JP2005157667A - Safety controller and system using the same - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a safety controller with which the number of wirings is reduced and a system can easily be constructed and to provide the system using the controller. <P>SOLUTION: The safety controller is provided with first and second CPUs 17 and 18 as control parts controlling safe output to an object of safe output control such as a magnet contactor based on safe input from an input device such as a safety door switch and inner safe input for logic connection from the other safety controller, semiconductor output is given as safe output. The first and second CPUs 17 and 18 judge whether inner safe input is normal or not. At abnormal time, an operation of a mechanical installation is inhibited. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a safety controller and a system using the safety controller, and more particularly to a safety controller suitable for a safety circuit of machine equipment such as a machine tool and an industrial robot, and a system using the safety controller.

  Conventionally, for example, in order to ensure occupational safety at a production site, a safety circuit using a relay unit incorporating a plurality of electromagnetic relays, that is, a machine tool, an industrial robot, etc. only when safety is ensured A safety circuit that supplies power to the power of mechanical equipment has been constructed (see, for example, Patent Document 1).

Such a relay unit monitors the state of the safety circuit based on the input signals from safety switches such as emergency stop switches and safety area sensors such as safety door switches. As long as it is shut off and the cause of the failure is not removed, it has a function of not restarting the mechanical equipment.
JP 2003-140702 A

  In a system using a relay unit incorporating such an electromagnetic relay, a safety circuit is constructed by a relay sequence. Therefore, logic is assembled by wiring, and as the number of machine tools to be controlled increases, the number of wiring increases. It becomes complicated and the design is not easy.

  Furthermore, when it is desired to change a part of the system in response to a user request, for example, in a production line configured by arranging a plurality of machine tools in each work area, a machine tool in a certain work area Even when it is desired to control start / stop in association with a machine tool in the adjacent work area, the logic must be changed by wiring, which requires a lot of time and labor.

  The present invention has been made paying attention to such points, and an object of the present invention is to provide a safety controller that reduces the number of wires and that can easily construct a system, and a system using the safety controller.

  In order to achieve the above object, the present invention is configured as follows.

  That is, the safety controller of the present invention is a safety controller that controls the operation of a mechanical facility by giving a safety output to a safety output control target based on an input from an input device, and provides a semiconductor output as the safety output. An output unit, a connection input unit to which a connection signal is given from another safety controller, a determination unit for determining whether or not the connection signal is normal, the input from the input device, and the connection signal And a control unit that controls the safety output in accordance with a program based on the determination by the determination unit.

  Here, the input device refers to a device that gives an input to the safety controller, such as an emergency stop switch, a safety door switch, a safety limit switch, and a safety light curtain.

  The safety output control target refers to a target controlled by a safety output that is an output of the safety controller, for example, a magnet contactor, a motor controller, a variable motor, a PLC, or the like.

  Mechanical equipment refers to various machine tools, industrial robots, and the like.

  Controlling the operation of the mechanical equipment means starting / stopping control of the mechanical equipment and control of the operation speed.

  The connection signal is a signal used for connection between the safety controller and another safety controller.

  According to the present invention, since the safety output unit that provides the safety output that is a semiconductor output to the safety output control target and the control unit that controls the safety output according to the program are provided, the conventional relay unit including the electromagnetic relay is provided. Thus, it is not necessary to build a safety circuit with a relay sequence, the number of wires can be reduced, and software can be used even when the manufacturer wants to change a part of the system according to the user's request. It will be possible to easily cope with this change.

  In addition, while it is possible to easily associate the safety controller with another safety controller using the connection signal, it is determined whether or not the connection signal is normal. For example, the output of another safety controller When an abnormality occurs in the connection signal due to a circuit failure or the like, it is possible to determine that the connection signal is not normal and prohibit the operation of the mechanical equipment.

  In one embodiment of the present invention, a connection output unit that provides a semiconductor output as a connection signal to another safety controller, the control unit, the input from the input device, the connection signal of the connection input unit and Based on the determination by the determination unit, the safety output and the connection signal of the connection output unit are controlled according to a program.

  According to this embodiment, another safety controller can be easily associated with the safety controller using the connection signal output from the connection output unit. For example, a plurality of machine tools are arranged in each work area. In a configured production line, a machine tool in a certain work area can easily cope with a case where it is desired to control start / stop in association with a machine tool in an adjacent work area, thereby improving expandability. To do.

  In a preferred embodiment of the present invention, the connection signal is a pulse signal having a predetermined pattern.

  The pulse signal of a predetermined pattern refers to a pulse signal of a predetermined pattern, such as a rectangular wave pulse having a predetermined combination of high level and low level, a rectangular wave pulse having a predetermined cycle or duty ratio, etc. Say.

  According to this embodiment, since the connection signal is a pulse signal having a predetermined pattern, the determination unit determines whether the pulse signal having the predetermined pattern is input, thereby determining whether the connection signal is input. Whether or not the signal is normal can be determined.

  In another embodiment of the present invention, the input from the input device is an input corresponding to a safety side or a danger side, and the safety output is a safety output corresponding to the safety side or the danger side. The connection signal is a connection signal corresponding to the safe side or the dangerous side, and the connection signal corresponding to the safe side is a rectangular wave pulse having a constant period and duty ratio.

