JP2009223398A - Industrial controller - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an industrial controller for preventing any application error from being caused even when a program is executed before connection is established. <P>SOLUTION: This industrial controller is provided with: an arithmetic part for performing the arithmetic operation of a user program including a function block FB; and a status flag storage part for storing attribute information of the validity/invalidity of a signal included in the user program. An arithmetic part is provided with a function for, in computing the FB, executing the arithmetic operation of the FB under such conditions that the attribute information of all input signals is valid, and for validating the attribute information on an output signal as an arithmetic result, and for, if any invalid input signal exist, not executing the arithmetic operation of the FB. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an industrial controller.

  A network system in FA (Factory Automation) includes one or more PLCs (Programmable Logic Controllers) that control input devices and output devices in a production facility, and devices whose operations are controlled by the PLCs. Connected to the network. These PLCs and devices communicate with each other cyclically via the network of the control system, thereby sending and receiving IN data and OUT data (hereinafter referred to as I / O data) to control production facilities.

  The PLC connects a CPU unit that executes calculations based on a control program, an input device such as a sensor or a switch and inputs an on / off signal as an input signal, and an output device such as an actuator or a relay. It is composed by combining multiple units such as an output unit that sends output signals to them, a communication unit that sends and receives data to and from other devices connected to the network, and a power supply unit that supplies power to each unit. Yes. There is also an integrated PLC in which each function is mounted in one housing.

  Furthermore, recently, a fail-safe (safety) system is being introduced also in the control by PLC. That is, not only the PLC and each device itself, but also the network connecting them is configured with a built-in safety function. Here, the safety function refers to, for example, duplicating the CPU and other processing units so that correct output is performed, a network error (normal communication is not possible), an emergency stop switch being pressed, When the network system enters a dangerous state, such as when a sensor such as a curtain detects the intrusion of a person (part of the body), the fail-safe function is activated, the system becomes safe, and the operation stops. It is.

  This type of safety control system includes a safety controller and a safety I / O terminal, and is used with a cutting machine, a cutting machine, a manufacturing machine robot with an arm, and the like. The safety controller incorporates a logic operation function and input / output control function similar to those of a general programmable controller (PLC), as well as a built-in safety self-diagnosis function, thereby providing a high level of safety and reliability in its control. Secured. The safety controller has a function (fail-safe function) for forcibly performing safe control so that the self-control does not lead to danger when an abnormality is detected from the self-diagnosis result. The safety I / O terminal also has a self-diagnosis function, and has a fail-safe function in which, when an abnormality is detected based on the self-diagnosis result, the self-control does not lead to danger. Thereby, the safety control system prevents the operation of the manufacturing machine robot or the like from leading to danger.

  More specifically, the term “safety” as used herein means that standardized safety standards are included. Safety standards include, for example, IEC61508 and EN standards. IEC 61508 (International Electrotechnical Commission on Functional Safety of Programmable Electronic Systems) defines the establishment of dangerous failures per hour (Probability of Failure per Hour), which establishes the SIL level (Safety Integrity Level). ) Is classified into 4 levels. Further, EN standards require that the risk of a machine be evaluated and that risk reduction measures be taken, and EN 954-1 defines the safety categories. The safety controller, safety I / O terminal, safety control system, and the like referred to in this specification correspond to any of these safety standards.

  The safety control system may be referred to as a “safety control system”, and the safety controller may be referred to as a “safety controller” or a “safety control device”. The safety I / O terminal is sometimes referred to as a “safety slave station”, “safety slave unit”, or simply “safety slave”, and is sometimes referred to by replacing safety with “safety”.

  There is known a safety control system in which a safety controller and a safety I / O terminal are connected via a network. The safety controller has a communication master function for performing network communication with the safety I / O terminal. If the safety controller is a building block type in which a plurality of unit housings (for example, a power supply unit, a CPU unit, an IO unit, a communication unit, etc.) are combined, the communication master unit incorporates the communication master function. . The communication master unit may be referred to as “safety master station”, “safety master unit”, or “safety master”, and may be referred to by replacing safety with “safety”.

