System for processing plastics

Abstract

Proposed is a system for processing plastics, having at least one plastics-processing machine (100) and having a control and operating system for the control and operation of said machine (100). The plastics-processing machine has safety-relevant actuators (110, 112, 113) and safety-relevant sensors (125a, 125b, 130a, 130b), which each generate a switch-off signal if a safety-relevant event occurs. The control and operating system comprises a cycle sequence controller which, in the production mode, controls the actuators of the plastics-processing machine and, for this purpose, uses a first computing unit (20) equipped with a first operating system. The control and operating system comprises a safety controller which: operates according to a safety program; uses a second computing unit (25); is communicatively connected to the safety-relevant sensors (125a, 125b, 130a, 130b); and is configured to directly switch off at least one safety-relevant actuator (110, 112, 113) in the presence of a switch-off signal generated by a safety-relevant sensor. In order to further increase operational safety, at least one bidirectional data exchange device (26) is provided, via which the cycle sequence controller and the safety controller exchange and / or compare data at least in a production mode. The cycle sequence controller transfers the machine (100) into a defined parked position if said cycle sequence controller detects a malfunction or a failure of the safety controller, and the safety controller switches off the at least one safety-relevant actuator (110, 112, 113) if said safety controller detects a malfunction or a failure of the cycle sequence controller.

Description

[0001] Plastics processing system

[0002] Description

[0003] Reference to related applications

[0004] The present application relates to and claims priority of the German patent application

[0005] 10 2024 134 092,4, filed on 20.11.2024, the disclosure content of which is hereby expressly made the subject of the present application in its entirety.

[0006] Field of invention

[0007] The invention relates to a system for plastics processing according to claim 1.

[0008] Technical background

[0009] A modern plastics processing system always includes the actual plastics processing machine and a control and operating system for this machine. Usually, a control-machine interface is provided, which electrically / electronically connects the control and operating system and the plastics processing machine. This interface, among other things, converts the low-voltage signals of the control and operating system into higher-voltage signals (usually 24V). According to the definitions used here, the control-machine interface is neither part of the control and operating system nor part of the plastics processing machine, but rather a separate subsystem.

[0010] The plastics processing machine and the control and operating system are usually structurally separated from each other, whereby the elements of the control and operating system can themselves be spatially distributed, in particular in such a way that parts of it are arranged in a machine control cabinet, while other parts of it, in particular those that serve for operation, are arranged outside the machine cabinet so that they can be operated or seen directly by a user.

[0011] The term "plastics processing machine" here refers to the mechanical hardware, which incorporates a multitude of actuators. The term "actuator" is used in its broadest sense and encompasses all elements that are at least indirectly controlled by the control and operating system. Typically, at least motor actuators, which at least indirectly drive moving elements, switching valves, and heating devices are considered actuators. However, for the purposes of this application, lighting devices and warning devices (signal lights, tone generators) are also considered "actuators." As mentioned above, these actuators are controlled at least indirectly by the control and operating system (in the sense of the definitions used here, via the control-machine interface). The aforementioned multitude of actuators always includes at least one (usually several) safety-relevant actuator."Safety-relevant" here means that it poses a potential danger to a person. This group of actuators typically includes, in particular, motor actuators (for example, in a clamping unit) and heating devices (for example, in a plasticizing unit). Lighting devices and warning devices, for example, are not safety-relevant actuators in this sense. Furthermore, such a plastics processing machine usually also has a number of sensors, which in turn send signals to the control and operating system (usually also via the control-machine interface). A distinction is generally made between safety-relevant sensors, such as door switches and emergency stop buttons, and sensors that measure machine or process parameters.According to the definitions given here, each safety-relevant sensor generates a shutdown signal when it detects a safety-relevant event, which leads to the shutdown of at least one safety-relevant actuator.

[0012] Such a plastics processing machine could be, in particular, an injection molding machine or a 3D printer. In principle, it is possible for a single control and operating system to control and operate exactly one plastics processing machine; however, it is also possible for a single control and operating system to control and operate several plastics processing machines.

[0013] The system – and therefore its components – has an operating mode. This operating mode refers to the state of the system in which it is complete and ready for operation. A sub-mode of this operating mode is the production mode, in which the system, and thus also the plastics processing machine, actually operates, i.e., produces. No operating mode exists, in particular, when the plastics processing machine and / or the control and operating system and / or the control-machine interface is undergoing maintenance, or when software updates are being performed on the control and operating system by a qualified and authorized person.

[0014] State of the art

[0015] The control and operating system of such a plastics processing system features a cycle sequence control which, in production mode, at least indirectly controls the plastics processing machine after a corresponding cycle sequence has been programmed into it. For this purpose, the cycle sequence control includes a first computing unit equipped with a first operating system.

[0016] In addition to the cycle control described above, the control and operating system typically includes a safety controller that operates according to a safety program. Such a safety controller—independent of the cycle control—is legally required in many countries and serves to ensure the occupational safety of the person(s) operating the machine. This type of safety controller operates according to a safety program that cannot be changed, at least during operation, and features a second processing unit, independent of the first processing unit (the processing unit of the cycle control), on which the safety program runs.The safety controller communicates with at least one safety-relevant sensor (since plastic processing machines typically have multiple safety-relevant sensors, it communicates with all of them) and is configured to deactivate at least one safety-relevant actuator when a shutdown signal is received. The selection of actuators that are deactivated upon receiving a shutdown signal generally depends on the type of safety-relevant sensor that generated the signal. At least two scenarios are typically distinguished: the emergency stop (which occurs when an emergency stop button is pressed) and the activation of a sensor within a safety zone (for example, when a door or protective cover is opened).In the first case, the safety control system usually switches off at least all safety-relevant actuators that move a machine part, at least indirectly; in the second case, it only switches off some of the safety-relevant actuators, e.g., those that become accessible by opening the door.

[0017] A forming machine with such a safety control system is known, for example, from DE 10 2015 963 A1.

[0018] DE 102 46 925 A1 proposes a method for controlling an injection molding machine and a handling device in which movement sequences can be programmed by the operator, but the method prohibits certain movement sequences that could lead to damage to machine parts.

