Monitor device for safety controller

Abstract

To disclose a monitoring device capable of easily monitoring redundant safety signals.SOLUTION: A monitoring device 200 of a safety controller 300 includes a monitor controller 205 that displays the state of safety signals, which are input / output signals of the safety controller 300, on a display 280. When an operator designates a specific safety signal as a target signal to be monitored, the monitor controller 205 extracts one or more candidates of safety signals redundant with the target signal as redundancy candidate signals, and the state of the target signal and the states of the one or more redundancy candidate signals are displayed on the same screen of the display 280.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] This specification discloses a monitor device that monitors the state of a safety signal, which is an input / output signal of a safety controller.

Background Art

[0002] Conventionally, a system combining a programmable logic controller (hereinafter referred to as "PLC") and a safety controller has been known (for example, Patent Document 1, etc.). The PLC receives ON / OFF information from input devices such as switches and sensors, executes logical operations in accordance with a sequence program (user program) described in ladder language or the like, and outputs ON / OFF information to a relay output connected to the PLC or a drive / stop information signal to output devices such as valves and actuators according to the operation result.

[0003] The safety controller is a device for controlling various devices on the safety side. Specifically, the safety controller reads an input signal from a safety response input device such as an emergency stop button or a safety door switch, determines an output signal by an embedded logical operation program, and stops various devices to be controlled or operates them on the safety side. Hereinafter, the signal input to the safety controller is called a "safety input signal", and the signal output from the safety controller is called a "safety output signal". When the safety input signal and the safety output signal are not distinguished, they are called "safety signals".

[0004] Furthermore, usually, in such a system, a monitor device for checking the state of input / output signals is also provided.

[0005] Here, in the safety controller, even when a single fault occurs in the devices constituting the safety system, multiple input / output systems corresponding to one event are provided to ensure safety. These multiple input / output systems are independent of each other and constitute a redundant multiple system. For example, in the safety controller, when an emergency stop button is pressed, a predetermined safety input signal is input to the safety controller, and a safety output signal corresponding to this safety input signal is output from the safety controller. Generally, in the safety controller, in order to cope with a single fault of the device, a plurality of input / output lines corresponding to such an emergency stop button are prepared, and a multiple system in which these multiple input / output lines are independent of each other is configured.

Prior Art Documents

Patent Documents

[0006]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0007] Here, even though an operation command is issued from the non-safety system, the controlled object may be stopped. For example, in a machine tool, even though an operation command for the spindle motor for cutting is issued, the operation of the spindle motor may be stopped. In this case, it is possible that the safety controller has instructed the operation to stop. For example, when the emergency stop button is turned ON, the safety controller detects this and outputs a safety output signal according to the detection result. In this case, even if the non-safety system PLC continues to output the operation command, the operation of the spindle motor stops.

[0008] Thus, even though an operation command is issued from a non-safe system, when the controlled object has stopped operating, in order for the operator to investigate the cause, it is necessary to check the states of the safety signals of all systems related to the controlled object. Therefore, conventionally, there has been a demand to simultaneously check the states of the safety signals of a plurality of redundant systems.

[0009] However, the combinations of the redundant safety signals are defined inside the control program. On the other hand, a monitor device that displays the states of the safety signals cannot read such definitions inside the control program. Therefore, conventional monitor devices could not identify the redundant safety signals and could not display them simultaneously.

[0010] Therefore, in a conventional monitor device, when an operator wants to simultaneously check the states of a plurality of redundant safety signals, the operator has to perform a special operation of identifying the combinations of the redundant safety signals by himself / herself and searching for and displaying the identified safety signals on the monitor device. However, such a special operation was troublesome and burdensome for the operator.

[0011] Therefore, this specification discloses a monitor device that can easily monitor redundant safety signals.

