JP2002358106A - Safety controller - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a safety controller capable of realizing fail/safe while simplifying a unit constitution. SOLUTION: This safety PLC 1 is constituted by connecting a CPU unit 2, an input unit 4, and output units 3 and 5. The CPU unit and the output units are respectively provided with user program storing parts 12, 13a and 13b for storing user programs whose contents are the same and MPU 6a, 5b and 6d for executing the user programs stored in the user program storing parts, and those MPU compare their respective arithmetic results with other, and when they are made coincident, the MPU output the arithmetic results to AND circuits 15a and 15b. The AND circuits also check whether or not those two inputs are made coincident to each other, and only when they are made coincident, output signals are outputted. Thus, it is possible to realize fail/safe by redundant processing although each unit is provided with only one MPU.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a safety controller having a safety function.

[0002]

2. Description of the Related Art FA (Factory Automation)
Programmable Controller (PLC) used in
Indicates ON / OFF of input devices (switches, sensors, etc.)
Inputs information, executes logical operation according to a sequence program (user program) written in ladder language, etc., and outputs ON / OFF information signals to output devices (relays, valves, actuators, etc.) based on the operation result. Is output to output the control.

[0003] The connection form of the PLC to the input device and the output device may be directly connected to the PLC or may be connected via a network. When a network system connected by such a network is constructed, transmission / reception of the ON / OFF information is performed via the network. At this time, information is normally transmitted in a master-slave system in which the PLC side becomes a master and the device side becomes a slave.

[0004] On the other hand, recently, a fail-safe (safety) system has also been introduced in control by a PLC. That is, not only the PLC and each device itself, but also the network are configured by incorporating a safety function. Here, the safety function means, for example, that the CPU (MPU) and other processing units are duplicated so that a correct output is obtained, a network error (normal communication cannot be performed), or an emergency stop switch is pressed. If the network system is in danger, such as when a sensor such as a light curtain detects the entry of a person (part of the body), fail-safe is activated and the system becomes safe, Try to stop.

[0005]

However, the system having the above-mentioned conventional safety function has the following problems. That is, as means for improving the reliability of the operation result, in addition to providing a plurality of CPUs (MPUs), redundancy, diversification, hardware diagnosis, and the like are generally performed. Since the system is implemented for each unit having the same, the system becomes complicated and causes a cost increase.

[0006] In the case of a network system having the above-mentioned safety function (safety network system), all devices connected to the network (PLCs, slaves, devices connected to the slaves, etc.) must use those having the safety function. was there. This is because, if at least one device without a safety function is incorporated, fail-safe cannot be executed for the device or cooperation with the device and data communication, and the security of the entire system cannot be guaranteed.

[0007] As a result, for example, when an attempt is made to add or introduce a safety PLC to an environment in which a network system based on a PLC is already installed, it is necessary to replace all existing facilities with devices having a safety function. That is, it is necessary to discard the existing equipment and install a new safety network system. Therefore, the introduction of a safety PLC (safety network system) not only increases costs but also requires a large number of replacement man-hours, and also has a problem of waste of resources (waste generation) due to disposal processing.

An object of the present invention is to provide a safety controller which can realize fail-safe while simplifying the structure of a single unit and can reduce the cost of the single unit as well as the entire system.

[0009]

The safety controller according to the present invention is a controller having a CPU unit and an output unit. The CPU unit and the output unit are provided with a user program storage unit for storing a user program having the same contents, and a calculation unit for executing the user program stored in the user program storage unit. The results are compared, and the calculation result is output from the output unit only when they match.

When the same user program is redundantly operated at a plurality of locations and is output as a correct operation result only when the operation results match, the reliability of the output result is improved and fail-safe is realized. In the present invention, two arithmetic units for performing arithmetic are mounted on different units (a CPU unit and an output unit). Therefore, when focusing on one unit, it is sufficient to mount one arithmetic unit. Therefore, the configuration can be simplified.

Further, since only one arithmetic unit is required to be mounted on the CPU unit or the output unit, a conventional C
Based on a PU unit or the like, a CPU unit or the like compatible with safety functions can be obtained by slightly changing the program. In other words, hardware resources can be shared with conventional resources (those not requiring fail-safe), and wasteful disposal can be suppressed as much as possible.

