Safety diagnostic device

Abstract

To provide a safety diagnostic device that can accurately calculate a PL of a safety relation unit.SOLUTION: An embodiment comprises an operation history acquisition unit, a parameter calculation unit, and a PL determination unit. The operation history acquisition unit stores time-series data of a plurality of signals between a safety PLC and a plurality of safety appliances in association with appliance IDs of the plurality of safety appliances. The parameter calculation unit calculates a PFHd based on a value of B10D and the time-series data of the signal, and associates it with the corresponding appliance ID when there are safety appliances, among the plurality of safety appliances, that do not provide either PFHd or MTTFd. The PL determination unit calculates and outputs a PL value by adding the values of a plurality of PFHds corresponding to the plurality of appliance IDs.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] An embodiment of the present invention relates to a safety diagnosis device that calculates and outputs an evaluation index relating to safety in a safety-related part of an industrial plant. [Background technology]

[0002] System safety requires risk assessment and safety design based on IEC and ISO standards. Similarly, in industrial plant control systems, it is important to build functional safety systems that meet the needs for functional safety.

[0003] A functional safety system is a system that can achieve risk reduction by implementing a function that immediately transitions the entire system to a safe state and maintains it when a problem occurs. The degree of risk reduction of a system is expressed in a safety scale called PL (Performance Level). This indicator is defined in ISO13849-1 (Safety of machinery - Safety-related parts of control systems).

[0004] Control systems for industrial plants are required to process huge amounts of information at high speed, with high-speed response and high accuracy. Such control systems connect different control layers via a common network: Level 0, which includes electric motors, drives, and hydraulic control devices; Level 1, which consists of high-speed control devices (sequencers); and Level 2, which consists of process control computers.

[0005] Within this control system, a safety PLC is used at level 1 of the safety-related parts. A safety PLC is a PLC that has received third-party safety certification based on standards such as IEC61508 (functional safety standard). In addition to the functions of a general-purpose PLC, a safety PLC also has safety functions such as multiplexing and redundancy of hardware and applications, and safety diagnostic functions. Quantitative evaluation of the PL of safety-related parts built with this safety PLC is necessary for safety diagnostics of industrial plants.

[0006] One known technology for safety PLCs is disclosed in Patent Document 1. In Patent Document 1, each device used in a safety control program is registered in a management table along with safety-related parameters, and a diagnosis is made as to whether the target safety control program complies with a given safety standard. However, in this technology, the parameter values ​​for each device registered in the management table are provided by each equipment manufacturer or calculated based on an estimated number of operations, and are not parameters based on actual operation. [Prior art documents] [Patent documents]

[0007] [Patent Document 1] Japanese Patent Application Laid-Open No. 2010-191943 Summary of the Invention [Problem to be solved by the invention]

[0008] If the manufacturer does not provide the parameters of each device that makes up the safety-related parts, such as PFHd (Probability of Dangerous Failure per Hour) or MTTFd (Expection of the Mean Time To Dangerous Failure, an estimate of the mean time it takes to reach a dangerous failure), these must be calculated based on the number of operations and operating time of each device.However, in large-scale systems such as industrial plants, it is difficult to determine the exact number and frequency of operations.

[0009] An object of an embodiment of the present invention is to provide a safety diagnosis device that can accurately calculate the PL of a safety-related part. [Means for solving the problem]

[0010] A safety diagnosis device according to an embodiment of the present invention includes an operation history collection unit that associates a plurality of signals sequentially input / output between a safety PLC and the plurality of safety devices and a plurality of times at which the plurality of signals were acquired with a plurality of device IDs that identify a plurality of safety devices communicably connected to the safety PLC, and stores the associated signals as a plurality of time-series data; and an operation history collection unit that, if there is a first safety device among the plurality of safety devices for which a PFHd value has been provided, associates the provided PFHd value with a device ID corresponding to the first safety device; if there is a second safety device among the plurality of safety devices for which a PFHd value has not been provided but an MTTFd value has been provided, calculates the PFHd value based on the provided MTTFd value and associates the PFHd value with a device ID corresponding to the second safety device; and, if there is a second safety device among the plurality of safety devices for which neither a PFHd value nor an MTTFd value has been provided, calculates the PFHd value based on the provided MTTFd value and associates the PFHd value with a device ID corresponding to the second safety device; 10D If there is a third safety device provided with a value of B 10D and a parameter calculation unit that calculates a value of MTTFd based on the value of MTTFd and the time series data associated with the device ID corresponding to the third safety device among the plurality of time series data, calculates a value of PFHd based on the calculated value of MTTFd, and associates the value of PFHd with the device ID corresponding to the third safety device, and a PL determination unit that calculates a value of PL, which is an evaluation index for safety, by calculating the sum of the plurality of PFHd values ​​associated with the plurality of device IDs. [Effects of the Invention]

