Safety controller and history display device

Abstract

To help understand the cause of a false OFF signal by recording a history associated with operation of a safety program.SOLUTION: A safety controller is configured to acquire additional information that is not used for requesting for an output signal from one or more safety input devices or safety sensors, and record input and output signals together with the additional information as history information in every predetermined recording period.SELECTED DRAWING: Figure 7

Description

[Technical field]

[0001] The present invention relates to a safety controller and a history display device. [Background technology]

[0002] In a manufacturing factory, many hazardous industrial machines are in operation. A safety system is essential to ensure the safety of humans from industrial machines (Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2014-16930 A Summary of the Invention [Problem to be solved by the invention]

[0004] The safety system outputs an ON signal if it is safe, and outputs an OFF signal if there is a possibility that it is unsafe. To increase the reliability of the safety system, the microcontroller units (MCUs) are also duplicated. The safety system outputs an ON signal only if both MCUs output an ON signal. If either of the two MCUs outputs an OFF signal, the safety system outputs an OFF signal. Designing the safety system in this way prevents the output of an erroneous ON signal. On the other hand, the erroneous output of an OFF signal has been tolerated from the perspective of ensuring the safety of workers.

[0005] However, if an erroneous OFF signal is output, the industrial machinery stops, which reduces the production efficiency of the product. Therefore, it is necessary to quickly identify the cause of the erroneous OFF signal.

[0006] Therefore, an object of the present invention is to contribute to identifying the cause of an erroneous OFF signal by recording history related to the operation of a safety program. [Means for solving the problem]

[0007] The present invention relates to, for example, A safety controller, an input unit to which an input signal is input from one or more safety input devices or safety sensors; a safety control unit that performs a predetermined calculation based on the input signal to obtain an output signal, and outputs, as the output signal, an ON signal to permit operation of a power source or an OFF signal to stop the power source; an acquisition means for acquiring additional information from the one or more safety input devices or safety sensors, the additional information being different from the input signal and not used to determine the output signal; a history recording means for recording the input signal and the output signal together with the additional information as history information; having The safety control section responds to the input signal or a calculation signal obtained from the input signal. vinegar R Decide on the calculation process The safety program is configured to be executed repeatedly for each scan cycle; the acquiring means is configured to acquire the additional information by communicating with the one or more safety input devices or safety sensors at a communication cycle longer than the scan cycle; The history recording means, for each scan cycle, Based on the current scan cycle The input signal and the output signal are recorded together with the additional information as history information. vinegar R Characterized by A safety controller is provided. Effect of the Invention

[0008] According to the present invention, by recording the history related to the operation of the safety program, it is possible to contribute to identifying the cause of an erroneous OFF signal. [Brief description of the drawings]

[0009] [Figure 1] Diagram explaining the safety controller [Diagram 2] Diagram explaining the main module and the extension module [Diagram 3] FIG. 1 is a diagram illustrating a program creation support device. [Figure 4] Diagram explaining the user interface [Diagram 5] Diagram explaining the user interface [Figure 6] Diagram explaining the user interface [Figure 7] Diagram explaining the functions of the MCU [Figure 8] Diagram explaining the timing of history collection [Figure 9] Flowchart showing the history recording method [Figure 10] Flowchart showing another aspect of the history recording method [Figure 11] is a perspective view of the safety controller. [Figure 12] is a perspective view of the safety controller. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Hereinafter, the embodiments will be described in detail with reference to the accompanying drawings. Note that the following embodiments do not limit the invention according to the claims, and not all combinations of features described in the embodiments are necessarily essential to the invention. Two or more features among the multiple features described in the embodiments may be arbitrarily combined. In addition, the same reference numerals are given to the same or similar configurations, and duplicated descriptions are omitted. In particular, lowercase alphabets are given to distinguish multiple similar components, and when a description common to multiple components is described, the lowercase alphabets may be omitted.

[0011] (Safety Controller) FIG. 1 shows the whole system. In this example, the safety controller 1 has a main module 3 and expansion modules 4a and 4b. The main module 3 executes a safety program transferred from a PC 2 that functions as a creation support device that supports a user in creating a safety program. The main module 3 has a display device 5a, an operation unit 6a, a communication connector 7a, an IO connector 10a, affinity ports 9a and 9b, etc. The PC 2 also has a display device 5b and an operation unit 6b. The communication connector 7a may be a connector for USB or wired LAN. A communication cable from the PC 2 is connected to the communication connector 7a. The wired LAN may be industrial Ethernet (registered trademark). LAN is an abbreviation for local area network. A safety input device 11a such as an emergency stop switch or a light curtain is connected to the input terminal of the IO connector 10a. An industrial device such as a robot arm is connected as a power source (hazard source) to the output terminal of the IO connector 10a.

[0012] The affinity ports 9a and 9b are connected to safety input devices 11c to 11h having interfaces corresponding to the affinity ports 9a and 9b. Examples of the safety input devices 11 that can be connected to the affinity ports 9a and 9b include safety sensors such as light curtains, safety laser scanners, and door switches. The affinity port 9 is a port having an ON / OFF input terminal that receives a safety output signal such as an OSSD signal output from the safety input device as a safety input signal, power supply terminals such as a +24V terminal and a 0V terminal for supplying power to the safety input device, and a communication terminal for communicating with the safety input device. The ON / OFF input terminals are a pair of terminals that receive a duplicated safety output signal from the safety input device as a duplicated safety input signal, similar to the pair of duplicated input terminals included in the IO connector 10a. The affinity port 9 may have an AUX terminal instead of or in addition to the communication terminal. The AUX terminal is a terminal that receives an auxiliary signal from the safety input device 11, and receives, for example, a signal indicating the detection state of a safety sensor or a signal indicating the detection state in a warning area different from the protection area corresponding to the OSSD signal.

[0013] The main module 3 performs calculation processing according to a safety program on the safety input signal (input value) input from the safety input device 11a to determine an output value, which the power source 12 outputs. For example, when an emergency stop switch, which is a type of safety input device 11a, is pressed down, the main module 3 changes the output value from ON (safe) to OFF (unsafe). This stops the power source 12. There are cases where the IO connector 10a provided on the main module 3 alone is not able to connect all the safety input devices and power sources. In such cases, the extension modules 4a and 4b are connected to the main module 3.