  The safety I / O terminal has a network communication function, that is, a communication slave function, with the communication master function of the safety controller. The safety I / O terminal includes a connection terminal, and at least one of an input device such as a switch for outputting an on / off signal and an output device that is an output destination of the control signal is connected to the connection terminal. Examples of the input device are an emergency stop switch SW, a light curtain, a door switch, and a two-hand switch. Examples of output devices are safety relays and contactors. These input devices or output devices also comply with safety standards. The safety I / O terminal generates control data based on a signal input from the connected safety application device, and performs network communication of the generated control data to the safety controller.

  If the safety controller is a building block type, each unit is connected to a common internal bus, and performs bus communication with the CPU unit that controls the entire safety controller to exchange data. The connected I / O unit also includes a connection terminal, and an input device for safety use or an output device for safety use is connected to the connection terminal. And the safety controller inputs the input signal of the input device input by the network communication from the safety I / O terminal via the communication master unit or the input signal of the input device connected to the connected I / O unit, The on / off of the input signal is logically calculated by a logic program stored in advance. An output signal based on the calculation result is output to the safety I / O terminal by network communication via the communication master unit or output to the connected I / O unit. The I / O unit and the safety I / O terminal output the output signal to an output device. By repeating this series of operations, the entire system including the manufacturing machine robot is controlled by the safety controller.

  Note that the communication cycle between the safety controller and the safety I / O terminal may be synchronized with the cycle of repeated execution of the safety controller or may be asynchronous. A logic program to be subjected to logic operation processing in the safety controller or CPU unit is created in advance by a programmer. The programming description at the time of creation may be, for example, ladder notation, mnemonic notation, or function block notation. In terms of programming language, it may be an interpreted language, a script language, an assembly language, a high-level language, or a Java language. Source code written in such a programming language is subjected to processing such as assembling and compiling to be executed by the CPU.

  Safety relays and contactors, which are output devices connected to the safety I / O terminal, are connected to manufacturing machine robots, processing machines, cutting machines, etc., while the contact points of the relays and contactors are on, the manufacturing machine robot Etc. operate, and the manufacturing machine robot etc. stops while the contacts are off. Therefore, the safety controller controls the operation of the operation robot or the like to be finally controlled by performing on / off control of the output device. As a specific example, when the safety controller inputs a normal operation of the emergency stop switch SW from the safety I / O terminal by communication, an output device (relay) prevents the control target from performing a dangerous operation. Or forcibly control to a safe state and immediately take the necessary safety measures. When the safety controller inputs a diagnosis result indicating that the emergency stop switch SW or other input device has an abnormality, the control target performs a dangerous operation regardless of whether the emergency stop switch SW is operated or the input device is on or off. The output device is turned off so as not to stop the operation, or it is forcibly controlled to a safe state, and the necessary safety measures are immediately taken.

  This safety control system (safety system) has a network configuration in which a safety controller 1 and a plurality of safety slaves 2 are connected to a safety network 3 as shown in FIG. The devices constituting the network such as each safety controller 1, safety slave 2, safety network 3, etc. are duplicated. In the drawing, the safety controller 1 as a master is notified via the safety network 3 that the switch for detecting an abnormal state such as an emergency stop switch is turned on from the leftmost input slave. The safety controller 1 executes a logical operation and sends OFF as I / O data to send an operation stop command to the rightmost safety slave 2. As a result, the operation of the external I / O device (output device) connected to the safety slave 2 at the right end stops, and fail-safe works.

The user program of the safety controller 1 corresponding to this safety system includes, for example, one constructed by one function block or a combination of a plurality of function blocks. As a PLC that performs an operation of a user program described using function blocks in this way, there is one disclosed in Patent Document 1.
JP 2000-276508 A

  As shown in FIG. 1, the PLC 1 that supports the communication function may cause a time lag between the execution of the program and the start of communication. In order to start communication, it is necessary to establish a connection with a communication partner (such as the safety slave 2) prior to communicating actual data such as I / O data. And when communicating with many other parties, since connections are established in an appropriate order with respect to individual communication partners, it takes time to establish connections with all communication partners. On the other hand, when the initial setting of the PLC 1 is completed upon power-on and the user program is started to be executed cyclically, the connections with all communication partners are not necessarily established when the user program is executed. In some cases, the execution of the user program may proceed while I / O data cannot be communicated with some communication partners.

