Plastics processing system

Abstract

A plastics processing system is described. This system comprises at least one plastics processing machine (100) and a control and operating system for controlling and operating this plastics processing machine (100). The plastics processing machine has safety-related actuators (110, 112, 113) and safety-related sensors (125a, 125b, 130a, 130b), which each generate a shutdown signal when a safety-related event occurs. The control and operating system includes a cycle control unit, which, in production mode, controls, among other things, the actuators of the plastics processing machine and uses a first computing unit (20) equipped with a first operating system for this purpose.The control and operating system further comprises a safety controller operating according to a safety program, which utilizes a second processing unit (25) and is in communication with the safety-relevant sensors (125a, 125b, 130a, 130b) and is configured to immediately switch off at least one safety-relevant actuator (110, 112, 113) when a shutdown signal generated by a safety-relevant sensor is present. To further increase operational safety, at least one bidirectional data exchange device (26) is provided, via which the cycle sequence control and the safety controller exchange and / or compare data, at least in one production mode.The cycle sequence control transfers the plastic processing machine (100) to a defined park position when it detects a malfunction or failure of the safety control, and the safety control switches off at least one safety-relevant actuator (110, 112, 113) when it detects a malfunction or failure of the cycle sequence control.

Description

[0001] The invention relates to a system for plastics processing according to claim 1.

[0002] A modern plastics processing system always includes the actual plastics processing machine and a control and operating system for this machine. Usually, a control-machine interface is provided, which electrically / electronically connects the control and operating system and the plastics processing machine. This interface, among other things, converts the low-voltage signals of the control and operating system into higher-voltage signals (usually 24V). According to the definitions used here, the control-machine interface is neither part of the control and operating system nor part of the plastics processing machine, but rather a separate subsystem.

[0003] The plastics processing machine and the control and operating system are usually structurally separated from each other, whereby the elements of the control and operating system can themselves be spatially distributed, in particular in such a way that parts of it are arranged in a machine control cabinet, while other parts of it, in particular those that serve for operation, are arranged outside the machine cabinet so that they can be operated or seen directly by a user.

[0004] The term "plastics processing machine" here refers to the mechanical hardware, which incorporates a multitude of actuators. The term "actuator" is used in its broadest sense and encompasses all elements that are at least indirectly controlled by the control and operating system. Typically, at least motor actuators, which at least indirectly drive moving elements, switching valves, and heating devices are considered actuators. However, for the purposes of this application, lighting devices and warning devices (signal lights, tone generators) are also considered "actuators." As mentioned above, these actuators are controlled at least indirectly by the control and operating system (in the sense of the definitions used here, via the control-machine interface). The aforementioned multitude of actuators always includes at least one (usually several) safety-relevant actuator."Safety-relevant" here means that it poses a potential danger to a person. This group of actuators typically includes, in particular, motor actuators (for example, in a clamping unit) and heating devices (for example, in a plasticizing unit). Lighting devices and warning devices, for example, are not considered safety-relevant actuators in this sense. Furthermore, such a plastics processing machine usually also has a number of sensors, which in turn send signals to the control and operating system (usually also via the control-machine interface). A distinction is generally made between safety-relevant sensors, such as door switches and emergency stop buttons, and sensors that measure machine or process parameters.According to the definitions given here, each safety-relevant sensor generates a shutdown signal when it detects a safety-relevant event, which leads to the shutdown of at least one safety-relevant actuator.

[0005] Such a plastics processing machine could be, in particular, an injection molding machine or a 3D printer. In principle, it is possible for a single control and operating system to control and operate exactly one plastics processing machine; however, it is also possible for a single control and operating system to control and operate several plastics processing machines.

[0006] The system – and therefore its components – has an operating mode. This operating mode refers to the state of the system in which it is complete and ready for operation. A sub-mode of this operating mode is the production mode, in which the system, and thus the plastics processing machine, actually operates, i.e., produces. No operating mode exists, in particular, when the plastics processing machine and / or the control and operating system and / or the control-machine interface is undergoing maintenance, or when software updates are being performed on the control and operating system by a qualified and authorized person. State of the art

[0007] The control and operating system of such a plastics processing system features a cycle sequence control which, in production mode, at least indirectly controls the plastics processing machine after a corresponding cycle sequence has been programmed into it. For this purpose, the cycle sequence control includes a first computing unit equipped with a first operating system.

[0008] In addition to the cycle control described above, the control and operating system typically also includes a safety controller that operates according to a safety program. Such a safety controller—independent of the cycle control—is legally required in many countries and serves to ensure the occupational safety of the person(s) operating the machine. This type of safety controller operates according to a safety program that cannot be changed, at least during operation, and has a second processing unit that is independent of the first processing unit (the processing unit of the cycle control) and on which the safety program runs.This safety controller communicates with at least one safety-relevant sensor (since plastic processing machines typically have multiple safety-relevant sensors, it communicates with all of them) and is configured to deactivate at least one safety-relevant actuator when a shutdown signal is received. The selection of actuators that are deactivated upon receiving a shutdown signal generally depends on the type of safety-relevant sensor that generated the signal. At least two scenarios are typically distinguished: the emergency stop (which occurs when an emergency stop button is pressed) and the activation of a sensor within a safety zone (for example, when a door or protective cover is opened).In the first case, the safety control system usually switches off at least all safety-relevant actuators that move a machine part, at least indirectly; in the second case, it only switches off some of the safety-relevant actuators, for example, those that become accessible by opening the door.

[0009] A forming machine with such a safety control system is known, for example, from DE 10 2015 963 A1.

[0010] DE 102 46 925 A1 proposes a method for controlling an injection molding machine and a handling device in which movement sequences can be programmed by the operator, but the method prohibits certain movement sequences that could lead to damage to machine parts.

[0011] WO 02 / 19957 A2 proposes a system for the central control of equipment used during a medical operation, comprising a first control unit designed as a closed system and a second control unit designed as an open system. The first control unit controls the equipment performing safety-related functions, while the second control unit controls the equipment performing non-safety-related functions. The two control units are interconnected for communication purposes. Description of the invention

[0012] Based on this state of the art, the present invention aims to further develop such a system in such a way as to further increase the safety for the operating persons.