[0014] The expansion modules 4a and 4b have IO connectors 10b and 10c, respectively, to which a safety input device 11b and a power source 12, etc. can be connected. The expansion modules 4a and 4b and the main module 3 communicate with each other to transfer input signals and output signals. That is, the main module 3 generates an output signal by applying a safety program to the input signal acquired from the safety input device 11a connected to itself and the safety input device 11a connected to the expansion modules 4a and 4b. Furthermore, the main module 3 outputs an output signal generated according to the safety program to the power source 12 connected to itself or to the power source 12 connected to the expansion modules 4a and 4b. The expansion modules 4a and 4b may also have affinity ports 9. A safety input device and a safety output device can also be connected to the affinity ports 9 of the expansion modules 4a and 4b.

[0015] The safety controller 1 has an IO connector 10a and IO connectors 10b and 10c on the front side, is attached to a mounting fixture on the rear side, and other modules are arranged on the side. The affinity port 9 may be provided on the front side of the safety controller 1 from the viewpoint of ease of access. In addition, the display device 5a, the operation unit 6a, the communication connector 7a, the IO connector 10a, etc. may be provided on the front side of the safety controller 1, and the affinity port 9 may be provided on the upper or lower side of the safety controller 1 from the viewpoint of the size of the safety controller 1. The safety controller 1 may further have a remote IO port for communicating with a remote IO. The remote IO port is provided, for example, on the upper or lower side of the safety controller 1, on a different surface from the affinity port 9.

[0016] The main module 3 and the expansion module 4 are connected via an internal bus, and the main module 3 communicates with the expansion module 4 via the internal bus to acquire a safety input signal from the safety input device 11 connected to the IO connectors 10b and 10c. The main module 3 also acquires a safety input signal from the safety input device 11 and acquires additional information from the safety input device 11 while supplying power to the safety input device 11 via the affinity port 9. That is, the main module 3 has a first acquisition path for acquiring a safety input signal (input value) from the safety input device 11b connected to the IO connector 10b of the expansion module 4 via the internal bus, and a second acquisition path for acquiring a safety input signal (input value) from the safety input devices 11c to 11h via the affinity port 9. In addition, when the main module 3 has a remote IO port, the main module 3 has a third acquisition path via the remote IO port. The main module 3 also has a function of a safety controller and a function of a sensor controller. The function of the safety controller is to generate a safety output signal (output value) according to a safety program using the safety input signal (input value) acquired via the first and second acquisition paths, and the function of the sensor controller is to display or record additional information from the safety input devices 11c to 11h such as safety sensors, or to control the safety input devices 11c to 11h such as safety sensors. As shown in FIG. 1, the safety input devices 11c to 11e and 11f to 11h such as safety sensors can be connected in series. By connecting them in series, it becomes possible to supply power to each safety input device 11 from the safety controller 1 side. Furthermore, a logical operation may be performed to combine the safety output signals of each safety input device 11 by the safety input devices 11c and 11h on the safety controller 1 side. This makes it possible to input a pair of safety output signals to the safety controller 1 as a pair of safety input signals. Furthermore, each safety input device 11 connected in series communicates additional information possessed by each safety input device 11 with the safety controller 1. A safety sensor generally determines whether to output ON or OFF as a safety output signal based on the detection results within a protected area to be monitored, predetermined determination conditions, and error detection results.The additional information includes, for example, the detection results within the protected area by the safety sensor and the error detection results, and helps to clarify the cause why the safety output signal became an OFF signal.

[0017] (Main module and expansion module hardware) As shown in FIG. 2, the controller 20a of the main module 3 has two MCUs 23a and 24a and a memory 25a. The controller 20a stores the safety program and the history record program received from the PC 2 in the memory 25a. The MCUs (microcontroller units) are duplicated to improve reliability. The MCUs 23a and 24a execute the safety program and the history record program stored in the memory 25a, respectively. The MCUs 23a and 24a generate output signals based on the input signal of the safety input device 11 via the safety input IF 21a and the input signal input from the expansion module 4 via the bus IF 26a, and output the output signals to the safety output IF 22a and the expansion module 4. For example, if both the MCUs 23a and 24a output an ON signal, the safety output IF 22a outputs an ON signal. If one or both of the MCUs 23a and 24a output an OFF signal, the safety output IF 22a outputs an OFF signal. In this way, the controller 20a communicates with the expansion module 4 via the bus IF 26a to receive input signals and transmit output signals. The communication IF 27a communicates with other devices (e.g., PC 2) via the communication connector 7a. Circuits related to the OSSD signals, power supply, and communication of the affinity port 9 may be included in the affinity port IF 28a, or may be independent as separate circuits.

[0018] Examples of safety input devices include safety laser scanners and light curtains. Safety input devices generally meet safety standards, and the output of the safety input device is duplicated. When a signal mismatch occurs due to the duplication, the safety controller or the sensor itself can detect the failure of the sensor.

[0019] The controller 20b of the expansion module 4a has two MCUs 23b and 24b and a memory 25b. The MCUs (microcontroller units) are duplicated to improve reliability. The MCUs 23b and 24b each execute a control program stored in the memory 25b. When the controller 20b receives an input signal from the safety input device 11 via the safety input IF 21b, it transmits the input signal to the main module 3 via the bus IF 26b. When the controller 20b receives an output signal from the main module 3 via the bus IF 26b, it outputs the output signal to the power source 12 or the like via the safety output IF 22b. An affinity port IF 28b may be provided as a circuit for the affinity port 9.

[0020] The controller 20c of the expansion module 4b has two MCUs 23c and 24c and a memory 25c. The MCUs (microcontroller units) are duplicated to improve reliability. The MCUs 23c and 24c each execute a control program stored in the memory 25c. When the controller 20c receives an input signal from the safety input device 11 via the safety input IF 21c, it transmits the input signal to the main module 3 via the bus IF 26c. When the controller 20c receives an output signal from the main module 3 via the bus IF 26c, it outputs the output signal to the power source 12 or the like via the safety output IF 22c. An affinity port IF 28c may be provided as a circuit for the affinity port 9.