As for the comparison of the calculation results, various means can be used. For example, as an example, the calculation unit obtains the calculation results of the other-side calculation unit and compares them with software. Processing can be performed. Further, the output unit is provided with comparing means, and the operation result of each operation unit is provided to the comparing means, and the comparing means determines whether or not the given two operation results match. You can also. The comparing means is realized by the AND circuits 15a, 15b, 15c in the embodiment. The comparison can also be made between the calculation unit and a processing unit having a different configuration. When both are performed, the reliability becomes higher. Of course, other processing means can be used.

Further, the CPU unit and the output unit have a self-diagnosis function for diagnosing the presence or absence of an internal failure.
It has at least one cross-check function for judging whether or not the other party is normal. If the execution result of the function is normal, the operation result by the operation unit is output. If not, the operation result is output. It is better not to do it. Although the diagnostic function is not an essential component, the reliability is further improved by adding such a function. The expression "do not output the operation result" includes both a case where the result of the operation process is not output and a case where the operation itself is not performed.

The user program having the same contents stored in the output unit may be all of the user programs stored in the CPU unit, or may be a part of the user program stored in the CPU unit. The program part may include a program to be executed by the operation unit of the output unit.
When all the former user programs are stored, the user programs stored in the CPU unit may be copied, so that the storing process can be easily performed. When the latter method of storing a part of the program portion is adopted, the memory capacity of the output unit can be reduced. Although some program parts are most preferable in view of reducing the memory capacity, it is most preferable that only the program parts to be processed by the output unit are included. May be added. Even in this case, the memory capacity can be reduced as compared with the case of copying all.

Further, the output unit is not limited to a unit for directly connecting an external device, but may be, for example, a unit having a communication master station function and a function of outputting via a network.

The user program is a broad concept that includes not only programs conventionally programmed by the user but also programs (programs requiring safety functions) created by the manufacturer of the unit. .

[0017]

FIG. 1 shows an embodiment of a safety PLC 1 as a safety controller according to the present invention.
As shown in the figure, the safety PLC 1 has four units,
That is, the CPU unit 2, the first output unit 3, the input unit 4, and the second output unit 5 are connected to each other. Each of the units 2 to 5 has an MPU 6a, 6
b, 6c and 6d are mounted. Each of these MPUs 6a
To 6d are connected to the system bus 7 and the CPU
The MPU 6a of the unit 2 serves as a master, and manages transmission and reception of data between MPUs.

Although not shown, the system ROM
Each of the members constituting a normal unit such as a RAM and a system RAM is also incorporated, and the MPUs 6a to 6d are provided with the system RO.
Execute the program stored in M. The programs to be executed include a program for executing control as an original PLC, and a program for performing a self-check (self-diagnosis) and a diagnosis of a connected external device (hardware).

The input unit 4 has an input interface 9, and an input device 11 is connected via the input interface 9. The input device 11 is a safety device having a safety function, for example, an emergency stop push button, a safety door switch, a safety limit switch, and the like. The contact information (ON / OFF information) of the input device 11 is provided to the MPU 6c via the input interface 9, and is provided to the MPU 6a of the CPU unit 2 via the system bus 7. Although specific illustration and description are omitted,
The processing in the input device 11 and the processing in the input unit are also duplicated and processed redundantly.

On the other hand, the CPU unit 2 has a tool interface 8, and by connecting a tool to the tool interface 8, a user program can be downloaded and an operation state can be monitored. Although not shown, it also holds configuration management information of each connected unit.

The downloaded user program is stored and held in the user program storage unit 12.
Then, the MPU 6a sequentially calculates and executes the stored user program.

Furthermore, the first and second output units 3,
5 has an external interface 10 and MPUs 6b and 6
The safety signal calculated by d is output to an external device connected via the external interface 10. In addition,
The above-described basic processing is the same as that of each unit configuring a safety PLC having a general safety function, and thus a detailed description thereof is omitted.