  Here, the safe side means the side where the operation of the mechanical equipment is allowed, and the dangerous side means the side where the operation of the mechanical equipment is prohibited.

  According to this embodiment, since the connection signal corresponding to the safe side where the operation of the mechanical equipment is allowed is a rectangular wave pulse having a constant cycle and duty ratio, the determination unit has a rectangular shape having a constant cycle and duty ratio. By determining whether or not a wave pulse is input, it is possible to determine whether or not the input connection signal is normal.

  In still another embodiment of the present invention, the determination unit determines whether the pulse signal that is the connection signal is normal by measuring the widths of the high level and the low level.

  According to this embodiment, the width of the high level and the low level of the pulse signal that is the connection signal is measured to determine whether the period and the duty ratio are rectangular wave pulses, that is, the connection signal is normal. It can be determined whether or not there is.

  In one embodiment of the present invention, the connection signal is a signal for logical connection, and the control unit is based on an input from the input device and a connection signal of the connection input unit according to the program. The logic operation is performed to control the connection signal of the safety output and the connection output unit.

  Here, “for logical connection” refers to a connection for connecting other safety controllers connected to the safety controller in association with logic such as logical product or logical sum.

  According to this embodiment, the logical operation of the input signal from the input device and the connection signal from the connection input unit can be performed, and the result can be used as a safety output or a connection signal for the connection output unit. It is possible to associate safety outputs and connection signals with other safety controllers by logic such as logical product or logical sum.

  In another embodiment of the present invention, the control unit controls the output state of the connection signal of the connection output unit to the same safety side or the dangerous side as the output state of the safety output according to the program. To do.

  According to this embodiment, since the output state of the connection signal is the same as the output state of the safety output, the other safety controller to which the connection signal of the safety controller is given can output the safety output of the safety controller. It can be related to the safety output by a logical operation.

  The system of the present invention is formed by connecting a plurality of safety controllers according to the present invention via the connection input unit and the connection output unit.

  According to the present invention, unlike the conventional relay unit incorporating an electromagnetic relay, it is not necessary to construct a safety circuit by a relay sequence, and the number of wires can be reduced. Even when it is desired to change a part of the system, it can be easily handled by changing the software.

  Further, the safety controller can be easily associated with other safety controllers using the connection signal, and the expandability is improved. In addition, since it is determined whether or not the connection signal is normal, for example, when an abnormality occurs in the connection signal due to a failure in the output circuit of another safety controller, the safety controller It is possible to determine that the input connection signal is not normal and prohibit the operation of the mechanical equipment.

  As described above, according to the present invention, a safety output unit that provides a safety output that is a semiconductor output to a safety output control target, a connection input unit that is provided with a connection signal from another safety controller, and a connection signal is normal. Since it has a determination unit that determines whether or not and a control unit that controls the safety output according to a program, a safety circuit is constructed by a relay sequence like a conventional relay unit with a built-in electromagnetic relay This is unnecessary, and the number of wirings can be reduced. In addition, when the manufacturer wants to change a part of the system according to the user's request, it can be easily handled by changing the software.

  In addition, the safety controller can be easily associated with another safety controller using the connection signal, and the expandability of the system is improved.

  Furthermore, when an abnormality occurs in the connection signal from another safety controller, it is possible to determine that the connection signal is not normal and prohibit the operation of the mechanical equipment, thereby ensuring safety. .

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a diagram illustrating a configuration example of a system using a safety controller according to an embodiment of the present invention.

  The safety controller of this embodiment constitutes a safety circuit that supplies power to the power of machine equipment such as machine tools and industrial robots (not shown) only when safety is ensured.

  The safety controller of this embodiment is connected to a single function unit 3 to which an input device such as the emergency stop switch 2 is connected, and to an input device such as the safety door switch 1 as well as to the single function unit 3. There are three types: a high-function unit 4 and an extension unit 5 connected to the high-function unit 4 via a cable 6.

  The single-function unit 3 receives input from an input device such as the emergency stop switch 2 and outputs safety to a magnetic contactor as a safety output control target for supplying / cutting off electric power to a motor that drives a machine tool or the like And an internal safety output as a signal for logical connection to the high-function unit 4.

  Here, the logic connection signal is a connection signal for logically connecting the single function unit 3 that outputs the logic connection signal and the high function unit 4 to which the logic connection signal is applied.

  In this embodiment, the safety output output from the single-function unit 3 to the safety output control target and the logic connection signal have the same output state, that is, the safety output controls the operation of the mechanical equipment. When the safety-side output state is permitted, the logical connection signal is also the safe-side output state. When the safety output is a dangerous-side output state that prohibits the operation of the mechanical equipment, the logical connection signal is output. Becomes the dangerous output state.

  Therefore, a logical connection signal having the same output state as an original safety output for a safety output control target such as a magnetic contactor is called an internal safety output.

  The high-function unit 4 has an internal safety input that is an input from an input device such as an emergency stop switch or safety door switch 1 and an internal safety output that is a logical connection signal output from the single-function unit 3 or the preceding high-function unit 4. Safety output for a magnetic contactor as a safety output control target for supplying / cutting off electric power to a motor etc. that drives a machine tool etc. and internal safety as a logic connection signal for a high-functional unit 4 in the subsequent stage Output is output.

