. It is a front view of the high-functional unit of FIG. It is a rear view of the high-functional unit of FIG. It is a front view of the single function unit of FIG. It is a block diagram of the high-functional unit of FIG. It is a block diagram which shows the detail of a part of FIG. It is a block diagram of the single function unit of FIG. It is a figure which shows the connection state of the 1st usage example. It is a time chart of FIG. It is a figure which shows the signal waveform of the safety input and safety output of FIG. It is a figure which shows a signal waveform when a short circuit arises. It is a figure which shows the connection state of the 2nd usage example. It is a time chart of FIG. It is a figure which shows the signal waveform of the safety input of FIG. 14, a safety output, and an internal safety output. It is a schematic block diagram which shows the 3rd usage example. It is a block diagram for demonstrating duplication.

Explanation of symbols

1 Safety Door Switch 2 Emergency Stop Switch 3 Single Function Unit 4 High Function Unit 5 Extension Unit 17, 18 First and Second CPU
31 Safety output circuit for moment 32 Safety output circuit for off-delay 34 Internal safety output circuit

Claims (7)

A safety controller that controls the operation of mechanical equipment by giving a safety output corresponding to the safety side or the danger side to a safety output control target based on an input corresponding to a safety side or a danger side from an input device,
A plurality of safety output units for providing a semiconductor output as the safety output;
A connection output unit for providing a semiconductor output as an output for connection corresponding to the safety side or the dangerous side to another safety controller;
A control unit that controls the safety output and the connection output according to a program based on the input from the input device;
The input, the plurality of safety outputs and the connection output are pulse signals, and the operation of mechanical equipment is permitted with respect to the nature of the signals by making the pattern and timing of the pulse signals different. In the state of safety, all of the input, the plurality of safety outputs, and the connection outputs are different from each other,
The control unit detects the abnormality by monitoring the state of the safety output of the safety output unit and the connection output of the connection output unit, and detects any abnormality in any one of the safety output and the connection output. Safety controller characterized by controlling safety output and connection output to the danger side . It has a connection input unit that gives the connection output from other safety controllers as the connection input,
The control unit controls the safety output and the connection output based on the input from the input device and the connection input from the connection input unit, and also connects the input from the input device and the connection input unit. The safety controller according to claim 1, wherein when the abnormality is detected in any one of the inputs and the connection inputs, all safety outputs and connection outputs are controlled to the dangerous side by monitoring the state of the input for the engine and detecting the abnormality. . The connection output is an output for logical connection, and the control unit performs a logical operation based on an input from the input device and an input for connection from the connection input unit according to the program, and performs the safety operation. The safety controller according to claim 2 , wherein the output and the connection output are controlled. The safety controller according to claim 3, comprising a plurality of the connection output units, and providing at least two connection outputs of logical product and logical sum. The safety controller according to any one of claims 1 to 4 , wherein the control unit controls the output state of the connection output to the safety side or the dangerous side that is the same as the output state of the safety output according to the program. . Wherein the control unit, the safety controller according to claim 1, comprising two CPU. A plurality of safety controllers according to claim 1, formed by connecting via the connection input part and the connecting output unit system.

Images