Here, in the present invention, one MPU 6a is provided in the CPU unit 2 and the like. That is, normally, two MPUs are provided, each MPU executes the same arithmetic processing, and outputs a correct output signal only when the arithmetic results match, but in the present embodiment, the following configuration is adopted. As a result, even if a single MPU 6a is used, the operation is performed redundantly, and the reliability of the output result can be improved.

That is, the first and second output units 3 and 5 that finally output the operation result are also provided with user program storage sections 13a and 13b, and the user program stored in the user program storage section 12 of the CPU unit 2 Retain equivalents. Then, the MPUs 6b and 6d of the first and second output units 3 and 5 also execute the user program.

The user programs stored in the user program storage sections 13a and 13b of the first and second output units 3 and 5 can extract and store at least a portion to be executed by the user. That is, the user program for finally outputting the operation result to the first output unit 3 is (A), and the operation result is finally set to the second
If the user program to be output to the output unit 5 is (B), the user program storage unit 12 stores the user program (A) + (B), but the user program storage unit 13a of the first output unit 3 Stores only the user program (A), and stores the second output unit 5
The user program storage unit 13b stores only the user program (B). Of course, the MPU 6b performs the operation of the user program (A), and the MPU 6d performs the operation of the user program (B).

Of course, the user program storage unit 13
Also in a and 13b, all user programs (A) + (B) may be stored and held. Also in this case, the program (A) or (B) that is arithmetically output to its own output unit performs the arithmetic operation. Although the user programs (A) and (B) are stored in the user program storage unit 12 for convenience of description, other user programs are also stored.

The operation results obtained by executing the user program in each of the MPUs 6a, 6b, 6d are passed to the corresponding MPU via the system bus 7, and it is determined whether the operation results match. Then, only when they match, the result is output as a correct operation result.

Further, the first output unit 3 includes an MPU
6b and an external circuit 10 are provided between the output of the external interface 10 and another input of the AND circuit 15a.
The output of the MPU 6a of the CPU unit 2 is also provided. Similarly, the MPU 6d is connected to the second output unit 5.
AND circuit 15 between the output of the
b, and the other input of the AND circuit 15b
The output of the MPU 6a of the U unit 2 is also provided. The AND circuits 15a and 15b are provided, for example, in FIG.
The following two circuit configurations are used to compare two input signals and output a safety signal only when the two signals match.

Therefore, the MPU 6a of the CPU unit 2
And MPUs 6b and 6d of the first and second output units 3 and 5
, The same user program is redundantly operated, and the results are compared and the operation result is output only when they match. As a result, the MPUs perform software checks, and the AND circuits 15a and 15b perform hardware checks, thereby improving reliability.

Next, the user program storage units 12 and 13
The process of storing the user program in the files a and 13b will be described. In this example, an example using a tool will be described. FIG.
As shown in (1), first, a tool is connected to the tool interface 8 of the CPU unit 2, and after executing predetermined initial processing, system configuration information stored and held by the CPU unit 2 is collected and tabulated (ST2). That is, configuration management information such as what unit is connected to where is obtained. Then, it is checked whether or not the units constituting the actual safety PLC 1 match the configuration management information (ST3), and if they do not match, abnormal processing is performed (ST9). Specifically, an error notification is sent to a tool monitor or the like.

On the other hand, if it is confirmed that the connection is correct as a result of the comparison, the user program is divided according to the configuration information (ST4). That is, the unit No. of the output unit. Is divided according to channel No. In the example shown in FIG. 1, the program is divided into a program (A) and a program (B).

Next, the user program is transferred to the user program storage section 12 of the CPU unit 2 (ST).
5). Since an answer back indicating whether or not the transfer (download) has been successful is returned from the MPU 6a, whether or not the answer is correct (ST6) is determined. A),
(B) is transferred (ST7). Upon receiving the transfer result of the divided user program, it is determined whether or not the transfer was successful (ST8).

Then, N is determined by the branch determination in steps 6 and 8.
o, that is, if the transfer has failed, the process jumps to step 9 to perform the abnormal processing and then execute the processing from the beginning. Then, when the transfer of all the programs is successful, the process is terminated.

