Gateway device, relay method, and relay program

Abstract

A gateway device (10) relays communication between an input / output device (20) and a control device (30). Upon receiving from the control device (30) non-safe output, which is an output signal for controlling the control state of the input / output device (20) to a non-safe state, the gateway device (10) determines whether safe input, which is an input signal for controlling the control state to a safe state, was received from the input / output device (20) during a storage period before the reception. When it is determined that the safe input has been received, the gateway device (10) does not relay the non-safe output to the input / output device (20), and instead transmits to the input / output device (20) safe output, which is an output signal for controlling the control state of the input / output device (20) to the safe state.

Description

Gateway device, relay method, and relay program

[0001] The present disclosure relates to a gateway device that relays communication between an input device, an output device, and a control device that controls the output device based on an input signal from the input device.

[0002] With the recent development of cloud computing, methods for utilizing the cloud for control are being researched. In the manufacturing industry, controlling on-site equipment using a virtual PLC on the cloud can reduce the amount of work required for operation and management. PLC stands for Programmable Logic Controller.

[0003] When implementing cloud-based control of on-site equipment, safety control must be considered. Safety control refers to control related to the protection of on-site workers and the prevention of accidents. Safety control is required to have characteristics that achieve fail-safe, for example. Guaranteeing response time is important for such safety control. In particular, the maximum required response time for transitioning from a state in which on-site equipment may pose a risk to workers to a safe state is clearly set based on factors such as the safety distance ensured by the on-site equipment. With cloud-based control, the transmission delay during communication over the public network between the on-site and the cloud is longer than the transmission delay in control completed within the on-site environment, making it difficult to meet the required response time.

[0004] Patent Document 1 describes a method of performing some processing on-site in order to meet the required response time. In the system configuration of the method in Patent Document 1, multiple networks are each connected to a higher-level control device via a gateway device. In this configuration, when the result of control based on input from an input / output device in a network is output to an input / output device in the same network, the gateway device performs the control on behalf of the higher-level control device.

[0005] In Patent Document 1, to compensate for the drawback of requiring a gateway device at the site in addition to a higher-level control device, a technique is introduced to reduce the processing required by the gateway device and reduce the number of gateway devices required. Specifically, only a portion of the control program that is subject to safety response time constraints is implemented in the gateway device. The entire system, combining the control device and gateway device, constitutes a vertically distributed processing system that satisfies safety requirements. Control programs using a control method called sequence control in FA generally have a control structure in which the behavior for the same input changes depending on the control context. FA stands for Factory Automation. Therefore, simply extracting a portion of the control program results in control that is inappropriate for the context, failing to meet safety requirements. Therefore, in Patent Document 1, the gateway device identifies the control state of the control device from the relayed data, ensuring correct control.

[0006] International Publication No. 2022 / 239116

[0007] In the method of Patent Document 1, there is a time lag before the control state of the gateway device is synchronized with the control state of the control device. This time lag can cause the gateway device to miss control that it should perform on its behalf. As a result, a situation can arise in which the required response time cannot be met. An object of the present disclosure is to enable the required response time in safety control to be met.

[0008] The gateway device according to the present disclosure is a gateway device that relays communication between an input device and an output device, and a control device that controls the output device based on an input signal from the input device, and includes an input determination unit that, when receiving from the control device a non-safety output that is an output signal that controls the control state of the output device to an unsafe state, determines whether or not a safety input that is an input signal that controls the control state to a safe state has been received from the input device during a storage period before the reception, and an activation control unit that, when it is determined by the input determination unit that the safety input has been received, does not relay the non-safety output to the output device, and transmits to the output device a safety output that is an output signal that controls the control state of the output device to a safe state.

[0009] In the present disclosure, when a gateway device receives a non-safety output from a control device, if the gateway device has received a safety input from an input device during the storage period before the reception, the gateway device does not relay the non-safety output to the output device and transmits a safety output to the output device. This makes it possible to meet the required response time for safety control even if there is a time lag until the control state of the gateway device is synchronized with the control state of the control device.

