Patent Application
20210389744
The present invention relates to a control system, a support device included in a control system, and a support program.
In many manufacturing sites, the introduction of safety systems is progressing in order to use facilities and machines safely. The safety systems are used to provide safety functions conforming to international standards, and include safety components such as a safety controller, a safety sensor, a safety switch, and a safety relay.
A safety system is also required to provide the safety function to a drive device that drives a servomotor or the like for driving a facility or a machine. In a safety system, Ethernet for Control Automation Technology (EtherCAT) (registered trademark) may be employed as a network for exchanging data, and Non-Patent Literature 1 discloses some provisions regarding safety functions in the standards of the EtherCAT Technology Group (ETG) which is an organization related to EtherCAT.
According to the provisions disclosed in Non-Patent Literature 1, all safety functions executed by a drive device are set in advance to be enabled as a default. More specifically, in designation information for designating enabling or disabling of the safety functions, all flags assigned to respective bits of a first byte are fixed to flags indicating enabling.
However, in the actual use, there may be cases where enabled/disabled settings of the safety functions are required to be changed depending on work details in a process, such as enabling the safety functions in one process and disabling the safety functions in another process. In such a case, a user is required to separately prepare a program for changing the enabled/disabled settings of the safety functions from the default state, which may increase an amount of work. In the programming work, since source code is required to be written, there is a risk that the user will unintentionally write erroneous setting details. The present invention has been made to solve the above problems, and an objective thereof is to facilitate setting of enabling or disabling of safety functions.
According to an example of the present disclosure, there is provided a control system. The control system includes a drive device that has at least one or more safety functions and drives a motor; a controller that outputs a command related to the at least one or more safety functions to the drive device according to a safety program; and a support device that supports development of the safety program. The safety program includes information for disabling a specific safety function among the at least one or more safety functions. The support device includes a reception unit that receives designation, given by a user, of enabling or disabling of each of the at least one or more motion safety functions, a generation unit that generates the safety program in accordance with the designation of enabling or disabling received by the reception unit, and a transfer unit that transfers the safety program generated by the generation unit to the controller.
According to this disclosure, the user designates enabling or disabling of a specific safety function for the support device, and thus the safety program is generated in accordance with the designation of enabling or disabling and is transferred to the controller. Consequently, the user can generate the safety program for designating enabling or disabling of the specific safety function without writing source code, and can easily set enabling or disabling of the safety function.
In the above disclosure, the support device provides a user interface for receiving the designation of enabling or disabling of each of the at least one or more safety functions via the reception unit.
According to this disclosure, the user can designate enabling or disabling of each of the at least one or more safety functions by using the user interface provided by the support device.
In the above disclosure, the support device provides a user interface for receiving the designation of enabling or disabling of each of the at least one or more safety functions via the reception unit for a specific drive device selected from among a plurality of the drive devices.
According to this disclosure, the user can designate enabling or disabling of each of the at least one or more safety functions by using the user interface provided by the support device for the specific drive device selected from among a plurality of the drive devices.
In the above disclosure, in response to designation of disabling of the specific safety function among the at least one or more safety functions, the support device prohibits use of a variable referred to by the safety program related to the specific safety function.
According to this disclosure, it is possible to prevent a situation in which the user unintentionally sets the variable referred to by a program related to the disabled safety function.
In the above disclosure, the support device provides a notification of prohibition of use of the variable.
According to this disclosure, it is possible to notify the user that the variable referred to by a program related to the disabled safety function is prohibited from being used.
In the above disclosure, the safety program generated by the generation unit is uneditable by the user.
According to this disclosure, since the safety program generated by the support device is not able to be edited by the user, it is possible to prevent the occurrence of a problem that set details of enabling or disabling of a safety function designated for the support device by the user do not coincide with set details in the safety program generated by the support device.
According to another example of the present disclosure, there is provided a support device that supports development of a safety program related to at least one or more safety functions executed by a controller controlling a drive device driving a motor. The safety program includes information for disabling a specific safety function among the at least one or more safety functions. The support device includes a reception unit that receives designation, given by a user, of enabling or disabling of each of the at least one or more safety functions; a generation unit that generates the safety program in accordance with the designation of enabling or disabling received by the reception unit; and a transfer unit that transfers the safety program generated by the generation unit to the controller.
According to this disclosure, the user designates enabling or disabling of a specific safety function for the support device, and thus the safety program is generated in accordance with the designation of enabling or disabling and is transferred to the controller. Consequently, the user can generate the safety program for designating enabling or disabling of the specific safety function without writing source code, and can thus easily set enabling or disabling of the safety function.
According to still another example of the present disclosure, there is provided a support program for supporting development of a safety program related to at least one or more safety functions executed by a controller controlling a drive device driving a motor. The support program includes information for disabling a specific safety function among the at least one or more safety functions. The support program causes a computer to execute receiving designation, given by a user, of enabling or disabling of each of the at least one or more safety functions; generating the safety program in accordance with the received designation of enabling or disabling; and transferring the generated safety program to the controller.
According to the present invention, it is possible to facilitate setting of enabling or disabling of safety functions.
An embodiment of the present invention will be described with reference to the drawings. The same or similar portions in the drawings will be given the same reference numeral, and description thereof will not be repeated.
First, an application example of the present invention will be described.
