WO2024070540A1

WO2024070540A1 - Control system

Info

Publication number: WO2024070540A1
Application number: PCT/JP2023/032449
Authority: WO
Inventors: 楓武知; 靖啓衣笠; 康之田中
Original assignee: パナソニックＩｐマネジメント株式会社
Priority date: 2022-09-29
Filing date: 2023-09-06
Publication date: 2024-04-04

Abstract

In the present invention, a notification board (54), which is a safety-related part, is provided with: non-volatile memories (54c, 54d); and master processors (54a, 54b) that execute a storage process for receiving safety-related parameters from non-safety-related parts and storing said parameters in the non-volatile memories (54c, 54d), and a parameter transfer process for reading the safety-related parameters from the non-volatile memories (54c, 54d) and transferring said parameters to a monitoring board (53), which is a safety-related part. The monitoring board (53) is provided with first slave processors (53a, 53b) that execute a reception process for receiving the safety-related parameters that were transferred in the parameter transfer process, and a calculation process in which the safety-related parameters are used.

Description

Control System

This disclosure relates to a control system that controls equipment such as robots.

Patent document 1 discloses a control system for controlling equipment.

JP 2018-136715 A

In a control system that controls equipment, it is possible to provide multiple boards with processors as safety-related parts that comply with standards such as ISO 13849-1 Category 3. In such a case, providing each of the multiple boards with non-volatile memory that stores safety-related parameters poses problems such as the risk of failure of the non-volatile memory and high costs.

This disclosure has been made in light of these points, and its purpose is to reduce the risk of failure of non-volatile memory that stores safety-related parameters and to reduce costs in a control system that has multiple boards as safety-related parts.

In order to achieve the above object, the present disclosure provides a control system for controlling equipment, comprising a non-safety-related unit that outputs safety-related parameters in response to a predetermined input, and a master board and a slave board that are safety-related units that conform to Category 3 of ISO 13849-1 and execute predetermined processing using the safety-related parameters, the master board having a non-volatile memory and a master processor that executes a storage process that receives the safety-related parameters from the non-safety-related unit and stores them in the non-volatile memory, and a parameter transfer process that reads the safety-related parameters from the non-volatile memory and transfers them to the slave board, and the slave board has a reception process that receives the safety-related parameters transferred in the parameter transfer process, and a slave processor that executes arithmetic processing using the safety-related parameters.

As a result, safety-related parameters are sent from the master processor to the slave processor, so there is no need to provide a non-volatile memory for storing the safety-related parameters on the slave board. This reduces the risk of non-volatile memory failure and cuts costs compared to providing non-volatile memory on both the master board and the slave board.

Furthermore, if the non-volatile memory for storing safety-related parameters is provided only on the master board and not on the slave board, the user only needs to set the safety-related parameters and check whether the safety-related parameters have been correctly set in the non-volatile memory on the master board, and does not need to do so on the slave board. For example, checking whether the safety-related parameters output by the non-safety-related section match the safety-related parameters set in the non-volatile memory only needs to be done on the master board, and does not need to be done on the slave board. Therefore, the effort required for setting and checking safety-related parameters can be reduced compared to when non-volatile memory is provided on both the master board and the slave board.

This disclosure makes it possible to reduce the risk of non-volatile memory failure and cut costs while minimizing the effort required for setting and checking safety-related parameters.

FIG. 1 is a block diagram showing a configuration of a robot control system according to an embodiment of the present disclosure. FIG. 1 is a block diagram showing a main part of a robot control system according to an embodiment of the present disclosure. 13 is a flowchart showing an operation of the master processor during a parameter transfer process. 13 is a flowchart showing an operation of the first slave processor during a parameter transfer process.

Below, embodiments of the present disclosure are described in detail with reference to the drawings. The following description of the preferred embodiment is merely exemplary in nature and is in no way intended to limit the present disclosure, its applications, or its uses.

FIG. 1 shows the configuration of a robot control system 1 according to this embodiment. This robot control system 1 controls a robot 2 as a device.

The robot control system 1 has a teach pendant 3, an area sensor 4, and a controller 5.