  The internal safety output, which is a logical connection signal output from the high function unit 4, is also a connection signal for logically connecting the preceding high function unit 4 and the subsequent high function unit 4 in the same manner as described above.

  Also, the safety output output from the high-function unit 4 to the safety output control target and the internal safety output that is the logic connection signal have the same output state. The high-function unit 4 can output a safety instantaneous output and a safety off-delay output, but the internal safety output is in the same output state as the safety instantaneous output.

  Here, the instantaneous safety output is a safety output that instantly switches to the dangerous side when the safety input switches from the safe side to the dangerous side when the safety output is on the safe side. Is the safety that switches to the dangerous side with a delay after continuing the safe state for the set time when the safety input switches from the safe side to the dangerous side when the safety output is on the safe side The output.

  In FIG. 1, the internal safety output given from the single-function unit 3 to the high-function unit 4 and the internal safety output given from the preceding high-function unit 4 to the subsequent high-function unit 4 are indicated by broken arrows. However, in this embodiment, the high function unit 4 is given an internal safety output from either the single function unit 3 or the preceding high function unit 4.

  The extension unit 5 is connected to the high-function unit 4 via the cable 6, and the safety output synchronized with the high-function unit 4 is used as a safety output control target for supplying / cutting off power for driving a machine tool or the like. This is output to a magnet contactor or the like.

  The single-function unit 3 is equipped with a CPU that constitutes a control unit as will be described later, and can input two safety inputs, as well as two safety instantaneous outputs that are semiconductor outputs (transistor outputs) and one internal safety output. Can be output. In this embodiment, the internal safety output that is a logic connection signal is an internal safety output for AND connection. The two safety inputs are given inputs from one emergency stop switch or the like for duplication according to safety standards.

  Further, the single function unit 3 can output a monitor output synchronized with the instantaneous safety output and an error output at the time of an internal error. Further, the single function unit 3 can input a feedback / reset input.

  As shown in the front view of FIG. 2, the single-function unit 3 includes a plurality of input / output terminals 7 on the top and bottom, as well as a power source (PWR), an error state (ERR), and safety inputs 1 and 2 (T1 , T2) and a safety instantaneous output (EI) state are respectively provided with a display unit 8 for displaying with LEDs.

  Like the single function unit 3, the high function unit 4 is equipped with a CPU as a control unit, and can input two safety inputs and one internal safety input, and two semiconductor outputs (transistor outputs). An instantaneous safety output, two safety off-delay outputs, and one internal safety output which is a signal for logical connection, and in this embodiment, an internal safety output for AND connection can be output.

  As with the single function unit 3, the two safety inputs are given inputs from one emergency stop switch, one safety door switch, or the like for duplication.

  One internal safety input is an input of an internal safety output which is a signal for logical connection from the single-function unit 3 or the preceding high-function unit 4, and the single-function unit 3 or the previous-stage input is input by this internal safety input. A logical connection is made to the high-function unit 4, and in this embodiment, an AND connection is made.

  That is, in this embodiment, this internal safety input and the two safety inputs of the high-function unit 4 are logically connected by AND, and the input state of the internal safety input is a safe side state. And when the input state of two safety inputs is the safe input state, the safe output of the safe output state is output.

  In this embodiment, as will be described later, an internal safety input (internal safety output) which is a connection signal for logically connecting the single function unit 3 and the high function unit 4 or the high function units 4 to each other is provided. It is determined whether or not it is normal, and when it is not normal, the operation of the machine equipment is prohibited to ensure safety.

  This high-function unit 4 can output a monitor output synchronized with a safety instantaneous output and an error output at the time of an internal error. Further, the high-function unit 4 can input a feedback / reset input.

  As shown in the front view of FIG. 3, the high-function unit 4 includes a plurality of input / output terminals 9 at the top and bottom, as well as a power source (PWR), an error state (ERR), and safety inputs 1 and 2 (T1 , T2), an internal safety input (AND), a feedback input (FB), a safety instantaneous output (EI), and a safety off-delay output (ED). The high-function unit 4 includes a connector 11 for connecting five extension units, and up to five extension units 5 can be connected.

  Via this connector 11, instantaneous safety output, safety off-delay output, feedback input / output of the extension unit 5 and ground signals are exchanged.

  Further, as shown in the rear view of FIG. 4, the high-function unit 4 has an opening formed in a portion to be mounted on the DIN rail, and the dip switch 12 and the rotary switch 13 are arranged so as to face the opening. The internal safety input, which is a signal for logical connection, is set to be valid or invalid, and settings such as an off-delay time are performed.

  When invalidity of the internal safety input, which is a signal for logical connection, is set, the internal safety input given from the other units 3 and 4 is invalidated and no logical connection is made.

  The expansion unit 5 is expanded as necessary when the number of output points is insufficient with the high-function unit 4 alone, and incorporates a plurality of electromagnetic relays. This extension unit 5 has an instantaneous type that outputs three safety outputs, which are relay outputs in synchronization with the safety instantaneous output from the high-function unit 4, and a relay output in synchronization with the safety off-delay output from the high-function unit 4. There is an off-delay type that outputs three safety outputs.