[0019] WO 02 / 19957 A2 proposes a system for the central control of equipment used during a medical operation, comprising a first control unit designed as a closed system and a second control unit designed as an open system. The first control unit controls the equipment performing safety-related functions, while the second control unit controls the equipment performing non-safety-related functions. The two control units are interconnected for communication purposes.

[0020] Based on this state of the art, the present invention aims to further develop such a system in such a way as to further increase the safety for the operating persons.

[0021] This problem is solved by a system having the features of claim 1.

[0022] According to the invention, the safety controller no longer forms a purely stand-alone unit, but is additionally in communication with the cycle sequence control, for which at least a bidirectional data exchange device is provided, by means of which the cycle sequence control and the safety controller exchange and compare data at least in production mode.Furthermore, the cycle control is designed to continuously monitor the function of the safety control, at least in production mode, and to move the plastics processing machine to a defined park position if it detects a malfunction or failure of the safety control. Additionally, the safety control is designed to continuously monitor the function of the cycle control, at least in production mode, and to deactivate at least one safety-relevant actuator that it can switch off – usually all safety-relevant actuators that it can switch off – of the machine if it detects a malfunction or failure of the cycle control.

[0023] This means that the cycle control and the safety control monitor each other and at least partially shut down the plastics processing machine if a malfunction or even a complete failure of the cycle control or the safety control is detected during this monitoring. Since the cycle control and the safety control use different processing units, it is extremely unlikely that they would fail simultaneously. This is only possible in the event of a complete power outage, which would cause the machine to shut down anyway. Thus, the operational reliability of the plastics processing machine is increased by a further level.

[0024] The plastics processing system according to the invention thus comprises at least one plastics processing machine and a control and operating system having an operating mode for controlling and operating this machine, wherein the operating mode has a production mode, and the plastics processing machine comprises:

[0025] (i) a plurality of actors which

[0026] (ii) has at least one safety-related actuator,

[0027] (ill) a plurality of sensors which

[0028] (iv) includes at least one safety-related sensor which generates a shutdown signal when a safety-related event occurs, and wherein the control and operating system includes:

[0029] (v) a cycle sequence control which, in production mode, at least indirectly controls the majority of the actuators according to (i) the plastics processing machine and which uses a first computing unit equipped with a first operating system for this purpose, and

[0030] (vi) a safety controller operating according to a safety program, wherein the safety program is not modifiable at least in operating mode, the safety controller uses a second computing unit (25) independent of the first computing unit (20) according to (v), the safety controller is in communication connection with the at least one safety-related sensor according to (iv) and is configured to immediately switch off the at least one actuator according to (ii) when a shutdown signal according to (iv) is present,

[0031] (vii) at least one bidirectional data exchange device through which the cycle sequence control according to (v) and the safety control according to (vi) exchange and compare data, at least in production mode. The cycle sequence control according to (v) is configured to continuously monitor the function of the safety control according to (vi), at least in production mode, and to move the plastics processing machine to a defined park position if it detects a malfunction or failure of the safety control according to (vi). The safety control according to (vi) is configured to continuously monitor the function of the cycle sequence control according to (v), at least in production mode, and to deactivate the at least one safety-related actuator according to (ii) of the plastics processing machine if it detects a malfunction or failure of the cycle sequence control according to (v).

[0032] Typically, a plastics processing machine naturally has multiple safety-relevant actuators. According to the definitions used here, the actuators that can be deactivated by the safety controller constitute a group of safety-relevant actuators. This group of safety-relevant actuators can represent all safety-relevant actuators; however, there are conceivable configurations in which additional safety-relevant actuators are present that cannot be deactivated by the safety controller, but only by the cycle sequence control. This means that in this case, the total number of safety-relevant sensors is larger than the group of safety-relevant sensors that can be deactivated by the safety controller. But as mentioned, the group of safety-relevant actuators defined here can be identical to the total number of safety-relevant actuators.

[0033] Since it is generally unnecessary and also undesirable to switch off all safety-relevant actuators of the group of safety-relevant actuators that can be switched off by the safety controller when every shutdown signal occurs, it is generally preferred to switch off both the safety-relevant actuators of this group and the safety-relevant sensors in subsets or groups.Categories are to be divided as follows: the group of safety-relevant actuators contains at least one subset – often more than one subset – of safety-relevant actuators, wherein each subset contains a smaller number of actuators than the whole, but at least one safety-relevant actuator; the plastics processing machine has a plurality of categories of safety-relevant sensors, wherein each of these categories includes at least one safety-relevant sensor, and these categories include: an emergency stop category, of which at least one safety-relevant sensor is an emergency stop button or switch which generates an emergency stop signal when actuated; at least one safety distance category, of which at least one safety-relevant sensor generates a safety distance signal.

[0034] In this system, the safety controller switches off all actuators in the group of safety-relevant actuators when an emergency stop signal is present, and only the actuators of a specific subset when a safety distance signal is present. This prevents, for example, all safety-relevant actuators from being switched off when a door is opened, including those that are not accessible when the door is opened. Heating elements can, in principle, belong to the group of actuators that can be switched off by the safety controller, but in many designs, they do not belong to this group, but only to the aforementioned group of all safety-relevant actuators. This is due, among other things, to the fact that, because of their inertia (even when a heating element is switched off, it remains hot for an extended period), an immediate emergency shutdown would often offer no advantage but could lead to significant damage to the machine.

[0035] Often, at least one category of safety-related sensors has at least two safety-related sensors. To provide the cycle control system with all the necessary information, while only providing the safety controller with the information it absolutely needs, it may be preferable to design the signal routing so that the corresponding shutdown signals are distinguishable for the cycle control system but not for the safety controller. This reduces the number of inputs required for the safety controller.

[0036] In a preferred embodiment, the cycle sequence control is also in communication with the at least one safety-relevant sensor and is configured to immediately switch off at least one safety-relevant actuator upon the presence of a shutdown signal, just like the safety controller. This creates redundancy, which further reduces the probability that a safety-relevant actuator will not be switched off despite the presence of a shutdown signal affecting it.

[0037] If safety-relevant actuators are present that, according to the definitions above, do not belong to the group that can be switched off by the safety controller, it may be preferable for these to be switched off or shut down by the cycle sequence controller if it detects a malfunction of the safety controller.