The robot 2 has nine motors 21 and nine encoders 22 that detect and output the position of the rotation axis of the corresponding motor 21. Some of the motors 21 and encoders 22 are not shown in FIG. 1. Each robot 2 is a six-axis robot with six rotary joints, and six of the nine motors 21 are motors that rotate the rotary joints, and three motors 21 are motors for external axes (not shown).

The teach pendant 3 has an input section 31, an operation input board 32, and a TP side communication board 33.

The input unit 31 accepts input from a user and outputs an input signal corresponding to the input.

The operation input board 32 generates operation input information based on the input signal output by the input unit 31, and transmits it to the TP side communication board 33 using the communication method specified in IEC 61784-3.

The TP-side communication board 33 receives the operation input information sent by the operation input board 32 and sends it to the controller 5 via the communication medium M. The TP-side communication board 33 is a non-safety-related part.

The area sensor 4 outputs a detection result indicating whether or not a person is within the working range of the robot 2.

The controller 5 controls the robot 2. The controller 5 includes a main control board 51, a sensor input board 52 as a slave board, a monitoring board 53 as a slave board, a notification board 54 as a master board, a motor control unit 55, and nine amplifiers 56.

The signal output by the teach pendant 3 is input to the main control board 51 as a specified input, and safety-related parameters are set according to this signal. The main control board 51 then outputs the set safety-related parameters. The main control board 51 is a non-safety-related part.

The sensor input board 52 generates sensor input information that indicates the detection results output by the area sensor 4.

The monitoring board 53 generates and outputs monitoring information based on the output of the nine corresponding encoders 22, which indicates whether or not the safety conditions are met, that is, the positions (angles) of the rotation shafts of the nine motors 21 that rotate the rotary joints are within a safety area and the speeds of the rotation shafts of the nine motors 21 are less than the speed limit. The monitoring board 53 also refers to a notification signal (described below) output by the notification board 54, and if the notification signal is at a low level, outputs a stop signal to the amplifier 56, thereby bringing the robot 2 to an emergency stop.

The notification board 54 can perform a reception process to receive operation input information, sensor input information, and monitoring information, and a notification signal output process to generate a notification signal related to the robot 2 based on this information and output it to the outside.

The motor control unit 55 controls the nine motors 21 by controlling the nine amplifiers 56.

The amplifier 56 stops the motor 21 when a stop signal is output from the monitoring board 53. When a stop signal is not output from the monitoring board 53, the amplifier 56 can rotate the motor 21 under the control of the motor control unit 55.

The notification board 54, monitoring board 53, sensor input board 52, and operation input board 32 are safety-related parts that comply with Category 3 of ISO13849-1 and perform specified processing using safety-related parameters.

As shown in FIG. 2, the notification board 54 has two

master processors

54a and 54b,

non-volatile memories

54c and 54d corresponding to the

master processors

54a and 54b, and

volatile memories

54e and 54f corresponding to the

master processors

54a and 54b. That is, the notification board 54 has two

non-volatile memories

54c and 54d. Each of the

master processors

54a and 54b executes a storage process for receiving the safety-related parameters from the main control board 51 and storing them in the

non-volatile memories

54c and 54d corresponding to the

master processors

54a and 54b, and a parameter transfer process for reading the safety-related parameters from the

non-volatile memories

54c and 54d and transferring the safety-related parameters to the monitoring board 53, the sensor input board 52, and the operation input board 32 with test data added. The test data is a CRC value of a CRC (Cyclic Redundancy Check). Additionally, each of the

master processors

54a, 54b executes a first calculation process using a portion of the safety-related parameters stored in the corresponding

non-volatile memory

54c, 54d. The first calculation process includes the above-mentioned notification signal output process that generates a notification signal for controlling the robot 2.

Each

master processor

54a, 54b further determines whether the first calculated value obtained in the first calculation process matches the first calculated value output by the

other master processor

54a, 54b. The first calculated value is a result of the first calculation process, or a calculated value obtained during the first calculation process. Each

master processor

54a, 54b continues processing if the first calculated value obtained by each

master processor

54a, 54b matches the first calculated value obtained by the

other master processor

54a, 54b, but stops the robot 2 if they do not match a predetermined number of times.