  When such a shift occurs, a problem may occur depending on the application. That is, as a function block peculiar to a safety controller, there is one having an EDM (External Device Monitoring) input terminal called external device monitoring, external device monitoring, or the like. This EDM is the concept of safety itself, and safety relays have two contact points, and one of them opens when one closes.

  FIG. 2 shows an example of a control program (control system) using this EDM function block. The EDM function block FB1 evaluates an input signal and the state of an external device, and performs safety output to an external device. Actually, a feedback signal from the external device (safety relay 2c) must be taken as an input signal and input to the EDM Feed Back signal to the EDM function block FB1. Since this feedback signal inputs a contact on the opposite side to the output, if the output is turned off if the external device 2c is normal, the feedback signal is turned on. On the other hand, when relay welding occurs, the output remains OFF, but the feedback remains OFF so that an abnormality can be detected.

  That is, when the emergency stop push button switches 2a and 2b are pressed, ON is input from the emergency stop function block FB2 as an input signal of the EDM function block FB1, and accordingly, the output of the EDM function block FB1 is turned ON. The output of the safety relay 2c is turned off, and this signal is input as the EDM Feed Back signal of the EDM function block FB1, and it can be confirmed that it is normal. Further, when the emergency stop push button switch is not depressed, the output of the EDM function block FB1 remains OFF, so the output of the safety relay 2c is turned ON, and the signal is sent to the EDM function block FB1. It is input as an EDM Feed Back signal and can be confirmed to be normal. Note that the ON / OFF state associated with the pressing of the emergency stop push button switch may be reversed.

  On the other hand, if the EDM function block FB1 operates normally and the output connection is not established, the output of the EDM function block FB1 is OFF. However, since the connection is not established, communication with the safety relay 2c cannot be performed, and the EDM Feed Back signal input to the EDM function block FB1 remains OFF. Then, both the output of the EDM function block FB1 and the EDM Feed Back signal are in the same state, and the EDM function block FB1 erroneously determines that it is abnormal.

  As a function peculiar to safety control, when such a failure occurs, the function block FB1 is in an abnormal state, and an operation for canceling the abnormality is required to restore this to the normal state. Therefore, if communication is not started and the program is executed before the data from the external device arrives, a mismatch occurs between the output result from the program and the feedback input from the external device, and the user performs the release operation. Otherwise, the problem arises that the system cannot be operated.

  As a countermeasure, a program for intentionally operating a feedback signal from an external device can be added only at the time of startup. For example, as shown in FIG. 3, a JMP instruction of a processing program for slave I / O is described. In this way, when the input condition of the JMP instruction is ON, the slave I / O process is executed without jumping, and when the input condition of the JMP instruction is OFF, the jump is executed and the slave I / O process is not performed. It becomes like this. Therefore, by writing the program so that the input condition is turned off until the connection is established, it is possible to prevent the program for the external device that is the connection destination of the connection from being executed before the connection is established.

  However, writing a program that includes the JMP instruction as described above adds processing that is essentially unnecessary, so as the number of communication partners increases, the program creation time increases, the program capacity increases, and the program readability increases. Problems such as degradation occur. Furthermore, as shown in FIG. 3, if the processing for the slave as a connection partner can be jumped in a lump, the function signal (FB1 output signal of FB1) in the program as shown in FIG. In such a case, it is often difficult and troublesome to insert a JMP instruction in the case where there is an influence on whether or not a connection can be established with respect to the EDM Feed Back signal.

  In order to solve such a problem, a PLC having a function of executing a program after waiting for communication has been developed. However, even if a function for executing a program after waiting for the start of communication is used, if there is a partner whose connection cannot be established due to a failure or the like, the entire user program cannot be executed. In order to avoid this problem, it is possible to execute the program without waiting for the start of communication when a preset time has elapsed, in which case the occurrence of the above application error should be prevented. I can't.