[0038] As already mentioned, such a system typically also includes a control-machine interface (“power rack”). In a preferred embodiment, this control-machine interface is configured as an assembly with a backplane and a plurality of daughterboards, wherein: the backplane has a logic area operated by a first voltage and a switching area operated by a second voltage, the second voltage being higher than the first voltage, and the cycle control is configured to drive the logic area of ​​the backplane, at least in operating mode.

[0039] Furthermore, the backplane features: a plurality of slots of the first type ("slave slots"), which extend across both the logic and switching areas, and at least one switchable supply line in the switching area that can be supplied with the second voltage and is switched off by the safety controller when a shutdown signal is present. A plurality of switching daughter cards are also provided, each of which is inserted into a slot of the first type and is controlled via the logic area. Each daughter card uses the second voltage to control at least one actuator of the plastics processing machine. The output of at least one switching daughter card, which controls at least one safety-related actuator, is supplied with the second voltage exclusively via the at least one switchable supply line.This means that the safety controller shuts down a safety-relevant actuator by switching off a switchable power supply line of the backplane. The corresponding switching daughter card is not involved in this process itself, so a malfunction of the switching daughter card has no effect on this shutdown procedure.

[0040] In a preferred embodiment, the switching area of ​​the backplane has at least two switchable supply lines, namely a first switchable supply line and, for each safety section category, a further switchable supply line assigned to that safety section category.

[0041] It is preferred that, in the presence of an emergency stop signal, all switchable supply lines are switched off by the safety controller, but in the presence of a safety section signal, only the associated additional supply line is switched off, so that an unnecessary (and possibly harmful) shutdown of actuators in the presence of a safety section signal is avoided.

[0042] The switchable supply lines are preferably supplied by means of a safety daughter card controlled by the safety controller, so that these supply lines can be switched off by the safety controller.

[0043] Typically, plastics processing machines also have non-safety-related actuators. According to the definitions used here, these are actuators that do not pose a potential danger to a person in any scenario or that even have a warning or protective function. Examples include machine lights or warning devices. These should not be switched off even when an emergency shutdown signal is present. Therefore, it is preferred that the switching area of ​​the backplane retains at least one non-switchable supply line, which is supplied with the second voltage at least in production mode and which cannot be switched off by the safety controller. This non-switchable supply line can also be used to power safety-related actuators (if present) that do not belong to the group that can be switched off by the safety controller.

[0044] The switching daughterboard typically has one output for each actuator. To enable the safety controller to deactivate this output in a defined manner, it is preferably assigned to exactly one supply line, at least during the system's operating mode, as already mentioned. To allow the use of switching daughterboards that are as similar or identical in design as possible, it is preferred that the switching daughterboards have connections to each supply line and that the assignment of a switching daughterboard output to a supply line is made via a jumper (preferably coded), i.e., in a sense "mechanically." This means that the connection is mechanically fixed during machine setup and therefore cannot be unintentionally changed during operation, even in the event of a software error. This further increases the level of safety.Based on the coding, the cycle control can detect whether all jumpers have been correctly inserted according to the intended tasks for the daughter cards and generate an error message if this is not the case.

[0045] The connection between the logic area and the cycle sequence control is preferably established via a controller daughter card, which is inserted into a second-type slot ("master slot") in the backplane. This allows communication between the cycle sequence control and the safety controller to occur via the controller daughter card and the safety daughter card, so that the bidirectional data exchange runs through the controller daughter card, the safety daughter card, and the logic area of ​​the backplane. Alternatively or additionally, the bidirectional data exchange can take place directly between the first and second processing units, whereby it is often preferable to provide both signal paths to create redundancy.

[0046] Particularly for EMC reasons, it may be preferable for the control-machine interface to be located in an area of ​​a control cabinet that is spatially separated from the first and second computing units.

[0047] It is essential that the machine operator can communicate with the cycle control system. This is achieved through an interface device (hereinafter also referred to as the first interface device), which includes at least one input device and at least one visualization device. Using this interface device, the machine operator can, for example, view the machine's status and, if necessary, make changes to the cycle sequence, such as when changing products. This interface device and the cycle control system communicate via a bidirectional communication device. In some embodiments, this first interface device can also communicate wirelessly with the cycle control system.

[0048] In a preferred embodiment, the first interface device has a computing unit, designated as a third computing unit, which is distinct from and independent of the first computing unit of the cycle sequence control and the second computing unit of the safety controller, and on which its own operating system (second operating system) runs. Independent here means that the computing units can operate independently of one another.

[0049] Furthermore, a second interface device, which has at least a second input device, and a second communication device that is at least unidirectional are provided, via which signals generated by the second input device are passed on to the first computing unit independently of the first interface device.

[0050] Providing a separate computing unit with its own operating system for the first interface device initially has the advantage that the operating system for cycle control and the operating system for the first interface device can be selected to be optimized for their respective tasks.

[0051] Another advantage is that the cycle control system can continue to control the plastics processing machine even if the first interface device fails (generally until the current production order is completed). This can reduce system downtime (and thus downtime of the plastics processing machine), at least statistically.

[0052] The second interface, which communicates directly with the cycle control unit (i.e., its first processing unit), ensures that even if the first interface fails, at least minimal communication with the cycle control unit is possible. This allows, for example, the machine to be shut down via the second interface. The second interface unit can, for instance, include one of the emergency stop buttons. Furthermore, the second interface unit can have additional buttons or switches that can send direct commands to the cycle control unit, such as "Move to a safe rest position" or "Pause production."

[0053] As already mentioned, one advantage of the system is that the two operating systems can be chosen to suit the user. It is particularly advantageous for the first operating system to be a so-called "Real-Time Operating System" (RTOS).

[0054] To ensure a high level of user-friendliness, it is further preferred that the second operating system be an operating system with a graphical user interface, such as those used on PCs, laptops or smartphones.

[0055] In particular, if the second operating system has a graphical user interface, the first interface device can have a touchscreen, which serves as the primary input device and visualization device, thus enabling intuitive operation of the plastics processing machine. Alternative or additional input devices include a keyboard, a mouse, a touchpad, or a camera, which can be used for gesture control. More than one primary input device may be provided.