With reference to
The standard controller 100 executes standard control (standard control 150 that will be described later) on control targets including the servomotor 400 according to a standard control program (a standard control program 1104 that will be described later) that is created in advance. Typically, the standard controller 100 executes control calculation in a cyclic manner in accordance with input signals from one or a plurality of sensors (not illustrated) to calculate commands for an actuator such as the servomotor 400 in a cyclic manner.
The safety controller 200 corresponds to a “controller”, and transmits a safety command related to an operation of a safety function (a safety function 250 that will be described later) to the safety driver 300 according to a safety program (a safety program 2104 that will be described later). The safety controller 200 executes monitoring and control calculation for realizing the safety function 250 for a control target in a cyclic manner separately from the standard controller 100.
The safety controller 200 may receive an input signal from any safety device 240 and/or may output a command to any safety device 240. The safety program 2104 is created in advance by a user by using a development environment provided by a support device 500 that is communicatively connected to the safety controller 200, and is transferred to the safety controller 200.
The safety driver 300 supplies power to the servomotor 400 in response to a command from the standard controller 100 to drive the servomotor 400. The safety driver 300 calculates a rotation position, a rotation speed, a rotation acceleration, and a generated torque of the servomotor 400 in a cyclic manner on the basis of a feedback signal or the like from the servomotor 400.
The safety driver 300 executes a predetermined motion safety function (a motion safety function 360 that will be described later) related to driving of the servomotor 400 in response to a safety command from the safety controller 200. More specifically, the safety driver 300 provides state information necessary for a safety function to the safety controller 200, and executes a motion safety program (a motion safety program 3204 that will be described later) corresponding to a required safety function to adjust or interrupt power supplied to the servomotor 400.
The servomotor 400 has a motor (a three-phase AC motor 402 that will be described later) that is rotated by receiving power from the safety driver 300, and outputs a detection signal as a feedback signal from an encoder (an encoder 404 that will be described later) coupled to a rotation shaft of the motor to the safety driver 300.
The support device 500 supports development on the standard controller 100 side and development on the safety controller 200 side. More specifically, the support device 500 supports development of a standard control program (the standard control program 1104 that will be described later) executed by the standard controller 100, setting related to the standard control 150, and the like as the development on the standard controller 100 side. The support device 500 supports development of a safety program (the safety program 2104 that will be described later) executed by the safety controller 200, setting related to the safety function 250, and the like as the development on the safety controller 200 side. The support device 500 combines one or more pieces of instruction information with each other to provide development environments (a program creation/editing tool, a parser, a compiler, and the like) for generating a program to a user.
In the present specification, “device” is a general term for devices that can perform data communication with other devices via any network such as the field network 2. In the control system 1 according to the present embodiment, the “device” includes the standard controller 100, the safety controller 200, and the safety driver 300.
In the present specification, the terms “standard control” and “safety control” are used in contrast. “Standard control” is a general term for processes for controlling a control target according to a predefined requirement specification. On the other hand, “safety control” is a general term for processes for preventing human safety from being threatened by facilities or machines. The “safety control” is designed to satisfy the requirements for realizing the safety functions defined in IEC 61508 and the like.
In the present specification, safety functions specific to the drive device (safety driver 300) are collectively referred to as a “motion safety function” or simply a “safety function”. Typically, the “function” includes the safety functions related to the drive device defined in Non-Patent Literature 2 described above. For example, the “function” includes control for monitoring a position or a speed of a control shaft to secure safety.
In the present specification, “process data” is a general term for data used in at least either the standard control or the safety control. Specifically, the “process data” includes input information that is acquired from a control target, output information that is output to the control target, internal information that is used for control calculation in each device, and the like.
The input information includes, for example, an ON/OFF signal (digital input) detected by a photoelectric sensor or the like, a physical signal (analog input) detected by a temperature sensor or the like, and a pulse signal (pulse input) generated by a pulse encoder or the like. The output information includes, for example, ON/OFF (digital output) for driving a relay or the like, a speed command (analog output) for giving an instruction for a rotation speed or the like of a servomotor, and a displacement command (pulse output) for giving an instruction for a movement amount or the like of a step motor. The internal information includes, for example, state information determined through control calculation in which any process data is input.
In the field network 2 of the control system 1, process data communication is performed, and a communication frame 600 is circulated in a cyclic manner (for example, every several to several tens of msec) among devices with the standard controller 100 as a communication master. A cycle in which the communication frame 600 is transferred will be referred to as a process data communication cycle. In the present embodiment, EtherCAT is used as an example of a protocol for the field network 2 via which the communication frame 600 is transferred in a cyclic manner.
A data region is allocated to each device in the communication frame 600. When the communication frame 600 transferred in a cyclic manner is received, each device writes the current value of preset data into a data region allocated to the device in the received communication frame 600. The communication frame 600 in which the current value has been written is sent to the device in the next stage. The current value of data written by each device can be referred to by other devices.
Since each device writes the current value of the present data into the communication frame 600, the communication frame 600 that is circulated through the field network 2 and returned to the communication master (standard controller 100) includes the latest value collected by each device.
In the present embodiment, a logical connection 4 is formed between the safety controller 200 and each safety driver 300 by using the process data communication. The logical connection 4 is used to exchange data for realizing the safety function 250.