[0010] 1 is an explanatory diagram of a normal system in the prior art. 2 is an explanatory diagram of an abnormal system in the prior art. 3 is a configuration diagram of a control system 100 according to a first embodiment. 4 is a hardware configuration diagram of a gateway device 10 according to the first embodiment. 5 is a functional configuration diagram of the gateway device 10 according to the first embodiment. 6 is a flowchart of processing of the gateway device 10 according to the first embodiment. 7 is an explanatory diagram of data relay processing according to the first embodiment. 8 is an explanatory diagram of a state monitoring unit 114 according to the first embodiment. 9 is an explanatory diagram of input determination processing according to the first embodiment. 10 is an explanatory diagram of the effect of the gateway device 10 according to the first embodiment. 11 is a hardware configuration diagram of an engineering tool 40 according to a second embodiment. 12 is a functional configuration diagram of the engineering tool 40 according to the second embodiment. 13 is an explanatory diagram of basic state transitions of the gateway device 10 according to the second embodiment. 14 is a diagram showing an example of state transitions of a control device 30 according to the second embodiment. 15 is a diagram showing an example of state transitions of a control device 30 according to the second embodiment in a table format. 16 is a diagram showing an example of state transitions of a gateway device 10 according to the second embodiment in a table format.

[0011] First Embodiment. The following explanation assumes the following: In the first embodiment, a control device controls an input / output device using control logic. The input / output device operates the equipment to be controlled in accordance with the control of the control device. The control logic is configured by combining safety logic defined by standards such as PLCopen, and has a safe state and an unsafe state. The unsafe state is a state in which the controlled equipment may pose a risk to humans. The unsafe state is, for example, a state in which the equipment is operating. The safe state is a state that is not an unsafe state. The safe state is, for example, a state in which the equipment is stopped. Furthermore, based on the principle that equipment should be started as soon as safety can be confirmed, the initial state is a safe state. The control logic outputs an output signal corresponding to the destination state based on the input signal from the input / output device and the current state, according to a state transition table. An input signal that transitions from a safe state to an unsafe state is called an unsafe input. An input signal that transitions from an unsafe state to a safe state is called a safety input. An output signal that is output when the control logic is in a safe state is called a safe output. An output signal that is output when the control logic is in an unsafe state is called an unsafe output.

[0012] ***Explanation of the Situation*** The operation of the safety shutdown according to the method of Patent Document 1 will be explained by classifying it into a normal system in which the gateway device can take over control as expected, and an abnormal system in which problems may arise.

[0013] The normal system will be described with reference to Figure 1. Figure 1 is a timing chart with the horizontal axis being the time axis, and shows the flow of input and output relays and the propagation of state transitions between each device. The initial state is a safe state. At this time, an unsafe input is sent from the input / output device. The gateway device receives the unsafe input. The gateway device then relays the unsafe input to the control device. Upon receiving the unsafe input, the control device switches the control state from a safe state to an unsafe state. The control device then transmits an unsafe output to the gateway device. Upon receiving the unsafe output, the gateway device switches the control state from a safe state to an unsafe state. The gateway device then relays the unsafe output to the input / output device. The input / output device receives the unsafe output. This causes the system to enter an unsafe state, and for example, equipment starts operating.

[0014] A safety input is then sent from the input / output device. The gateway device receives the safety input. The gateway device then switches the control state from an unsafe state to a safe state. The gateway device then relays the safety input to the control device and sends a safety output to the input / output device on behalf of the control device. The input / output device receives the safety output. This puts the device into a safe state, and for example, the equipment stops operating. When the control device receives the safety input, it switches the control state from an unsafe state to a safe state. The control device then sends a safety output to the gateway device. When the gateway device receives the safety output, it relays the safety output to the input / output device. The input / output device receives the safety output, but is already in a safe state. Therefore, for example, the equipment remains stopped.

[0015] As described above, when the gateway device receives a safety input in an unsafe state, it transmits a safety output to the input / output device on behalf of the control device. In other words, when a safety input is transmitted, a safety output is immediately generated from the gateway device. This satisfies the required response time for safety control.