[0011] According to the embodiment of the present invention, it is possible to provide a safety diagnosis device that can accurately calculate the PL of a safety-related part. [Brief explanation of the drawings]

[0012] [Figure 1] 1 is a schematic block diagram illustrating a safety diagnosis device according to an embodiment. [Figure 2] FIG. 2 is a schematic diagram illustrating the configuration of a safety-related part. [Figure 3] 10A and 10B are schematic diagrams illustrating other configurations of the safety-related part. DETAILED DESCRIPTION OF THE INVENTION

[0013] Hereinafter, embodiments will be described with reference to the drawings. The drawings are schematic or conceptual, and the relationship between the thickness and width of each part, the size ratio between parts, etc. are not necessarily the same as those in reality. Furthermore, even when the same part is shown, the dimensions and ratios may be different depending on the drawing. In the present specification and the drawings, elements similar to those described above with reference to the previous drawings are designated by the same reference numerals, and detailed descriptions thereof will be omitted as appropriate.

[0014] FIG. 1 is a schematic block diagram illustrating a safety diagnosis device according to an embodiment. As shown in FIG. 1, the safety diagnosis device 10 is communicatively connected to the safety devices 21 to 23 and the safety devices 31 to 33 via a control network. Although not shown, a safety PLC is communicatively connected to the control network 2. The safety PLC receives signals output by the safety devices 21 to 23 and processes them as input signals. The safety PLC processes the input signals according to a set control program to generate output signals, and outputs the output signals to the safety devices 31 to 33. The safety devices 31 to 33 operate according to the supplied signals. The safety diagnosis device 10 and the safety PLC may be configured as an integrated unit, or the safety PLC may be configured separately from the safety diagnosis device 10. In the following, unless otherwise specified, the safety diagnosis device 10 will be described as including the safety PLC.

[0015] The safety diagnosis device 10 receives input signals and output signals via the control network 2 and uses them to calculate the parameter MTTFd (Expection of the Mean Time To Dangerous Failure) of each safety device. Note that MTTFd is an estimated value of the mean time to reach a dangerous failure, and a specific calculation method will be described later.

[0016] The safety diagnosis device 10 is communicatively connected to a management terminal 41. The connection between the safety diagnosis device 10 and the management terminal 41 may be a general-purpose communication network such as Ethernet (registered trademark), or may be a connection using another communication interface.

[0017] The management terminal 41 has a parameter input unit 42. The parameter input unit 42 is, for example, an input interface of the management terminal 41 and an input device connected via the input interface. The management terminal 41 can set desired parameters in the safety diagnosis device 10 via the parameter input unit 42. When setting the parameters, multiple types of parameters can be set, and details of the parameters will be described later.

[0018] The management terminal 41 has a PL display unit 43. The PL display unit 43 is, for example, an output interface of the management terminal 41 and a display device connected via the output interface. The management terminal 41 can display, via the PL display unit 43, the calculation results of a performance level (PL), an evaluation index related to safety, and the like.

[0019] The evaluation index PL is the sum of the parameters PFHd (Probability of Dangerous Failure per Hour) of each safety device including the safety PLC constituting the safety-related part, and the safety diagnosis device 10 calculates the value of the evaluation index PL by calculating the sum of the parameters PFHd of each safety device constituting the safety-related part. In the example of Fig. 1, the safety diagnosis device 10 calculates the sum of the parameters PFHd of the safety devices 21 to 23, the safety devices 31 to 33 and the safety PLC to calculate the evaluation index PL.