[0056] The preferred separation of the cycle control unit from the first interface unit makes it possible, in particular, to use the first interface unit not only as an interface to the machine operator (i.e., as a direct human-machine interface), but also as an interface to the "outside world" (especially the digital world). Therefore, the first interface unit preferably has at least one additional interface. This can, in particular, include one of the following: an interface to a local network (LAN / WLAN), a universal interface (especially a USB interface), or an interface to the internet. The second processing unit is always located between the digital world and the first processing unit of the cycle control unit, so that this second processing unit forms a first shield between the cycle control unit and the outside world.

[0057] To further improve the protection of the control and operating system, and in particular its cycle control, if an interface to the digital outside world is provided ("additional interface"), it is preferable to provide a data security device, separate from the second processing unit, for example in the form of a hardware firewall and / or a software firewall, between the second processing unit and at least one additional interface of the first interface device. Such a software firewall can be integrated into the second processing unit. To achieve the best possible security, a combination of hardware and software firewalls is preferable in some cases. This further increases operational reliability, as it already reduces the probability of a computer virus infection of the first interface device—i.e., its processing unit (second processing unit).Thus, two protective barriers are in place to prevent a computer virus infection from affecting the cycle control system. Any malware present in the cycle control system can cause significantly more damage than in the first interface device, as a malfunction of the plastics processing machine caused by malware could lead to mechanical damage to the machine itself. Naturally, such a data security device also protects the first interface device.

[0058] Preferably, a first data set is stored in the first computing unit (i.e., the computing unit of the cycle sequence control), which can be modified at least in production mode by means of the first interface device, so that changes in the cycle sequence can be made by the person operating the machine or via an interface of the first interface device to the outside world (if available) at least within a predefined framework.

[0059] In other words, in a particularly preferred embodiment, the control and operating system comprises at least three independent computing units, wherein the first computing unit (the central computing unit, so to speak) controls the plastics processing machine, while it is shielded from the outside world by the third computing unit and supported by the second computing unit with regard to occupational safety. This results in a multi-layered safety concept that addresses both data security and traditional occupational safety. This also further enhances overall occupational safety. The features listed individually in the claims can be combined in a technologically meaningful manner and can be supplemented by explanatory details from the description and by details from the figures, thereby illustrating further embodiments of the invention.Further preferred embodiments and advantages will become apparent from the further dependent claims and the exemplary embodiments now explained in more detail with reference to the figures.

[0060] Brief description of the characters

[0061] The invention will now be explained in more detail for better understanding by means of schematic and simplified embodiments with reference to the figures. These show:

[0062] Figure 1 is a highly schematic representation of a preferred embodiment of the system according to the invention for plastics processing,

[0063] Figure 2 is also a very schematic representation of the basic functionality of the invention,

[0064] Figure 3 is a schematic representation of a backplane with no daughter cards inserted.

[0065] Figure 4, the backplane from Figure 3 with daughter cards inserted,

[0066] Figure 5 is a very schematic representation of the functionality of the security daughter card from Figure 4.

[0067] Figure 6 shows a variant of the one shown in Figure 5, in which the backplane has an additional switchable supply line.

[0068] Figure 7 is a very schematic representation of part of a switching daughterboard,

[0069] Figs. 8a - 8c schematic representations of jumper wires used to connect the power supply of a switching daughterboard, as shown in Figure 7, to one of the supply lines of the backplane and

[0070] Figure 9 is an alternative to what is shown in Figure 4.

[0071] Detailed description of preferred embodiments

[0072] The invention will now be explained in more detail by way of example with reference to the accompanying drawings. However, the exemplary embodiments are merely examples and are not intended to limit the inventive concept to a specific arrangement. Before the invention is described in detail, it should be noted that it is not limited to the respective components of the device or the respective process steps, as these components and processes may vary. The terms used are intended solely to describe particular embodiments and are not used restrictively. Furthermore, where the singular or indefinite articles are used in the description or in the claims, this also refers to the plural of these elements, unless the overall context clearly indicates otherwise.

[0073] Figure 1 schematically shows a preferred embodiment of a plastics processing system according to the invention. This system comprises several functionally and usually also spatially separated units, some of which can be further subdivided into several subunits. Following this approach, the system can initially be divided into three units: the control and operating system 10, the "actual" plastics processing machine 100, which in the illustrated embodiment is designed as a shot-molding machine, and the control-machine interface 60 (power rack), via which the control and operating system 10 communicates bidirectionally with the plastics processing machine (hereinafter also referred to as: injection molding machine 100).

[0074] The term "plastics processing machine 100" encompasses all mechanical elements of the system, including actuators and sensors (except for sensors required for the computer units described later, such as temperature sensors for these units). As mentioned above, the term "actuator" is to be understood broadly and includes all elements of the plastics processing machine that are controlled by the control and operating system. As a rule, the plastics processing machine, according to the definitions presented here, also has its own electronic components; however, the machine cannot operate without a connection to the control and operating system 10 (namely, via the control-machine interface 60). The system as a whole (and thus also its aforementioned units) has an operating mode in which the entire system is ready for operation, enabling production.Thus, a production mode is a sub-mode of the operating mode, which must be distinguished in particular from one or more maintenance modes. In the operating mode, communication between the plastics processing machine 100 and the control and operating system 10 is established via the control-machine interface 60.

[0075] First, the control and operating system 10 will be discussed. This system can be considered to have three subunits. These three subunits are the first processing unit 20, comprising the cycle sequence controller; the second processing unit 25, comprising the safety controller; and the third processing unit 34, comprising the first interface device. Each of these processing units 20, 25, and 34 forms an autonomous system in the sense that it can operate independently of the other processing units. Typically, each processing unit has at least a CPU, RAM, and ROM.

[0076] These three computing units 20, 25, 34 are housed in a first control cabinet section S1, which in this embodiment (and this is also frequently preferred) is spatially separated from a second control cabinet section S2, in which the aforementioned control-machine interface 60 is housed in the form of a power rack. It should be noted that, as shown in Figure 1, it is possible to arrange the first computing unit 20 and the third computing unit 34 within this control cabinet. However, it is often preferred to arrange the third computing unit 34 outside this control cabinet and, in particular, to integrate it into the actual operating unit (in the illustrated embodiment, the element containing the touchscreen). The control cabinet (i.e., both control cabinet sections S1 and S2) should typically be locked and accessible only to specific groups of people.The cycle control system consists solely of the first computing unit 20 (which is why the terms "cycle control system" and "first computing unit" are used somewhat synonymously in the following) and serves to control the plastics processing machine in production mode. To control the machine 100 during a specific production order, it accesses stored data sets. These typically include data sets that can be modified within operating mode and data sets that are generally unchangeable within operating mode.