[0016] An abnormal system will be described with reference to Figure 2. The initial state is a safe state. At this time, an unsafe input is sent from the input / output device. The gateway device receives the unsafe input. This time is defined as time t0. The gateway device then relays the unsafe input to the control device. Upon receiving the unsafe input, the control device switches the control state from a safe state to an unsafe state. The control device then transmits an unsafe output to the gateway device. The gateway device receives the unsafe output. This time is defined as time t2. The gateway device then switches the control state from a safe state to an unsafe state. The gateway device then relays the unsafe output to the input / output device. The input / output device receives the unsafe output. This causes the system to enter an unsafe state, and for example, the equipment starts operating.

[0017] Between time t0 and time t2, a safety input is transmitted from the input / output device. The gateway device receives the safety input. This time is designated time t1. The gateway device then relays the safety input to the control device. At time t1, the control state of the gateway device is in a safe state. Therefore, the gateway device does not transmit a safety output to the input / output device on behalf of the control device. This is because there is no need to shut down the equipment in an emergency if the state is safe. When the control device receives the safety input, it switches the control state from an unsafe state to a safe state. The control device then transmits a safety output to the gateway device. When the gateway device receives the safety output, it switches the control state from an unsafe state to a safe state. The gateway device then relays the safety output to the input / output device. The input / output device receives the safety output. This transitions to a safe state, and the equipment, for example, stops operating. This time is designated time t3.

[0018] In a normal system, when the gateway device receives a safety input, it immediately sends a safety output to the I / O device. However, in an abnormal system, the gateway device receives a safety input at time t1, but the I / O device does not receive a safety output until time t3. This means that the response time in safety control becomes longer. Since the response time must be guaranteed to be the maximum value in all cases, the system response time cannot be guaranteed due to an abnormal system.

[0019] In other words, in order for the gateway device to act on behalf of the control device and transmit a safety output to the input / output device, the control state must be in an unsafe state. However, the gateway device recognizes the state as unsafe at time t2, when it receives the unsafe output. Therefore, if the gateway device receives a safety input between time t0, when it receives the unsafe input, and time t2, when it receives the unsafe output, it will not act on behalf of the control device and transmit a safety output to the input / output device. In other words, a missed control occurs. This is because the transmission time from when the input / output device transmits the input signal to when the gateway device receives the output signal is longer than the transmission time from when the input / output device transmits the input signal to when the gateway device receives the input signal.

[0020] ***Description of Configuration*** The configuration of a control system 100 according to the first embodiment will be described with reference to Fig. 3. The control system 100 includes a gateway device 10, a plurality of input / output devices 20, and a control device 30. The gateway device 10 and each input / output device 20 are connected via a transmission path 91. The gateway device 10 and the control device 30 are connected via a transmission path 92. Here, the transmission path 91 is assumed to be a network such as a LAN within a facility such as a factory. LAN is an abbreviation for Local Area Network. The transmission path 92 is assumed to be a public network.

[0021] The gateway device 10 relays communication between the input / output device 20 and the control device 30. The input / output device 20 is divided into an input device 21 and an output device 22. The input device 21 is a device that transmits input from a connected sensor, switch, etc. as an input signal to a higher-level device. The output device 22 is a device that outputs an operation corresponding to an output signal received from the higher-level device to an actuator, etc. connected downstream. The control device 30 controls the output device 22 by transmitting an output signal to the output device 22 based on the input signal from the input device 21 and the control state. This causes the actuator, etc. connected to the output device 22 to be operated.

[0022] The hardware configuration of the gateway device 10 according to the first embodiment will be described with reference to FIG. 4 . The gateway device 10 is a computer. The gateway device 10 includes hardware such as a CPU 11, a memory 12, a non-volatile memory 13, and a bus 14. CPU stands for Central Processing Unit. The non-volatile memory 13 stores programs and parameters that implement the functions of the functional components of the gateway device 10. The CPU 11 loads the programs and parameters stored in the non-volatile memory 13 into the memory 12 via the bus 14. The CPU 11 executes the programs loaded into the memory 12. This realizes the functions of the gateway device 10.

[0023] These pieces of hardware have been developed in accordance with the requirements of safety-related systems. These pieces of hardware may have a configuration in which some or all of the components are duplicated to satisfy a required safety integrity level (SIL). SIL stands for Safety Integrity Level. Note that the gateway device 10 may also be duplicated.