[0013] This problem is solved by a system having the features of claim 1.

[0014] According to the invention, the safety controller no longer forms a purely stand-alone unit, but is additionally in communication with the cycle sequence control, for which at least a bidirectional data exchange device is provided, by means of which the cycle sequence control and the safety controller exchange and compare data at least in production mode.Furthermore, the cycle control is designed to continuously monitor the function of the safety control, at least in production mode, and to move the plastics processing machine to a defined park position if it detects a malfunction or failure of the safety control. The safety control is also designed to continuously monitor the function of the cycle control, at least in production mode, and to deactivate at least one safety-relevant actuator that it can switch off – usually all safety-relevant actuators that it can switch off – of the machine if it detects a malfunction or failure of the cycle control.

[0015] This means that the cycle control and the safety control monitor each other and at least partially shut down the plastics processing machine if a malfunction or even a complete failure of the cycle control or the safety control is detected during this monitoring. Since the cycle control and the safety control use different processing units, it is extremely unlikely that they would fail simultaneously. This is only possible in the event of a complete power outage, which would cause the machine to shut down anyway. Thus, the operational reliability of the plastics processing machine is increased by a further level.

[0016] The plastics processing system according to the invention thus comprises at least one plastics processing machine and a control and operating system having an operating mode for controlling and operating this plastics processing machine, wherein the operating mode has a production mode, and the plastics processing machine comprises: (i) a plurality of actors which (ii) has at least one safety-related actuator, (iii) a plurality of sensors which (iv) has at least one safety-related sensor which generates a shutdown signal when a safety-related event occurs, and whereby the control and operating system features: (v) a cycle sequence control which, in production mode, at least indirectly controls the majority of the actuators according to (i) the plastics processing machine and which uses a first computing unit equipped with a first operating system for this purpose, and (vi) a safety controller operating according to a safety program, wherein the security program cannot be changed, at least in operating mode, the security controller uses a second computing unit (25) that is independent of the first computing unit (20) according to (v), the safety controller is in communication connection with the at least one safety-relevant sensor according to (iv) and is configured to immediately switch off the at least one actuator according to (ii) when a shutdown signal according to (iv) is present, (vii) at least one bidirectional data exchange device through which the cycle sequence control according to (v) and the safety control according to (vi) exchange and compare data at least in production mode.

[0017] In this case, the cycle sequence control according to (v) is configured to continuously check the function of the safety control according to (vi) at least in production mode and to move the plastics processing machine to a defined park position if it detects a malfunction or failure of the safety control according to (vi), and the safety control according to (vi) is configured to continuously check the function of the cycle sequence control according to (v) at least in production mode and to switch off the at least one safety-relevant actuator according to (ii) of the plastics processing machine if it detects a malfunction or failure of the cycle sequence control according to (v).

[0018] Typically, a plastics processing machine naturally has multiple safety-relevant actuators. According to the definitions used here, the actuators that can be deactivated by the safety controller constitute a group of safety-relevant actuators. This group of safety-relevant actuators can represent all safety-relevant actuators; however, there are conceivable configurations in which additional safety-relevant actuators are present that cannot be deactivated by the safety controller, but only by the cycle sequence control. This means that in this case, the total number of safety-relevant sensors is larger than the group of safety-relevant sensors that can be deactivated by the safety controller. But as mentioned, the group of safety-relevant actuators defined here can be identical to the total number of safety-relevant actuators.

[0019] Since it is generally unnecessary and also undesirable to switch off all safety-relevant actuators of the group of safety-relevant actuators that can be switched off by the safety controller when every shutdown signal occurs, it is generally preferred to divide both the safety-relevant actuators of this group and the safety-relevant sensors into subsets or categories as follows: - The group of safety-relevant actors contains at least one subset - often more than one subset - of safety-relevant actors, where each subset contains a smaller number of actors than the whole, but at least one safety-relevant actor. - The plastics processing machine has multiple categories of safety-related sensors, each of which includes at least one safety-related sensor, and these categories include: - an emergency stop category, at least one of which is a safety-relevant sensor that is an emergency stop button or switch which generates an emergency stop signal when activated, - at least one safety zone category, of which at least one safety-relevant sensor generates a safety zone signal.

[0020] In this system, the safety controller switches off all actuators in the group of safety-relevant actuators when an emergency stop signal is present, and only the actuators of an assigned subset when a safety section signal is present. This prevents, for example, all safety-relevant actuators from being switched off when a door is opened, including those that are not even accessible when the door is opened.

[0021] Heating elements can, in principle, belong to the group of actuators described above that can be switched off by the safety controller. However, in many embodiments, they do not belong to this group, but only to the aforementioned set of all safety-relevant actuators. This is due, among other things, to the fact that, because of their inertia (even when a heating element is switched off, it remains hot for an extended period), an immediate emergency shutdown would often offer no advantage but could lead to significant damage to the machine.

[0022] Often, at least one category of safety-related sensors has at least two safety-related sensors. To provide the cycle control system with all necessary information, while only providing the safety controller with the information it absolutely needs, it may be advantageous to design the signal routing so that the corresponding shutdown signals are distinguishable for the cycle control system but not for the safety controller. This reduces the number of inputs required for the safety controller.

[0023] In a preferred embodiment, the cycle sequence control is also in communication with the at least one safety-relevant sensor and is configured to immediately switch off at least one safety-relevant actuator upon the presence of a shutdown signal, just like the safety controller. This creates redundancy, which further reduces the probability that a safety-relevant actuator will not be switched off despite the presence of a shutdown signal affecting it.

[0024] If safety-relevant actuators are present that, according to the definitions above, do not belong to the group that can be switched off by the safety controller, it may be preferable for these to be switched off or shut down by the cycle sequence controller if it detects a malfunction of the safety controller.