As described above, in a case where EtherCAT is used as a protocol for the field network 2, the logical connection 4 may be formed by using a protocol called FailSafe over EtherCAT (FSoE).
More specifically, a dedicated data region for storing commands exchanged to form the logical connection 4 is allocated to the communication frame 600. The logical connection 4 is formed by exchanging commands between the devices by using the dedicated data region.
As illustrated in
Each safety driver 300 has only the motion safety function 360 that is determined in advance. For example, the specific safety driver 300 does not have SSR and has the other functions such as STO, SS1, SS2, SOS, SDIp, and SDIn among the motion safety functions 360 illustrated in
The safety driver 300 enables or disables each motion safety function 360 according to the designation information included in the safety status 70. The “designation information” may be any information as long as the information is used to designate enabling or disabling of each of the motion safety functions 360. In the present embodiment, the designation information designates enabling or disabling with a flag represented by “0” or “1”. More specifically, when the flag is “0”, the motion safety function 360 is enabled, and, when the flag is “1”, the motion safety function 360 is disabled.
Flags are fixed such that all of the motion safety functions 360 are enabled during starting (that is, as a default), and details thereof cannot be changed by a user. In other words, all of the motion safety functions 360 are fixed to be enabled as a default. This is required in the provisions disclosed in Non-Patent Literature 1 described above.
Here, with reference to
As illustrated in
In the present embodiment, the flags are fixed to “0” indicating enabling in a default state with respect to all of the motion safety functions 360. Each motion safety function 360 is required to be set to the flag of “0” as a default.
In the first byte in which enable/disable setting of the safety function as illustrated in
“Enabling” of the safety function refers to that a function for performing safety control is in an operating state. For example, STO, SS1, SS2, SOS, and SSR are “active” when the flag is “0”. This indicates that the functions for performing safety control are in an operating state. SDIp and SDIn are “disabled” when the flag is “0”. This indicates that the motor is prohibited from operating in a positive direction or a negative direction, that is, the functions for performing safety control are in an operating state.
On the other hand, “disabling” of the safety function refers to that the functions for performing safety control is in a non-operating state. For example, STO, SS1, SS2, SOS, and SSR are “deactivated” when the flag is “1”. This indicates that the functions for performing safety control are in a non-operating state. SDIp and SDIn are “enabled” when the flag is “1”. This indicates that the motor is permitted to operate in the positive direction or the negative direction, that is, the functions for performing safety control are in a non-operating state.
With reference to
As described above, in each safety driver 300, the default setting is fixed to enabling with respect to all of the motion safety functions 360 regardless of whether or not the motion safety function 360 is installed. However, in actual use, it may be necessary to change the enabled/disabled settings of the safety functions according to work details in the process, such as enabling or disabling the motion safety functions 360.
As a method of changing enabling or disabling of the specific motion safety function 360 afterward, it is conceivable that a safety command from the safety controller 200 includes designation information for enabling or disabling the specific motion safety function 360. For example, in the present embodiment, after the logical connection 4 is established, the safety command can be transmitted to the safety driver 300 from the safety controller 200. When designation information for enabling or disabling the specific motion safety function 360 is included in the safety command, it is possible to change enabling or disabling of the specific motion safety function 360 afterward.
However, in this case, a user is required to create the safety program 2104 by using a tool such as the support device 500 in order to change the enabled/disabled settings of the specific motion safety function 360 from the default state. Thus, a situation in which a work amount increases may occur. Therefore, if the user writes source code and frequently creates the safety program 2104, the efficiency will be reduced. When the user writes the source code, there is a risk that the user will unintentionally write erroneous setting contents. In a case where a plurality of safety drivers 300 is provided in the control system 1, the safety program 2104 is required to be created for all the safety drivers 300, which causes a problem that a work amount becomes enormous.
Therefore, in the control system 1 according to the present embodiment, a method for creating the safety program 2104 as easily as possible without the user writing the source code is proposed.
For example, as illustrated in
Here, regarding “transfer”, the support device 500 may convert source code into object code by performing a build, and transfer the safety program 2104 to the safety controller 200 in the form of the object code, or transfer the safety program 2104 to the safety controller 200 in the form of source code without performing the build. The support device 500 may transfer the safety program 2104 to the safety controller 200 via the standard controller 100, or may directly transfer the safety program 2104 to the safety controller 200 without using the standard controller 100.
The user can use the support device 500 to designate enabling or disabling of each of the motion safety functions 360 for the support device 500. The support device 500 automatically generates the safety program 2104 in accordance with enable/disable setting of the motion safety function 360 designated by the user. Thus, the user can generate the safety program 2104 for designating enabling or disabling of each of the motion safety functions 360 without taking the trouble to write the source code.
The “designation information” may be any information as long as the information is information for designating enabling or disabling of each of the motion safety functions 360. In the present embodiment, in the designation information, enabling or disabling of each of the motion safety functions 360 is designated by a flag indicated by “0” or “1” by using a bit string in which bits respectively corresponding to the motion safety functions 360 are arranged. As described above, the user can set a flag in the designation information by using the support device 500 and can thus change enabling or disabling of the specific motion safety function 360 from a default state.