[0024] The gateway device 10 includes a communication method 1 port 15 and a communication method 2 port 16 for communication with other devices, and a setting port 17 for setting using an engineering tool. In the first embodiment, the communication method 1 port is a port for communication with the control device 30. In the first embodiment, the communication method 2 port is a port for communication with the input / output device 20.

[0025] The functional configuration of the gateway device 10 according to the first embodiment will be described with reference to Fig. 5. The gateway device 10 includes, as functional components, a data relay unit 111, an activation control unit 112, an input determination unit 113, and a status monitoring unit 114. The data relay unit 111 has a function of relaying communication between the input / output device 20 and the control device 30. The input determination unit 113, the activation control unit 112, and the status monitoring unit 114 have functions for satisfying a required response time in safety control.

[0026] ***Description of Operation*** The operation of the gateway device 10 according to the first embodiment will be described with reference to Figures 6 to 9. The operation procedure of the gateway device 10 according to the first embodiment corresponds to the relay method according to the first embodiment. Furthermore, the program that realizes the operation of the gateway device 10 according to the first embodiment corresponds to the relay program according to the first embodiment.

[0027] The processing of the gateway device 10 according to the first embodiment will be described with reference to Fig. 6. (Step S1: Data Relay Processing) When the input / output device 20 is started, the state transitions from the initial safe state in response to an input signal. At this time, as shown in Fig. 7, in the gateway device 10, the data relay unit 111 relays communication between the input / output device 20 and the control device 30. That is, the data relay unit 111 transmits an input signal received from the input device 21 to the control device 30 via a shared memory for input signals, and transmits an output signal received from the control device 30 to the output device 22 via a shared memory for output signals.

[0028] At this time, as shown in Fig. 7, the activation control unit 112 stores the input signal received from the input / output device 20 in an input signal buffer. The input signal buffer is set in, for example, the memory 12. Here, the period during which the input signal is stored in the input signal buffer is called the storage period. The storage period is equal to or longer than the period from when the input signal is received from the input device 21 to when the output signal that controls the output device 22 based on the input signal is received from the control device 30. The activation control unit 112 sequentially deletes input signals that have passed the storage period from the input signal buffer.

[0029] The activation control unit 112 does not need to save input signals when the input / output device 20 is in an unsafe state. Here, as shown in Fig. 8, the state monitoring unit 114 manages the state of the input / output device 20 by monitoring the input signals. Therefore, the activation control unit 112 may avoid saving input signals when the state of the input / output device 20 managed by the state monitoring unit 114 is in an unsafe state. Furthermore, the activation control unit 112 does not need to save input signals that are not used by the input determination unit 113, which will be described later.

[0030] During the execution of the process of step S1, an unsafety input is transmitted from the input device 21. Then, the data relay unit 111 relays the unsafety input to the control device 30. The control device 30 executes control logic and transmits an unsafety output to the gateway device 10. When the data relay unit 111 receives this unsafety output, the process of step S2 is executed.

[0031] (Step S2: Input Determination Process) As shown in FIG. 9 , the input determination unit 113 determines whether or not the input signals stored in the input signal buffer include a safety input. That is, the input determination unit 113 determines whether or not a safety input has been received from the input device 21 during the storage period before the reception of an unsafe output. In other words, the input determination unit 113 determines whether or not a safety input has been transmitted from the input device 21 after the input device 21 transmitted an unsafe input. This corresponds to the input determination unit 113 determining whether or not the current state will become a safe state when the input signals stored in the input signal buffer are applied in chronological order. If a safety input is included, the input determination unit 113 proceeds to step S3. On the other hand, if a safety input is not included, the input determination unit 113 proceeds to step S4.