[0020] The value of the parameter PFHd is set for each safety device including the safety PLC. When the value of the parameter PFHd is provided for the safety device, the provided value of the parameter PFHd is set in advance in the safety diagnosis device 10 via the management terminal 41.

[0021] There are cases where the value of the parameter PFHd is not provided for a safety device. In such cases, the safety diagnosis device 10 calculates the value of the parameter PFHd using the value of the parameter MTTFd for the safety device. Specifically, the parameter PFHd for a safety device can be calculated using ISO-13849-1, Annex K, Table K.1. In Table K.1, in addition to the parameter MTTFd, the category and average fault diagnosis rate DCavg of the safety device must be set, and this information is set in advance in the safety diagnosis device 10 via the management terminal 41. For safety devices for which the value of the parameter PFHd is not provided, the safety diagnosis device 10 calculates and sets the value of the parameter PFHd using the values ​​of MTTFd, category, and average fault diagnosis rate DCavg.

[0022] Depending on the safety device, the value of the parameter MTTFd may not be provided. In that case, the safety diagnosis device 10 uses the parameter B 10D The value of the parameter MTTFd is calculated based on the value of the provided parameter B and the number of times the safety equipment has been operated, and the value of the PFHd is calculated using the calculated MTTFd, the preset category, and the value of DCavg. 10D The value of B is set in advance in the safety diagnostic device 10 via the management terminal 41. 10D (Unit: times) is the number of times that 10% of the parts can be operated until a dangerous failure occurs, and in safety devices applied to safety-related parts, this parameter is provided in place of the parameter MTTFd.

[0023] The configuration of the safety diagnosis device 10 according to the embodiment will be described. The safety diagnosis device 10 according to the embodiment includes an input / output signal receiving unit 11 , an operation history collecting unit 12 , a parameter calculating unit 13 , a group parameter setting unit 14 , and a PL determining unit 15 .

[0024] The input / output signal receiving unit 11 is connected to the control network 2. The input / output signal receiving unit 11 sequentially receives, via the control network 2, input signals that are output by the safety devices 21 to 23 and input to the safety PLC, and output signals that are output by the safety PLC and input to the safety devices 31 to 33. These input signals and output signals are associated with device IDs that identify the safety devices that input or output these signals. The input signals and output signals that are associated with device IDs and received sequentially are associated with the time of reception of the signal each time it is received, and are treated as time-series data of the signal associated with the device ID.

[0025] The operation history collection unit 12 is set in, for example, the storage unit 12a of the safety PLC. The operation history collection unit 12 stores time-series data of each of the input and output signals acquired by the input / output signal receiving unit 11, for example, in an area for each associated device ID. The operation history collection unit 12 stores the time-series data of each of the input and output signals for an arbitrary appropriate period. The appropriate period is set, for example, so that the number of operating days per year required to calculate the parameter MTTFd can be estimated with sufficient accuracy.

[0026] When the parameter MTTFd of a safety device is provided, the parameter calculation unit 13 calculates the parameter PFHd of the safety device based on the preset value of the parameter MTTFd, the category, and the value of the average fault diagnosis rate DCavg. The parameter calculation unit 13 associates the calculated parameter PFHd with a device ID and outputs it to the group parameter setting unit.

[0027] If the value of the parameter MTTFd is not provided for the safety device, the parameter calculation unit 13 uses the value of the parameter B 10DThe parameter calculation unit 13 calculates the parameter MTTFd of the safety device using the value of (a) and (b) and calculates the value of the parameter PFHd based on the calculated value of the parameter MTTFd, the preset category, and the value of the average fault diagnosis rate DCavg. The parameter calculation unit 13 associates the calculated parameter PFHd with the device ID of the safety device and outputs it to the group parameter setting unit 14.