[0025] As already mentioned, such a system typically also includes a control-machine interface (“power rack”). In a preferred embodiment, this control-machine interface is configured as an assembly with a backplane and a plurality of daughterboards, wherein: - the backplane has a logic area powered by a first voltage and a switching area powered by a second voltage, wherein - the second voltage is higher than the first voltage, and - the cycle control is set up to control the logic area of ​​the backplane, at least in operating mode.

[0026] Furthermore, the backplane features: - a plurality of slots of the first type (“slave slots”), which extend over both the logic area and the switching area, and - at least one switchable supply line in the switching area that can be supplied with the second voltage and which is switched off by the safety control when a shutdown signal is present.

[0027] A plurality of switching daughter cards are provided, each of which is plugged into a slot of the first type and is controlled via the logic area. Each daughter card uses the second voltage to control at least one actuator of the plastics processing machine. The output of at least one switching daughter card, which controls at least one safety-related actuator, is supplied with the second voltage exclusively via the at least one switchable supply line. This means that the safety controller shuts down a safety-related actuator by switching off a switchable supply line of the backplane. The corresponding switching daughter card itself is not involved in this process, so a malfunction of the switching daughter card has no effect on this shutdown procedure.

[0028] In a preferred embodiment, the switching area of ​​the backplane has at least two switchable supply lines, namely - a first switchable supply line and - for each safety route category, one additional switchable supply line assigned to that safety route category.

[0029] It is preferred that, in the presence of an emergency stop signal, all switchable supply lines are switched off by the safety controller, but in the presence of a safety section signal, only the associated additional supply line is switched off, so that an unnecessary (and possibly harmful) shutdown of actuators in the presence of a safety section signal is avoided.

[0030] The switchable supply lines are preferably supplied by means of a safety daughter card controlled by the safety controller, so that these supply lines can be switched off by the safety controller.

[0031] Typically, plastics processing machines also have non-safety-related actuators. According to the definitions used here, these are actuators that do not pose a potential danger to a person in any scenario or that even have a warning or protective function. Examples include machine lights or warning devices. These should not be switched off even when an emergency shutdown signal is present. Therefore, it is preferred that the switching area of ​​the backplane retains at least one non-switchable supply line, which is supplied with the second voltage at least in production mode and which cannot be switched off by the safety controller. This non-switchable supply line can also be used to power safety-related actuators (if present) that do not belong to the group that can be switched off by the safety controller.

[0032] The switching daughterboard typically has one output for each actuator. To enable the safety controller to deactivate this output in a defined manner, it is preferably assigned to exactly one supply line, at least during the system's operating mode, as previously mentioned. To allow the use of switching daughterboards with similar or identical designs, it is preferred that the switching daughterboards have connections to each supply line and that the assignment of a switching daughterboard output to a supply line is made via a jumper (preferably coded), thus in a "mechanical" manner. This means that the connection is mechanically fixed during machine setup and therefore cannot be unintentionally changed during operation, even in the event of a software error. This further increases the level of safety.Based on the coding, the cycle control can detect whether all jumpers have been correctly inserted according to the intended tasks for the daughter cards and generate an error message if this is not the case.

[0033] The connection between the logic area and the cycle control is preferably established via a controller daughter card, which is inserted into a second-type slot ("master slot") in the backplane. This allows communication between the cycle control and the safety controller to occur via the controller daughter card and the safety daughter card, so that the bidirectional data exchange runs through the controller daughter card, the safety daughter card, and the logic area of ​​the backplane. Alternatively or additionally, the bidirectional data exchange can take place directly between the first and second processing units, whereby it is often preferable to provide both signal paths to create redundancy.

[0034] Particularly for EMC reasons, it may be preferable for the control-machine interface to be located in an area of ​​a control cabinet that is spatially separated from the first and second computing units.

[0035] It is essential that the machine operator can communicate with the cycle control system. This is achieved through an interface device (hereinafter also referred to as the first interface device), which includes at least one input device and at least one visualization device. Using this interface device, the machine operator can, for example, view the machine's status and, if necessary, make changes to the cycle sequence, such as when changing products. This interface device and the cycle control system communicate via a bidirectional communication device. In some embodiments, this first interface device can also communicate wirelessly with the cycle control system.

[0036] In a preferred embodiment, the first interface device has a computing unit, designated as a third computing unit, which is distinct from and independent of the first computing unit of the cycle sequence control and the second computing unit of the safety controller, and on which its own operating system (second operating system) runs. Independent here means that the computing units can operate independently of one another.

[0037] Furthermore, a second interface device, which has at least a second input device, and a second communication device that is at least unidirectional are provided, via which signals generated by the second input device are passed on to the first computing unit independently of the first interface device.

[0038] Providing a separate computing unit with its own operating system for the first interface device initially has the advantage that the operating system for cycle control and the operating system for the first interface device can be selected to be optimized for their respective tasks.

[0039] Another advantage is that the cycle control system can continue to control the plastics processing machine even if the first interface device fails (generally until the current production order is completed). This reduces system downtime (and thus downtime of the plastics processing machine), at least statistically.

[0040] The second interface, which communicates directly with the cycle control unit (i.e., its first processing unit), ensures that even if the first interface fails, at least minimal communication with the cycle control unit is possible. This allows, for example, the machine to be shut down via the second interface. The second interface unit can, for instance, include an emergency stop button. Furthermore, the second interface unit can have additional buttons or switches that can send direct commands to the cycle control unit, such as "Move to a safe rest position" or "Pause production."

[0041] As already mentioned, one advantage of the system is that the two operating systems can be chosen to suit the specific needs of the system. It is particularly advantageous for the first operating system to be a so-called "Real-Time Operating System" (RTOS).

[0042] To ensure a high level of user-friendliness, it is further preferred that the second operating system be an operating system with a graphical user interface, such as those used on PCs, laptops or smartphones.

[0043] In particular, if the second operating system has a graphical user interface, the first interface device can have a touchscreen, which serves as the primary input device and visualization device, thus enabling intuitive operation of the plastics processing machine. Alternative or additional input devices include a keyboard, a mouse, a touchpad, or a camera, which can be used for gesture control. More than one primary input device may be provided.