[0021] (PC hardware) As shown in Fig. 3, the PC 2 includes a CPU 13, a display device 5b, an operation unit 6b, a storage device 15, and a communication IF 27b. The display device 5b, the operation unit 6b, the storage device 15, and the communication IF 27b are each electrically connected to the CPU 13. The storage device 15 includes a RAM, a ROM, an HDD, and an SSD, and may further include a removable memory card. CPU is an abbreviation for central processing unit. ROM is an abbreviation for read-only memory. RAM is an abbreviation for random access memory. HDD is an abbreviation for hard disk drive. SSD is an abbreviation for solid state drive.

[0022] A user of the PC 2 causes the CPU 13 to execute the editing program 14 stored in the storage device 15, edits the safety program 16, the history recording program, setting information, etc. through the operation unit 6b, and transfers them to the main module 3. The setting information includes identification information of the extension module 4 connected to the main module 3, and identification information (terminal assignment information) of the safety input device 11 and the power source 12 connected to each input terminal and each output terminal provided on the IO connectors 10a to 10c.

[0023] The CPU 13 stores the history data 18 read from the main module 3 in the storage device 15. The CPU 13 displays the history data 18 on the display device 5b in accordance with the history display program 17. The history data 18 will be useful in identifying the cause of an erroneous OFF signal.

[0024] (User Interface (UI)) 4 shows a history display UI 30 that the CPU 13 displays on the display device 5b in accordance with the history display program 17. The history display UI 30 has at least two display modes.

[0025] (1) Block information mode The first display mode is a block information mode. The block information mode is a mode in which the history data 18 is displayed in association with a plurality of function blocks forming a safety program. When it is detected that the block information button 31 is clicked or touched, the CPU 13 displays, in the block display section 40, icons of the function blocks 41 forming the safety program 16, icons of the terminals 42 of each function block, and a connection line 38 connecting the terminals. The display condition selection section 33 is used to input conditions for filtering data to be displayed among the history data 18 recorded by the main module 3. The condition specification sections 34 and 35 are pull-down menus for displaying a list of a plurality of pre-prepared condition candidates and for specifying two conditions from the list. The history list 36 displays a list of records (events 37) extracted according to the display conditions. The event 37 may include a serial number of the record (event number), the date and time (timestamp) of the event recording, the name (identification information) of the function block in which the event occurred, and the like. For example, the event 37 may include additional information and programs of an input device connected to an affinity port of the main module 3. Each record may be recorded when a pre-specified event occurs, or may be recorded for each scan cycle of the safety program 16. When the user selects any one of the events 37 displayed in the history list 36, the CPU 13 reads out an event record corresponding to the selected event 37 from the history data 18 and reflects it in the block display unit 40. For example, the CPU 13 may color the icon of a function block 41 in an ON state light blue or light green, and the icon of a function block 41 in an OFF state light pink or orange. Similarly, the CPU 13 may color the icon of a terminal 42 in an ON state blue or green, and the icon of a terminal 42 in an OFF state red. This makes it easier to visually check the logic of signals and the state of each function block.

[0026] The operation button 45a is a button for changing the display target to the first record or event. The operation button 45b is a button for moving the focus to the previous signal change point for a specified signal or block. The operation button 45c is a button for moving the focus to the next signal change point for a specified signal or block. The operation button 45d is a button for changing the display target to the last record or event. The operation button 45e is a button for changing the state of the display target to the state one step before. The operation button 45f is a button for changing the state of the display target to the state one step after. The menu 46 is a pull-down menu for selecting the time interval of one step (e.g., 100 ms, 200 ms, 500 ms, etc.).

[0027] (2) Time chart mode When it is detected that the time chart button 32 is clicked or touched, the CPU 13 switches from the first display mode to the second display mode. The second display mode is a time chart mode in which the history data 18 is displayed in the form of a time chart.

[0028] 5 shows a time chart UI 60. In this example, the time chart UI 60 is displayed in a switched manner with the block display section 40, but both the time chart UI 60 and the block display section 40 may be displayed in parallel. For example, the time chart UI 60 may be displayed in a first window, and the block display section 40 may be displayed in a second window.

[0029] The time chart UI 60 displays the states of various safety input signals, safety output signals, and output terminals of function blocks contained in the history data 18. The current position bar 61 is a bar indicating the position of the timestamp of the event or record currently selected by the user. The time bar 62 is a graphical object indicating the entire history recording period from the timestamp of the first record recorded in the history data 18 to the last record. The event bar 65 is an object indicating the time when an event occurred. The time chart period 63 indicated by diagonal lines is an object for clearly indicating the period from the start time to the end time of the time chart displayed in the time chart UI 60 (the period to be displayed). The current position object 64 corresponds to the time indicated by the current position bar 61.

[0030] In this example, we can see that pressing the emergency stop switch turned the reset function block OFF, and then the first AND block turned OFF, which resulted in the output block A turning OFF. We can also see that pressing the reset switch returned the reset function block from OFF to ON, which turned the first AND block ON, which resulted in the output block A turning ON.

[0031] In the next event corresponding to the current position bar 61, it can be seen that the light curtain is blocked, so that the light curtain is turned OFF, the second AND block is turned OFF, and then the first AND block is turned OFF, and as a result, output block A is turned OFF. The light curtain is unblocked, so that the light curtain returns to ON, the second AND block is turned ON, and then the first AND block is turned ON, and as a result, output block A is turned ON.

[0032] Furthermore, in the next event, the door to which the door switch is attached is opened, which turns the door switch OFF, the second AND block OFF, and the first AND block OFF, which results in the output block A turning OFF. When the door is shown, the door switch turns back ON, the second AND block turns ON, and the first AND block turns ON, which results in the output block A turning ON.

[0033] Incidentally, the main module 3 of this embodiment may obtain additional information from safety input devices such as a light curtain or a door switch connected to the affinity port 9, and record the additional information in the history data 18 together with the state of the function block and the state of each signal. As described above, the additional information is information that is not directly involved in the calculation of the safety output signal. Incidentally, information that is involved in the calculation of the safety output signal is the ON / OFF state of the light curtain, the ON / OFF state of the door switch, etc.

[0034] A light curtain monitors a protected area using multiple optical axes and has multiple pairs of light-emitting elements and light-receiving elements corresponding to the multiple optical axes. The paired light-emitting elements and light-receiving elements are arranged opposite each other and detect objects in the protected area by detecting the blocking of the optical axis by an object, as well as errors in the self-circuitry, etc. Light curtains are safety sensors that generate a safety output signal based on the object detection results and error detection results.