Means for Solving the Problem

[0012] The monitor device of the safety controller disclosed in this specification includes a monitor controller that causes a display to display the states of safety signals that are input / output signals of the safety controller. When the operator designates a specific one of the safety signals as a signal to be monitored, the monitor controller extracts one or more candidates of safety signals that are redundant with the target signal as redundant candidate signals, and causes the display to display the state of the target signal and the states of the one or more redundant candidate signals on the same screen.

[0013] In this case, the monitor controller may extract, as the redundancy candidate signal, the safety signal in which at least one of the signal label and the comment is similar to the target signal by a certain level or more.

[0014] Further, when a plurality of the redundancy candidate signals are extracted, the monitor controller may cause the display to display, in a list format, the states of the plurality of the redundancy candidate signals in an order from the one having the highest possibility of being redundant with the target signal.

[0015] Further, the monitor controller monitors the timings of the state changes of the target signal and the redundancy candidate signals, and may determine that, among the redundancy candidate signals, the signal whose state changes at substantially the same timing as the target signal has a higher possibility of being redundant with the target signal than other signals.

[0016] Further, the monitor controller may extract, as the redundancy candidate signal, one or more safety signals whose state changes at substantially the same timing as the target signal.

Advantages of the Invention

[0017] The monitor device for the safety controller disclosed in this specification extracts a signal that may be redundant with the target signal as a redundancy candidate signal and displays this on the same screen as the target signal. Therefore, the operator can easily monitor the redundant safety signal.

Brief Description of the Drawings

[0018]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Embodiments for Carrying Out the Invention

[0019] Hereinafter, the configuration of the monitor device 200 will be described with reference to the drawings. FIG. 1 is a block diagram of a controller system having the monitor device 200. As shown in FIG. 1, the controller system includes a PLC 100, a monitor device 200, and a safety controller 300. The PLC 100, the monitor device 200, and the safety controller 300 are connected to each other via an I / O link 400 and can transmit and receive data to and from each other. Further, a normal I / O slave station (not shown) and a safety I / O slave station (not shown) are connected to the I / O link 400. The safety I / O slave station is connected to safety-responsive input devices such as an emergency stop button and a safety door switch. The normal I / O slave station is connected to devices that output normal input signals, control target devices that receive normal output signals, and the like.

[0020] Physically, the PLC 100 is a computer having a processor and a memory. This PLC 100 receives ON / OFF information from devices such as switches and sensors and executes logical operations in accordance with a control program written in ladder language or the like. Further, the PLC 100 outputs ON / OFF information toward a relay output connected to the PLC 100 or outputs a signal of drive / stop information toward output devices such as valves and actuators based on the operation result of the logical operation. Functionally, this PLC 100 can be roughly classified into a PLC command execution unit 110, a normal input / output memory 120, and an I / O link normal master station control unit 130.

[0021] The PLC command execution unit 110 executes PLC commands by referring to the values of the normal input signals recorded in the normal input / output memory 120 and updates the values of the normal output signals recorded in the normal input / output memory 120. The normal input / output memory 120 is a memory that stores the values of the normal input signals and the normal output signals.

[0022] Normally, the input signal is input from the normal I / O slave station to the PLC 100 through the I / O link 400 and the I / O link normal master station control unit 130. The normal output signal is output from the PLC 100 to the normal I / O slave station through the I / O link normal master station control unit 130 and the I / O link 400. Also, the normal input signal and the normal output signal are output from the I / O link normal master station control unit 130 to the normal input / output status memory 230 and recorded. In other words, the normal input / output status memory 230 records the same signal information as the normal input / output memory 120.

[0023] The safety controller 300 reads the safety input signal from the safety input devices to stop various devices to be controlled or operate them on the safe side, and determines the safety output signal according to the built-in logic operation program. Physically, the safety controller 300 is a computer having a processor and a memory. Functionally, the safety controller 300 can be roughly classified into a safety logic execution unit 310, a safety input / output memory 320, and an I / O link safety master station control unit 330. The safety logic execution unit 310 executes the safety logic with reference to the value of the safety input signal stored in the safety input / output memory 320, and updates the value of the safety output signal stored in the safety input / output memory 320. The safety input / output memory 320 is a memory that stores the values of the safety input signal and the safety output signal.