[0044] The preferred separation of the cycle control unit from the first interface unit makes it possible, in particular, to use the first interface unit not only as an interface to the machine operator (i.e., as a direct human-machine interface), but also as an interface to the "outside world" (especially the digital world). Therefore, the first interface unit preferably has at least one additional interface. This can, in particular, include one of the following: an interface to a local network (LAN / WLAN), a universal interface (especially a USB interface), or an interface to the internet. The second processing unit is always located between the digital world and the first processing unit of the cycle control unit, so that this second processing unit forms a first shield between the cycle control unit and the outside world.

[0045] To further improve the protection of the control and operating system, and in particular its cycle control, it is preferable, if an interface to the digital outside world is provided ("additional interface"), to provide a data security device separate from the second computing unit, for example, in the form of a hardware firewall and / or a software firewall, between the second computing unit and at least one additional interface of the first interface device. Such a software firewall can be integrated into the second computing unit. To achieve the best possible security, a combination of hardware and software firewalls is preferable in some cases. This further increases operational reliability, as it already reduces the probability of a computer virus infection of the first interface device—i.e., its computing unit (second computing unit).Thus, two protective barriers are in place to prevent a computer virus infection from affecting the cycle control system. Any malware present in the cycle control system can cause significantly more damage than in the first interface device, as a malfunction of the plastics processing machine caused by malware could lead to mechanical damage to the machine itself. Naturally, such a data security device also protects the first interface device.

[0046] Preferably, a first data set is stored in the first computing unit (i.e., the computing unit of the cycle sequence control), which can be modified at least in production mode by means of the first interface device, so that changes in the cycle sequence can be made by the person operating the machine or via an interface of the first interface device to the outside world (if available) at least within a predefined framework.

[0047] In other words, in a particularly preferred embodiment, the control and operating system comprises at least three independent computing units, wherein the first computing unit (the central computing unit, so to speak) controls the plastics processing machine, while it is shielded from the outside world by the third computing unit and supported by the second computing unit with regard to occupational safety. This results in a multi-layered safety concept that addresses both data security and traditional occupational safety. This also further enhances overall occupational safety.

[0048] Further preferred embodiments and advantages will become apparent from the further dependent claims and the exemplary embodiments now explained in more detail with reference to the figures.

[0049] The invention will now be explained in more detail for better understanding by means of schematic and simplified embodiments with reference to the figures. These show: Fig. 1 a highly schematic representation of a preferred embodiment of the system according to the invention for plastics processing, Fig. 2 a similarly schematic representation of the basic functionality of the invention, Fig. 3 a schematic representation of a backplane into which no daughter cards are inserted, Fig. 4 the backplane out Fig. 3 with daughter cards inserted, Fig. 5 a very schematic representation of the functionality of the security daughter card from Fig. 4, Fig. 6 a variant of the one in Fig. 5. Shown, where the backplane has an additional switchable supply line, Fig. 7 a very schematic representation of part of a switching daughterboard, Fig. 8a - 8c Schematic representations of jumper wires used to supply power to a switching daughterboard, as used in Fig. 7 is shown, to connect to one of the backplane supply lines and Fig. 9 an alternative to the one in Fig. 4 shown.

[0050] The Fig. Figure 1 schematically shows a preferred embodiment of a plastics processing system according to the invention. This system comprises several functionally and usually also spatially separated units, some of which can be further subdivided into several subunits. Following this approach, the system can initially be divided into three units: the control and operating system 10, the "actual" plastics processing machine 100, which in the illustrated embodiment is designed as a shot-molding machine, and the control-machine interface 60 (power rack), via which the control and operating system 10 communicates bidirectionally with the plastics processing machine (hereinafter also referred to as: injection molding machine 100).

[0051] The term "plastics processing machine 100" encompasses all mechanical elements of the system, including actuators and sensors (except for sensors required for the computer units described later, such as temperature sensors for these units). As mentioned above, the term "actuator" is to be understood broadly and includes all elements of the plastics processing machine that are controlled by the control and operating system. As a rule, the plastics processing machine, according to the definitions presented here, also has its own electronic components; however, the machine cannot operate without a connection to the control and operating system 10 (namely, via the control-machine interface 60). The system as a whole (and thus also its aforementioned units) has an operating mode in which the entire system is ready for operation, enabling production.Thus, a production mode is a sub-mode of the operating mode, which must be distinguished in particular from one or more maintenance modes. In the operating mode, communication between the plastics processing machine 100 and the control and operating system 10 is established via the control-machine interface 60.

[0052] First, the control and operating system 10 will be discussed. This system can be considered to have three subunits. These three subunits are the first processing unit 20, comprising the cycle sequence controller; the second processing unit 25, comprising the safety controller; and the third processing unit 34, comprising the first interface device. Each of these processing units 20, 25, and 34 forms an autonomous system in the sense that it can operate independently of the other processing units. Typically, each processing unit has at least a CPU, RAM, and ROM.

[0053] These three computing units 20, 25, 34 are housed in a first control cabinet area S1, which in this embodiment (and this is also frequently preferred) is spatially separated from a second control cabinet area S2, in which the aforementioned control-machine interface 60 is housed in the form of a power rack. It should be noted that, as in Fig. As shown in Figure 1, it is possible to arrange the first computing unit 20 and the third computing unit 34 inside this control cabinet. However, it is often preferable to arrange the third computing unit 34 outside this control cabinet and, in particular, to integrate it into the actual operating unit (in the illustrated embodiment, the element containing the touchscreen). The control cabinet (i.e., both control cabinet sections S1 and S2) should usually be locked and accessible only to specific groups of people.

[0054] The cycle control system consists solely of the first computing unit 20 (which is why the terms "cycle control system" and "first computing unit" are used somewhat synonymously in the following) and serves to control the plastics processing machine in production mode. To control the machine 100 during a specific production order, it accesses stored data sets. These typically include data sets that can be modified within operating mode and data sets that are generally unchangeable within operating mode.