[0035] The additional information of the light curtain includes, for example, at least one of the following information: information on the detection of an object in the protected area, information indicating the ON / OFF status of each optical axis of the light curtain, information indicating the amount of light of each optical axis of the light curtain, information indicating an error detected in the light curtain, information indicating the mute state of the light curtain, and information indicating the light curtain waiting to be reset.

[0036] The safety controller 1 can acquire not only information regarding its own safety control, but also information related to the generation of a safety output signal from the safety input device 11 and information regarding the protection area as additional information, which can help clarify the cause of an erroneous OFF signal.

[0037] The light curtain has a first housing having a plurality of light-emitting elements and a second housing arranged to face the first housing. The second housing has a plurality of light-receiving elements, and outputs an ON signal when all of the plurality of light-receiving elements meet a predetermined amount of received light. Therefore, if the optical axis of the first housing and the optical axis of the second housing are not correctly installed, the margin for the predetermined amount of received light becomes small. Therefore, the user will be able to appropriately review the arrangement of the light curtain by obtaining events related to the light curtain from the history data 18 and checking additional information related to the optical axis.

[0038] 6 shows the additional information UI 70. When a function block corresponding to the light curtain is clicked or touched in the block display section 40 or the time chart UI 60, additional information of the light curtain associated with the time corresponding to the current position bar 61 is read from the history data 18, and the additional information UI 70 is created and displayed on the display device 5b. The additional information UI 70 may display multiple pieces of information. For example, the additional information UI 70 may simultaneously display ON / OFF information of the light curtain, information on the light curtain's light intensity, and information indicating an error in the light curtain.

[0039] The additional information UI70 has a selection unit 71 for selecting one piece of sensor information from multiple pieces of sensor information included in the additional information. The CPU 13 displays the sensor information selected by the user in the selection unit 71 on the sensor information display unit 72. In this example, the amount of light is selected, so the amount of light received by each light receiving element that constitutes the light curtain is displayed. The advice display unit 73 displays advice for the user. In this example, it is advised that optical axis adjustment should be performed. The back button 74 is a button for instructing the CPU 13 to close the additional information UI70 and return to the history display UI30.

[0040] A safety laser scanner is a safety sensor that detects objects within a predetermined protection area based on the reflected light received from the objects by scanning the protection area with a laser light, and detects errors in the self-circuit, etc., and generates a safety output signal based on the object detection results and error detection results. The additional information of the safety laser scanner includes at least one of the following information: detection information of an object within the protection area, information indicating the ON / OFF of each optical axis, information indicating the distance or light amount of each optical axis of the safety laser scanner, information indicating an error that has occurred in the safety laser scanner, information indicating the mute state of the safety laser scanner, information indicating the safety laser scanner waiting for reset release, and image information acquired by a camera provided in the laser scanner.

[0041] The safety controller 1 can acquire not only information regarding its own safety control, but also information related to the generation of a safety output signal from the safety input device 11 and information regarding the protection area as additional information, which can help clarify the cause of an erroneous OFF signal.

[0042] The door switch is a safety sensor in which an actuator having a transponder and a detector for detecting the distance from the transponder are installed at positions facing each other at points that move relatively as the door is opened or closed, and the detector detects the open / closed state of the door based on the distance to the transponder and detects errors in the self-circuit, etc., and generates a safety output signal based on the detection results of the door open / closed state and the error detection results. The door switch may also have a locking mechanism that prevents the door from being opened, and the door switch controls the locked state and the unlocked state by electrically controlling the lock pin of the locking mechanism.

[0043] The additional information of the door switch includes at least one of the following information: detection information of door opening / closing, information indicating lock control of the door switch, information indicating an error that has occurred in the door switch, information indicating a mute state of the door switch, and information indicating waiting for the door switch to lock.

[0044] The safety controller 1 can acquire not only information related to its own safety control, but also information related to the generation of a safety output signal from the safety input device 11 and information related to door opening and closing as additional information, which can help clarify the cause of an erroneous OFF signal.

[0045] <History Record Processing> (MCU functions) Since the main module 3 has two MCUs 23a and 23b, only one of the MCUs 23a and 23b may execute the history recording program, or both of the MCUs 23a and 23b may execute the history recording program. In the latter case, two pieces of history data 18 are created, and one of the MCUs 23a and 23b may integrate the two pieces of history data 18 into one piece of history data 18 based on a time stamp. Here, a case in which only one of the MCUs 23a and 23b executes the history recording program will be described in detail.

[0046] FIG. 7 shows functions that are realized by the MCU 23 executing the history recording program 19. The execution engine 801 executes the safety program 16. The time synchronization unit 802 synchronizes the real-time clock of the extension module 4 and the real-time clock of the safety input device 11 connected to the affinity port 9 with the real-time clock 803 of the main module 3. The FB information acquisition unit 804 acquires the state of each function block constituting the safety program executed by the execution engine 801 from the execution engine 801. The additional information acquisition unit 805 acquires additional information by communicating with the safety input device 11 connected to the affinity port 9 of the main module 3 or the extension module 4. The safety input device 11 may add a time stamp to the additional information and transmit it to the additional information acquisition unit 805. The correction unit 806 corrects the time stamp added to the additional information. There is a communication delay time (communication processing time) between the main module 3 and the safety input device 11. Therefore, the correction unit 806 corrects the time stamp added to the additional information by the amount of the communication delay time. When the recording condition is satisfied, the history recording unit 807 creates a record including the safety input signal, the safety output signal, the state of the function block, and additional information, and adds a timestamp acquired from the real-time clock 803 to this record and adds it to the history data 18. The recording condition may be, for example, every scan cycle. A scan cycle is a period in which the safety program 16 is repeatedly executed by the execution engine 801. In other words, every time the execution engine 801 executes the safety program 16 once, one record is created and added to the history data 18. The recording condition may be the occurrence of a predetermined event (for example, a designated signal such as a safety output signal changing from ON to OFF) (change point recording). In this case, an advantage is obtained in that the size of the history data 18 is reduced.

[0047] The MCU 23 may have a monitoring function (monitoring unit / determination unit) that determines whether the execution engine 801 has normally processed the safety input signal and the safety output signal, whether there is an error in the output of the MCUs 23 and 24, etc. If the monitoring function detects any error, the MCU 23 forcibly turns off the output.