  The present invention provides an industrial controller that allows a user to create a program without being conscious of communication settings and communication status, and that no application error occurs even if the program is executed before the connection is established. The purpose is to do.

  In order to achieve the above-described object, an industrial controller according to the present invention includes (1) an arithmetic unit that executes a user program including a POU, which is a program constituent unit composed of a plurality of instruction words, and a user program. An attribute information storage unit that stores valid / invalid attribute information of the included signal, and when the calculation unit performs a POU calculation, the calculation unit accesses the attribute information storage unit and inputs all of the POUs to be calculated On the condition that the signal is in the valid state, the calculation of the POU is executed, the attribute information stored in the attribute information storage unit for the output signal as the calculation result is set in the valid state, and even one input signal in the invalid state If there is, the operation of the POU is not executed.

  (2) The attribute information about the input signal received by communication is stored in the attribute information storage unit so as to be in an invalid state until communication is started and to be in an effective state after the connection is established and the first data is received. Means for updating the attribute information to be updated.

  (3) The attribute information about the input signal from the I / O terminal possessed by the industrial controller itself is stored in the attribute information storage unit so that the initial value is invalidated and the initial value is received and then valid. It is preferable to provide means for updating the attribute information.

  (4) When there is even one invalid input signal and the POU calculation is not executed, the calculation unit may have a function of invalidating the attribute information of the signal indicating the calculation result of the POU.

  (5) The industrial controller can be used in a safety system in which a fail-safe is activated when a safe operation cannot be guaranteed and the controlled device becomes safe and stops operating.

  POU is an abbreviation for “Program Organization Unit” and is also referred to as a program configuration unit. This POU is a minimum unit in program management composed of a plurality of instruction words, and is called a program, function, or function block. The program can be reused in this POU unit.

  The industrial controller is a controller for FA and includes not only PLC but also controller called PAC (Programmable Automation Controller). This PAC has the high accuracy and durability of a PLC in addition to the high speed, high functionality, and function expandability of a personal computer. The PAC, like the PLC, communicates with the equipment of the production facility via the network to transmit / receive I / O data and control the production facility.

  In the present invention, the attribute information of a signal used by a program created by a user is stored and held inside the industrial controller (attribute information storage unit). The calculation unit sequentially executes the user program. However, when the execution target becomes the POU, the calculation unit does not immediately execute the calculation but checks the attribute signal of the input signal of the processing target POU. The attribute information becomes valid when valid data is input, and is invalid until then.

  Therefore, all input signals to the POU are already connected and can be normally communicated (I / O data can be transmitted / received) as well as I / O that can be connected to the I / O data and connected to itself. When the POU is composed only of a signal whose attribute information is valid, such as an input signal from a device or an output signal of a POU operating normally, the POU is calculated. On the other hand, by disabling the attribute information of the input signal from the communication partner with which the connection is not established, it is not necessary to execute the POU calculation executed by the input signal.

  Thus, for example, in a program in which the output signal of the EDM function block is given to the safety relay and the inverted signal from the safety relay is given to the EDM Feed Back signal, the user program is not connected to the safety relay. Even if the calculation processing is performed, the attribute information of the EDM Feed Back signal, which is the input signal of the function block, is invalidated, so that the function block is not calculated and an abnormality can be avoided. .

  Therefore, even if there is an external device or the like in which connection is not established in part, it is possible to start execution of the user program. Furthermore, when creating a user program, the user does not need to consider whether or not a connection has been established and its timing. Of course, the EDM function block shows an example, and the same applies to other blocks.

  According to the present invention, a program can be created without the user being aware of communication settings and communication status, and even if the program is executed before the connection is established, an application error does not occur.

  FIG. 4 shows an example of a network system to which the present invention is applied. The PLC 10 and a plurality of remote devices 20 are subscribed to the same network 30. The remote device 20 is connected to one or a plurality of I / O devices, and a device that connects a plurality of I / O devices is also called a remote I / O or a remote terminal. This network system constructs a safety system in which when a safe operation cannot be guaranteed, a fail safe is activated and the controlled device becomes safe and stops operating. Therefore, the remote device 20, the PLC 10, and the network 30 adopt a configuration that complies with the safety network system.