  As shown in the front view of FIG. 5, the extension unit 5 includes a plurality of input / output terminals 14 on the upper and lower sides, as well as a power source (PWR), an error state (ERR), a safety instantaneous output (EI), or a safety A display unit 15 for displaying each state of the off-delay output (ED) with LEDs is provided. The extension unit 5 includes a connector 16 for connecting to the high function unit 4 or for connecting the extension unit 5.

  FIG. 6 is a block diagram of the high-function unit 4. In the figure, reference numerals 17 and 18 denote two first and second CPUs that constitute a control unit and a determination unit as will be described later, and the CPUs 17 and 18 execute the same processing and are duplicated. The CPUs 17 and 18 communicate with each other for synchronizing software processing via an inter-CPU communication port.

  20 is a non-volatile memory for storing the setting contents from the setting switch 19 such as the above-described dip switch, 21 is an LED for displaying each state such as the power supply (PWR) and error state (ERR), and 22 is a delay IC. The watchdog timer 23 used is a monitoring circuit that monitors the state of the power supply circuit 24 that supplies power to each section.

  Reference numerals 25 and 26 each represent one system of duplicated safety inputs. For example, inputs from one safety door switch are given. Reference numeral 27 denotes a reset input circuit to which a feedback input or a reset input is given.

  28 is an AND input circuit to which an internal safety input which is a signal for logical connection from the single function unit 3 or the preceding high function unit 4 is given, and 29 and 30 are RS232C circuits and a changeover switch for communication with an external personal computer or the like. is there.

  31 is a safety output circuit for moment, 32 is a safety output circuit for off-delay, 33 is an output line control circuit for duplication, and 34 is an internal safety output that is a signal for logical connection to the high-functional unit 4 at the subsequent stage. Internal safety output circuit for output, 35 is a monitor output circuit for outputting a safety instantaneous output for monitoring to a programmable controller (PLC), etc. 36 is an error output circuit for giving an error output in the event of an internal error, 37 is for connecting the extension unit 5 It is a connector to do.

  The first and second CPUs 17 and 18 as the control unit are configured to output a safety output circuit according to a program based on the safety input from the safety input circuits 25 and 26 and the internal safety input from the AND input circuit 28 as the connection input unit. 31 and 32 and the internal safety output circuit 34 are controlled to control the safety output and the internal safety output which are semiconductor outputs (transistor outputs). The internal safety output circuit 34 includes a transistor for semiconductor output.

  FIG. 7 is a block diagram showing the configuration of the instantaneous safety output circuit 31, the off-delay safety output circuit 32, and the output line control circuit 33 of FIG. 6, and parts corresponding to those in FIG. A sign is attached. In FIG. 7, the signal from the first CPU 17 and the signal to the first CPU 17 are indicated by dashed arrows, and the signal from the second CPU 18 and the signal to the second CPU 18 are indicated by dashed-dotted arrows, respectively. Show.

  The instantaneous safety output circuit 31 includes two instantaneous output control units 38 and 39, and the off-delay safety output circuit 32 includes two off-delay output control units 40 and 41. Each of the output control units 38 to 41 includes a semiconductor output transistor.

  The output line control circuit 33 for duplexing the safety output includes a driving signal S1, S2 from the first and second CPUs 17, 18, a WDT signal from the watchdog timer 22, and a monitoring circuit 23 for monitoring the power supply circuit 24. PSM signals are respectively provided.

  When the driving signals S1 and S2 are both turned on, a voltage is applied to the power supply line VL and power is supplied to the output control units 38 to 41.

  The WDT signal from the watchdog timer 22 is also given to the output control units 38 to 41. When the watchdog timer 22 is not reset, this WDT signal is turned off and all the output control units 38 to 41 are turned on. Therefore, the safety output can be turned off, which is a danger side prohibiting the operation of the mechanical equipment, and safety can be ensured.

  The PSM signal from the monitoring circuit 23 for monitoring the power supply is also given to the output control units 38 to 41. When a power supply abnormality is detected, the PSM signal is turned off and all the output control units 38 are turned off. The safety output of .about.41 is turned off, which is a danger side prohibiting the operation of the mechanical equipment, and safety can be ensured.

  The output line control circuit 33 outputs monitoring signals S4 and S5 to the first and second CPUs 17 and 18, respectively. The monitoring signals S4 and S5 cause a failure (abnormality) in the output line control circuit 33. ) Or when the above-mentioned WDT signal or PSM signal is turned off.

  Instantaneous output drive signals S6 and S7 are respectively supplied from the first CPU 17 to the instantaneous output control units 38 and 39 of the instantaneous safety output circuit 31, and by these drive signals S6 and S7, a safe instantaneous output is provided. The logic of ON (safe side) / OFF (danger side) is controlled. That is, when the driving signals S6 and S7 are turned on and the above-described power supply line VL is turned on, the safety instantaneous outputs that are on the safe side are output from the instantaneous output terminals 42 and 43, respectively. To do.

  The instantaneous output control units 38 and 39 output monitor signals S9 and S10 to the first and second CPUs 17 and 18, respectively, and the instantaneous output control units 38 and 39 are normal. For example, the monitoring signals S9 and S10 are inverted logic signals of the driving signals S6 and S7.