[0024] The safety input signal is input from the safety I / O slave station to the safety controller 300 through the I / O link 400 and the I / O link safety master station control unit 330. The safety output signal is output from the safety controller 300 to the safety I / O slave station through the I / O link safety master station control unit 330 and the I / O link 400. Also, the safety input signal and the safety output signal are output to the PLC 100 via the I / O link 400. The PLC 100 determines the normal output signal based on the normal input signal and the safety output signal. Further, the PLC 100 outputs the received safety input signal and safety output signal to the safety input / output status memory 270. In other words, the safety input / output status memory 270 records the same signal information as the safety input / output memory 320.

[0025] The monitor device 200 is a device that presents the states of signals input to and output from the PLC 100 and the safety controller 300 to the operator. This monitor device 200 includes a monitor controller 205, a display 280, and an input device 290.

[0026] Physically, the monitor controller 205 is a computer having a processor and a memory. This monitor controller 205 may be a separate computer independent of the PLC 100. Also, in another form, the monitor controller 205 may be the same computer as the PLC 100. That is, one computer may function as both the PLC 100 and the monitor controller 205.

[0027] Functionally, the monitor controller 205 can be broadly classified into a label / comment table 210, a label similarity determination unit 220, a normal input / output state memory 230, an input / output state change determination unit 240, a screen control unit 250, an operation input control unit 260, and a safety input / output state memory 270. As described above, the normal input / output state memory 230 and the safety input / output state memory 270 store mirror copies of the data stored in the normal input / output memory 120 and the safety input / output memory 320, respectively. Therefore, the normal input / output state memory 230 stores the values of the normal input signals and the normal output signals, and the safety input / output state memory 270 stores the values of the safety input signals and the safety output signals.

[0028] The screen control unit 250 controls the display of the display 280. Also, the operation input control unit 260 receives instructions from the operator via the input device 290. The operator designates the address and bit position of a safety signal (hereinafter referred to as the "target signal") to be monitored via the input device 290.

[0029] The label / comment table 210 is a table that records the addresses, bit positions, labels, and comments of a plurality of safety signals. The label is the name of the safety signal, and the comment is the explanatory text of the safety signal. The labels and comments of the safety signals are predefined by the system designer in advance. Usually, similar labels and comments are set for redundant safety signals. For example, if there are two safety input signals indicating that the panel emergency stop button has been pressed, one signal is labeled "ipEMSTP_B" and the other signal is labeled "ipEMSTP1B_B". Also, one signal is set with a comment of "Panel emergency stop_B", and the other signal is set with a comment of "Panel emergency stop1B_B". Therefore, it can be said that safety signals with similar labels and comments are likely to be redundant signals with respect to each other.

[0030] When the label similarity determination unit 220 receives the safety signal to be monitored, that is, the address and bit position of the target signal, from the operation input control unit 260, it refers to the label / comment table 210 to acquire the label and comment of the target signal. Also, the label similarity determination unit 220 refers to the label / comment table 210 to calculate the similarity (hereinafter referred to as "label similarity") between the label of the target signal and the labels of other safety signals. Then, the label similarity determination unit 220 extracts, as candidates for signals redundant with the target signal, that is, redundant candidate signals, those safety signals whose label similarity is a certain value or more.

[0031] Here, the form of calculating the label similarity is not particularly limited. For example, the similarity may be calculated based on the Levenshtein distance between the label character strings. The Levenshtein distance is the minimum number of procedures required to convert one character string into another by inserting, deleting, or replacing characters. It may be determined that the smaller this Levenshtein distance is, the higher the similarity. Also, as another form, the similarity may be calculated based on the number of matching characters from the beginning of the label, the number of matching characters in the entire label, and the like.