  Briefly describing the safety network system, for example, sensing information detected by a safety input device is transmitted from the remote device 20 to a predetermined PLC 10 via the network 30. The PLC 10 analyzes the acquired sensing information and sends a control command to the safety output device (the remote device 20 to which the device is connected) that should operate based on the sensing result. When an abnormal situation occurs, the safety output device is operated on the safe side. In some cases, commands may be sent directly from the safety input device to the safety output device.

  In this embodiment, the PLC 10 is a building block type. In the figure, the PLC 10 includes a CPU unit 11, an I / O unit 12, and a communication unit 13, but in addition, a power supply unit, a high-functional unit and other various types as necessary. Units are connected. As shown in FIG. 5, in the case of the PLC 10, the units 11, 12, and 13 are connected by an internal bus 10a, and send / receive I / O data and messages via the internal bus 10a. In the case of a safety PLC, the internal bus 8a is also duplicated.

  The CPU unit 11 includes an MPU 11a, a RAM 11b, a nonvolatile memory 11c, a display unit 11e, a setting unit 11f, and a bus control unit 11h. The MPU 11a cyclically executes and executes the user program, and controls the devices constituting the safety network system. The RAM 11b functions as a work memory when the MPU 11a performs an operation, an IO memory that stores I / O data, and the like. The non-volatile memory 11c stores various setting data set via a tool or setting unit 11f, a user program, and the like. The display unit 11e includes, for example, a display lamp (alarm lamp) indicating an operation state (communication state) such as an LED or abnormality / normality, and a message display function using a liquid crystal panel or an EL panel. The setting unit 11f is a switch for setting an address. The bus control unit 11h is an interface (physical layer) for the internal bus 10a, and the MPU 11a transmits / receives data to / from a predetermined unit via the bus control unit 11h.

  The I / O unit 12 includes an MPU 12a, a RAM 12b, a nonvolatile memory 12c, a display unit 12d, a setting unit 12e, an I / O drive circuit 12f, and a bus control unit 12g. The MPU 12a receives a message acquired via the internal bus 10a, executes predetermined processing, generates and returns a response, and executes control and the like for the connected I / O device. The RAM 12b functions as a work memory used when the MPU 12a executes processing. The nonvolatile memory 12c stores various setting data and the like. The display unit 12d is, for example, an operation state (communication state) such as an LED or a display lamp (alarm lamp) indicating abnormality / normality. The setting unit 12e is a switch for setting parameters such as an address. The I / O drive circuit 12 f transmits and receives I / O data to and from external I / O devices such as input devices and output devices connected to the I / O unit 12. Assuming that the I / O device takes a binary value of ON / OFF, in the case of an output device, the I / O drive circuit 12f controls ON / OFF of the operation of the output device in accordance with an instruction from the MPU 12a. . When the I / O device is an input device, the I / O drive circuit 12 has a function of transmitting the state of the I / O device to the MPU 12a. It is also possible to control the operation of the output device by providing an open / close switch in the electric circuit and opening / closing the open / close switch. The bus control unit 12g is an interface (physical layer) for the internal bus 10a, and the MPU 12a transmits / receives data to / from a predetermined unit via the bus control unit 12g.

  The communication unit 13 includes an MPU 13a, a RAM 13b, a nonvolatile memory 13c, a display unit 13d, a setting unit 13e, a communication physical layer 13f, and a bus control unit 13g. The MPU 13a executes communication processing with the CPU unit 11 and communication processing with an external device. This communication process includes a predetermined I / O data transmission / reception process (including a transfer process), a process for a received message addressed to itself, and a response return process.