[0048] 7, the MCU 23 may communicate with a device connected to the affinity port 9 to obtain model information of the device. This allows the MCU 23 to easily recognize whether the device connected to the affinity port 9 is a light curtain, a door switch, or a safety laser scanner (model discrimination function).

[0049] (Timing of history recording) FIG. 8 is a diagram for explaining history records for each scan cycle. Scan0 to Scan5 are information related to safety control acquired for each scan cycle. Information related to safety control is, for example, information related to or involved in the calculation of a safety output signal (e.g., safety input signal, function block state, safety output signal). A01 to A03 are, for example, additional information of a light curtain. B01 to B03 are additional information of a door switch. In this example, the safety input devices each have their own control cycle, so the timing of acquiring the additional information is different. The history record includes information related to safety control and additional information acquired for each scan cycle. Since the scan cycle and the control cycle of the safety input device are different, the history record includes information related to safety control and additional information based on the scan cycle. In this case, the timestamp added to the history record is a timestamp based on the scan cycle.

[0050] Incidentally, during a safe period when an ON signal is continuously output, multiple consecutive history records may be identical to each other. In this case, the history recording unit 807 may keep the first history record of the multiple consecutive history records that are identical to each other, and delete the remaining history records (change point compression).

[0051] Here, one history record is created for each scan cycle, but the data to be recorded may be assigned a time stamp for each type of data, and a record may be created for each type of data. For example, for a safety output signal, the safety output signal is acquired for each scan cycle and a time stamp is assigned. Similarly, for a safety input signal, the safety input signal is acquired for each scan cycle and a time stamp is assigned. Additional information may also be acquired for each scan cycle or control period and a time stamp is assigned. In this case, the PC 2 may create the block display section 40 or the time chart UI 60 based on the time stamp of each data, and display it on the display device 5b.

[0052] (flowchart) 9 is a flowchart showing the history recording process executed by the main module 3. The MCU 23 of the main module 3 executes the following processes in accordance with the history recording program 19.

[0053] In S1, the MCU 23 (time synchronization unit 802) executes time synchronization. The time synchronization unit 802 transmits time synchronization commands to the safety input device 11 connected to the affinity port 9, the expansion module 4 connected via the bus IF 26a, and the safety input device 11 connected to the affinity port 9 of the expansion module 4, thereby synchronizing the time of its own real-time clock 803.

[0054] In S2, the MCU 23 (the execution engine 801) acquires a safety input signal. For example, the execution engine 801 acquires a safety input signal from the safety input device 11 connected to the affinity port 9 and the safety input device 11 connected to the affinity port 9 of the expansion module 4.

[0055] In S3, the MCU 23 (execution engine 801) executes the safety program 16. The execution engine 801 executes the safety program 16 to calculate and obtain a safety output signal in response to a safety input signal.

[0056] In S4, the MCU 23 (execution engine 801) outputs a safety output signal. The execution engine 801 outputs the safety output signal to the power source connected to the safety output IF 22a and to the power sources connected to the safety output IFs 22b and 22c of the expansion module 4. When a power source is connected to the affinity port 9, the safety output signal is output to the power source via the affinity port 9.

[0057] In S5, the MCU 23 (FB information acquisition unit 804) acquires state information of each function block forming the safety program 16 from the execution engine 801.

[0058] In S6, the MCU 23 (additional information acquisition unit 805) acquires additional information from the safety input device 11 connected to the affinity port 9 and the safety input device 11 connected to the affinity port 9 of the expansion module 4.

[0059] In S7, the MCU 23 (history recording unit 807) creates a history record including the safety input signal, the safety output signal, the status information of the function blocks, and additional information, and determines whether there is a change with respect to the latest history record included in the history data 18. The history record is created by the record creation unit 811. The determination of the change in the history record is executed by the change determination unit 812. If there is a change in the history record, the MCU 23 proceeds to S8. If there is no change in the history record, the MCU 23 skips S8 and proceeds to S9. Note that S7 is optional.

[0060] In S8, the MCU 23 (history recording unit 807) adds a timestamp to the history record and adds it to the history data 18.

[0061] In S9, the MCU 23 (history recording unit 807) determines whether or not the user has input an instruction to end the history recording program 19 or the safety program 16. If an instruction to end the program has not been input, the MCU 23 returns to S2. If an instruction to end the program has been input, the MCU 23 stops the history recording program 19.

[0062] Figure 10 shows the recording process from another perspective. Here, we focus on the recording process shown in Figure 8. As Figure 8 shows, the following process is executed for each scan cycle.

[0063] In S11, the MCU 23 (history recording unit 807) determines whether or not the calculation of the safe output signal based on the safe input signal has been completed. After waiting for the calculation to be completed, the MCU 23 proceeds to S12.

[0064] In S12, the MCU23 (history recording unit 807) acquires the additional information. Here, the additional information to be acquired is not the additional information at the timing when the calculation is completed, but the additional information at the timing immediately before that. As shown in Fig. 8, the additional information for the scan cycle Scan01 is A01 and B00, not A02 or B01.

[0065] In S12, the MCU 23 (history recording unit 807) adds to the history data 18 a history record created by associating the additional information with the information related to safety control.

[0066] (When a safety laser scanner is connected to affinity port 9) The safety laser scanner receives setting data from a setting support device (e.g., PC2) that generates a protection area set in a detection area as setting data, detects an object in the protection area received as the setting data, and outputs a safety control signal. The safety laser scanner includes a light projecting means for projecting detection light onto the detection area, a light receiving means for receiving reflected light from an object in the detection area and generating a light receiving signal, a distance calculating means for calculating a distance to the target object, a scanning means for scanning the detection light around a rotation axis, an intrusion detecting means for detecting an object in the protection area and generating a detection signal based on distance measurement information consisting of the distance and the scanning angle of the detection light and the protection area included in the setting information, and an output means for outputting the detection signal as a safety output signal. In addition, in order to facilitate confirmation of the situation when an object is detected in the protection area by the safety laser scanner, a memory or the like may be provided that stores a scan image, time data, the position of the optical axis that detected the intrusion into the protection area, and the like as an event history. More preferably, a camera that captures the detection area of ​​the safety laser scanner may be built in. The memory may store an image of the detection area captured by the camera. The scan image is an image generated from ranging information including the scanning angle at which reflected light is detected and the detected distance, and is an image that displays multiple ranging information obtained in the scanning period of the detection light in two dimensions, showing the ranging information as multiple ranging positions on the scan plane of the detection light.