[0077] The first interface device comprises an input device and a visualization device, which in the illustrated embodiment are designed as a touchscreen 32 and communicate with the third computing unit 34. However, it would also be possible to implement the first input device and the visualization device separately, for example as a keyboard and screen. The first interface device can optionally have at least one further interface 33, in particular a USB interface, a printer interface, an internet connection, or a LAN / WLAN interface, which also communicates bidirectionally with the second computing unit 34. A data security device, for example in the form of a firewall 38 (in particular a hardware firewall and / or a software firewall), is arranged between the further interface 33 and the second computing unit.

[0078] The first interface device 30, namely its third processing unit 34, is connected to the first processing unit 20 (i.e., the cycle sequence control) via a bidirectional first communication device 36. The first interface device 30 serves for communication between the system and the outside world, e.g., a person operating the system, who can obtain information about the state of the machine 100 via the visualization device and can modify at least part of the modifiable data set of the cycle sequence control via the first input device, e.g., to adjust process parameters.

[0079] The described separation of the cycle control (i.e., its first processing unit 20) from the first interface device has two consequences: First, the control and operating system can be configured so that external access to the first processing unit 20 is only possible serially via the second processing unit 34 and the firewall 38, thus significantly increasing security against malware attacks that penetrate as far as the cycle control. Furthermore, the cycle control can operate completely independently of the first interface device 30, so that even if the first interface device fails, production is not necessarily interrupted.

[0080] The first interface unit 30, that is, the third computing unit 34, can operate with a user-friendly graphical operating system, whereas a machine-oriented real-time operating system (RTOS) is installed on the first computing unit 20. In any case, each of the computing units 20 and 34 has its own operating system, and it is particularly preferred that the two operating systems are different, which further improves protection against an attack that penetrates to the cycle control level. As mentioned previously, several types of data are stored in the first computing unit 20, especially data that cannot be modified by the first interface unit 30 during operation. This data relates, for example, to the configuration of the plastics processing machine 100.Other data can be modified in operating mode using the first interface device 30, for example, certain production parameters that may result from a tool or material change. If the interface device 30 fails, the cycle control running on the first computing unit 20 can continue to control the plastics processing machine 100, so that production does not necessarily have to be interrupted and the machine remains in a safe state.

[0081] However, in order to maintain minimal communication between the cycle control and a person operating the machine even in the event of a failure of the first interface device 30, a second interface device 50 is provided, which communicates directly with the first computing unit 20 via a second communication device 54. This second interface device 50 is designed exclusively as a human-machine interface and, in particular, is not capable of communicating electronically with other devices. This second communication device 54 can be designed, for example, as a classic hand control (as shown), as a machine keyboard, or as a "normal" or modified computer keyboard. In any case, the second communication device 54 has at least one second input device. It may be preferred that the second communication device 54 has a dedicated emergency stop switch.Furthermore, it is preferred that it also has additional input keys with immediate control commands.

[0082] As mentioned, communication between the control and operating system and the machine takes place, at least for the most part, via the Power Rack 60. This will be discussed in more detail later. Direct connections can also be provided, for example, for controlling the drive controllers.

[0083] First, the cooperation and operation of the first computing unit 20 (the cycle control unit) and the second computing unit 25 (the safety control unit) are described in more detail with reference to Figure 2. It should be noted that the representation in Figure 2 is also very simplified, specifically in that only three actuators and two groups of safety-related sensors of the injection molding machine 100 are shown. However, these have been selected as examples to make the functionality easy to understand. Furthermore, the power rack is not shown in Figure 2 due to the purely functional nature of the representation.

[0084] Figure 2 schematically depicts the following components of the injection molding machine 100: a protective hood 120 with two doors 122a, 122b; a two-part injection mold located inside the protective hood 120; a clamping unit with an actuator 110 located inside the protective hood 120; machine lighting 115 also located inside the protective hood 120; a plasticizing unit with two actuators 112, 113, two emergency stop buttons 130a, 130b, and two door switches 125a, 125b. Actuator 112 is a mechanical actuator (e.g., for moving the screw), which is also arranged under a protective hood; and actuator 113 is a heating element.

[0085] It is self-evident that a "real" injection molding machine has significantly more actuators and sensors; however, to illustrate the principles of the invention, the selection made here by way of example suffices, whereby the following applies: a) Machine lighting 115, actuators 112 and 113 of the plasticizing unit, and actuator 110 of the clamping unit constitute the actuators of the injection molding machine 100. b) Actuators 112 and 113 of the plasticizing unit and actuator 110 of the clamping unit constitute the entirety of the safety-relevant actuators, while machine lighting 115 does not belong to the entirety of the safety-relevant actuators. In the illustrated embodiment, the entirety of the safety-relevant actuators also constitutes the group of actuators that can be switched off by the safety controller (also referred to simply as the "group"). c) Actuator 110 of the clamping unit and the motorized actuator 112 of the plasticizing unit form a subset of this group.In this simplified embodiment, the group thus only includes a subset that is smaller than the group itself. d) The safety-related sensors, i.e., the door switches 125a, 125b and the emergency stop buttons 130a, 130b, form two categories of safety-related sensors: the emergency stop category (emergency stop buttons 130a, 130b) and the safety section category (door switches 125a, 125b). As explained again later, usually exactly one emergency stop category is provided; however, it is possible to provide more than one safety section category. A shutdown signal generated by a sensor of the safety section category is also referred to as a safety section signal, and a shutdown signal generated by a sensor of the emergency stop category is also referred to as an emergency stop signal.