  The RAM 13b functions as a work memory used when the MPU 13a executes processing. The nonvolatile memory 13c stores various setting data and the like. The display unit 13d is, for example, an operation state (communication state) such as an LED or a display lamp (alarm lamp) indicating abnormality / normality. The setting unit 13e is a switch for setting parameters such as an address and a communication speed. The communication physical layer 13f is a physical layer corresponding to the communication protocol of the connected network, and is also referred to as a communication interface. The bus control unit 13g is an interface (physical layer) for the internal bus 10a, and the MPU 13a transmits / receives data to / from a predetermined unit via the bus control unit 13g.

  FIG. 6 is a block diagram showing the internal structure of the remote device 20. The remote device 20 connects I / O devices such as one or more sensors, switches, relays, other safety input devices and safety output devices. The remote device 20 includes an MPU 20a, a RAM 20b, a nonvolatile memory 20c, a display unit 20d, a setting unit 20e, a communication physical layer 20f, and an I / O drive circuit 20g. The MPU 20a receives a message acquired via the network 30, executes a predetermined process, generates and returns a response, and executes control on the connected I / O device. In other words, this I / O device control is performed by, for example, acquiring I / O data (IN data) of an input device such as a connected sensor or switch and transmitting it to the PLC 10 or the like that is connected at a predetermined timing. In the case where an output device such as an actuator or a relay is connected, I / O data (OUT data) sent from the PLC 10 or the like is acquired and the connected output device is operated.

  The RAM 20b functions as a work memory used when the MPU 20a executes processing. The nonvolatile memory 20c stores various setting data and the like. The display unit 20d is, for example, an operation state (communication state) such as an LED or a display lamp (alarm lamp) indicating abnormality / normality. The setting unit 20e is a switch for setting an address. The communication physical layer 20f is a physical layer corresponding to the communication protocol of the connected network 30, and is also referred to as a communication interface, and exchanges I / O data, various messages, and the like with the communication unit 13 serving as a master. . The I / O drive circuit 20g is connected to an external I / O device such as an input device or an output device, and transmits / receives I / O data. Assuming that the I / O device takes a binary value of ON / OFF, in the case of an output device, the I / O drive circuit 20g controls ON / OFF of the operation of the output device in accordance with an instruction from the MPU 20a. . When the I / O device is an input device, the I / O drive circuit 20g has a function of transmitting the state of the I / O device to the MPU 20a. It is also possible to control the operation of the output device by providing an open / close switch in the electric circuit and opening / closing the open / close switch. When the remote device 20 can connect a plurality of I / O devices like a remote terminal, the I / O drive circuit 20g has a plurality of terminal portions for connecting the I / O devices. Individual control is performed on the terminal section (I / O data transmission / reception, etc.).

  Here, in the present embodiment, attribute information (status flag) indicating whether or not the signal is valid is added to a signal (I / O data) used by a user-created program (user program). When the CPU unit executes a user program, the MPU 11a, which is a calculation unit, executes the flowchart shown in FIG. 7 when executing a POU that is a program constituent unit composed of a plurality of instruction words such as function blocks. With functionality. That is, the MPU 11a sequentially executes the user program, and when the processing target becomes a function block, the MPU 11a does not immediately execute the calculation, but checks the attribute of the input signal of the function block (S1, S2). When all the attribute information is valid (S2 is Yes), the MPU 11a executes the function block and validates the attribute information of the output signal that is the execution result of the function block (S3, S3). S4). On the other hand, when there is even one input signal with invalid attribute information (No in S2), the MPU 11a does not execute the function block program (S5). Accordingly, since the initial value of the attribute information is invalid, the attribute information of the output signal of the non-executed function block remains invalid. At this time, a process of updating to an invalid state may be performed.

  As an example, it is assumed that the user program is configured as shown in FIG. In this user program, first, two signals of the terminal 0 of the remote device A and the terminal 0 of its own IO unit are input to the first function block FB11, and the operation result (output signal) of the first function block FB11 is obtained. It is input to one of the third function blocks FB13. On the other hand, two signals of the terminal 0 of the remote device B and the terminal 1 of its own IO unit are input to the second function block FB12, and the operation result (output signal) of the second function block FB12 is the third function block FB3. Is output to the terminal 0 of the remote device C. Then, the calculation result (output signal) of the third function block FB13 is given to the terminal 10 of its own I / O unit.