[0055] The first interface device comprises an input device and a visualization device, which in the illustrated embodiment are designed as a touchscreen 32 and communicate with the third computing unit 34. However, it would also be possible to implement the first input device and the visualization device separately, for example as a keyboard and screen. The first interface device can optionally have at least one further interface 33, in particular a USB interface, a printer interface, an internet connection, or a LAN / WLAN interface, which also communicates bidirectionally with the second computing unit 34. A data security device, for example in the form of a firewall 38 (in particular a hardware firewall and / or a software firewall), is arranged between the further interface 33 and the second computing unit.

[0056] The first interface device 30, namely its third processing unit 34, is connected to the first processing unit 20 (i.e., the cycle sequence control) via a bidirectional first communication device 36. The first interface device 30 serves for communication between the system and the outside world, for example, a person operating the system, who can obtain information about the state of the machine 100 via the visualization device and can modify at least part of the modifiable data set of the cycle sequence control via the first input device, for example, to adjust process parameters.

[0057] The described separation of the cycle control (i.e., its first processing unit 20) from the first interface device has two consequences: First, the control and operating system can be configured so that external access to the first processing unit 20 is only possible serially via the second processing unit 34 and the firewall 38, thus significantly increasing security against malware attacks that penetrate as far as the cycle control. Furthermore, the cycle control can operate completely independently of the first interface device 30, so that even if the first interface device fails, production is not necessarily interrupted.

[0058] The first interface unit 30, that is, the third computing unit 34, can operate with a user-friendly graphical operating system, whereas a machine-oriented real-time operating system (RTOS) is installed on the first computing unit 20. In any case, each of the computing units 20 and 34 has its own operating system, and it is particularly preferred that the two operating systems are different, which further improves protection against an attack that penetrates to the cycle control level.

[0059] As mentioned previously, the first computing unit 20 stores several types of data, particularly data that cannot be modified by the first interface device 30 during operation. This includes, for example, the configuration of the plastics processing machine 100. Other data can be modified by the first interface device 30 during operation, such as certain production parameters that might result from a tool or material change. If the interface device 30 fails, the cycle control running on the first computing unit 20 can continue to control the plastics processing machine 100, so that production does not necessarily have to be interrupted and the machine remains in a safe state.

[0060] However, to maintain minimal communication between the cycle control and a person operating the machine even in the event of a failure of the first interface device 30, a second interface device 50 is provided, which communicates directly with the first computing unit 20 via a second communication device 54. This second interface device 50 is designed exclusively as a human-machine interface and, in particular, is not capable of communicating electronically with other devices. This second communication device 54 can be designed, for example, as a classic hand control (as shown), as a machine keyboard, or as a "normal" or modified computer keyboard. In any case, the second communication device 54 has at least one second input device. It may be preferred that the second communication device 54 has a dedicated emergency stop switch.Furthermore, it is preferred that it also has additional input keys with immediate control commands.

[0061] As mentioned, communication between the control and operating system and the plastics processing machine takes place, at least for the most part, via the Power Rack 60. This will be discussed in more detail later. Direct connections can also be provided, for example, for controlling the drive controllers.

[0062] First, the cooperation and operation of the first computing unit 20 (the computing unit of the cycle sequence control) and the second computing unit 25 (the computing unit of the safety control) will be described with reference to Fig. 2 described in more detail, whereby it should first be mentioned that the representation of the Fig. Figure 2 is very simplified, in particular in that only three actuators and two groups of safety-relevant sensors of the injection molding machine 100 are shown, although these are selected as examples so that the functionality can be easily understood. Furthermore, in Fig. 2. The power rack is not shown due to the purely functional representation.

[0063] In Fig. Figure 2 schematically depicts a protective hood 120 with two doors 122a, 122b, a two-part injection mold located inside the protective hood 120, a clamping unit with an actuator 110 located inside the protective hood 120, machine lighting 115 also located inside the protective hood 120, a plasticizing unit with two actuators 112, 113, two emergency stop buttons 130a, 130b, and two door switches 125a, 125b, located essentially outside the protective hood 120. Actuator 112 is a mechanical actuator (for example, for moving the screw), which is also arranged under a protective device designed as a hood, and actuator 113 is a heating element.

[0064] It goes without saying that a "real" injection molding machine has significantly more actuators and sensors; however, to illustrate the principles of the invention, the selection made here as an example is sufficient, whereby the following applies: a) Machine lighting 115, actuators 112 and 113 of the plasticizing unit and actuator 110 of the clamping unit form the actuators of the injection molding machine 100. b) Actuators 112 and 113 of the plasticizing unit and actuator 110 of the clamping unit constitute the entirety of the safety-relevant actuators, while the machine lighting 115 does not belong to the entirety of the safety-relevant actuators. In the illustrated embodiment, the entirety of the safety-relevant actuators also constitutes the group of actuators that can be switched off by the safety controller (also referred to simply as the "group"). c) The actuator 110 of the closing unit and the motor actuator 112 of the plasticizing unit form a subset of this group. In this simplified embodiment, the group therefore only includes a subset that is smaller than the group itself. d) The safety-related sensors, namely the door switches 125a, 125b and the emergency stop buttons 130a, 130b, constitute two categories of safety-related sensors: the emergency stop category (emergency stop buttons 130a, 130b) and the safety section category (door switches 125a, 125b). As explained again later, usually only one emergency stop category is provided; however, it is possible to provide more than one safety section category. A shutdown signal generated by a sensor in the safety section category is also referred to as a safety section signal, and a shutdown signal generated by a sensor in the emergency stop category is also referred to as an emergency stop signal.

[0065] All the aforementioned safety-related sensors are in communication with both the first processing unit 20 (the processing unit of the cycle sequence control) and the second processing unit 25 (the processing unit of the safety controller). The signals from the safety-related sensors are fed individually to processing unit 20 of the cycle sequence control, while the signals of a category of safety-related sensors are aggregated for processing unit 25 of the safety controller to save occupied inputs. In other words, the cycle sequence control "knows," for example, which of the doors 122a, 122b has been opened, while the safety controller "knows" only that at least one of the doors has been opened. The aggregation of the signals for the safety controller is shown schematically here using signal dividers 140, 141.The cycle control (that is, its computing unit 20) controls all actuators, as indicated by the corresponding arrows in . Fig. 2 is shown schematically.