For example, as illustrated in
As described above, the user designates enabling or disabling of the specific motion safety function 360 for the support device 500, and thus the safety program 2104 is generated in accordance with the designation of enabling or disabling and is transferred to the safety controller 200. Consequently, the user can generate the safety program 2104 for designating enabling or disabling of the specific motion safety function 360 without writing source code, and can thus easily set enabling or disabling of the motion safety function 360.
Next, a configuration example of the device included in the control system 1 will be described.
(b1: Standard Controller 100)
The processor 102 generally corresponds to a calculation processing part executing control calculation related to the standard control 150, and is configured with a central processing unit (CPU) or a graphics processing unit (GPU). Specifically, the processor 102 reads programs (for example, a system program 1102 and the standard control program 1104) stored in the storage 110, loads the programs to the main memory 104, and executes the programs to realize control calculation related to a control target (for example, the safety driver 300 or the servomotor 400) and various processes that will be described later.
The main memory 104 is configured with a volatile storage device such as a dynamic random access memory (DRAM) or a static random access memory (SRAM). The storage 110 is configured with a nonvolatile storage device such as a solid state drive (SSD) or a hard disk drive (HDD).
The storage 110 stores not only the system program 1102 for realizing fundamental functions but also the standard control program 1104 that is created in accordance with a control target. The storage 110 stores setting information 1106 for setting a variable or the like.
The higher-level network controller 106 exchanges data with any information processing device via a higher-level network.
The field network controller 108 exchanges data with any devices including the safety controller 200 and the safety driver 300 via the field network 2. In the control system 1 illustrated in
The USB controller 120 exchanges data with the support device 500 or the like via USB connection.
The memory card interface 112 accepts a memory card 114 that is an example of an attachable and detachable recording medium. The memory card interface 112 can record data on the memory card 114 or read the various types of data (a log, trace data, or the like) from the memory card 114.
The local bus controller 116 exchanges data with any unit connected to the standard controller 100 via a local bus.
(b2: Safety Controller 200)
The processor 202 generally corresponds to a calculation processing part executing control calculation related to the safety control, and is configured with a CPU or a GPU. Specifically, the processor 202 reads programs (for example, a system program 2102 and the safety program 2104) stored in the storage 210, loads the programs to the main memory 204, and executes the programs to realize control calculation for providing the necessary safety function 250 and various processes that will be described later.
Particularly, the safety controller 200 executes the safety program 2104, and thus outputs a safety command including designation information for designating enabling or disabling of the motion safety function 360 of the safety driver 300 to the safety driver 300. The designation information included in the safety status 70 of the safety driver 300 may be updated on the basis of the designation information included in the safety command.
The main memory 204 is configured with a volatile storage device such as a DRAM or an SRAM. The storage 210 is configured with a nonvolatile storage device such as an SSD or an HDD.
The storage 210 stores not only the system program 2102 for realizing fundamental functions but also the safety program 2104 that is created in accordance with the required safety function 250. The storage 210 stores setting information 2106 for setting a variable or the like.
The field network controller 208 exchanges data with any devices including the standard controller 100 and the safety driver 300 via the field network 2. In the control system 1 illustrated in
The USB controller 220 exchanges data with an information processing device such as the support device 500 via USB connection.
The safety local bus controller 216 exchanges data with any safety unit connected to the safety controller 200 via a safety local bus.
The safety I/O unit 230 exchanges input and output signals with any safety device 240. More specifically, the safety I/O unit 230 receives an input signal from the safety device 240 such as a safety sensor or a safety switch. Alternatively, the safety I/O unit 230 outputs a command to the safety device 240 such as a safety relay.
(b3: Safety Driver 300 and Servomotor 400)
The field network controller 302 exchanges data with any devices including the standard controller 100 and the safety controller 200 via the field network 2. In the control system 1 illustrated in
The control part 310 executes a calculation process required to operate the safety driver 300. As an example, the control part 310 includes processors 312 and 314, a main memory 316, and a storage 320.
The processor 312 generally corresponds to a calculation processing part executing control calculation for driving the servomotor 400. The processor 314 generally corresponds to a calculation processing part executing control calculation for providing the safety function 250 related to the servomotor 400. In the present embodiment, the processor 314 disables the specific motion safety function 360 in response to the safety command. Both of the processors 312 and 314 are configured with CPUs and the like.
The main memory 316 is configured with a volatile storage device such as a DRAM or an SRAM. The storage 320 is configured with a nonvolatile storage device such as an SSD or an HDD.
The storage 320 stores a servo control program 3202 for realizing servo control 350 that will be described later, a motion safety program 3204 for realizing the motion safety function 360 that will be described later, and setting information 3206 for setting a variable or the like that is open to other devices. The safety status 70 for managing enabled/disabled settings of the motion safety function 360 is stored in the setting information 3206.
The drive circuit 330 includes a converter circuit, an inverter circuit, and the like, generates power with designated voltage, current, and phase in response to a command from the control part 310, and supplies the power to the servomotor 400.
The feedback reception circuit 332 receives a feedback signal from the servomotor 400, and outputs the reception result to the control part 310.
The servomotor 400 typically includes a three-phase AC motor 402 and an encoder 404 provided at a rotation shaft of the three-phase AC motor 402.
The three-phase AC motor 402 is an actuator that receives power supplied from the safety driver 300 and generates torque.
The encoder 404 outputs a feedback signal (typically, a pulse signal corresponding to a rotation speed) corresponding to the rotation speed of the three-phase AC motor 402.