[0067] When the safety controller 1 is stopped, the main module 3 is able to read the event history as described above from the safety laser scanner via the affinity port 9.

[0068] The safety controller 1 may transmit a safety control signal to the connected safety laser scanner via the affinity port 9. The safety control signal includes, for example, a bank number used for bank switching, and when 16 banks can be switched, the signal is composed of a total of eight signal lines by duplicating four lines representing the bank number by a binary combination. The safety control signal may include a light emission stop signal for stopping the light emission of the safety laser scanner.

[0069] The AUX terminal of the affinity port 9 receives as additional information a warning signal indicating that an intrusion has been detected in a warning area set in the safety laser scanner.

[0070] (When a light curtain is connected to affinity port 9) The light curtain is a multi-optical axis photoelectric sensor that includes a light emitter having a plurality of light-emitting elements and a light receiver having a plurality of light-receiving elements that receive light emitted from the light emitter, and outputs a safety signal generated based on the light-blocking state of at least one of the plurality of optical axes formed between the light emitter and the light receiver to the outside. The light curtain may have a memory that stores, as additional information, time error information of the light curtain and an image of the detection area of ​​each optical axis captured by a camera built into the light curtain. When the safety controller 1 is stopped, the main module 3 may obtain the above-mentioned additional information from the light curtain via the affinity port 9. In addition, an image related to the light amount of each optical axis generated from the state information of the light curtain may be included in the additional information.

[0071] As described above, when a safety laser scanner or light curtain is connected, it is desirable for the safety input device to have, as additional information, detection information regarding the protected area used to generate an input signal.

[0072] (Safety controller connection type) 11 and 12 are perspective views of the safety controller. As shown in FIG. 11, affinity ports 9a and 9b are provided on the top surface of the main module 3. A port connector 1190a provided at the tip of a cable extending from a safety input device 11 such as a safety laser scanner can be connected to the affinity ports 9a and 9b. An affinity port 9c is also provided on the top surface of the expansion module 4a. A port connector 1190d provided at the tip of a cable extending from a safety input device 11 such as a light curtain can be connected to the affinity port 9c.

[0073] A receptacle 1100 for the bus IF 26a is provided on the right side of the main module 3. A bus connector 1101 for the bus IF 26b is provided on the left side of the extension module 4a. By connecting the bus connector 1101a to the receptacle 1100, the bus IFs 26a and 26b are connected so as to be able to communicate with each other (internal bus connection).

[0074] Boss grooves 1102, 1103, 1104, and 1105 are provided on the right side of the main module 3. Positioning bosses 1112, 1113, 1114, and 1115 are provided on the left side of the expansion module 4a. When the expansion module 4a is connected to the main module 3, the bosses 1112, 1113, 1114, and 1115 fit into the corresponding boss grooves 1102, 1103, 1104, and 1105, respectively, and the expansion module 4a is positioned relative to the main module 3.

[0075] The right side surface of the main module 3 is provided with locking grooves 1112, 1113, 1114, and 1115. The left side surface of the extension module 4a is provided with hooks 1132, 1133, 1134, and 1135. When the extension module 4a is securely fixed to the main module 3, the hooks 1132, 1133, 1134, and 1135 engage with the corresponding locking grooves 1122, 1123, 1124, and 1125, respectively. The hooks 1132, 1133, 1134, and 1135 are provided on the upper surface of the extension module 4a and have a lever 1130 that can move in the forward and backward directions. In conjunction with the movement of the lever 1130, the hooks 1132, 1133, 1134, and 1135 move backwards to lock. As the lever 1130 moves, the hooks 1132, 1133, 1134, and 1135 move forward, thereby releasing the lock.

[0076] The structure of the right side surface of the expansion module 4a is the same as the structure of the right side surface of the main module 3, and therefore a description thereof will be omitted. The structure of the expansion module 4b is the same as the structure of the expansion module 4a, and therefore a description thereof will be omitted. Because a common structure is adopted for these connection surfaces, it is possible to connect the left side surface of the expansion module 4b to the right side surface of the expansion module 4a.

[0077] 12, a remote IO receptacle 1200 is provided on the bottom surface of the main module 3. A remote IO connector 1201 provided at the tip of a cable extending from a remote IO unit is connected to the remote IO receptacle 1200. The remote IO unit is a unit for connecting safety input devices and safety output devices located away from the main module 3 to the main module 3.

[0078] However, there is already not enough free space left on the rear, front, right side, and left side of the main module 3 and the expansion modules 4a and 4b for their basic use as safety controllers. For example, there is a connection groove or backplane for connecting to a DIN rail on the rear of the main module 3 and the expansion modules 4a and 4b. A display surface, I / O connectors, etc. are present on the front of the main module 3 and the expansion module 4. Receptacles for the bus IF 26a, etc. are arranged on the left and right sides. Therefore, there is no space to provide new ports on these sides.

[0079] Therefore, possible locations for providing the new ports are the top and bottom surfaces of the main module 3 and the expansion module 4. The affinity ports 9b and 9c and the remote IO receptacle 1200 for the remote IO port may be provided on the top or bottom surface of the main module 3 and the expansion module 4.

[0080] When the heat dissipation holes 1180, 1181, 1182, and 1183 are provided on the upper and lower surfaces of the main module 3 and the expansion modules 4a and 4b, respectively, only a small space is left. In this case, the space for arranging new ports is limited. Therefore, for example, the affinity ports 9b and 9c may be arranged on the upper surface of the main module 3 and the expansion module 4, and a remote IO receptacle 1200 for a remote IO port may be provided on the lower surface of the main module 3 and the expansion module 4 (upper and lower distributed arrangement). Alternatively, the remote IO receptacle 1200 for a remote IO port may be provided on the upper surface of the main module 3 and the expansion module 4, and the affinity ports 9b and 9c may be provided on the lower surface of the main module 3 and the expansion module 4.