[0066] If one of the safety-related sensors is activated (i.e., a door 122a, 122b is opened or an emergency stop button 130a, 130b is pressed), the sensor in question generates a shutdown signal. A shutdown signal can also be the interruption of a circuit. The safety controller 25 is configured to immediately or after a defined time delay shut down at least one safety-related actuator when such a shutdown signal from a safety-related sensor is present, as follows: If one of the emergency stop buttons 130a, 130b is pressed, all safety-related actuators of the group defined under b) (i.e., actuators 110, 112, and 113) are immediately shut down. If one of the doors 122a, 122b is opened, so that the corresponding door switch 125a, 125b generates a corresponding shutdown signal, only the actuators 110 and 112 are immediately switched off by the safety control.Each actuator is switched off by a disconnector 142a, 142b, 142c, as shown in . Fig. 2 is also only shown very schematically.

[0067] Even though the safety controller 25 alone would generally be sufficient to ensure adequate operational safety, the cycle sequence controller 20 is also configured to switch off the corresponding actuators according to the aforementioned scheme when a corresponding shutdown signal is present. In the exemplary embodiment, this means that the cycle sequence controller 20 switches off all actuators 110, 112, and 113 when at least one of the emergency stop buttons 130a, 130b is pressed, and switches off actuators 110, 112 when one of the doors 122a, 122b is opened. This means that the actuator shutdown is implemented redundantly, which further increases operational safety.

[0068] A bidirectional data exchange device 26 is provided, by means of which the cycle sequence control 20 and the safety controller 25 exchange and compare data, at least in production mode. If the safety controller 25 detects a deviation from the normal state in the cycle sequence control 20, it immediately switches off all safety-relevant actuators. If the cycle sequence control 20 detects a deviation from the normal state in the safety controller 25, it moves the plastics processing machine to a predefined park position. Not all safety-relevant actuators are necessarily switched off in this case.

[0069] With regard to the Fig. Sections 3 to 8c now also address the design of the control-machine interface, in particular the backplane and the daughter cards inserted therein. At least part of the communication between the control and operating system and the plastics processing machine runs via this control-machine interface, including, in particular, the deactivation of actuators by the safety controller and / or the cycle sequence controller.

[0070] The Fig. Figure 3 shows the backplane 70 of the control-machine interface in a highly schematic, top-view representation. This backplane 70 has a logic area 72 and a switching area 74. The logic area 72 is operated at a lower voltage than the switching area 74, with typical voltages being 3.3 V for the logic area and 24 V for the switching area. The backplane 70 has multiple slots: several slots 76 of a first type (slave slots) and one slot 78 of a second type (master slot). All slots extend across both the logic area 72 and the switching area 74. The logic area of ​​slot 78 of the second type is in bidirectional communication with the logic areas of the slots 76 of the first type, as is generally known in the prior art.

[0071] In switching area 74, several supply lines 74a, 74b, 74c extend; in this embodiment, there are three. These are shown here only schematically, but can also have connectors for each daughterboard. The three supply lines are of different types, as follows: There is a non-switchable supply line 74a (permanent positive), a first switchable supply line 74b, and another switchable supply line 74c. As will be explained later, more than one additional supply line can also be provided.

[0072] Fig. 4 shows the backplane from Fig. 3 and daughter cards 82, 84, 80a, 80b, and 80c are inserted into the slots of the backplane. The control daughter card 82 is inserted into slot 78 of the second type. This daughter card communicates with the first processing unit 20 (the processing unit of the cycle sequence control) and, in this embodiment, also supplies the power for the switching area via this slot (the latter is not mandatory, but often advantageous), namely into the non-switchable power supply line 74a (permanent positive). Since slot 78 of the second type is in communication connection with all slots of the first type, communication also occurs between the first processing unit 20 and all daughter cards inserted into slots 76 of the first type. Like the backplane, the daughter cards each had a logic area and a switching area.

[0073] The safety daughter card 84 communicates with the second processing unit 25 and its primary function is to supply power to the switchable supply lines (here 74b and 74c) or to interrupt the power supply to these lines when a shutdown signal is present. This will be discussed in more detail later. Furthermore, communication between the cycle sequence controller 20 and the safety controller 25 can take place exclusively or additionally via the control daughter card 82 and the safety daughter card 84. To provide redundancy, it is possible and also preferred to provide two bidirectional connections: one direct connection within the first control cabinet area S1 and a second connection via the control daughter card 82, the backplane 70, and the safety daughter card 84.

[0074] In the illustrated, highly simplified embodiment, each of the switching daughterboards 80a, 80b, 80c, 80d is assigned to exactly one of the Fig. The two actuators shown are assigned to each of the two actuators. However, it should be noted that due to the limited number of slots, each of the switching daughter cards 80 typically controls several actuators. In the described embodiment, the first switching daughter card 80a is connected to the machine lighting 115, the second switching daughter card 80b to the heating element 113 of the plasticizing unit, the third switching daughter card 80 to the motorized actuator 112 of the plasticizing unit, and the fourth switching daughter card 80d to the actuator 110 of the closing unit.The power supply for the power section (switching area) of the second switching daughter card 80b is provided via the non-switchable supply line 74a (permanent positive), the power supply for the power section (switching area) of the first switching daughter card 80a is provided via the first switchable supply line 74b, and the power supply for the respective power sections (switching areas) of the third and fourth switching daughter cards 80c and 80d is provided via the second switchable supply line 74c. The power supply for the logic areas of all daughter cards is provided via the non-switchable supply line 74a (permanent positive).