[0032] If a redundant candidate signal can be extracted, then subsequently, the label similarity determination unit 220 determines the display order of this redundant candidate signal. Specifically, the label similarity determination unit 220 sets a higher display order for a higher label similarity. Also, when there are multiple redundant candidate signals with equal label similarities, the label similarity determination unit 220 also calculates the similarity between the comment of the redundant candidate signal and the comment of the target signal (hereinafter referred to as "comment similarity"). Then, the label similarity determination unit 220 sets a higher display order for a higher comment similarity. In other words, the label similarity determination unit 220 sorts the extracted multiple redundant candidate signals using the label similarity as the first sort key and the comment similarity as the second sort key, and determines the order of this sort as the display order.

[0033] Here, as described above, signals that have been made redundant often have similar labels and comments set for each other. Therefore, the display order obtained by sorting the redundant candidate signals by label similarity and comment similarity can be said to be the order in which it is highly likely that they are redundant with the target signal. The label similarity determination unit 220 outputs information on the target signal and the redundant candidate signal (for example, address, bit position, display order, etc.) to the input / output state change determination unit 240.

[0034] The input / output state change determination unit 240 refers to the safety input / output state memory 270 to acquire the state of the target signal and the state of the redundant candidate signal. Also, the input / output state change determination unit 240 periodically outputs the ON / OFF state, display order, address, bit position, etc. of the target signal and the redundant candidate signal to the screen control unit 250.

[0035] In addition, the input / output state change determination unit 240 refers to the safety input / output state memory 270 and monitors the presence or absence of a redundant candidate signal that changes state at substantially the same timing as the target signal. That is, the input / output state change determination unit 240 monitors the presence or absence of a redundant candidate signal that switches from ON to OFF and from OFF to ON at substantially the same timing as the target signal. Here, "substantially the same timing" means a timing at which the difference in the timing of the state change falls within a predetermined allowable range, and the allowable range is, for example, on the order of the time difference caused by variations in the assumed signal transmission speed.

[0036] Here, a plurality of signals that are redundant with each other change state at substantially the same timing. Therefore, it can be said that a redundant candidate signal that changes state at substantially the same timing as the target signal is highly likely to be redundant with the target signal. Thus, when the input / output state change determination unit 240 finds a redundant candidate signal that changes state at substantially the same timing as the target signal, it raises the display order of this redundant candidate signal that changes state at substantially the same timing above the display order of other redundant candidate signals.

[0037] As described above, the screen control unit 250 controls the display of the display 280. When the screen control unit 250 receives the states and display orders of the target signal and redundant candidate signals from the input / output state change determination unit 240, it displays them on the screen in list form. At this time, when there are a plurality of redundant candidate signals, the plurality of redundant candidate signals are arranged and displayed in descending order of display order, in other words, in descending order of the likelihood of being redundant with the target signal.

[0038] Next, the screen displayed on the display 280 will be described with reference to FIGS. 2 to 4. FIG. 2 is a diagram showing an example of changes in a plurality of safety signals. FIG. 3 is a diagram showing an example of the display screen at time t1 in FIG. 2. FIG. 4 is a diagram showing an example of the display screen at time t4 in FIG. 2.

[0039] As shown in FIG. 2, consider the case where two safety signals, "ipEMSTP_B" and "ipEMSTP1B_B", change their states at substantially the same timing from time t2 to t3. In this case, at the timing of time t1, the screen shown in FIG. 3 is displayed on the display 280. As shown in FIG. 3, information on a plurality of safety signals is displayed in the list format on the display 280. Here, the list has six columns, namely, an address display column 501, a bit display column 502, an attribute display column 503, an ON / OFF state display column 504, a label display column 505, and a comment display column 506, in order from the left. Also, a search button 508 is provided at the lower left of the list. The safety signal selected by the operator is highlighted.