  As a premise, the initial value of the attribute information of all I / O data becomes invalid, and when the connection is established and regular data can be received (in the case of a remote device), or when data is received (I / O unit) ), The attribute information is effectively switched. In the above program, the attribute information of the signal at the terminal 0 of the remote device A and the signal at the terminal 0 of the I / O unit is invalid (data received from the I / O unit that has not established a connection with the remote device) The attribute information of the signals from the terminal 0 of the remote device B and the terminal 1 of the I / O unit is valid.

  Then, since the first function block FB11 is invalid for the attribute information of all the input signals, the calculation is not performed, and the attribute information of the output signal also remains invalid. On the other hand, since the attribute information of all input signals is valid for the second function block FB12, the calculation is executed, and the attribute information of the output signal is also switched effectively.

  In the third function block FB13, since the input signal from the first function block FB11 remains in an invalid state, the calculation is not executed and the attribute information of the output signal also remains in an invalid state.

  In this state, if both the attribute information of the two signals of the terminal 0 of the remote device A and the terminal 0 of its own IO unit become valid, the first function block FB11 is executed, The result is output (attribute information: valid). Then, since all the input signals of the third function block FB13 are valid, the third function block FB13 is also operated and the output is given to the terminal 10 of the I / O unit.

  Therefore, for example, in the case of the EDM function block FB1 shown in FIG. 2, the attribute information of the EDM Feed Back signal is invalid until the connection with the external safety relay 2c is established. The function block FB1 is not subjected to computation. Therefore, since it is not checked whether the relationship between the output signal and the EDM Feed Back signal is in the determination state, it is not determined that the output signal is in the abnormal state. When the connection with the safety relay 2c is established, data can be normally received, the attribute information of the EDM Feed Back signal becomes valid, and the attribute information of other input signals becomes valid, the EDM function block FB1 is executed, and it is checked whether there is an abnormal state as to whether the output signal and the EDM Feed Back signal are in an inverted relationship. If it is not in the reverse state at this time, it can be determined that there is an abnormality in the device.

  In order to execute the above processing, a status flag storage unit 16 is provided in the RAM 11b of the CPU unit 11 in association with the IO memory 15 as shown in FIG. The status flag storage unit 16 is uniquely associated with each I / O data stored in the IO memory 15, and stores information (attribute information) indicating whether each I / O data is valid (1) or invalid (0). Is done. The relationship between the storage area (address) of the IO memory 15 and the storage area (address) of the status flag storage unit 16 is managed by another table or the like, and the MPU 11a accesses the IO memory 15 when executing an operation. When the input signal is acquired, the status flag storage unit 16 is accessed to check the corresponding attribute information, and when the output signal obtained by executing the function block is stored in the IO memory, it is associated with it. The attribute information of the corresponding area in the received status flag storage unit 16 is effectively updated.

  Also, since the IO memory for storing the I / O data for the remote device 20 of the communication partner is prepared in the RAM 13b of the communication unit 13, the attribute information of the I / O data stored in the IO memory is stored. Similarly, a status flag storage unit for storage is prepared and managed in the RAM 13b.

  The invalid / valid management of the status flag storage unit 16 is performed by the MPU 11a as follows. That is, the initial values of the status flag storage unit 16 are all invalid (0). As described above, with respect to the storage area of the status flag storage unit 16 corresponding to the output signal of the function block, as described above, the RAM 11a of the CPU unit 11 calculates and executes the program and outputs the output signal (IO memory). And the attribute information of the signal is updated to valid (1).