[0075] The Fig. Figure 5 schematically illustrates the main function of the safety daughter card 84, namely the supply of power to the switchable supply lines 74b and 74c. The safety daughter card 84 is powered via the non-switchable supply line 74a. The first switchable supply line 74b and the second switchable supply line 74c are supplied via a first disconnect switch 84a, which is assigned to the emergency stop buttons 130a and 130b. The connection between the first disconnect switch 84a and the second supply line 74c is made via a second disconnect switch 84b (i.e., the first and second disconnect switches are connected in series). It follows that if the second computing unit 25 receives an emergency stop signal due to the actuation of one of the two emergency stop buttons 130a, 130b, the safety control unit 25 controls the safety daughter card 84 in such a way that the first disconnect switch 84a is opened.This disconnects both the first switchable supply line 74b and the second disconnect switch 84b connected in series, and thus also the further switchable supply line 74c, from the supply voltage, regardless of the state of the second disconnect switch 84b. This means that when an emergency stop button 131a, 131b is activated, all switchable supply lines are de-energized, but not the non-switchable supply line 74a.

[0076] If, however, the safety controller 25 receives a shutdown signal from one of the door switches 125a, 125b (safety section signal), it controls the safety daughter card 84 in such a way that only the second disconnect switch 84b is opened and only the further supply line 74c is de-energized.

[0077] How to Fig. If power is drawn from 6, any number of additional switchable supply lines (here two additional supply lines 74c and 74d) can be provided, each of which is supplied with power via a disconnect switch 84b, 84c connected in series with the first disconnect switch 84a.

[0078] It is not possible to shut down the non-switchable supply line 74a by the safety control.

[0079] In the present embodiment (where each switching daughter card controls exactly one actuator), each of the switching daughter cards 80a, 80b, 80c is assigned to exactly one of the supply lines in operating mode. To ensure that the switching daughter cards have a uniform basic structure, each daughter card has a connection to each supply line 74a, 74b, 74c ( Fig. 7), however, only one is "activated". This is done by selecting a suitable jumper 150a, 150b, 150c ( Fig. 8a to 8c), each connecting exactly one supply line to the switching area of ​​the daughterboard. These jumpers are preferably coded so that the cycle control can recognize whether the correct jumper is installed in each daughterboard for its task. Only when all assignments made by the jumpers are correct does the cycle control enable the machine for production.

[0080] In practice, each switching daughterboard has multiple outputs, allowing it to control several actuators. In this case, each output or output group is assigned a jumper as described above.

[0081] Fig.Figure 9 shows an alternative configuration in which the first processing unit 20 (i.e., the CPU) is not spatially separated from the backplane but is located directly on it, so that no second-type slot (master) and no control daughterboard are provided. The safety daughterboard and the switching daughterboard are controlled directly by the CPU. In this case, the voltage can be fed into the non-switchable power supply line, for example, via a direct connection (as shown) or via the safety daughterboard.

[0082] As another alternative, it would be possible to arrange the CPU (first processing unit) 20 on the control daughterboard.

[0083] In both of the above-mentioned cases, the CPU is not spatially separated from the control machine interface; the functionalities described above remain unaffected. Reference symbol list 10 Control and operating system 20 first computing unit (computing unit of the cycle sequence control) 25 second computing unit (computing unit of the safety controller) 26 bidirectional data exchange device 30 first interface setup 32" touchscreen (includes initial interface setup and visualization setup) 33 more interfaces 34 third computing unit 36 bidirectional first communication device 38 Firewall 50 second interface device 52 Input device of the second interface device 54 second communication device 60 power rack 70 Backplane 72 Logic area 74 switching range 74a Non-switchable supply line (permanent positive) 74b first switchable supply line (SE) 74c, d further switchable supply line (SC) 76 Type 1 slot (“slave”) 78 Type II slot (“Master”) 80a-d switching daughter card 82 Control Daughter Card 84 Security Daughter Card 84a first disconnect switch 84b second disconnect switch 84c third disconnect switch 100 injection molding machines 110 Locking unit / Actuator of the locking unit 112 First actuator of the plasticizing unit (motor actuator, e.g. worm drive) 113 Second actuator of the plasticizing unit (e.g. heating) 115 Machine lighting 120 protective hood 122a, b Door 125a, b Door switch 130a, b Emergency stop button 140a, b Signal divider 142a, b, c Separator 1501, b, c Plug-in bridge BA area outside the control cabinet S1 first control cabinet area S2 second control cabinet area