[0040] When the operator wants to specify a target signal, the operator selects the target signal from among the plurality of safety signals displayed in the list and presses the search button 508. When the target signal is specified, the target signal is displayed at the top of the list. In the example of FIG. 3, the safety signal "ipEMSTP_B" generated when the "panel emergency stop button" is pressed is specified as the target signal. Also, if the target signal is specified, candidates for signals that are redundant with this target signal, that is, redundant candidate signals, are displayed in the display order determined by the input / output state change determination unit 240.

[0041] Here, at the timing of time t1, no signal that changes its state at substantially the same timing as the target signal "ipEMSTP_B" is found. Therefore, at the timing of time t1, as shown in FIG. 3, the target signal "ipEMSTP_B" is displayed at the top, and then a plurality of redundant candidate signals are displayed in descending order of label similarity.

[0042] Thereafter, if it is detected that the target signal "ipEMSTP_B" and the redundancy candidate signal "ipEMSTP1B_B" change states at substantially the same timing from time t2 to time t3, the display screen changes to FIG. 4. That is, the display order of "ipEMSTP1B_B" that changes states at substantially the same timing is raised, and "ipEMSTP1B_B" is displayed next to the target signal "ipEMSTP_B". After "ipEMSTP1B_B", other redundancy candidate signals are displayed in descending order of label similarity.

[0043] As is clear from the above description, in this example, the target signal and the signal highly likely to be redundant, that is, the redundancy candidate signal, are extracted and displayed on the display 280 together with the target signal. Further, when there are a plurality of redundancy candidate signals, they are displayed in descending order of the likelihood of being redundant with the target signal. With such a configuration, if the operator designates the target signal, thereafter, the operator can easily grasp the states of the target signal and the signal highly likely to be redundant without going through complicated procedures.

[0044] Note that the configuration described so far is an example, and at least one or more candidates of the target signal and the redundant signal are extracted as the redundancy candidate signal, and as long as the state of the target signal and the state of one or more redundancy candidate signals are displayed on the same screen of the display 280, other configurations may be changed. For example, in this example, the target signal and the signal with a label similar by a certain degree or more are extracted as the redundancy candidate signal, but the redundancy candidate signal may be extracted based on other elements. For example, instead of the label, a signal with a comment similar to the target signal by a certain degree or more may be extracted as the redundancy candidate signal. Also, a signal similar to the target signal in both the label and the comment may be extracted as the redundancy candidate signal. Further, without calculating the similarity of the label and the comment, only a signal that changes states at substantially the same timing as the target signal may be extracted as the redundancy candidate signal.

[0045] Also, in this example, although a redundant candidate signal that changes state at substantially the same timing as the target signal is identified, the history of this identification may be stored in the memory as a change history and used for determining the display order. This will be described with reference to FIG. 5. FIG. 5 is a block diagram of a controller system of another example.

[0046] The monitor controller 205 shown in FIG. 5 further has a change history memory 295. When the input / output state change determination unit 240 finds a redundant candidate signal that changes state at substantially the same timing as the target signal, it records the identification information of the signal and the timing at which the state changed in the change history memory 295. The input / output state change determination unit 240 may determine the display order of the redundant candidate signals based on the information recorded in the change history memory 295.

[0047] Specifically, when a target signal is specified by the operator, if there is a signal recorded in the change history memory 295 that has changed state at substantially the same timing as the target signal in the past, the display order of this recorded signal may be made higher than that of other redundant candidate signals. For example, assume that signal A is newly specified as the target signal in a state where the change history memory 295 stores records that signal A has changed state twice at substantially the same timing as signal B in the past. When a new target signal is specified, the input / output state change determination unit 240 refers to the change history memory 295 and checks for the presence of a signal that has changed state at substantially the same timing as the target signal A in the past. In this example, signal B has changed state at substantially the same timing as the target signal A in the past. In this case, the input / output state change determination unit 240 makes the display order of signal B higher than the display orders of other redundant candidate signals.