(b4: Support Device 500)
With reference to
The processor 502 is configured with a CPU or a GPU, reads programs (for example, an OS 5102 and a support program 5104) stored in the storage 510, loads the programs to the main memory 504, and executes the programs to perform various processes that will be described later. In other words, the processor 502 has a function of a computer executing the support program 5104. Particularly, the processor 502 has the function of the generation unit 5212 illustrated in
The main memory 504 is configured with a volatile storage device such as a DRAM or an SRAM. The storage 510 is configured with a nonvolatile storage device such as an HDD or an SSD.
The storage 510 stores not only the OS 5102 for realizing fundamental functions but also the support program 5104 for providing functions of the support device 500. In other words, the support program 5104 is executed by a computer connected to the control system 1 to implement the support device 50 according to the present embodiment. The support program 5104 includes an enable/disable setting support program 90. The support device 500 executes the enable/disable setting support program 90 to receive designation of enabling or disabling of the motion safety function 360 from a user, and also generates the safety source program 5112 by using the processor 502 in accordance with the received designation of enabling or disabling.
The storage 510 stores project data 5106 that is created by the user in a development environment that is provided by executing the support program 5104.
In the present embodiment, the support device 500 provides a development environment in which setting on each device included in the control system 1 and creation of a program executed by each device can be integrally performed. The project data 5106 includes data generated by using such an integrated development environment. Typically, the project data 5106 includes a standard control source program 5108, standard controller setting information 5110, a safety source program 5117, safety controller setting information 5114, and safety driver setting information 5116.
The standard control source program 5108 is converted into object codes that are then transmitted to the standard controller 100 to be stored in the standard control program 1104 (refer to
The safety source program 5117 is converted into object codes that are then transmitted to the safety controller 200 to be stored in the safety program 2104 (refer to
The safety driver setting information 5116 is transmitted to the safety driver 300 to be stored in the setting information 3206 (refer to
The input part 506 is an interface that receives information that is input with a keyboard or a mouse, and has the function of the reception unit 5216 illustrated in
The USB controller 520 has the function of the transfer unit 5218 illustrated in
The support device 500 has the optical drive 512, and a program is read from a recording medium 514 (for example, an optical recording medium such as a digital versatile disc (DVD)) that stores computer-readable programs in a non-transitory manner and is installed in the storage 510 or the like.
The support program 5104 or the like executed by the support device 500 may be installed via the computer-readable recording medium 514, or may be downloaded from a server device or the like on the network to be installed. The functions provided by the support device 500 according to the present embodiment may be realized in a form of using some modules provided by the OS.
During an operation of the control system 1, the support device 500 may be detached from the standard controller 100.
Next, an example of function sharing in the control system 1 will be described.
With reference to
On the other hand, the safety driver 300 provides the motion safety function 360 in correspondence to the safety function 250 provided by the safety controller 200. The motion safety function 360 is realized by the processor 314 (refer to
When a predefined condition is established, the safety function 250 enables the predefined safety function 250 on the basis of a state value stored in the standard control 150 executed by the standard controller 100, a state value indicated by a signal from the safety device 240, a state value stored in the safety driver 300, and the like.
The process of enabling the predefined safety function 250 includes, for example, output of a safety command for the safety driver 300 or output of a safety command for the safety device 240 (for example, a safety relay related to the supply of power to a specific device is turned off).
The safety driver 300 executes the motion safety program 3204 to realize the designated motion safety function 360 in response to a safety command from the safety controller 200. The motion safety function 360 that can be executed is defined in advance in each safety driver 300. Depending on the type of the designated motion safety function 360, a process of intervening in the control of the servomotor 400 based on the servo control 350 to interrupt the supply of power to the servomotor 400, or a process of monitoring whether or not a state value of the control of the servomotor 400 based on the servo control 350 is within a predefined restriction range is executed. The motion safety program 3204 enables or disables each motion safety function 360 in accordance with enable/disable setting of a safety function designated by designation information included in the safety status 70.
When a safety event from the safety device 240 (for example, a safety sensor) occurs at a certain timing (sequence SQ6), the safety controller 200 outputs a safety command to the safety driver 300 (motion safety function 360) (sequence SQ8). The motion safety function 360 of the safety driver 300 enables the designated safety function 250 in response to the safety command (sequence SQ10).
In response to enabling of the safety function 250, a command corresponding to the enabled safety function 250 is calculated and output from the standard control 150 of the standard controller 100 (sequence SQ12). On the other hand, the safety driver 300 (motion safety function 360) monitors whether or not an operation state of the servomotor 400 is within a predefined restriction range. When it is determined that the operation state of the servomotor 400 is not within the predefined restriction range, or a predefined stoppage time comes, the safety driver 300 (motion safety function 360) interrupts the supply of power to the servomotor 400 (sequence SQ14).
As described above, the safety driver 300 can drive the servomotor 400 in response to a command from the standard controller 100 (standard control 150), and can also realize the motion safety function 360 for the safety controller 200 (safety function 250) in response to a command for enabling the safety function 250.
Next, an example of the motion safety function 360 provided by the control system 1 will be described.