Claims

[1] Plastics processing system with at least one plastics processing machine (100) and a control and operating system (10) having an operating mode for controlling and operating this plastics processing machine (100), wherein the operating mode has a production mode, and where the plastics processing machine has: (i) a plurality of actors which (ii) has at least one safety-related actuator (110, 112, 113), and (iii) a plurality of sensors which (iv) has at least one safety-related sensor (125a, 125b, 130a, 130b) which generates a shutdown signal when a safety-related event occurs, and whereby the control and operating system features: (v) a cycle sequence control which, in production mode, at least indirectly controls the majority of the actuators according to (i) the plastics processing machine and which uses a first computing unit (20) equipped with a first operating system for this purpose, and (vi) a safety controller operating according to a safety program, wherein the safety program is not modifiable at least in operating mode, the safety controller uses a second computing unit (25) independent of the first computing unit (20) according to (v), the safety controller is in communication connection with the at least one safety-relevant sensor (125a, 125b, 130a, 130b) according to (iv) and is configured to immediately switch off the at least one safety-relevant actuator (110, 112, 113) according to (ii) when a shutdown signal according to (iv) is present, characterized by , that (vii) at least one bidirectional data exchange device (26) is provided and the cycle sequence control according to (v) and the safety control according to (vi) are configured to exchange and / or compare data at least in production mode using this at least one bidirectional data exchange device (26), and the cycle sequence control according to (v) is configured to continuously check the function of the safety control according to (vi) at least in production mode and to move the plastics processing machine (100) to a defined park position if it detects a malfunction or failure of the safety control according to (vi), and that the safety control according to (vi) is configured to continuously check the function of the cycle sequence control according to (v) at least in production mode and to switch off the at least one safety-relevant actuator (110, 112) according to (ii) if it detects a malfunction or failure of the cycle sequence control according to (v). [2] System according to claim 1, characterized by , that (viii) the plastics processing machine has a plurality of safety-related actuators according to (ii) which form a group of safety-related actuators, wherein (ix) the group of safety-relevant actors according to (viii) contains at least a subset of safety-relevant actors, each subset containing a smaller number of safety-relevant actors than the group according to (viii), but containing at least one safety-relevant actor, (x) the plastics processing machine has a plurality of categories of safety-related sensors according to (iv), each of these categories including at least one safety-related sensor, wherein these categories comprise: (xi) an emergency stop category, at least one of which safety-related sensor is an emergency stop switch or emergency stop button (130a, 130b) which, when actuated, generates an emergency stop signal, (xii) at least one safety distance category, at least one of which safety-related sensor generates a safety distance signal when activated, where The safety control according to (vi) switches off all actuators of the group of safety-relevant actuators according to (viii) when an emergency stop signal according to (xi) is present, and switches off only the actuators of a subset according to (ix) when a safety section signal according to (xi) is present. [3] System according to claim 2, characterized by , that the plastics processing machine has at least two safety-relevant sensors in at least one category according to (x), whose shutdown signals are distinguishable for the cycle sequence control according to (v), but not for the safety control according to (vi). [4] System according to any one of claims 1 to 3, characterized by, that the cycle sequence control according to (v) is also in communication connection with the at least one safety-relevant sensor (122a, 122b) according to (iv) and is configured to switch off the same at least one safety-relevant actuator (120) according to (ii) immediately when a shutdown signal according to (iv) is present as the safety control according to (vi). [5] System according to any of the preceding claims, characterized by , that a control-machine interface is still provided, which at least in operating mode has: (xiii) a backplane (70) comprising a logic area (72) powered by a first voltage and a switching area (74) powered by a second voltage, wherein - the second voltage is higher than the first voltage, and - the cycle sequence control according to (v) is set up to control the logic area (72) of the backplane (70) at least in operating mode, the backplane features: (xiv) a plurality of slots of a first type (76) which extend over both the logic area (72) and the switching area (74), and (xv) at least one switchable supply line (74b-74d) in the switching area (74) which can be supplied with the second voltage and which is switched off by the safety control according to (vi) when a shutdown signal according to (iv) is present, and (xvi) a plurality of switching daughter cards (80a-80d), each of these switching daughter cards (80a-80d) being inserted into a slot of the first type (76) according to (xiv), and each being controlled via the logic area (72) and in production mode each controlling at least one actuator according to (i) of the plastics processing machine (100) by means of the second voltage, wherein (xvii) at least one switching daughter card (80c, 80d) which controls at least one safety-related actuator (110, 112) according to (ii) is supplied with the second voltage exclusively via the at least one switchable supply line according to (xv). [6] System according to claim 2 or claim 3 and according to claim 5, characterized by , that the switching area (74) of the backplane (70) has at least two switchable supply lines to (xv), namely (xviii) a first switchable supply line (74b) and (xix) for each safety section category according to (xii) has a further switchable supply line (74c, 74d) assigned to that safety section category. [7] System according to claim 6, characterized by , that if an emergency stop signal is received according to (xi) the safety controller according to (vi) switches off all switchable supply lines (74b, 74c, 74d) according to (xviii) and (xix). [8] System according to claim 6 or claim 7, characterized by , that the supply of the switchable supply lines to (xviii) and (xix) is provided by means of a safety daughter card (84) controlled by the safety controller to (vi), so that these supply lines can be switched off by the safety controller to (vi). [9] System according to claim 8, characterized by , that the connection between the second computing unit (25) and the security daughter card (84) is at least also direct and not, or not exclusively, via the logic area (72) of the backplane. [10] System according to any one of claims 5 to 9, characterized by , that the switching area (74) of the backplane (70) continues (xx) has at least one non-switchable supply line (74a) which is supplied with the second voltage at least in production mode and which cannot be switched off by the safety control according to (vi). [11] System according to any one of claims 5 to 10, characterized by , that each switching daughter card (80a, 80b, 80c) in the operating mode of the system (xxi) has at least one output assigned to an actuator, which is assigned to exactly one supply line. [12] System according to claim 11, characterized by , that the assignment of an output to (xxi) of a switching daughter card to (xvi) to a supply line to (xviii), (xix) or (xx) is made via a jumper (150a-150c), which is preferably coded. [13] System according to any one of claims 5 to 12, characterized by , that the connection of the logic area (72) to the cycle sequence control according to (v) is made by means of a control daughter card (82) which is plugged into a slot of the second type (78) in the backplane (70), or that the first computing unit is arranged directly on the backplane. [14] System according to claim 13, characterized by, that the communication between cycle sequence control according to (v) and safety control according to (vi) via the bidirectional data exchange device according to (vii) takes place at least also directly and not, or not exclusively, via the logic area (72) of the backplane. [15] System according to at least one of claims 5 to 14, characterized by , that the control-machine interface is located in an area (S2) of a control cabinet that is spatially separated from the first computing unit (20) and the second computing unit. [16] Plastics processing system according to one of the preceding claims, wherein the control and operating system further comprises: (xxii) a first interface device (30) comprising at least a first input device, at least a visualization device and a third computing unit (34) equipped with a second operating system and in communication connection with the first input device and the visualization device, which is independent of the first computing unit (20) and the second computing unit (25), (xxiii) a bidirectional first communication device (36) through which the first computing unit (20) according to (v) and the third computing unit according to (xxii) communicate with each other, (xxiv) a second interface device (50) which has at least one second input device (52), (xxv) a second communication device (54) that is at least unidirectional, through which signals generated by the second input device (52) according to (xxiv) are passed to the first computing unit (20) according to (v). [17] System according to claim 16, characterized by , that by means of the input device (52) of the second interface device (50) according to (xxiv) a shutdown command can be transmitted to the cycle sequence control according to (v), which causes the cycle sequence control to transfer the plastic processing machine (100) into a defined park position. [18] System according to at least one of claims 16 to 17, characterized by , that at least in production mode, a first data set that can be modified by means of the first interface device according to (xxii) is stored in the first computing unit (20).

Images