[0032] (Step S3: Relay Suspension Processing) The activation control unit 112 does not relay the unsafe output to the output device 22, but transmits a safe output to the output device 22. In practice, the activation control unit 112 may instruct the data relay unit 111 to transmit a safe output, rather than transmitting the safe output. This makes it possible to eliminate the influence of the public network on the response time of the protective operation, even if a safe input occurs immediately after an unsafe input. The activation control unit 112 stops relaying the unsafe output received from the control device 30 to the output device 22 and continues transmitting the safe output until it receives a safe output from the control device 30. When the activation control unit 112 receives the safe output from the control device 30, it returns the processing to step S1.

[0033] (Step S4: Relay continuation processing) The activation control unit 112 transmits the unsafe output to the output device 22. That is, the activation control unit 112 relays the unsafe output. Note that in practice, the activation control unit 112 may not transmit the unsafe output, but may instead instruct the data relay unit 111 to transmit the unsafe output. Then, the activation control unit 112 returns the processing to step S1.

[0034] ***Effects of First Embodiment*** As described above, when the gateway device 10 according to the first embodiment receives a non-safety output from the control device 30, if a safety input has been received from the input device 21 during the storage period before the reception, the gateway device 10 does not relay the non-safety output to the output device 22, but transmits a safety output to the output device 22. This makes it possible to meet the required response time in safety control even if there is a time lag until the control state of the gateway device 10 is synchronized with the control state of the control device 30.

[0035] The effects of the gateway device 10 according to the first embodiment will be described with reference to FIG. 10 . The initial state is a safe state. At this time, an unsafe input is transmitted from the input / output device 20. The gateway device 10 receives the unsafe input. The gateway device 10 then relays the unsafe input to the control device. Upon receiving the unsafe input, the control device 30 switches the control state from the safe state to the unsafe state. The control device 30 then transmits an unsafe output to the gateway device 10. The flow up to this point is the same as that of the abnormal system described with reference to FIG. 2 . Before the gateway device 10 receives the safe output, the input / output device 20 transmits a safety input. The gateway device 10 then receives the safety input. The gateway device then relays the safety input to the control device. Thereafter, the gateway device 10 receives the unsafe output. The gateway device 10 then determines whether the input signal stored in the input signal buffer includes a safe input (step S2 in FIG. 6 ). In this case, a safe input is included. Therefore, the gateway device 10 does not relay the non-safety output to the output device 22, but transmits a safe output to the output device 22 (step S3 in FIG. 6). Therefore, the state of the input / output device 20 remains in the safe state, and operation of the equipment is not initiated. The response time is the time from when a safety input is transmitted to when a safety output is transmitted. In other words, the response time is the time from when a safety input is transmitted to when a safe state is realized. In the example of FIG. 10, the safe state is maintained after the safety input is transmitted. Therefore, the response time is essentially zero.

[0036] ***Other Configurations*** <Modification 1> In the first embodiment, each functional component is realized by software. However, in Modification 1, each functional component may be realized by hardware. The differences between Modification 1 and the first embodiment will be described below.

[0037] When each functional component is realized by hardware, the gateway device 10 includes an electronic circuit instead of the CPU 11, the memory 12, and the non-volatile memory 13. The electronic circuit is a dedicated circuit that realizes the functions of each functional component, the memory 12, and the non-volatile memory 13.

[0038] Possible electronic circuits include a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA, an ASIC, and an FPGA. GA stands for Gate Array. ASIC stands for Application Specific Integrated Circuit. FPGA stands for Field-Programmable Gate Array. Each functional component may be realized by a single electronic circuit, or each functional component may be distributed across multiple electronic circuits.

[0039] <Modification 2> As a modification 2, some of the functional components may be realized by hardware, and other functional components may be realized by software.

[0040] The CPU 11, the memory 12, the non-volatile memory 13, and the electronic circuitry are collectively referred to as a processing circuit. In other words, the functions of the respective functional components are realized by the processing circuit.

[0041] Second Embodiment In a second embodiment, a method for generating control logic for the gateway device 10 will be described.

[0042] 6, the gateway device 10 needs to realize a control logic different from that of the control device 30. The control logic realized by the gateway device 10 is generated from a control program executed by the control device 30. The control logic realized by the gateway device 10 can be realized by state transitions.