With reference to
With reference to
Of STO illustrated in
Non-Patent Literature 1 described above defines not only the motion safety functions illustrated in
As described above, in the control system 1 according to the present embodiment, safety communication can be performed through data communication and the logical connection 4. Next, installation examples of standard control and safety control using each type of communication will be described.
As illustrated in
The data communication layer 170, the data communication layer 270, and the data communication layer 370 are used to transfer the communication frame 600 on the field network 2.
The logical connection layer 276 of the safety controller 200 and the logical connection layer 376 of the safety driver 300 exchange safety communication frames 630. In other words, the logical connection layer 276 and the logical connection layer 376 exchange commands and data by using the safety communication frame 630 included in the communication frame 600 according to a protocol (FSoE in the present embodiment) for establishing the logical connection 4. The safety controller 200 includes an establishment module 277 for establishing the logical connection 4 with the safety driver 300 via the logical connection layer 276.
In the standard controller 100, the I/O management module 172 exchanges signals with a control target to update process data 174. The standard control program 1104 executed in the standard controller 100 executes control calculation by referring to the process data 174, and updates the process data 174 as an execution result of the control calculation.
In the safety controller 200, the I/O management module 272 exchanges signals with the safety device 240 to update process data 274.
The safety program 2104 executed in the safety controller 200 executes control calculation by referring to the process data 274 and the safety function state management engine 278, and updates the process data 274 or outputs an internal command to the safety function state management engine 278 on the basis of an execution result of the control calculation.
The safety function state management engine 278 generates a safety command for enabling or disabling the specific motion safety function 360 for the specific safety driver 300 in accordance with the execution result of the control calculation performed by the safety program 2104. The logical connection layer 276 exchanges necessary commands and data with the logical connection layer 376 of the target safety driver 300 by using the safety communication frames 630 in response to the command from the safety function state management engine 278.
In the safety driver 300, the servo control execution engine 352 executes control calculation related to servo control by referring to process data 374 and information regarding a feedback signal acquired via the feedback reception circuit 332. The servo control execution engine 352 updates the process data 374 and outputs an internal command to the drive circuit 330 on the basis of an execution result of the control calculation. The drive circuit 330 drives the servomotor 400 in response to the command from the servo control execution engine 352.
The motion safety function state management engine 378 manages a state of the motion safety function 360 in response to a safety command from the safety controller 200. The safety status 70 is stored in the motion safety function state management engine 378. The motion safety function state management engine 378 outputs an internal command to the motion safety function execution engine 362 according to designation information included in the safety status 70.
In the motion safety function execution engine 362, the motion safety program 3204 is executed to realize the designated motion safety function 360.
The logical connection layer 376 exchanges necessary commands and data with the logical connection layer 276 of the safety controller 200 by using the safety communication frames 630 in response to a command from the motion safety function state management engine 378.
As described above, in the safety driver 300, the flags corresponding to all of the motion safety functions 360 are set to “0” as a default regardless of whether or not the motion safety functions 360 is installed. In other words, the flags of all bits included in the safety status 70 are set to “0” as a default.
When a user designates enabling or disabling of the motion safety functions 360 such that the flag of the second bit corresponding to SS2 is set to “1” in order to disable SS2, the flag of the third bit corresponding to SOS is set to “1” in order to disable SOS, and the flag of the fifth bit corresponding to SDIp is set to “1” in order to disable SDIp, by using the support device 500, the safety program 2104 is automatically generated in accordance with the designation of enabling or disabling. The safety controller 200 executes the safety program 2104 to transmit a safety command including the information regarding the designation, given by the user, of enabling or disabling of the motion safety function 360 to the safety driver 300.
When the safety driver 300 receives the safety command from the safety controller 200, the designation information included in the safety status 70 is updated according to the designation information included in the safety command. More specifically, the designation information included in the safety status 70 is overwritten to be the same as the designation information included in the safety command.
As described above, in the control system 1 according to the present embodiment, after connection in the field network 2 is established, setting of enabling or disabling of the specific motion safety function 360 can be changed from a default state by using a safety command.
Next, with reference to
As illustrated in
More specifically, “TRUE” is designated for SS2, SOS, and SDIp with respect to the safety driver 300 correlated with the identification code “E010”. “TRUE” is designated for SS1, SOS, SSR, and SDIn with respect to the safety driver 300 correlated with the identification code “E011”.
A flag is set to “1” in each bit included in designation information with respect to the motion safety function 360 for which “TRUE” is designated. In other words, in a case where the safety program 2104 generated on the basis of the source code illustrated in
In the related art, such source code is required to be written through an input operation of a user, but, in the present embodiment, the user only designates enable/disable setting of the safety function in the support device 500, and thus the safety program 2104 in which the same source code is written is automatically generated.
The safety program 2104 that is automatically generated by the support device 500 cannot be edited by the user. For example, the generated safety program 2104 is not displayed on a display part of the support device 500 or the like, and the user cannot recognize details of the program and cannot edit the program either. Alternatively, the generated safety program 2104 may be displayed on the display part of the support device 500 or the like, but the user cannot edit details of the program.
Consequently, since the safety program 2104 generated by the support device 500 is not able to be edited by the user, it is possible to prevent the occurrence of a problem that set details of enabling or disabling of a safety function designated for the support device 500 by the user do not coincide with set details in the safety program 2104 generated by the support device 500.