[0028] The following (Equation 1) and (Equation 2) are preset in the parameter calculation unit 13. The parameter calculation unit 13 extracts time-series data of the input signal or output signal of the safety device from the operation history collection unit 12 using the product ID. The parameter calculation unit 13 calculates B 10D The value of and the time series data of the input signal, or B 10D The value of the parameter MTTFd is calculated by applying the value of and the time series data of the output signal to (Equation 1) and (Equation 2).

[0029] In (Equation 1), n op (Unit: times) is the total number of times the target application is operated per year. In (Equation 2), t cycle (unit: sec / year) is the average time interval for one operation cycle, h op (unit: hour / day) is the operating hours per day, d op (unit: day / year) represents the number of operating days per year. The parameter calculation unit 13 calculates t cycle , h op and d op Calculate.

[0030] MTTFd=B 10D / (0.1×n op ) (Formula 1) n op =(d op ×h op ×3600) / t cycle (Formula 2)

[0031] The group parameter setting unit 14 can associate a device ID with one or more safety groups in advance. As a result, the group parameter setting unit 14 associates the value of the parameter PFHd associated with the device ID with the safety group, which is a group of safety-related parts set via the management terminal 41. In addition, the group parameter setting unit 14 associates the value of the parameter PFHd calculated by the parameter calculation unit 13 and associated with the device ID with the safety group set via the management terminal 41.

[0032] The PL determination unit 15 calculates the sum of the parameters PFHd of each safety device for each safety group, and calculates the value of the evaluation index PL for that safety group. A determination criterion PLr is set in advance in the PL determination unit 15. The determination criterion PLr is set as a PL value for a hazard by identifying the hazard based on a risk assessment set in consideration of the environment, conditions, etc. in which the safety-related part is installed. The PL determination unit 15 outputs the calculated value of PL and the determination criterion PLr for each safety group to the management terminal 41.

[0033] The operation of the safety diagnosis device 10 according to the embodiment will be described. Initial settings are applied to the safety diagnosis device 10. One of the initial settings is the setting of parameters for each safety device. Another initial setting is the setting of a safety group.

[0034] More specifically, the safety diagnosis device 10 inputs and sets parameters for each device via the management terminal 41. If the value of the parameter PFHd is provided in advance, that value is set in advance. If the value of the parameter MTTFd is provided in advance, that value, the category, and the value of the average fault diagnosis rate DCavg are set in advance. If neither the parameter PFHd nor the parameter MTTFd is provided in advance, the parameter B 10D The value of , the category and the value of the average accident diagnosis rate DCavg are set in advance.

[0035] Furthermore, the safety diagnosis device 10 sets a safety group via the management terminal 41.

[0036] The Safety Group, which is a group of safety-related departments, will now be explained. FIG. 2 is a schematic diagram illustrating the configuration of the safety-related part. FIG. 3 is a schematic diagram illustrating another configuration of the safety-related part. 2 and 3, the safety-related part consists of three subsystems: input, control, and output. The safety PLC constitutes the control subsystem. The safety diagnosis device 10 has a PLC function and includes a safety PLC.

[0037] A safety group is a group of safety devices consisting of an input subsystem, a control subsystem, and an output subsystem. One or more safety groups can be set in one safety-related part. In one safety-related part, one safety group includes one or more safety devices that make up the input subsystem, one or more safety devices that make up the control subsystem, and one or more safety devices that make up the output subsystem. As will be described later, when multiple safety groups are set, the safety devices that make up each subsystem can be overlapped and set in multiple safety groups.

[0038] 2 shows an example in which one safety group is set for a safety-related part. In this example, a lock switch 121 is provided as an input safety device, and two contactors 131 and 132 are provided as output safety devices. In this safety-related part, the safety diagnosis device 10 drives the contactors 131 and 132 in accordance with the open / close signal of the lock switch 121. In the example of FIG. 2, there is one control path.

[0039] 3 shows an example in which three safety groups are set for the safety-related parts. In this example, three lock switches 221 to 223 are provided as input safety devices, and six contactors 231 to 236 are provided as output safety devices. The safety diagnosis device 10 controls the two contactors 231 and 232 by opening and closing the lock switch 221. Furthermore, the safety diagnosis device 10 controls the four contactors 231 to 234 by opening and closing the lock switch 222. Furthermore, the safety diagnosis device 10 controls the six contactors 231 to 236 by opening and closing the lock switch 223.