  The off-delay output control units 40 and 41 of the off-delay safety output circuit 32 are supplied with off-delay output driving signals S12 and S13 from the second CPU 18, respectively. By the driving signals S12 and S13, The logic of the safety off-delay output on (safe side) / off (dangerous side) is controlled. That is, when the driving signals S12 and S13 are turned on and the above-described power supply line VL is turned on, an on-safety off-delay output which is a safe state is output from the off-delay output terminals 45 and 46. Output each.

  The off-delay output control units 40 and 41 output monitor signals S14 and S15 to the first and second CPUs 17 and 18, respectively. The off-delay output control units 40 and 41 are normal. If so, the monitoring signals S14 and S15 are inverted logic signals of the driving signals S12 and S13.

  The output line control circuit 33 for redundant safety output turns off the power supply line VL and outputs an instantaneous output terminal when a failure (abnormality) occurs in the instantaneous output control units 38, 39 or the off-delay output control units 40, 41. The safety outputs of 42 and 43 and off-delay output terminals 45 and 46 are all turned off to ensure safety.

  On the contrary, when a failure (abnormality) occurs in the output line control circuit 33, the instantaneous output terminals 42 and 43 and the off-delay output terminal are output by the instantaneous output control units 38 and 39 and the off-delay output control units 40 and 41, respectively. All safety outputs 45 and 46 are turned off to ensure safety.

  FIG. 8 is a block diagram of the single function unit 3, and parts corresponding to those in FIG.

  The single function unit 3 is not provided with the above-described AND input circuit 28, the off-delay safety output circuit 32, the setting switch 19, and the connector 37 for the extension unit. The same as 4.

  In this way, the control unit having the first and second CPUs 17 and 18 controls the safety output, which is a semiconductor output, in accordance with a program, so that the safety circuit is configured by a relay sequence as in a conventional relay unit incorporating an electromagnetic relay. There is no need to construct the system, and the number of wirings can be reduced. In addition, when the manufacturer wants to change a part of the system, it can easily cope with the change of the software.

  Next, the operation of each unit will be described based on some usage examples.

  FIG. 9 is a diagram showing a connection state when the high-function unit 4 is used alone, and FIG. 10 is a time chart thereof.

  In this example, for example, two contacts of one safety door switch are connected to the safety input 1 of the terminals T11 and T12 of the high-function unit 4 and the safety input 2 of the terminals T21 and T22. The b contact of the magnet contactor is connected in series, and the reset button 50 is connected in series.

  The instantaneous output terminal S13 is connected to the amplifier 52, and the off-delay output terminals S43 and S53 are connected to the magnet contactors 48 and 49. In this example, a fixed time T is set as the off-delay time.

  As the door equipped with the safety door switch is closed, the two safety inputs 1 and 2 are turned on as shown in FIGS. 10 (a) and 10 (b), and as shown in FIG. 10 (c). When the reset input is turned off, on, and off, the safety instantaneous output of the terminal S13 is turned on as shown in FIG. 10D, and the terminals S43, S43, as shown in FIG. The safety off-delay output in S53 is turned on, the main contacts of the magnet contactors 48 and 49 are turned on, and the motor 51 is driven to operate the mechanical equipment.

  In this state, for example, when the door is opened, the two safety inputs 1 and 2 are turned off. The safety inputs 1 and 2 are turned on and off at the same time. FIG. 10B shows an example in which the safety input 2 is turned off with a delay.

  When either safety input 1 or 2 is turned off, the safety instantaneous output is turned off and slowed down by the amplifier 52 as shown in FIG. 10D, and the safety off-delay output is turned off after a certain time T. By doing so, the main contacts of the magnet contactors 48 and 49 are turned off, the power supply to the motor 51 is cut off, and the operation of the mechanical equipment is stopped.

  FIG. 11 is a diagram showing a connection state between the two high-function units 4-1 and 4-2 and the off-delay type extension unit 5, and FIG. 12 is a time chart thereof. The two safety inputs of the second high-functional unit 4-2 are referred to as safety inputs 3 and 4 for convenience.

  In this example, for example, two contacts of one safety door switch are connected to the safety input 1 of the terminals T11 and T12 of the first high-function unit 4-1 and the safety input 2 of the terminals T21 and T22. The feedback loop 47 is connected in series with the b-contact of the magnet contactor and with the reset button 50 in series.

  The instantaneous output terminals S13 and S23 are connected to the magnet contactors 54 and 55, and the off-delay output terminals S33 and S43 are connected to the magnet contactors 56 and 57. In the first high function unit 4-1, T = 0 is set as the off delay time. The internal safety output terminal LO is connected to the internal safety input terminal LA of the second high function unit 4-2. That is, the internal safety output, which is a signal for logical connection of the first high-function unit 4-1, is given as an AND input of the second high-function unit 4-2 at the subsequent stage.

  The safety input 3 of the terminals T11 and T12 of the second high-function unit 4-2 and the safety input 4 of the terminals T21 and T22 are different from, for example, the safety door switch of the first high-function unit 4-1 Two contacts of one safety door switch are connected, and the feedback loop 69 is connected in series with the b-contact of the magnetic contactor and in series with the reset button 70.

  The instantaneous output terminals S13 and S23 are connected to the magnet contactors 71 and 72, and the off-delay output terminals S43 and S53 are connected to the magnet contactors 73 and 74. In the second high function unit 4-2, a predetermined time T is set as an off-delay time.