The monitoring board 53 has two

first slave processors

53a, 53b and volatile memories 53c, 53d corresponding to the

first slave processors

53a, 53b. Each of the

first slave processors

53a, 53b executes a reception process to receive the safety-related parameters transferred by the

master processors

54a, 54b of the notification board 54 together with the inspection data, and stores the safety-related parameters received in the reception process in the corresponding volatile memory 53c, 53d. Each of the

first slave processors

53a, 53b further executes a second calculation process using the safety-related parameters stored in the corresponding volatile memory 53c, 53d. The second calculation process includes the above-mentioned process of generating the monitoring information, and a process of generating the stop signal based on the notification signal from the notification board 54.

Each of the

first slave processors

53a, 53b further determines whether the second calculated value obtained in the second arithmetic process matches the second calculated value output by the other of the

first slave processors

53a, 53b. The second calculated value is a result of the second arithmetic process, or a calculated value obtained during the second arithmetic process. Each of the

first slave processors

53a, 53b continues processing if the second calculated value obtained by each of the

first slave processors

53a, 53b matches the second calculated value obtained by the other of the

first slave processors

53a, 53b, but stops the robot 2 if they do not match a predetermined number of times.

The sensor input board 52 has two

second slave processors

52a, 52b and

volatile memories

52c, 52d corresponding to each of the

second slave processors

52a, 52b. Each of the

second slave processors

52a, 52b executes a reception process to receive the safety-related parameters transferred by the

master processors

54a, 54b of the notification board 54 together with the inspection data, and stores the safety-related parameters received in the reception process in the corresponding

volatile memory

52c, 52d. Each of the

second slave processors

52a, 52b further executes a third calculation process using the safety-related parameters.

Each

second slave processor

52a, 52b further determines whether the third calculated value obtained in the third calculation process matches the third calculated value output by the other

second slave processor

52a, 52b. The third calculated value is a result of the third calculation process, or a calculated value obtained in the course of the third calculation process. Each

second slave processor

52a, 52b continues processing if the third calculated value obtained by each

second slave processor

52a, 52b matches the third calculated value obtained by the other

second slave processor

52a, 52b, but stops the robot 2 if they do not match a predetermined number of times.

The operation input board 32 has two

third slave processors

32a, 32b and

volatile memories

32c, 32d corresponding to each of the

third slave processors

32a, 32b. Each of the

third slave processors

32a, 32b executes a reception process to receive the safety-related parameters transferred by the

master processors

54a, 54b of the notification board 54 together with the inspection data via the main control board 51 and the TP side communication board 33. Each of the

third slave processors

32a, 32b stores the safety-related parameters received in the reception process in the corresponding

volatile memory

32c, 32d. Each of the

third slave processors

32a, 32b further executes a fourth calculation process using the safety-related parameters.

Each of the

third slave processors

32a, 32b further determines whether the fourth calculated value obtained in the fourth calculation process matches the fourth calculated value output by the other

third slave processor

32a, 32b. The fourth calculated value is a result of the fourth calculation process, or a calculated value obtained during the fourth calculation process. Each of the

third slave processors

32a, 32b continues processing if the fourth calculated value obtained by each of the

third slave processors

32a, 32b matches the fourth calculated value obtained by the other

third slave processor

32a, 32b, but stops the robot 2 if they do not match a predetermined number of times.

In the robot control system 1 configured as described above, when a user inputs a predetermined value to the teach pendant 3 to set a safety-related parameter, the teach pendant 3 outputs a signal corresponding to the input to the controller 5. The signal output by the teach pendant 3 is input as a predetermined input to the main control board 51 of the controller 5, and a safety-related parameter corresponding to the signal is set. The main control board 51 then outputs the set safety-related parameter to the notification board 54. Each of the

master processors

54a, 54b of the notification board 54 receives the safety-related parameter from the main control board 51 and executes a storage process to store the parameter in the