[0040] In the example of Fig. 3, the control paths are multiplexed, and the multiplexed controls are organized by grouping. The first output group Gr1 includes two contactors 231 and 232. The second output group Gr2 includes two contactors 233 and 234 and the first output group Gr1. The third output group Gr3 includes two contactors 235 and 236 and the first output group Gr1 and the second output group Gr2.

[0041] The first safety group includes a lock SW 221 which is an input subsystem, a safety PLC which is a control subsystem, and contactors 231 and 232 which are output subsystems. Specifically, if the output subsystem in the first safety group is called a first output group Gr1, in the first output group Gr1, the two contactors 231 and 232 are controlled by one lock SW 221. In other words, there is one control path in the first output group Gr1.

[0042] The second safety group includes a lock SW 222 which is an input subsystem, a safety PLC which is a control subsystem, and contactors 231 to 234 which are output subsystems. Specifically, if the output subsystem in the second safety group is called the second output group Gr2, in the second output group Gr2, the four contactors 231 to 234 are controlled by the one lock SW 222. In addition to contactors 233 and 234, the second output group Gr2 also includes the first output group Gr1 which is made up of contactors 231 and 232, and there are two control paths in the second output group Gr2.

[0043] The third safety group includes a lock SW 223 which is an input subsystem, a safety PLC which is a control subsystem, and contactors 231 to 236 which are output subsystems. Specifically, if the output subsystem in the third safety group is called a third output group Gr3, in the third output group Gr3, the six contactors 231 to 236 are controlled by one lock SW 223. In addition to contactors 235 and 236, the third output group Gr3 also includes contactors 231 and 232 of the first output group Gr1 and contactors 233 and 234 of the second output group Gr2, and three control paths exist in the third output group Gr3.

[0044] In the above-mentioned specific examples, the case of a single group and the case where multiple safety groups are nested on the output subsystem side have been described, but the configuration of the safety groups is not limited to these. The configuration of the safety groups can be any appropriate multiple configuration depending on the situation of the safety-related parts. For example, the safety devices that make up the input subsystem may be duplicated and set in multiple safety groups, or the subsystems may be hierarchically organized in multiple safety groups.

[0045] Thus, in the safety-related parts of the control system in an industrial plant, it is necessary to measure the operating time and number of operations of each safety device while taking into consideration each of the complex and intricate control systems.

[0046] In the safety diagnosis device 10 according to the embodiment, the safety group settings of the safety-related parts are set via the management terminal 41. The safety group is set in the group parameter setting unit 14. In addition to setting the safety group, the group parameter setting unit 14 also sets the PFHd, MTTFd, B for each safety device. 10D , category, and DCavg. As with group setting, this information is set in the group parameter setting unit 14 via the management terminal 41. When the parameter calculation unit 13 calculates PFHd, etc., the parameter calculation unit 13 can use these values ​​by referring to the group parameter setting unit 14.

[0047] After the above-described initial setting, the safety diagnosis device 10 operates as follows: That is, as shown in Fig. 1, the safety diagnosis device 10 uses the input / output signal receiving unit 11 to sequentially collect input signals input from the safety devices 21 to 23 to the safety PLC and output signals output from the safety PLC to the safety devices 31 to 33.

[0048] The safety diagnosis device 10 associates the collected input and output signals with the device ID of each safety device and the time of signal acquisition, and stores the signals in the operation history collection unit 12 as time-series data.

[0049] The safety diagnosis device 10 extracts the value of the parameter PFHd for each device ID from the group parameter setting unit 14.

[0050] When the parameter PFHd does not exist for one device ID, the safety diagnosis device 10 extracts the parameter MTTFd, category, and average fault diagnosis rate DCavg from the group parameter setting unit 14. The safety diagnosis device 10 calculates the parameter PFHd using the parameter MTTFd, category, and average fault diagnosis rate DCavg of the safety device corresponding to the device ID, using the parameter calculation unit 13.