[0081] <Summary> As shown in FIG. 1, the safety controller 1 is an example of a safety controller. As shown in FIG. 2, the safety input IF 21 and the affinity port 9 function as an input unit to which an input signal is input from one or more safety input devices or safety sensors (e.g., light curtains, door switches, safety laser scanners, etc.). The MCU 23 and the execution engine 801 function as a safety control unit that performs a predetermined calculation based on the input signal to obtain an output signal and outputs an ON signal that permits the operation of the power source or an OFF signal that stops the power source as the output signal. The MCU 23 and the additional information acquisition unit 805 function as an acquisition unit that acquires additional information (e.g., sensor information) that is not used to obtain an output signal from one or more safety input devices or safety sensors. The MCU 23 and the history recording unit 807 function as a history recording unit that records the input signal and the output signal as history information (e.g., history data 18) together with the additional information. In this way, by recording the history related to the operation of the safety program, it is possible to contribute to clarifying the cause of an erroneous OFF signal. For example, if sensor information regarding improper installation of a safety sensor is recorded as history, users can review the installation of the safety sensor to prevent erroneous OFF signals from being output, which will improve the production efficiency of industrial machinery.

[0082] As shown in Fig. 4, the safety control section (e.g., MCU 23) may be configured to repeatedly execute, for each scan cycle, a safety program 16 having a plurality of function blocks that perform logical operations on input signals or operation signals obtained from input signals. As shown in Fig. 8, the history recording means (history recording section 807) may record the input signals and output signals as history information together with additional information for each scan cycle, which is a predetermined recording period. Since the scan cycle is an extremely short interval for monitoring the safety program, it is possible to provide a user with a lot of information to clarify the cause of an erroneous OFF signal.

[0083] As shown in Fig. 8, the acquisition means (e.g., MCU 23) may be configured to acquire additional information by communicating with one or more safety input devices or safety sensors at a communication cycle longer than the scan cycle. Compared with input signals and output signals, additional information may be information that is less likely to change. Frequent communication of such additional information may place a load on the MCU 23 and bus IF 26, lengthening the scan cycle. Therefore, by adopting a communication cycle different from the scan cycle, the load on the MCU 23 and bus IF 26 is reduced.

[0084] The history recording means (e.g., MCU 23 or FB information acquisition unit 804) may be further configured to acquire the states of multiple function blocks for each scan cycle and record them as history information. This will make it easier to identify the cause of an erroneous OFF signal caused by a bug in the safety program.

[0085] The history recording means (e.g., change determination unit 812) may record the history information acquired in the current scan cycle when the history information acquired in the current scan cycle differs from the latest history information recorded in the history recording means, and may not record the history information acquired in the current scan cycle when the history information acquired in the current scan cycle matches the latest history information recorded in the history recording means. This may enable change point compression of the history data 18.

[0086] The main module 3 and the expansion module 4 may further include a real-time clock. The history recording means (e.g., the record creation unit 811) may record the history information by adding time information obtained from the real-time clock as a time stamp. This makes it possible to know when an erroneous OFF signal occurred.

[0087] The time synchronization unit 802 functions as a time synchronization means for synchronizing the real-time clock 803 of the safety controller with the real-time clock of one or more safety input devices or safety sensors. The correction unit 806 may function as a means for correcting the time information of the additional information with the communication processing time required for communication with one or more safety input devices or safety sensors. The history recording means (e.g., the history recording unit 807) records the additional information based on the time information corrected by the correction means. It is assumed that the real-time clock 803 of the main module 3 gives a timestamp to the signal acquired from the safety input device connected to the main module 3 and the additional information acquired by the safety input device connected to the expansion module 4 through bus communication. In this case, the timestamp of the additional information becomes a timestamp later than the time when the additional information was actually acquired and transmitted by the safety input device. This is because the communication processing time exists. Therefore, by correcting the timestamp of the additional information to a time in the past by the communication processing time, the timestamp of the additional information will become more accurate.

[0088] The one or more safety input devices or safety sensors may be a light curtain. In this case, the additional information may include at least one of information indicating ON / OFF of the optical axis of the light curtain, information indicating the light amount of the optical axis of the light curtain, information indicating an error occurring in the light curtain, information indicating a mute state of the light curtain, and information indicating a waiting state for reset of the light curtain. These may be useful information in clarifying an erroneous OFF signal generated due to the light curtain.

[0089] The one or more safety input devices or safety sensors may be a safety laser scanner. In this case, the additional information may include at least one of information indicating ON / OFF of an optical axis of the safety laser scanner, information indicating a measured distance or light amount of each optical axis of the safety laser scanner, information indicating an error that has occurred in the safety laser scanner, information indicating a mute state of the safety laser scanner, information indicating a wait for reset of the safety laser scanner, and image information acquired by a camera provided in the safety laser scanner. These will be reference information for clarifying an erroneous OFF signal generated due to the safety laser scanner.

[0090] The one or more safety input devices or safety sensors may be a door switch. In this case, the additional information may include at least one of information indicating a lock control of the door switch, information indicating an error occurring in the door switch, information indicating a mute state of the door switch, and information indicating a waiting state for the door switch to be locked. These may be useful information in clarifying an erroneous OFF signal generated due to the door switch.

[0091] The history recording unit 807 may be configured to record image data acquired by a camera as history information. The main module 3 can be connected to a camera and can receive image data acquired by the camera. For example, the camera may be installed to capture images of a safety input device, a safety sensor, a safety output device (power source), and the like. The amount of information in the image data is far greater than the amount of information in the safety input signal and the safety output signal. Therefore, the user will be able to easily identify the cause of an erroneous OFF signal by checking the image data. On the other hand, in order to reduce the size of the history data 18, the history recording unit 807 may record image data only when the safety output signal changes (changes from ON to OFF).

[0092] The PC2 functions as a history display device that displays history information recorded by the safety controller. In this case, the operation unit 6b and the display condition selection unit 33 function as a selection means that selects one of the history records included in the history information. The CPU 13 functions as a display means that displays the history record selected by the selection means on the display device.

[0093] As shown in FIG. 4, the CPU 13 may reflect the ON / OFF states of multiple function blocks contained in the history information in function block icons corresponding to multiple function blocks constituting the safety program executed by the safety controller and display them on the display device.

[0094] As shown in FIG. 4, the CPU 13 may display the state of an input signal as the state of an input-type function block, and the state of an output signal as the state of an output-type function block.

[0095] As shown in FIG. 5, the CPU 13 may display the states of a plurality of input signals and at least one output signal contained in the history information in a time chart format.