[0086] All the aforementioned safety-related sensors are in communication with both the first processing unit 20 (the processing unit of the cycle sequence control) and the second processing unit 25 (the processing unit of the safety controller). The signals from the safety-related sensors are fed individually to processing unit 20 of the cycle sequence control, while the signals of a category of safety-related sensors are aggregated for processing unit 25 of the safety controller to save occupied inputs. In other words, the cycle sequence control "knows," for example, which of the doors 122a, 122b has been opened, while the safety controller "knows" only that at least one of the doors has been opened. The aggregation of the signals for the safety controller is shown schematically here using signal dividers 140, 141.The cycle control (that is, its computing unit 20) controls all actuators, which is schematically indicated by the corresponding arrows in Figure 2.

[0087] If one of the safety-related sensors is activated (i.e., a door 122a, 122b is opened or an emergency stop button 130a, 130b is pressed), the sensor in question generates a shutdown signal. A shutdown signal can also be the interruption of a circuit. The safety controller 25 is configured to immediately or after a defined time delay shut down at least one safety-related actuator when such a shutdown signal from a safety-related sensor is present, as follows: If one of the emergency stop buttons 130a, 130b is pressed, all safety-related actuators of the group defined under b) (i.e., actuators 110, 112, and 113) are immediately shut down. If one of the doors 122a, 122b is opened, so that the corresponding door switch 125a, 125b generates a corresponding shutdown signal, only the actuators 110 and 112 are immediately switched off by the safety control.Each actuator is switched off by a separator 142a, 142b, 142c, as is only shown very schematically in Figure 2.

[0088] Even though the safety controller 25 alone would generally be sufficient to ensure adequate operational safety, the cycle sequence controller 20 is also configured to switch off the corresponding actuators according to the aforementioned scheme when a corresponding shutdown signal is present. In the exemplary embodiment, this means that the cycle sequence controller 20 switches off all actuators 110, 112, and 113 when at least one of the emergency stop buttons 130a, 130b is pressed, and switches off actuators 110, 112 when one of the doors 122a, 122b is opened. This means that the actuator shutdown is implemented redundantly, which further increases operational safety.

[0089] A bidirectional data exchange device 26 is provided, by means of which the cycle sequence control 20 and the safety controller 25 exchange and compare data, at least in production mode. If the safety controller 25 detects a deviation from the normal state in the cycle sequence control 20, it immediately switches off all safety-relevant actuators. If the cycle sequence control 20 detects a deviation from the normal state in the safety controller 25, it moves the plastics processing machine to a predefined park position. Not all safety-relevant actuators are necessarily switched off in this case.

[0090] With reference to Figures 3 to 8c, the design of the control-machine interface, in particular the backplane and the daughter cards inserted therein, will now be discussed. At least part of the communication between the control and operating system and the plastics processing machine runs via this control-machine interface, including, in particular, the deactivation of actuators by the safety controller and / or the cycle control.

[0091] Figure 3 shows the backplane 70 of the control-machine interface in a highly schematic, top-view representation. This backplane 70 has a logic area 72 and a switching area 74. The logic area 72 is operated at a lower voltage than the switching area 74, with typical voltages being 3.3 V for the logic area and 24 V for the switching area. The backplane 70 has multiple slots, namely several slots 76 of a first type (slave slots) and one slot 78 of a second type (master slot). All slots extend across both the logic area 72 and the switching area 74. The logic area of ​​the slot 78 of the second type is in bidirectional communication with the logic areas of the slots 76 of the first type, as is generally known in the prior art.In switching area 74, several supply lines 74a, 74b, 74c extend; in this embodiment, there are three. These are shown here only schematically, but can also have connectors for each daughterboard. The three supply lines are of different types, as follows: There is a non-switchable supply line 74a (permanent positive), a first switchable supply line 74b, and another switchable supply line 74c. As will be explained later, more than one additional supply line can also be provided.

[0092] Figure 4 shows the backplane from Figure 3 and daughterboards 82, 84, 80a, 80b, and 80c inserted into the backplane's slots. The control daughterboard 82 is inserted into slot 78 of the second type. This daughterboard communicates with the first processing unit 20 (the processing unit of the cycle sequence control) and, in this embodiment, also supplies the voltage for the switching area via this slot (the latter is not mandatory, but often advantageous), namely into the non-switchable supply line 74a (permanent positive). Since slot 78 of the second type communicates with all slots of the first type, the first processing unit 20 also communicates with all daughterboards inserted into slots 76 of the first type. Like the backplane, the daughterboards each have a logic area and a switching area.

[0093] The safety daughter card 84 communicates with the second processing unit 25 and its primary function is to supply power to the switchable supply lines (here 74b and 74c) or to interrupt the power supply to these lines when a shutdown signal is present. This will be discussed in detail later. Communication between the cycle sequence controller 20 and the safety controller 25 can take place exclusively or additionally via the control daughter card 82 and the safety daughter card 84. To provide redundancy, it is possible and also preferred to provide two bidirectional connections: one direct connection within the first control cabinet area S1 and a second connection via the control daughter card 82, the backplane 70, and the safety daughter card 84.

[0094] In the illustrated, highly simplified embodiment, each of the switching daughter cards 80a, 80b, 80c, 80d is assigned to exactly one of the actuators shown in Figure 2. It should be noted, however, that due to the limited number of slots, each switching daughter card 80 typically controls several actuators. In this embodiment, the first switching daughter card 80a is connected to the machine lighting 115, the second switching daughter card 80b to the heating element 113 of the plasticizing unit, the third switching daughter card 80 to the motorized actuator 112 of the plasticizing unit, and the fourth switching daughter card 80d to the actuator 110 of the closing unit.The power supply for the power section (switching area) of the second switching daughter card 80b is provided via the non-switchable supply line 74a (permanent positive), the power supply for the power section (switching area) of the first switching daughter card 80a is provided via the first switchable supply line 74b, and the power supply for the respective power sections (switching areas) of the third and fourth switching daughter cards 80c and 80d is provided via the second switchable supply line 74c. The power supply for the logic areas of all daughter cards is provided via the non-switchable supply line 74a (permanent positive).