[0048] Also, when a signal that changes state at substantially the same timing as the target signal is newly found, it may be determined based on the past change history whether the signal is a redundant signal. For example, in a state where the change history memory 295 stores a record that signal A has changed state twice at substantially the same timing as signal B in the past, if a new target signal A changes state at substantially the same timing as signal B and signal C. In this case, the input / output state change determination unit 240 refers to the past state change history recorded in the change history memory 295 and determines which of signal B and signal C is more likely to be redundant with the target signal A. In the case of this example, although the target signal A has changed state at substantially the same timing as signal B in the past, it has never changed state at substantially the same timing as signal C. Therefore, in this case, the input / output state change determination unit 240 determines that signal B is more likely to be redundant with the target signal A than signal C, and sets the display order of signal B above the display order of signal C.

Explanation of Signs

[0049] 100 PLC, 110 PLC command execution unit, 120 normal input / output memory, 130 I / O link normal master station control unit, 200 monitor device, 205 monitor controller, 210 label / comment table, 220 label similarity determination unit, 230 normal input / output state memory, 240 input / output state change determination unit, 250 screen control unit, 260 operation input control unit, 270 safety input / output state memory, 280 display, 290 input device, 295 change history memory, 300 safety controller, 310 safety logic execution unit, 320 safety input / output memory, 330 I / O link safety master station control unit, 400 I / O link, 501 address display column, 502 bit display column, 503 attribute display column, 504 ON / OFF state display column, 505 label display column, 506 comment display column, 508 search button.

Claims

1. A monitor device for a safety controller, comprising: a monitor controller configured to cause a display to display a state of a safety signal that is an input / output signal of the safety controller; when an operator designates a specific one of the safety signals as a signal to be monitored, the monitor controller extracts one or more candidates of safety signals that are redundant with the signal to be monitored as redundant candidate signals, and causes the display to display the state of the signal to be monitored and the states of the one or more redundant candidate signals on the same screen; the monitor controller extracts, as the redundant candidate signals, safety signals in which at least one of a label and a comment of the signal is substantially similar to the signal to be monitored; A monitor device characterized by the above.

2. The monitor device according to claim 1, wherein: when a plurality of the redundant candidate signals are extracted, the monitor controller causes the display to display the states of the plurality of redundant candidate signals in a list format arranged in descending order of the likelihood of being redundant with the signal to be monitored; the monitor controller determines that a signal having at least one of a label and a comment with a high similarity to the signal to be monitored among the redundant candidate signals is more likely to be redundant with the signal to be monitored than other signals; A monitor device characterized by the above.

3. The monitor device according to claim 2, wherein: the monitor controller further monitors timings of state changes of the signal to be monitored and the redundant candidate signals, and determines that a signal that changes state at substantially the same timing as the signal to be monitored among the redundant candidate signals is more likely to be redundant with the signal to be monitored than other signals; A monitor device characterized by the above.

4. The monitor device according to claim 1, wherein: when a plurality of the redundant candidate signals are extracted, the monitor controller causes the display to display the states of the plurality of redundant candidate signals in a list format arranged in descending order of the likelihood of being redundant with the signal to be monitored; the monitor controller monitors timings of state changes of the signal to be monitored and the redundant candidate signals, and determines that a signal that changes state at substantially the same timing as the signal to be monitored among the redundant candidate signals is more likely to be redundant with the signal to be monitored than other signals; A monitor device characterized by the above.

5. A monitor device for a safety controller, comprising: A monitor controller is provided that causes a display to display the state of a safety signal that is an input / output signal of the safety controller. When an operator designates a specific one of the safety signals as a signal to be monitored, the monitor controller extracts one or more candidates of safety signals that are redundant with the signal to be monitored as redundant candidate signals, and causes the state of the signal to be monitored and the states of the one or more redundant candidate signals to be displayed on the same screen of the display. The monitor controller extracts, as the redundant candidate signals, the signal to be monitored and one or more of the safety signals that change state at substantially the same timing. A monitor device characterized by the above.

Images