[0051] If the parameter MTTFd does not exist for one device ID, the safety diagnostic device 10 receives the parameter B 10D , category and average accident diagnosis rate DCavg. The safety diagnosis device 10 extracts the parameter B of the safety device corresponding to the device ID. 10D , category and average accident diagnosis rate DCavg are used to calculate the parameter PFHd.

[0052] The safety diagnosis device 10 associates each device ID with a group set in the group parameter setting unit 14 .

[0053] The safety diagnosis device 10 calculates an evaluation index PL for each safety group by adding up the parameters PFHd of the safety devices for each safety group in the PL determination unit 15, and outputs the evaluation index PL to the management terminal 41 together with the determination criterion PLr.

[0054] The effects of the safety diagnosis device 10 according to the embodiment will be described. Even if the parameter PFHd is not provided for one safety device, the safety diagnosis device 10 according to the embodiment can calculate the parameter PFHd based on the parameter MTTFd provided instead. Also, even if the parameter MTTFd is not provided, the parameter PFHd can be calculated based on the parameter B provided instead. 10D The parameter PFHd can be calculated based on the time series data of the input signal or the output signal. Therefore, the parameter PFHd can be calculated using the parameter MTTFd calculated based on the accurate number of operations and operating frequency of the safety device, and the evaluation index PL can be calculated more accurately, enabling reliable evaluation.

[0055] The safety diagnosis device 10 according to the embodiment can associate the parameter PFHd of each safety device with a preset safety group. Therefore, even in the case of a safety-related part that is complexly configured by being multiplexed, redundant, etc., by appropriately setting the safety group, it is possible to reliably measure the number of times each safety device operates and the operating frequency without omission, and to accurately calculate the evaluation index PL.

[0056] In this way, a safety diagnosis device that can accurately calculate the PL of a safety-related part can be realized.

[0057] Although several embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included within the scope and spirit of the invention, and are also included in the scope of the invention and its equivalents as defined in the claims. [Explanation of symbols]

[0058] 2...Control network, 10...Safety diagnosis device, 11...Input / output signal receiving unit, 12...Operation history collecting unit, 12a...Memory unit, 13...Parameter calculation unit, 14...Group parameter setting unit, 15...PL judgment unit, 21 to 23, 121, 221 to 223, 31 to 33, 131, 132, 231 to 236...Safety devices, 41...Management terminal, 42...Parameter input unit, 43...PL display unit

Claims

1. an operation history collection unit that associates a plurality of signals sequentially input / output between the safety PLC and the plurality of safety devices and a plurality of times at which the plurality of signals were acquired with a plurality of device IDs that identify a plurality of safety devices communicably connected to the safety PLC, and stores the associated signals as a plurality of time-series data; If there is a first safety device among the plurality of safety devices to which a PFHd value has been provided, associate the provided PFHd value with a device ID corresponding to the first safety device; If there is a second safety device among the plurality of safety devices for which a PFHd value is not provided but a MTTFd value is provided, calculate the PFHd value based on the provided MTTFd value and associate the value with a device ID corresponding to the second safety device; Among the plurality of safety devices, neither the value of PFHd nor the value of MTTFd is provided, and B １０Ｄ If there is a third safety device provided with a value of B, １０Ｄ a parameter calculation unit that calculates a value of MTTFd based on the value of MTTFd and time series data associated with the device ID corresponding to the third safety device among the plurality of time series data, calculates a value of PFHd based on the calculated value of MTTFd, and associates the value of PFHd with the device ID corresponding to the third safety device; a PL determination unit that calculates a PL value, which is an evaluation index of safety, by calculating a sum of a plurality of PFHd values ​​associated with the plurality of device IDs; A safety diagnostic device equipped with

2. a group parameter setting unit that associates each of the plurality of device IDs with one or more safety groups; The safety diagnosis device according to claim 1 , wherein the PL determination unit calculates the PL value for each of the one or more safety groups.

3. 2. The safety diagnosis device according to claim 1, wherein the PL determination unit presets an evaluation standard for evaluating the calculated PL value, and outputs the evaluation standard together with the PL value.

Images