Incidentally, the transfer to the output unit is performed by CP
The MPU 6a of the U unit 2 passes the data to the MPUs 6b and 6d via the system bus 7, and the MPUs 6b and 6d are connected to the user program storage units 13a and 13d, respectively.
3b. Of course, when a tool interface is provided for each output unit, the data can be directly transferred by connecting to the tool interface.

Next, each MPU 6 during actual operation
The functions of a, 6b, and 6d will be described. FIG. 4 shows the function of the MPU 6a of the CPU unit 2. As shown in the figure, a predetermined initial process is executed (ST10). That is, processing such as clearing the input / output and the internal auxiliary relay, presetting the timer, and recognizing the connection state of the I / O unit is performed.

After completing the initial setting, self-diagnosis is performed and the CPU
The presence / absence of an abnormality in the unit 2 is determined, and the presence / absence of an abnormality in the connected external device is diagnosed. Further, cross-check with the MPUs 6b and 6d of the first and second output units 3 and 5,
That is, whether the other party is operating normally is also checked (ST11). Then, it is determined whether or not the results of the above-described diagnoses and checks are normal (ST12), and if abnormal, lockout is performed (ST13). Specifically, it outputs an OFF output to the AND circuits 15a and 15b and outputs an alarm to notify that there is an abnormality, recognizes the content of the error, and executes a process of storing a corresponding error code.

On the other hand, if the check result is normal, the user program counter is reset and the user program is executed (ST14 to ST16). The execution of the user program includes a safety function process.

As will be described later, since the MPUs 6b and 6d of the first and second output units 3 and 5 also execute the same user program, it is determined whether or not the outputs of the corresponding operation results match. A decision is made (ST17). That is, the calculation results of the corresponding MPUs 6b and 6d are obtained via the system bus 7, and it is determined whether the outputs match. If they do not match, the process jumps to step 13 to perform lockout processing.

On the other hand, if they match, step 1
8 to execute an I / O refresh (ST1).
8). In the context of the present invention, the operation result is output to the AND circuits 15a and 15b at the time of this refresh processing. Then, after performing system management such as checking whether the system configuration is suitable (ST19), the process returns to step 11. Thereafter, the above processing is repeatedly executed.

The M of the first and second output units 3 and 5
The processing functions of the PUs 6b and 6d are as shown in the flowchart of FIG. As shown in the figure, a predetermined initial process is executed (ST20). That is, processing such as clearing the input / output and the internal auxiliary relay, presetting the timer, and recognizing the connection state of the I / O unit is performed.

After completion of the initial setting, self-diagnosis is performed to determine whether or not the output unit has its own abnormality. Further, a cross check with the MPU 6a of the CPU unit 2, that is, a check whether the other party is operating normally is also performed (ST21).
Then, it is determined whether or not each of the above diagnosis and check results is normal (ST22), and if abnormal, lockout is performed (ST23). The specific process of lockout is CPU
This is the same as the case of the unit 2.

On the other hand, if the check result is normal, the user program counter is reset and the user program is executed (ST24 to ST26). The execution of the user program includes a safety function process.

Next, when the execution of the program is completed, the output of the operation result of the same user program is received from the MPU 6a of the CPU unit 2 via the system bus 7, and it is determined whether or not the result matches (ST27). If they do not match, the process jumps to step 23 to perform lockout processing.

On the other hand, if they match, step 2
8 to execute an I / O refresh (ST2).
8). In the context of the present invention, the operation result is output to the AND circuit 15a or 15b at the time of this refresh processing. Then, the safety output is refreshed (ST2).
9) After performing system management such as checking whether the system configuration is correct (ST30), the process returns to step 21. Thereafter, the above processing is repeatedly executed.

FIG. 6 is a timing chart of the MPUs 6a, 6b, 6d in the CPU unit 2, the first and second output units 3, 5. That is, each MPU executes a user program after performing a self-diagnosis or the like. Then, I / O refresh is performed in synchronization, and the operation result is sent to the AND circuit. Then, after performing the system management, the system shifts to self-diagnosis and the like in the next cycle with synchronization.

The output unit is not limited to an external interface provided with an external interface as in the above-described embodiment, and an external device may be connected thereto. For example, as shown in FIG. The unit 20 may be provided. That is, the safety output may be output to the slave station 22 connected via the network 21.