  The off-delay output terminals 75 and 76 of the extension unit 5 incorporating a plurality of electromagnetic relays are connected to the magnet contactors 77 and 78.

  As shown in FIGS. 12A and 12B, the safety door switch connected to the first high-function unit 4-1 is closed, and the two safety inputs 1 and 2 are turned on. When the reset input is turned off, on, and turned off as shown in FIG. 12C, the safety instantaneous output of the first high-function unit 4-1 is turned on as shown in FIG. As a result, the main contacts of the magnet contactors 54 to 57 of the first high-function unit 4-1 are turned on, and the motors 63 and 64 are driven. Also, the internal safety output shown in FIG. 12 (e) which is the same as the safety instantaneous output of the first high function unit 4-1 is given as the AND input (internal safety input) of the second high function unit 4-2. .

  The second high-function unit 4-2 is in a state where the internal safety input, which is the logic connection signal shown in FIG. 12 (f), is ON, and the safety output of the second high-function unit 4-2. When is on the safe side, the safety output is turned on. In FIG. 12, when the internal safety input is turned on, the door of the safety door switch connected to the second high function unit 4-2 is closed, as shown in FIGS. 12 (g) and 12 (h). In addition, since the two safety inputs 3 and 4 are on, as shown in FIG. 12 (i), the AND condition is established when the reset input is turned off, on and off, and FIG. 12 (j) , (K), the safety instantaneous output and safety off-delay output of the second high-function unit 4-2 are turned on, and the extension unit 5 is safety-off as shown in FIG. The delay output is turned on, whereby the magnetic contactors 71 to 74, 77, and 78 of the second high-function unit 4-2 and the extension unit 5 are turned on to drive the motors 79 to 81.

  In this state, for example, when the door of the safety door switch connected to the first high function unit 4-1 is opened, as shown in FIGS. 12 (a) and 12 (b), the first high function The two safety inputs 1 and 2 of the unit 4-1 are turned off, and as shown in FIG. 12D, the safety instantaneous output of the first high-function unit 4-1 is turned off and the magnet contactors 54 to 57 are turned on. The power supply to the motors 63 and 64 is cut off and the internal safety output, which is a signal for logical connection to the second high function unit 4-2, is also turned off as shown in FIG.

  The second high function unit 4-2 is shown in FIG. 12 (j) by turning off the internal safety input from the first high function unit 4-1 as shown in FIG. 12 (f). Thus, the safety instantaneous output is turned off and the magnet contactors 71 and 72 are turned off to cut off the power supply of the motor 79. Further, as shown in FIG. While the delay output is turned off, as shown in FIG. 12 (l), the safety off-delay output of the extension unit 5 is turned off, whereby the contactors 73, 74, 77, 78 are turned off and the motors 80, 81 are turned off. The power supply to will be cut off.

  In this way, the safety output of the second high-function unit 4-2 can be easily changed to the safety output of the first high-function unit 4-1 by logical connection using the internal safety output that is a signal for logical connection. Can be associated.

  FIG. 13 is a diagram showing a connection state between the single function unit 3 and the two high function units 4-1 and 4-2, and FIG. 14 is a time chart thereof. The two safety inputs of the single function unit 3 are referred to as safety inputs 5 and 6 for convenience.

  In this example, one emergency constant stop switch 82 is connected to the safety input 5 of the terminals T11 and T12 of the single function unit 3 and the safety input 6 of the terminals T21 and T22, respectively. The reset button 83 is connected. The internal safety output terminals LO1, LO2 of the single function unit 3 are connected to the internal safety input terminals LA, LA of the first and second high function units 4-1, 4-2, respectively.

  The safety input 1 of the terminals T11 and T12 of the first high-function unit 4-1 and the safety input 2 of the terminals T21 and T22 are connected to two contact points of a safety door switch, respectively. The b contact of the magnet contactor is connected in series.

  The instantaneous output terminal S13 is connected to the amplifier 52, and the off-delay output terminals S43 and S53 are connected to the magnet contactors 48 and 49. In this example, a fixed time T is set as the off-delay time.

  The safety input 3 of the terminals T11 and T12 of the second high function unit 4-2 and the safety input 4 of the terminals T21 and T22 are one safety door different from the first high function unit 4-1. Two contact points of the switch are connected to each other, and a b contact point of the magnetic contactor is connected in series to the feedback loop 84, and a reset button 85 is connected in series.

  The instantaneous output terminal S13 is connected to the amplifier 86, and the off-delay output terminals S43 and S53 are connected to the magnet contactors 87 and 88. In this example, a fixed time T is set as the off-delay time.

  In the state where the emergency stop switch 82 is not operated, as shown in FIGS. 14A and 14B, the two safety inputs 5 and 6 of the single function unit 3 are turned on. When the reset input is turned off, on, and turned off as shown in (c), the internal safety output that is a signal for logical connection of the single function unit 3 is turned on as shown in FIG. As shown in FIGS. 14E and 14J, the internal safety output is provided as an AND input to the internal safety inputs of the first and second high-function units 4-1 and 4-2, respectively.