[0096] As shown in FIG. 5, the CPU 13 may display, in the form of a time chart, the states of a plurality of function blocks that constitute a safety program executed by the safety controller and that are recorded in the history information.

[0097] 4 and 5, the CPU 13 may function as an extraction condition receiving means for receiving extraction conditions for extracting history records to be displayed. Furthermore, the CPU 13 may function as an extraction means for extracting history records that satisfy the extraction conditions from the history information and creating a list (e.g., history list 36). The CPU 13 may display the states of the input signals and the output signals included in the history record selected from the list by the selection means.

[0098] The CPU 13 may function as a designation receiving means for receiving designation of a safety input device or a safety sensor for which additional information is to be displayed. As shown in Fig. 6, the CPU 13 may read out additional information of the safety input device or the safety sensor corresponding to the designation received by the designation receiving means from the history information and display the additional information.

[0099] The invention is not limited to the above-described embodiment, and various modifications and variations are possible within the scope of the gist of the invention.

Claims

1. A safety controller, an input unit to which an input signal is input from one or more safety input devices or safety sensors; a safety control unit that performs a predetermined calculation based on the input signal to obtain an output signal, and outputs, as the output signal, an ON signal that permits operation of a power source or an OFF signal that stops the power source; an acquisition means for acquiring additional information from the one or more safety input devices or safety sensors, the additional information being different from the input signal and not used to determine the output signal; a history recording means for recording the input signal and the output signal together with the additional information as history information; having the safety control unit is configured to repeatedly execute, for each scan cycle, a safety program that determines a calculation process for the input signal or a calculation signal obtained from the input signal; the acquiring means is configured to acquire the additional information by communicating with the one or more safety input devices or safety sensors at a communication cycle longer than the scan cycle; The safety controller, wherein the history recording means records, for each scan cycle, the input signal and the output signal together with the additional information based on that scan cycle as history information.

2. The safety program has a plurality of function blocks that perform logical operations on the input signals or on operation signals derived from the input signals, 2. The safety controller according to claim 1, wherein the history recording means is configured to obtain an ON / OFF state of the plurality of function blocks for each scan cycle and record the ON / OFF state as the history information.

3. 3. The safety controller according to claim 1, wherein the history recording means records the history information acquired in the current scan cycle when the history information acquired in the current scan cycle differs from the latest history information recorded in the history recording means, and does not record the history information acquired in the current scan cycle when the history information acquired in the current scan cycle matches the latest history information recorded in the history recording means.

4. Further comprising a real-time clock; 3. The safety controller according to claim 1, wherein the history recording means records the history information by adding time information obtained from the real-time clock as a time stamp.

5. time synchronization means for synchronizing a real-time clock of the safety controller with a real-time clock of the one or more safety input devices or safety sensors; a correction means for correcting time information of the additional information based on a communication processing time required for communication with the one or more safety input devices or safety sensors; having 5. The safety controller according to claim 4, wherein the history recording means records the additional information based on time information corrected by the correction means.

6. the one or more safety input devices or safety sensors are light curtains; A safety controller as described in any one of claims 1 to 5, characterized in that the additional information includes at least one of information indicating ON / OFF of the optical axis of the light curtain, information indicating the light amount of the optical axis of the light curtain, information indicating an error that has occurred in the light curtain, information indicating a mute state of the light curtain, and information indicating waiting for the light curtain to be reset.

7. the one or more safety input devices or safety sensors are safety laser scanners; A safety controller as described in any one of claims 1 to 5, characterized in that the additional information includes at least one of the following information: information indicating the ON / OFF status of the optical axis of the safety laser scanner, information indicating the measured distance or light amount of each optical axis of the safety laser scanner, information indicating an error that has occurred in the safety laser scanner, information indicating a mute state of the safety laser scanner, information indicating waiting for the safety laser scanner to be released from reset, and image information acquired by a camera provided in the safety laser scanner.

8. the one or more safety input devices or safety sensors are door switches; The safety controller according to any one of claims 1 to 5, characterized in that the additional information includes at least one of information indicating lock control of the door switch, information indicating an error that has occurred in the door switch, information indicating a mute state of the door switch, and information indicating waiting for the door switch to be locked.

9. 9. The safety controller according to claim 1, wherein the history recording means is configured to record image data acquired by a camera as the history information.

10. A history display device that displays history information recorded by a safety controller, The safety controller includes: an input unit to which an input signal is input from one or more safety input devices or safety sensors; a safety control unit that performs a predetermined calculation based on the input signal to obtain an output signal, and outputs, as the output signal, an ON signal that permits operation of a power source or an OFF signal that stops the power source; an acquisition means for acquiring additional information from the one or more safety input devices or safety sensors, the additional information not being used to determine the output signal; a history recording means for recording the input signal and the output signal together with the additional information as history information, the history recording means creates a history record including the additional information based on acquisition of the input signal and the output signal; The history display device includes: A selection means for selecting one of the plurality of history records included in the history information; a display means for displaying the history record selected by the selection means on a display device; A history display device comprising:

11. An extraction condition receiving means for receiving extraction conditions for extracting history records to be displayed; an extraction means for extracting history records that satisfy the extraction condition from the history information and creating a list; and 11. The history display device according to claim 10, wherein said display means displays the states of said input signals and said output signals selected by said selection means from said list and included in a history record.

12. The display device further includes a designation receiving means for receiving designation of a safety input device or a safety sensor that is to be displayed as the additional information, 11. The history display device according to claim 10, wherein the display means reads additional information of a safety input device or a safety sensor corresponding to the designation accepted by the designation accepting means from the history information and displays the additional information.

13. The history display device according to claim 10, characterized in that the display means displays, on the display device, function block icons corresponding to the plurality of function blocks constituting the safety program executed by the safety controller, reflecting the ON / OFF states of the plurality of function blocks contained in the history information.

14. 14. The history display device according to claim 13, wherein the display means is configured to display the state of the input signal as the state of an input type function block, and to display the state of the output signal as the state of an output type function block.

15. 11. The history display device according to claim 10, wherein said display means displays the states of a plurality of input signals and at least one output signal contained in said history information in a time chart format.

16. The history display device according to claim 15, characterized in that the display means displays, in a time chart format, the states of a plurality of function blocks constituting a safety program executed by the safety controller, which are states recorded in the history information.

Images