non-volatile memory

54c, 54d corresponding to each of the

master processors

54a, 54b. In more detail, each of the

master processors

54a, 54b receives the safety-related parameter together with the inspection data from the main control board 51, and performs a CRC calculation on the received safety-related parameter. Specifically, the remainder obtained by dividing the safety-related parameter by a predetermined constant (generator polynomial) is calculated as the first CRC value. Then, it is checked whether the calculated first CRC value matches the test data received from the main control board 51. If the first CRC value matches the test data, each

master processor

54a, 54b deletes past data stored in the

non-volatile memory

54c, 54d, and writes the safety-related parameters received from the main control board 51 to the

non-volatile memory

54c, 54d. Next, each

master processor

54a, 54b reads the written safety-related parameters from the

non-volatile memory

54c, 54d, performs CRC calculations on the read safety-related parameters, and calculates a second CRC value. Then, each

master processor

54a, 54b checks whether the calculated second CRC value matches the first CRC value. If the first and second CRC values match, each

master processor

54a, 54b transmits information indicating successful rewriting and the matching CRC value (first or second CRC value) to the main control board 51. Thereafter, based on the display of the teach pendant 3, the user confirms that the safety-related parameters stored in the

non-volatile memories

54c, 54d are the same as the safety-related parameters set in the main control board 51 by the predetermined input, and performs a predetermined input to the teach pendant 3. In response to this, each

master processor

54a, 54b writes the matching CRC value (first or second CRC value) to the

non-volatile memory

54c, 54d. This enables the safety-related parameters stored in the

non-volatile memory

54c, 54d.

When the robot control system 1 is started, each

master processor

54a, 54b of the notification board 54 receives test data from the main control board 51 and checks whether the received test data matches the CRC value stored in the

non-volatile memory

54c, 54d. If the test data matches the CRC value, each

master processor

54a, 54b transmits the check result to the main control board 51. Then, each

master processor

54a, 54b executes a parameter transfer process to transfer the safety-related parameters read from the

non-volatile memory

54c, 54d, together with the test data, to the monitoring board 53, the sensor input board 52, and the operation input board 32.

Next, the detailed operation of the

master processors

54a and 54b during the parameter transfer process will be described with reference to FIG. 3. Here, multiple safety-related parameters are transferred.

First, in (S101), set n=0.

Next, in (S102), the

master processors

54a and 54b set n = n + 1. Then, the

master processors

54a and 54b read the nth safety-related parameter from the

non-volatile memories

54c and 54d, and transfer it to the monitoring board 53, the sensor input board 52, and the operation input board 32 with the inspection data attached.

Next, in (S103), the

master processors

54a and 54b receive the check results from the monitoring board 53, the sensor input board 52, and the operation input board 32.

Next, in (S104), the

master processors

54a and 54b determine whether or not there is an abnormality based on the check results received in (S103). If the

master processors

54a and 54b determine that there is an abnormality, they proceed to processing in (S105), and if they determine that there is no abnormality, they proceed to processing in (S106).

In (S105), the

master processors

54a and 54b notify the main control board 51 of the abnormality. In other words, the

master processors

54a and 54b notify the main control board 51 of the abnormality based on the check results and end the parameter transfer process.

In (S106), the

master processor

54a, 54b determines whether n is the maximum value. Here, the maximum value is the number of safety-related parameters to be transferred. If the

master processor

54a, 54b determines that n is not the maximum value, it returns to (S102), and if it determines that n is the maximum value, it proceeds to (S107).

In (S107), the

master processors

54a and 54b notify the main control board 51 of the end of the transfer process, and the parameter transfer process ends.

Next, the operation of the

first slave processors

53a and 53b during the parameter transfer process will be described with reference to FIG. 4. Note that the

second slave processors

52a and 52b and the

third slave processors

32a and 32b also perform the same operation during the parameter transfer process.

First, in (S201), the

first slave processors

53a and 53b each receive safety-related parameters together with the inspection data from the notification board 54.

Next, in (S202), the

first slave processors

53a and 53b each perform a CRC calculation on the safety-related parameters received in (S201). In detail, the remainder is calculated when the safety-related parameters are divided by a predetermined constant (generator polynomial).