In this case, although a specific description is omitted,
The MPU 6e has a function of executing the flowchart shown in FIG. Then, the user program (C) stored in the user program storage unit 13c is executed, and at the time of I / O refresh, the operation result is output to the AND circuit 15c and compared with the operation result from the MPU 6a. It outputs a safety output to the communication ASIC 23 and outputs it from the communication interface 24 to the network 21.

In the above-described embodiment, an example has been described in which a user program is stored by using a tool. However, the present invention is not limited to this. The present invention can also be applied to a case where a manufacturer executes a preinstalled program.

[0049]

As described above, in the present invention, the fail-safe is realized by executing the same user program in the CPU unit and the output unit, comparing the operation results, and outputting only when they match. it can. In addition, since a single arithmetic unit may be mounted on each unit (although mounting a plurality of units is not impeded), the configuration of a single unit can be simplified, and the cost of the unit alone and the entire system can be reduced. Can be planned.

[Brief description of the drawings]

FIG. 1 is a diagram showing a preferred embodiment of a controller according to the present invention.

FIG. 2 is a diagram illustrating a specific example of an AND circuit.

FIG. 3 is a flowchart showing a processing procedure for transferring a user program.

FIG. 4 is a flowchart illustrating functions of a CPU of the CPU unit.

FIG. 5 is a flowchart illustrating functions of a CPU of the output unit.

FIG. 6 is a timing chart showing the operation timing of each CPU.

FIG. 7 is a diagram showing another embodiment of the controller according to the present invention.

[Explanation of symbols]

Reference Signs List 1 safety PLC (controller) 2 CPU unit 3 first output unit 4 input unit 5 second output unit 6a to 6e MPU 7 system bus 8 tool interface 9 input interface 10 external interface 11 input device 12, 13a, 13b, 13c user program Storage unit 15a, 15b, 15c AND circuit 20 Communication master station unit (output unit) 21 Network 22 Slave station 23 Communication ASIC 24 Communication interface

 ────────────────────────────────────────────────── ─── Continuing on the front page (72) Inventor Yasuo Muneda 801 Fudo-term, Omron Co., Ltd., 801 Minami-Fudo-cho, Shiori-ji, Horikawa-shi, Shimogyo-ku, Kyoto 5B034 AA01 AA02 CC01 CC03 DD01 DD02 5H209 CC03 CC09 CC13 DD04 EE11 EE18 GG04 SS01 SS05 SS07 TT10 5H220 BB05 BB10 CC09 CX01 EE07 HH04 JJ07 JJ08 JJ16 JJ17 JJ28 JJ29 JJ35 JJ38 KK01 MM08

Claims (7)

[Claims] 1. A controller comprising a CPU unit and an output unit, wherein the CPU unit and the output unit store a user program storage unit storing a user program having the same contents, and a user program storage unit stored in the user program storage unit. And a calculation unit for executing the user program, wherein the calculation results of the calculation units are compared, and the calculation result is output from the output unit only when the calculation results match. 2. The method according to claim 1, wherein the comparing of the calculation results includes:
2. The safety controller according to claim 1, wherein the operation result of the other-side operation unit is obtained and compared. 3. The output unit is provided with comparison means,
3. The method according to claim 1, wherein an operation result of each of the operation units is provided to the comparison unit, and the comparison unit determines whether or not the provided two operation results match. 4. Safety controller. 4. The CPU unit and the output unit have at least one of a self-diagnosis function for diagnosing the presence or absence of an internal failure and a cross-check function for determining whether the other party is normal. The safety controller according to any one of claims 1 to 3, wherein the operation result is output if the result is normal, and the operation result is not output if the result is not normal. . 5. The user program stored in the output unit is all of the user programs stored in the CPU unit.
The safety controller according to any one of the preceding claims. 6. A user program stored in the output unit is a part of a user program stored in the CPU unit, and the program portion is executed by a calculation unit of the output unit. 2. A program including a program.
The safety controller according to any one of claims 1 to 4, wherein 7. The safety controller according to claim 1, wherein the output unit has a communication master station function and has a function of outputting via a network.