  The first high function unit 4-1 outputs a safety output when the internal safety input, which is a logic connection signal, is turned on and when the first high function unit 4-1 is on the safe side. Turn on. In FIG. 14, when the internal safety input is turned on, the door of the safety door switch connected to the first high-function unit 4-1 is closed as shown in FIGS. 14 (f) and 14 (g). In response to the internal safety input, the safety instantaneous output and safety off-delay output are turned on in response to the internal safety input. The main contacts of the magnet contactors 48 and 49 are turned on and the motor 51 is driven.

  Similarly, in response to the internal safety input from the single function unit 3, the second high function unit 4-2 also outputs a safety instantaneous output and a safety off-delay output as shown in FIGS. Is turned on, the main contacts of the magnet contactors 87 and 88 are turned on, and the motor 89 is driven.

  When the emergency stop switch 82 connected to the single function unit 3 is operated in this state, the two safety inputs 5 and 6 of the single function unit 3 shown in FIGS. 14A and 14B are turned off. The internal safety output shown in FIG. 14 (d) is turned off. The safety inputs 5 and 6 are turned on and off at the same time, but FIG. 14B shows a case where the safety input 6 remains on.

  In the first and second high-function units 4-1 and 4-2, the internal safety output which is a signal for logical connection of the single-function unit 3, that is, the internal safety inputs in FIGS. As a result, the safe instantaneous output in FIGS. 14 (h) and 14 (m) is turned off and slowed down by the amplifiers 52 and 86. Further, as shown in FIGS. After the delay, the safety off-delay output is turned off, whereby the main contacts of the magnet contactors 48, 49, 87, 88 are turned off, and the power to the motors 51, 89 is cut off.

  In this way, the safety outputs of the first and second high-function units 4-1 and 4-2 can be easily associated with the internal safety output that is a signal for logical connection of the single-function unit 3.

  In this embodiment, when an abnormality occurs in the internal safety input (internal safety output) that is a signal for logical connection between the single function unit 3 and the high function unit 4 or between the high function units 4, for example, Failure of the internal safety output circuit of the functional unit 3 or the preceding high-function unit 4 or short-circuiting of the internal safety output, or the single-function unit 3 or the preceding high-function unit 4 is not a regular unit with a different manufacturer. In the case where an illegal signal is input with malicious intent, the operation of the mechanical equipment is prohibited to ensure safety as follows.

  That is, FIG. 15 is a signal waveform diagram of an internal safety output that is a signal for logical connection, and shows an enlarged time axis as compared with FIG.

  In this embodiment, an internal safety output which is a logic connection signal output from the single function unit 3 or the high function unit 4, and therefore an internal safety input which is a logic connection signal input to the subsequent high function unit 4. On the safe side (on side) where the operation of the machine equipment is allowed, as shown in FIG. 15A, the cycle and duty ratio are rectangular wave pulses, and the operation of the machine equipment is prohibited. On the dangerous side (off side), as shown in FIG. 15B, the signal is at a low level.

  This internal safety output is generated in the single function unit 3 or the high function unit 4 on the transmission side, for example, as follows.

  That is, the interrupt processing is started at the interrupt generation timing indicated by the arrow in FIG. 16, for example, a low level signal is generated for the interrupt generation interval T, and a high level signal is generated for a period nT that is a fixed multiple of the interval T, In addition, a rectangular wave pulse having a constant duty ratio is generated.

  In the high-function unit 4 on the receiving side where the internal safety output is input as an internal safety input, the first and second CPUs 17 and 18 having a function as a determination unit have a rectangular shape with a constant cycle and duty ratio. By determining whether or not it is a wave pulse, it is determined whether or not it is a normal internal safety input corresponding to the safe side, and when it is not normal, the operation of the mechanical equipment is prohibited.

  That is, the first and second CPUs 17 and 18 as the determination unit measure the high level width (period) and the low level width (period) of the input internal safety input, and each is within an allowable range. When the regular rectangular wave pulse is determined to be a regular rectangular wave pulse and the regular rectangular wave pulse continues for a predetermined time or more, it is determined that the internal safety input corresponding to the safe side is normal, and the logical connection is validated.

  Also, if the measured high-level width or low-level width is not within the allowable range, or if the regular rectangular wave pulse does not continue for a certain period of time, the internal safety input corresponding to the safe side is not normal. And locks out the logical connection as invalid.

  The determination process of the high-functional unit 4 on the receiving side will be described in more detail.

  In this embodiment, an interrupt process is generated using an ON / OFF edge of an internal safety input, which is a logical connection signal, as a trigger. Therefore, the timing of interrupt generation depends on the internal safety input. The first and second CPUs 17 and 18 measure the width of the high level or the low level using the generation timing of the interrupt process as a trigger, determine whether or not the pulse is a regular rectangular wave pulse, and further, the regular rectangular wave When the pulse is a wave pulse, it is determined whether or not it has continued for a certain number of times, and it is determined whether or not the internal safety input corresponding to the safe side is normal.

  FIG. 17 is a flowchart of the internal safety input determination operation by this interrupt processing.

  First, the first and second CPUs 17 and 18 start interrupt processing, read the port state corresponding to the internal safety input, and determine whether the interrupt factor is a rising edge or a falling edge (step) n1) The interrupt generation interval value stored in the timers of the first and second CPUs 17 and 18 is read (step n2), and the interrupt generation interval is checked (step n3). In this interrupt interval check, the read interrupt generation interval is compared with the normal value of the low-level width W1 shown in FIG. 15 when the interrupt factor is the rising edge, and in the case of the falling edge, Compared with the normal value of the high-level width W2 shown in FIG. 15, if the difference from the normal value is within the allowable value, it is determined as OK, and the process proceeds to step n4. To step n6.