[0095] Figure 5 schematically shows the main function of the safety daughter card 84, namely the supply of the switchable supply lines 74b and 74c. The safety daughter card 84 is powered via the non-switchable supply line 74a. The supply to the first switchable supply line 74b and the second switchable supply line 74c is provided via a first disconnect switch 84a, which is assigned to the emergency stop buttons 130a and 130b. The connection between the first disconnect switch 84a and the second supply line 74c is made via a second disconnect switch 84b (i.e., the first and second disconnect switches are connected in series). It follows that if the second computing unit 25 receives an emergency stop signal due to the actuation of one of the two emergency stop buttons 130a, 130b, the safety control unit 25 controls the safety daughter card 84 in such a way that the first disconnect switch 84a is opened.This disconnects both the first switchable supply line 74b and the second disconnect switch 84b connected in series, and thus also the further switchable supply line 74c, from the supply voltage, regardless of the state of the second disconnect switch 84b. This means that when an emergency stop button 131a, 131b is activated, all switchable supply lines are de-energized, but not the non-switchable supply line 74a.

[0096] If, however, the safety controller 25 receives a shutdown signal from one of the door switches 125a, 125b (safety section signal), it controls the safety daughter card 84 in such a way that only the second disconnect switch 84b is opened and only the further supply line 74c is de-energized.

[0097] As can be seen from Figure 6, any number of additional switchable supply lines (here two additional supply lines 74c and 74d) can be provided, each of which is supplied with power via a disconnect switch 84b, 84c connected in series with the first disconnect switch 84a.

[0098] It is not possible to shut down the non-switchable supply line 74a by the safety control.

[0099] In the present embodiment (where each switching daughter card controls exactly one actuator), each of the switching daughter cards 80a, 80b, 80c is assigned to exactly one of the supply lines in operating mode. To ensure that the switching daughter cards have a uniform basic structure, each daughter card has a connection to each supply line 74a, 74b, 74c (Fig. 7), although only one is "activated" at a time. This is achieved by selecting a suitable jumper 150a, 150b, 150c (Figures 8a to 8c), each of which connects exactly one supply line to the switching area of ​​the daughter card. These jumpers are preferably coded so that the cycle control can recognize whether the appropriate jumper is inserted in each daughter card. Only when all assignments formed by the jumpers are correct does the cycle control enable the machine for production.In practice, each switching daughterboard has multiple outputs, allowing it to control several actuators. In this case, each output or output group is assigned a jumper as described above.

[0100] Figure 9 shows an alternative embodiment in which the first processing unit 20 (i.e., the CPU) is not spatially separated from the backplane but is located directly on it, so that no second-type slot (master) and no control daughterboard are provided. The security daughterboard and the switching daughterboard are controlled directly by the CPU. In this case, the voltage can be supplied to the non-switchable power supply line, for example, via a direct connection (as shown) or via the security daughterboard.

[0101] As another alternative, it would be possible to arrange the CPU (first processing unit) 20 on the control daughterboard.

[0102] In both of the above-mentioned cases, the CPU is not spatially separated from the control machine interface; the functionalities described above remain unaffected.

[0103] It goes without saying that this description may be subject to various modifications, changes and adjustments, which are in the range of equivalents to the attached claims.

[0104] Reference symbol list

[0105] 10 Control and operating system 76 Type one slot (“slave”)

[0106] 20 first computing unit (computing unit of the 78 slot of the second type ("Master")

[0107] Cycle sequence control) 80a-d switching daughter card

[0108] 25 Second processing unit (processing unit of the 82 control daughter card safety controller) 84 Safety daughter card

[0109] 26 bidirectional data exchange device 84a first disconnect switch

[0110] 30 first interface device 84b second disconnect switch

[0111] 32" touchscreen (with first interface, third disconnect switch, direction and visualization device) 100 injection molding machine

[0112] 33 additional interfaces 110 locking unit / actuator of the locking unit

[0113] 34 third computing unit 112 first actuator of the plasticizing unit (motor¬

[0114] 36 bidirectional first communication unit actuator, e.g. worm drive) direction 113 second actuator of the plasticizing unit (e.g.

[0115] 38 Firewall Heating)

[0116] 50 second interface device 115 machine lighting

[0117] 52 Input device of the second interface 120 Protective cover 122a, b Door

[0118] 54 second communication device 125a, b door switch

[0119] 60 Power rack 130a, b Emergency stop button

[0120] 70 Backplane 140a, b Signal divider

[0121] 72 Logic area 142a, b, c Separator

[0122] 74 Switching range 150a, b, c Jumper

[0123] 74a Non-switchable supply line (DauBA area outside the control cabinet erplus) 51 First control cabinet area

[0124] 74b first switchable supply line (SE) 52 second switch cabinet area

[0125] 74c, d further switchable supply line (SC)

Claims

Patent claims 1. Plastics processing system comprising at least one plastics processing machine (100) and a control and operating system (10) having an operating mode for controlling and operating this plastics processing machine (100), wherein the operating mode has a production mode, and wherein the plastics processing machine has: (i) a plurality of actors which (ii) has at least one safety-related actuator (110, 112, 113), and (iii) a plurality of sensors which (iv) includes at least one safety-related sensor (125a, 125b, 130a, 130b) which generates a shutdown signal when a safety-related event occurs, and wherein the control and operating system includes: (v) a cycle sequence control which, in production mode, at least indirectly controls the majority of the actuators according to (i) the plastics processing machine and which uses a first computing unit (20) equipped with a first operating system for this purpose, and (vi) a safety controller operating according to a safety program, wherein the safety program is not modifiable at least in operating mode, the safety controller uses a second computing unit (25) independent of the first computing unit (20) according to (v), the safety controller is in communication connection with the at least one safety-relevant sensor (125a, 125b, 130a, 130b) according to (iv) and is configured to immediately switch off the at least one safety-relevant actuator (110, 112, 113) according to (ii) when a shutdown signal according to (iv) is present, characterized in that (vii) at least one bidirectional data exchange device (26) is provided and the cycle sequence control according to (v) and the safety control according to (vi) are configured to exchange and / or compare data at least in production mode using this at least one bidirectional data exchange device (26), and the cycle sequence control according to (v) is configured to continuously check the function of the safety control according to (vi) at least in production mode and to move the plastics processing machine (100) to a defined park position if it detects a malfunction or failure of the safety control according to (vi), and that the safety control according to (vi) is configured to continuously check the function of the cycle sequence control according to (v) at least in production mode and to switch off the at least one safety-related actuator (110, 112) according to (ii),if it detects a malfunction or failure of the cycle sequence control according to (v).