Next, an example of a user interface related to the motion safety function 360 provided by the support device 500 will be described.
As illustrated in
The multiview explorer field 610 includes a configurations and setup switch 614 for setting a constituent connected to a network in the control system 1. A lower-level layer developed by the configurations and setup switch 614 includes an enable/disable setting icon 616 for designating enabling or disabling of the motion safety function 360 and an I/O map icon 618 for mapping a variable referred to by the safety program 2104. The “variable” includes data and a container or a storage region in which the data is stored. For example, the variable referred to by the safety program 2104 is correlated with a state value of the servomotor 400 or the like, and each motion safety function 360 is realized according to the state value correlated with the variable.
The enable/disable setting icon 616 is provided in each of one or a plurality of safety drivers 300 connected to the control system 1, and, in this example, the enable/disable setting icon 616 corresponding to the safety driver 300 of Node10 is selected.
A screen 620 for designating enabling or disabling of the motion safety function 360 is displayed at the center of the screen related to the user interface 601. The screen 620 includes a number field 622 and a flag field 624.
In the number field 622, numbers are shown for the respective motion safety functions 360 in order from the first bit in the same order as the designation information included in the safety status 70. In this example, since the motion safety function 360 of SSR in the fourth bit is not installed, all information corresponding to the fourth bit is “Reserved”.
The flag field 624 is provided with a check box that can be checked by the user. In a case where the user designates “TRUE” in the source code of the safety program 2104, the user may uncheck the check box of the flag field 624. For the motion safety function 360 for which the check box is unchecked, the flag is set to “1” in the designation information included in the safety command. On the other hand, for the motion safety function 360 for which the check box is checked, the flag is set to “0” in the designation information included in the safety command. In above-described way, the user can easily perform enable/disable setting of the motion safety function 360 in the safety command by checking or unchecking the check box of the flag field 624.
With respect to enable/disable setting of the motion safety function 360, the user can change the default state in the second byte of the safety status 70, and, as illustrated in
In the example illustrated in
As described above, the user designates enabling or disabling of each motion safety function 360 in the safety driver 300, and then selects a transfer icon 680, and thus the safety program 2104 corresponding to the designation of enabling or disabling can be generated. The generated safety program 2104 is transferred to the safety controller 200.
As illustrated in
As illustrated in
Each motion safety function 360 installed in the selected safety driver 300 (Node10 in this example) is shown in the port field 652. A variable correlated with each motion safety function 360 is shown in the variable field 654. A comment to the variable correlated with each motion safety function 360 is shown in the variable comment field 656.
Here, as illustrated in
As described above, in response to designation of disabling of the specific motion safety function 360, the support device 500 prohibits the use of the variable referred to by the safety program 2104 related to the specific motion safety function 360. Consequently, it is possible to prevent a situation in which the user unintentionally sets a variable referred to by the safety program 2104 related to the disabled motion safety function 360.
Next, a safety enable/disable program generation process executed by the support device 500 will be described.
As illustrated in
On the other hand, in a case where display of safety function enable/disable setting screen has been received (YES in S502), the support device 500 displays the safety function enable/disable setting screen as illustrated in
Next, the support device 500 determines whether or not safety function enable/disable setting has been received (S506). Specifically, the support device 500 whether the check box of the flag field 624 has been checked or unchecked by a user in the screen related to the user interface 601 illustrated in
On the other hand, in a case where safety function enable/disable setting has been received (YES in S506), the support device 500 determines whether or not an instruction for transfer has been received (S508). Specifically, the support device 500 determines whether or not the transfer icon 680 has been selected in the screen related to the user interface 601 illustrated in
On the other hand, in a case where an instruction for transfer has been received (YES in S508), the support device 500 determines whether or not a variable has been mapped to the motion safety function 360 set to be disabled (S510). In a case where a variable has not been mapped to the motion safety function 360 set to be disabled (NO in S510), the support device 500 finishes the present process.
On the other hand, in a case where a variable has been mapped to the motion safety function 360 set to be disabled (YES in S510), the support device 500 cancels the variable corresponding to the motion safety function 360 set to be disabled (S512), and provides a notification of cancelation (S514). For example, the support device 500 provides a notification that the variable correlated with the disabled specific motion safety function 360 has been canceled in the output window 670 illustrated in
Next, the support device 500 maps a variable for generating the safety program 2104 to the safety function set to be disabled (S516). Regarding the variable used in this case, it is preferable that a unique name that is not set by the user is used as a variable name. If the same name is used for the variable name, the name may be identified by adding a subscript such as a number. The support device 500 generates the safety program 2104 by using the variable mapped in S516 (S518). In a case where a variable for generating the safety program 2104 has already been mapped to a safety function set to be disabled, the support device 500 may generate the safety program 2104 by using the variable.
The support device 500 prohibits mapping of a variable to the motion safety function 360 set to be disabled (S520), and transfers the generated safety program 2104 to the safety controller 200 (S522). In this case, the support device 500 may convert source code into object code by performing a build, and transfer the safety program 2104 to the safety controller 200 in the form of the object code, or transfer the safety program 2104 to the safety controller 200 in the form of source code without performing the build. The support device 500 may transfer the safety program 2104 to the safety controller 200 via the standard controller 100, or may directly transfer the safety program 2104 to the safety controller 200 without using the standard controller 100. Thereafter, the support device 500 finishes the present process.