  As for the input signal, I / O data is sent to the CPU unit 11 at a predetermined timing (I / O refresh) from the I / O unit to which the communication unit 13 or the input device is connected. The attribute information is added to the I / O data and sent. Then, the MPU 11a stores the acquired I / O data in a predetermined area of the IO memory, and stores the acquired attribute information in the storage area of the corresponding status flag storage unit 16. Although the attribute information is transmitted from the I / O unit or the communication unit 13, the attribute information may be added to all I / O data every time, or when the state is switched from the invalid state to the valid state. It may be sent once or several times thereafter and not sent after that. To switch from the invalid state to the valid state, for example, a flag indicating whether or not the attribute information has been sent is prepared, and when the attribute information is valid when the attribute information is not sent, there is a switch to the valid state. It can be handled by judging that

  Further, the MPU 13a switches the I / O data of each remote device to the IO memory, which is switching from the invalid state to the valid state (especially for the input signal) stored in the status flag storage unit 16 in the communication unit 13. Since the storage area is known, the attribute information of the storage area of the status flag storage unit 16 corresponding to the I / O data is validated on the condition that the connection is established and the I / O data is received from the remote device. It can be managed by rewriting.

  The I / O unit 12 also basically has functions and configurations for performing the same processing as described above except that it is not necessary to determine connection establishment. That is, when the MPU 12a of the I / O unit 12 receives I / O data from an input device connected to the I / O unit 12, the MPU 12a performs a process of switching the attribute information of the signal from invalid to valid. Further, when sending I / O data to the CPU unit 11, attribute information is added to the I / O data. And the process which adds the attribute information and transmits may be performed every time, and may be sent once or several times after switching to the valid state.

  Note that once the attribute information is switched to “valid”, no further monitoring / updating processing is required. This is because after the connection is established, it is possible to monitor a normal network (device abnormality / failure occurrence).

  In the above-described embodiment, an example in which a “function block” that is a block having input / output variables and internal variables is included in the program has been described. However, the present invention is not limited to a function block, for example, a PLC or the like The block may be a “function” that does not have an internal variable, and may be a “program” that is a main program including I / O and global variables. Thus, the present invention can be applied to POU (Program Organization Unit) such as “function block”, “function”, and “program”. In any case, until the attribute information of all input signals becomes valid, the POU is not executed. When the attribute information of all input signals becomes valid, the calculation is executed and the attribute information of the output signal is obtained. Update effectively.

It is a figure which shows the whole system. It is a figure which shows an example of the program using the function block with EDM. It is a figure which shows an example of the conventional program. A diagram showing the entire system. It is a figure which shows the internal structure of PLC. It is a figure which shows the internal structure of a remote apparatus. It is a flowchart which shows the function of MPU (calculation part) of a CPU unit. It is a figure explaining an operation principle. It is a figure which shows the data structure of IO memory and a status flag memory | storage part.

Explanation of symbols

10 PLC (industrial controller)
11 CPU unit 11a MPU (calculation unit)
12 I / O unit 13 Communication unit 15 IO memory 16 Status flag storage unit (attribute information storage unit)
20 Remote device

Claims (5)

A computing unit that computes and executes a user program including a POU that is a program constituent unit composed of a plurality of instruction words;
An attribute information storage unit for storing valid / invalid attribute information of signals included in the user program;
With
When calculating the POU, the calculation unit accesses the attribute information storage unit and executes the calculation of the POU on condition that all input signals for the calculation target POU are valid. The attribute information stored in the attribute information storage unit for the output signal as the calculation result is made valid, and if there is even one invalid input signal, the operation of the POU is not executed. Industrial controller.   The attribute information about the input signal received by communication is stored in the attribute information storage unit so as to be invalid until communication is started and to be valid after the connection is established and the first data is received. 2. The industrial controller according to claim 1, further comprising means for updating the attribute information.   The attribute information about the input signal from the I / O terminal of the industrial controller itself is stored in the attribute information storage unit so as to invalidate the initial value and to make the valid state after receiving the first input signal. The industrial controller according to claim 1, further comprising means for updating the attribute information.   The arithmetic unit includes a function of invalidating attribute information of a signal indicating a calculation result of a POU when there is an input signal in an invalid state and no POU calculation is performed. The industrial controller according to any one of claims 1 to 3.   5. The industrial controller according to claim 1, wherein the industrial controller is used for a safety system in which a fail-safe function is activated when a safe operation cannot be guaranteed and the control target device becomes a safe side and stops operating. The industrial controller according to claim 1.

Images