2. System according to claim 1, characterized in that (viii) the plastics processing machine has a plurality of safety-related actuators according to (ii) which form a group of safety-related actuators, wherein (ix) the group of safety-relevant actors according to (viii) contains at least a subset of safety-relevant actors, each subset containing a smaller number of safety-relevant actors than the group according to (viii), but containing at least one safety-relevant actor, (x) the plastics processing machine has a plurality of categories of safety-related sensors according to (iv), each of these categories including at least one safety-related sensor, wherein these categories comprise: (xi) an emergency stop category, at least one of which safety-related sensor is an emergency stop switch or emergency stop button (130a, 130b) which, when actuated, generates an emergency stop signal, (xii) at least one safety section category, at least one of whose safety-relevant sensor generates a safety section signal when actuated, wherein the safety controller according to (vi) switches off all actuators of the group of safety-relevant actuators according to (viii) when an emergency stop signal according to (xi) is present and switches off all actuators of the group of safety-relevant actuators according to (viii) when a safety section signal according to (xi) is present (xi) only switches off the actuators of a subset according to (ix).

3. System according to claim 2, characterized in that the plastics processing machine has at least two safety-relevant sensors in at least one category according to (x), the shutdown signals of which are distinguishable for the cycle sequence control according to (v), but not for the safety control according to (vi).

4. System according to one of claims 1 to 3, characterized in that the cycle sequence control according to (v) is also in communication connection with the at least one safety-relevant sensor (122a, 122b) according to (iv) and is configured to switch off the same at least one safety-relevant actuator (120) according to (ii) immediately when a shutdown signal according to (iv) is present, as does the safety control according to (vi).

5. System according to one of the preceding claims, characterized in that a control-machine interface is further provided, which at least in operating mode has: (xiii) a backplane (70) with a logic area (72) operated by a first voltage and a switching area (74) operated by a second voltage, wherein the second voltage is higher than the first voltage, and the cycle control according to (v) is configured to drive the logic area (72) of the backplane (70) at least in operating mode, wherein the backplane has: (xiv) a plurality of slots of a first type (76) which extend over both the logic area (72) and the switching area (74), and (xv) at least one switchable supply line (74b- 74d) in the switching area (74) that can be supplied with the second voltage and which is switched off by the safety control according to (vi) when a shutdown signal according to (iv) is present, and (xvi) a plurality of switching daughter cards (80a-80d), each of these switching daughter cards (80a-80d) being inserted into a slot of the first type (76) according to (xiv), and each being controlled via the logic area (72) and in production mode each controlling at least one actuator according to (I) of the plastics processing machine (100) by means of the second voltage, wherein (xvii) at least one switching daughter card (80c, 80d) which controls at least one safety-related actuator (110, 112) according to (II), is supplied with the second voltage exclusively via the at least one switchable supply line according to (xv).

6. System according to claim 2 or claim 3 and according to claim 5, characterized in that the switching range (74) the backplane (70) at least two switchable supply lines to (xv), namely (xviii) a first switchable supply line (74b) and (xix) for each safety section category according to (xii) has a further switchable supply line (74c, 74d) assigned to that safety section category.

7. System according to claim 6, characterized in that, in the event of an emergency stop signal according to (xi), all switchable supply lines (74b, 74c, 74d) according to (xviii) and (xix) are switched off by the safety controller according to (vi).

8. System according to claim 6 or claim 7, characterized in that the supply of the switchable supply lines according to (xviii) and (xix) is provided by means of a safety daughter card (84) controlled by the safety controller according to (vi), so that these supply lines can be switched off by the safety controller according to (vi).

9. System according to claim 8, characterized in that the connection between the second computing unit (25) and the security daughter card (84) is at least also directly and not, or not exclusively, via the logic area (72) of the backplane.

10. System according to one of claims 5 to 9, characterized in that the switching area (74) of the backplane (70) further (xx) has at least one non-switchable supply line (74a) which is supplied with the second voltage at least in production mode and which cannot be switched off by the safety control according to (vi).

11. System according to one of claims 5 to 10, characterized in that each switching daughter card (80a, 80b, 80c) in the operating mode of the system (xxi) has at least one output assigned to an actuator, which is assigned to exactly one supply line.

12. System according to claim 11, characterized in that the assignment of an output according to (xxi) of a switching daughter card according to (xvi) to a supply line according to (xviii), (xix) or (xx) is carried out via a jumper (150a- 150c), which is preferably coded.

13. System according to one of claims 5 to 12, characterized in that the connection of the logic area (72) to the cycle sequence control according to (v) is made by means of a control daughter card (82) which is inserted into a slot of the second type (78) in the backplane (70), or that the first computing unit is arranged directly on the backplane.

14. System according to claim 13, characterized in that the communication between cycle sequence control according to (v) and safety control according to (vi) takes place at least also directly and not, or not exclusively, via the logic area (72) of the backplane by means of the bidirectional data exchange device according to (vii).

15. System according to at least one of claims 5 to 14, characterized in that the control-machine interface is arranged in an area (S2) of a control cabinet that is spatially separated from the first computing unit (20) and the second computing unit.

16. Plastics processing system according to one of the preceding claims, wherein the control and operating system further comprises: (xxii) a first interface device (30) comprising at least a first input device, at least a visualization device and a third computing unit (34) equipped with a second operating system and in communication connection with the first input device and the visualization device, which is independent of the first computing unit (20) and the second computing unit (25), (xxiii) a bidirectional first communication device (36) through which the first computing unit (20) according to (v) and the third computing unit according to (xxii) communicate with each other, (xxiv) a second interface device (50) which has at least one second input device (52), (xxv) a second communication device (54) that is at least unidirectional, through which signals generated by the second input device (52) according to (xxiv) are passed to the first computing unit (20) according to (v).

17. System according to claim 16, characterized in that a shutdown command can be transmitted to the cycle sequence control according to (v) by means of the input device (52) of the second interface device (50) according to (xxiv), which causes the cycle sequence control to move the plastic processing machine (100) into a defined park position.

18. System according to at least one of claims 16 to 17, characterized in that at least in production mode a first data record which can be modified by means of the first interface device according to (xxii) is stored in the first computing unit (20).

Images