As described above, the support device 500 generates the safety program 2104 in accordance with designation, given by the user, of enabling or disabling of the specific motion safety function 360, and transfers the generated safety program 2104 to the safety controller 200. Consequently, the user can generate the safety program 2104 for designating enabling or disabling of the specific motion safety function 360 without writing source code, and can thus easily set enabling or disabling of the motion safety function 360.
In response to designation of disabling of the specific motion safety function 360, the support device 500 prohibits the use of the variable referred to by the safety program 2104 related to the specific motion safety function 360. Consequently, it is possible to prevent a situation in which the user unintentionally sets a variable referred to by the safety program 2104 related to the disabled motion safety function 360.
The support device 500 can notify the user that a variable referred to by the safety program 2104 related to the disabled motion safety function 360 is prohibited from being used.
Next, a safety command reception process executed by the safety driver 300 will be described.
As illustrated in
On the other hand, in a case where a safety command has been received (YES in S322), the safety driver 300 determines whether or not enable/disable setting of the motion safety function 360 is included in the safety command (S324). In other words, the safety driver 300 determines whether or not designation of enabling or disabling of the safety function that is given by the user and is input from the support device 500 is included in the safety command that is transferred due to execution of the safety program 2104 automatically generated by the support device 500.
In a case where enable/disable setting of the motion safety function 360 is not included in the safety command (NO in S324), the safety driver 300 finishes the present process.
On the other hand, in a case where enable/disable setting of the motion safety function 360 is included in the safety command (YES in S324), the safety driver 300 performs enable/disable setting of the specific motion safety function 360 according to designation information included in the safety command (S326). For example, as illustrated in
As described above, the safety driver 300 performs enable/disable setting of the motion safety function 360 in response to a safety command that is received after the logical connection 4 is established. Consequently, the user can change enabling or disabling of the specific motion safety function 360 from a default state by using the safety command.
In the user interface 601 for setting enabling or disabling of the safety function illustrated in
In the user interface 601 for setting enabling or disabling of the safety function illustrated in
The present embodiment described above includes the following technical concept.
A control system (1) including:
a drive device (300) that has at least one or more safety functions and drives a motor (400);
a controller (200) that outputs a command related to the at least one or more safety functions to the drive device according to a safety program (2104); and
a support device (500) that supports development of the safety program,
in which the safety program includes information for disabling a specific safety function among the at least one or more safety functions,
in which the support device includes
a reception unit (5216) that receives designation, given by a user, of enabling or disabling of each of the at least one or more safety functions,
a generation unit (5212) that generates the safety program in accordance with the designation of enabling or disabling received by the reception unit, and
a transfer unit (5218) that transfers the safety program generated by the generation unit to the controller.
The control system according to Configuration 1,
in which the support device provides a user interface (601) for receiving the designation of enabling or disabling of each of the at least one or more safety functions via the reception unit.
The control system according to Configuration 1 or 2,
in which the support device provides a user interface (601) for receiving the designation of enabling or disabling of each of the at least one or more safety functions via the reception unit with respect to a specific drive device selected from among a plurality of the drive devices.
The control system according to any one of Configurations 1 to 3,
in which, in response to designation of disabling of the specific safety function among the at least one or more safety functions, the support device prohibits use of a variable referred to by the safety program related to the specific safety function.
[Configuration 5]
The control system according to Configuration 4, in which the support device provides a notification of prohibition of use of the variable.
The control system according to any one of Configurations 1 to 5,
in which the safety program generated by the generation unit is uneditable by the user.
A support device (500) that supports development of a safety program (2104) related to at least one or more safety functions executed by a controller (200) controlling a drive device (300) driving a motor (400), the safety program including information for disabling a specific safety function among the at least one or more safety functions, the support device including:
a reception unit (5216) that receives designation, given by a user, of enabling or disabling of each of the at least one or more safety functions;
a generation unit (5212) that generates the safety program in accordance with the designation of enabling or disabling received by the reception unit; and
a transfer unit (5218) that transfers the safety program generated by the generation unit to the controller.
A support program (5104) for supporting development of a safety program (2104) related to at least one or more safety functions executed by a controller (200) controlling a drive device (300) driving a motor (400), the support program including information for disabling a specific safety function among the at least one or more safety functions, the support program causing a computer to execute:
a step (S506) of receiving designation, given by a user, of enabling or disabling of each of the at least one or more safety functions;
a step (S510) of generating the safety program in accordance with the received designation of enabling or disabling; and
a step (S512) of transferring the generated safety program to the controller.
In the control system 1 according to the present embodiment, a user designates enabling or disabling of the specific motion safety function 360 for the support device 500, and thus the safety program 2104 is generated in accordance with the designation of enabling or disabling and is transferred to the safety controller 200. Consequently, the user can generate the safety program 2104 for designating enabling or disabling of the specific motion safety function 360 without writing source code, and can thus easily set enabling or disabling of the motion safety function 360.
It should be considered that the embodiments disclosed this time are exemplary in all respects and not limited. The scope of the present invention is shown by the claims, not the above description, and is intended to include all modifications within the meaning and the scope equivalent to the claims.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2018-219266 | Nov 2018 | JP | national |
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/JP2019/042162 | 10/28/2019 | WO | 00 |