[0043] The derivation of the control logic to be realized by the gateway device 10 needs to be performed before starting control of the gateway device 10. The control logic to be realized by the gateway device 10 can be realized by adding an automatic derivation function to the engineering tool 40, or by adding to the gateway device 10 a function for calling and using logic that has been derived in advance by the vendor of the gateway device 10 or the engineering tool 40. In the second embodiment, an example will be described in which the engineering tool 40 generates the control logic to be realized by the gateway device 10.

[0044] ***Description of Configuration*** The hardware configuration of the engineering tool 40 according to the second embodiment will be described with reference to FIG. 11 . The engineering tool 40 is a computer. The engineering tool 40 includes hardware such as a CPU 41, a memory 42, a non-volatile memory 43, and a bus 44. The non-volatile memory 43 stores programs and parameters that implement the functions of the functional components of the engineering tool 40. The CPU 41 loads the programs and parameters stored in the non-volatile memory 43 into the memory 42 via the bus 44. The CPU 41 executes the programs loaded into the memory 42. This implements the functions of the engineering tool 40.

[0045] The engineering tool 40 includes a setting port 45 for setting the gateway device 10 or the control device 30 .

[0046] The functional configuration of the engineering tool 40 according to the second embodiment will be described with reference to FIG. 12 . The engineering tool 40 includes, as functional components, a gateway logic generation unit 411, a gateway logic setting unit 412, a control logic generation unit 413, a control logic setting unit 414, and a programming unit 415. The gateway logic generation unit 411 has a function of generating the control logic of the gateway device 10. The gateway logic setting unit 412 has a function of setting the control logic in the gateway device 10. The control logic generation unit 413 has a function of generating the control logic of the control device 30. The control logic setting unit 414 has a function of setting the control logic in the control device 30. The programming unit 415 has a function of supporting the generation of the control logic. Here, the gateway logic generation unit 411 and the gateway logic setting unit 412 will be described.

[0047] ***Description of Operation*** The operation of the engineering tool 40 according to the first embodiment will be described with reference to Figures 13 to 16. The operation procedure of the engineering tool 40 according to the second embodiment corresponds to the logic generation method according to the second embodiment. Furthermore, the program that realizes the operation of the engineering tool 40 according to the second embodiment corresponds to the logic generation program according to the second embodiment.

[0048] With reference to FIG. 13 , a basic state transition of the gateway device 10 according to the second embodiment will be described. The gateway device 10 has the following states: a safe state, an unsafe state, a safe standby state, an inspection standby state, and a unsafe standby state. When an unsafe output is received in the safe state, the state transitions to the unsafe state. When a safe input is received in the unsafe state, the state transitions to the safe standby state. When a safety output is received in the safe standby state, the state transitions to the inspection standby state. When an unsafe output is received in the inspection standby state, the state transitions to the non-safety standby state. When a safety input is present in an input signal buffer (described later) in the non-safety standby state, the state transitions to the safe standby state. When a safety input is not present in an input signal buffer (described later) in the non-safety standby state, the state transitions to the unsafe state.

[0049] The safety standby state is a state in which a non-safety output is not relayed to the output device 22, and a safety output is transmitted to the output device 22. In other words, the safety standby state is a state in which the processing of step S3 in FIG. 6 is being performed. The inspection standby state is a state in which an input signal is stored in an input signal buffer while a non-safety output is monitored. In other words, the inspection standby state is a state in which an input signal is stored in the input signal buffer in step S1 in FIG. 6. The non-safety standby state is a state in which it is determined whether or not to relay a non-safety output to the output device 22. In other words, the non-safety standby state is a state in which the processing of step S2 in FIG. 6 is being performed.

[0050] Specific examples of state transitions of the gateway device 10 according to the first embodiment will be described with reference to FIGS. 14 to 16 . Here, it is assumed that the control logic of the control device 30 is realized by the state transitions shown in FIG. 14 . FIG. 15 shows the state transitions shown in FIG. 14 in a table format. In the state transitions shown in FIG. 14 , when condition 1 is satisfied in safe state 0, which is the initial state, the state transitions to safe state 1. When condition 2 is satisfied in safe state 1, the state transitions to safe state 2. When condition 3 is satisfied in safe state 2, the state transitions to safe state 1. When condition 4 is satisfied in safe state 2, the state transitions to unsafe state 1. In other words, satisfying condition 4 is an unsafe input. When condition 5 is satisfied in unsafe state 1, the state transitions to unsafe state 2. When condition 6 is satisfied in unsafe state 2, the state transitions to unsafe state 1. When condition 7 is satisfied in unsafe state 2, the state transitions to safe state 3. In other words, satisfying condition 7 is a safe input. If condition 8 is met in safe state 3, the state transitions to safe state 2.