  In step n4, it is determined whether or not the number of consecutive times determined to be OK is equal to or greater than a certain number. If the number is equal to or greater than a certain number, it is determined that the internal safety input corresponds to the safe side (ON) and interrupt processing is performed. Is finished (step n5). Further, in step n6, it is determined whether or not the number of consecutive times determined to be NG is equal to or greater than a certain number. If the number is equal to or greater than a certain number, it is determined that the internal safety input corresponds to the danger side (OFF). The interrupt process is terminated (step n7).

  In this way, the logical connection is valid only when it is determined that the internal safety input (internal safety output), which is a signal for logical connection, is normal and is determined to be normal. Safety input ensures safety without malfunction.

(Other embodiments)
In the above-described embodiment, logical connection is performed by AND. However, the logical connection is not limited to AND, and may be logical connection by OR, XOR, or the like, and a plurality of logical connections may be possible.

  In the above-described embodiment, since the logic connection signal is a rectangular wave pulse having a constant cycle and duty ratio, at least one of the cycle and duty ratio can be varied to obtain a plurality of types of connection signals. For example, logic contents such as AND and OR may be assigned and used for each type.

As another embodiment of the present invention, for example, as shown in FIG. 18, a common signal CS having a common pattern and individual signals SS having different patterns are combined to form a plurality of types of connection signals. You can also. That is, the connection signal in FIG. 18 has a common signal CS in which an ON signal having a length n times the basic length is sandwiched between OFF signals having a basic length, and a length n times the basic length. And a combination of the individual signals SS of the patterns (0... 001) to (1... 110) expressing binary numbers from 1 to 2 ⁿ −2, and 2 ⁿ −2 types of connection signals. Can be obtained.

In this connection signal, for example, when n = 3, as shown in FIG. 19, the common signal CS is (01110), and the individual signal SS is a number from 1 to 2 ³ −2 = 6. Expressed in decimal, (001), (010), (011), (100), (101), (110). Therefore, six types of connection signals can be obtained by combining the common signal CS and the individual signal SS.

  The present invention is useful for building a safety system.

It is a figure which shows the structural example of the system which concerns on one embodiment of this invention. It is a front view of the single function unit of FIG. It is a front view of the high-functional unit of FIG. It is a rear view of the high-functional unit of FIG. It is a front view of the extension unit of FIG. It is a block diagram of the high-functional unit of FIG. It is a block diagram which shows the detail of a part of FIG. It is a block diagram of the single function unit of FIG. It is a figure which shows the connection state of the 1st usage example. It is a time chart of FIG. It is a figure which shows the connection state of the 2nd usage example. It is a time chart of FIG. It is a figure which shows the connection state of the 3rd usage example. It is a time chart of FIG. It is a figure which shows the signal waveform of an internal safety input. It is a figure for demonstrating the production | generation of an internal safety input. It is a flowchart with which operation | movement description is provided. It is a figure which shows the signal for a connection. It is a figure which shows the signal for a connection.

Explanation of symbols

1 Safety Door Switch 2 Emergency Stop Switch 3 Single Function Unit 4 High Function Unit 5 Extension Unit 17, 18 First and Second CPU
31 Safety output circuit for moment 32 Safety output circuit for off-delay 34 Internal safety output circuit

Claims (8)

A safety controller that controls the operation of mechanical equipment by giving a safety output to a safety output control target based on an input from an input device,
A safety output unit for providing a semiconductor output as the safety output;
A connection input to which a connection signal is given from another safety controller;
A determination unit for determining whether or not the connection signal is normal;
A control unit that controls the safety output according to a program based on the input from the input device, the connection signal, and the determination by the determination unit;
A safety controller characterized by comprising:   A connection output unit that provides a semiconductor output as a connection signal to another safety controller, the control unit based on the input from the input device, the connection signal of the connection input unit and the determination by the determination unit, The safety controller according to claim 1, wherein the safety output and the connection signal of the connection output unit are controlled according to a program.   The safety controller according to claim 1, wherein the connection signal is a pulse signal having a predetermined pattern.   The input from the input device is an input corresponding to a safety side or a dangerous side, the safety output is a safety output corresponding to the safety side or the dangerous side, and the connection signal is the safety side 4. The safety controller according to claim 3, wherein the connection signal corresponding to the dangerous side is a rectangular wave pulse having a constant cycle and duty ratio.   The safety controller according to claim 4, wherein the determination unit determines whether the pulse signal that is the connection signal is normal by measuring a width of a high level and a low level.   The connection signal is a signal for logical connection, and the control unit performs a logical operation based on an input from the input device and a connection signal of the connection input unit according to the program, and performs the safety output. The safety controller according to any one of claims 1 to 5, which controls a connection signal of the connection output unit.   The control unit according to any one of claims 2 to 6, wherein the control unit controls the output state of the connection signal of the connection output unit to the safety side or the dangerous side that is the same as the output state of the safety output according to the program. The listed safety controller.   A system comprising a plurality of the safety controllers according to any one of claims 2 to 7 connected via the connection input unit and the connection output unit.

Images