Next, in (S203), the

first slave processors

53a and 53b each check the CRC of the safety-related parameters. In other words, the

first slave processors

53a and 53b check whether the remainder calculated in (S202) matches the inspection data received in (S201).

Next, in (S204), the

first slave processors

53a and 53b each transmit the result of the check in (S203), i.e., a value indicating whether the remainder calculated in (S202) matches the test data, to the other

first slave processor

53a and 53b as the check result (error detection result).

Next, in (S205), the

first slave processors

53a and 53b transmit the result of the check in (S203), i.e., a value indicating whether the remainder calculated in (S202) matches the test data, as the check result (error detection result) to the

master processors

54a and 54b of the notification board 54. Thus, in (S202) and (S203), the

first slave processors

53a and 53b perform error detection on the safety-related parameters received in (S201) using the test data, and transmit the error detection result to the

master processors

54a and 54b. The check result is received by the

master processors

54a and 54b in (S103) above. This ends the processing on the

first slave processors

53a and 53b side during the parameter transfer process.

Therefore, according to this embodiment, since the safety-related parameters are transmitted from the

master processors

54a, 54b to the

first slave processors

53a, 53b, the

second slave processors

52a, 52b, and the

third slave processors

32a, 32b, it is not necessary to provide non-volatile memory for storing the safety-related parameters in the monitoring board 53, the sensor input board 52, and the operation input board 32. Therefore, compared to providing non-volatile memory in all of the notification board 54, the monitoring board 53, the sensor input board 52, and the operation input board 32, it is possible to reduce the risk of failure of the non-volatile memory and to reduce costs.

In addition, since the monitoring board 53, the sensor input board 52, and the operation input board 32 are not provided with non-volatile memory for storing safety-related parameters, the user does not need to set the safety-related parameters or check whether the safety-related parameters have been correctly set in the non-volatile memory on the monitoring board 53, the sensor input board 52, and the operation input board 32. Therefore, the effort required for setting and checking the safety-related parameters can be reduced compared to when non-volatile memory is provided on all of the notification board 54, the monitoring board 53, the sensor input board 52, and the operation input board 32.

In the above embodiment, the robot control system 1 is provided with four pairs of processors, but the present disclosure can also be applied to cases where the number of processors is other than four pairs. For example, the present disclosure can also be applied to cases where only one pair of master processors and one pair of slave processors that receive safety-related parameters from the master processor are provided.

The control system disclosed herein reduces the risk of non-volatile memory failure and cuts costs while minimizing the effort required for setting and checking safety-related parameters, making it useful as a control system for controlling equipment.

1 Robot control system 2 Robot 32

Operation input boards

32a, 32b Third slave processor 51 Main control board 53

Monitoring boards

53a, 53b First slave processor 52

Sensor input boards

52a, 52b Second slave processor 54

Notification boards

54a,

54b Master processor

54c, 54d Non-volatile memory

Claims

A control system for controlling an apparatus, comprising:
a non-safety-related unit that outputs a safety-related parameter in response to a predetermined input;
A master board and a slave board that are safety-related parts that conform to Category 3 of ISO 13849-1 and execute a predetermined process using the safety-related parameters,
the master board has a non-volatile memory and a master processor that executes a storage process of receiving the safety-related parameters from the non-safety-related parts and storing them in the non-volatile memory, and a parameter transfer process of reading the safety-related parameters from the non-volatile memory and transferring them to the slave board;
The slave board is a control system having a slave processor that performs a reception process for receiving the safety-related parameters transferred in the parameter transfer process, and a calculation process using the safety-related parameters.
2. The control system of claim 1,
the safety-related parameters are transferred in the parameter transfer process with the inspection data added to the safety-related parameters;
The receiving process receives the safety-related parameters together with the inspection data;
the slave processor further executes an error detection process of detecting an error in the safety-related parameters received in the receiving process by using the inspection data and transmitting a result of the error detection to the master processor;
the master processor receives a result of the error detection transmitted in the error detection process, and further performs an abnormality notification process to notify the non-safety-related part of an abnormality based on the result of the error detection.