[0051] The gateway logic generation unit 411 performs the following steps (1) to (5) in order to generate the state transitions shown in FIG.

[0052] (1) The gateway logic generation unit 411 extracts records whose current state is an unsafe state from the table (see FIG. 15) that shows the control logic of the control device 30. Here, three records of line numbers 5 to 7 in FIG. 15 are extracted and set as records of line numbers 1 to 3 in FIG. 16.

[0053] (2) The gateway logic generation unit 411 adds a record in which the current state is the unsafe standby state, the condition is that there is a safety input in the input signal buffer, and the next state is the safe standby state. Here, the record of line number 4 in FIG. 16 is added. The gateway logic generation unit 411 also adds a line in which the current state is the unsafe standby state, the condition is that there is no safety input in the input signal buffer, and the next state is the unsafe state. Note that if there are multiple unsafe states to transition from the safe state, the gateway logic generation unit 411 adds as many records as there are unsafe states. Here, the record of line number 5 in FIG. 16 is added.

[0054] (3) The gateway logic generation unit 411 adds a record where the current state is an unsafe state, the condition is receiving a safety input, and the next state is a safety standby state. Note that if there are multiple unsafe states that transition to a safe state, the gateway logic generation unit 411 adds as many records as there are unsafe states. In this case, the record of line number 6 in FIG. 16 is added.

[0055] (4) The gateway logic generation unit 411 adds a record in which the current state is a safety standby state, the condition is reception of a safety output, and the next state is an inspection standby state. Here, the record of line number 7 in FIG. 16 is added.

[0056] (5) The gateway logic generation unit 411 adds a record in which the current state is an inspection standby state, the condition is reception of an unsafe output, and the next state is a unsafe standby state. Here, the record of line number 8 in FIG. 16 is added.

[0057] Then, the gateway logic setting unit 412 sets the control logic indicated by the generated state transition in the gateway device 10.

[0058] ***Effects of Second Embodiment*** As described above, the engineering tool 40 according to the second embodiment generates the control logic of the gateway device 10 from the control logic of the control device 30. This makes it possible to easily generate the control logic of the gateway device 10.

[0059] Furthermore, the term "unit" in the above description may be read as a "circuit," "step," "procedure," "process," or "processing circuit."

[0060] The embodiments and modifications of the present disclosure have been described above. Some of these embodiments and modifications may be combined and implemented. Furthermore, one or more of them may be implemented partially. Note that the present disclosure is not limited to the above embodiments and modifications, and various modifications are possible as needed.

[0061] 100 Control system, 10 Gateway device, 11 CPU, 12 Memory, 13 Non-volatile memory, 14 Bus, 15 Communication method 1 port, 16 Communication method 2 port, 17 Setting port, 111 Data relay unit, 112 Activation control unit, 113 Input determination unit, 114 Status monitoring unit, 20 Input / output device, 21 Input device, 22 Output device, 30 Control device, 40 Engineering tool, 41 CPU, 42 Memory, 43 Non-volatile memory, 44 Bus, 45 Setting port, 411 Gateway logic generation unit, 412 Gateway logic setting unit, 413 Control logic generation unit, 414 Control logic setting unit, 415 Programming unit, 91 Transmission path, 92 Transmission path.

Claims

1. a gateway device that relays communication between an input device and an output device, and a control device that controls the output device based on an input signal from the input device; an input determination unit that, when receiving an unsafe output, which is an output signal for controlling a control state of the output device to a unsafe state, from the control device, determines whether or not a safety input, which is an input signal for controlling the control state to a safe state, has been received from the input device during a storage period before the reception of the unsafe output; an activation control unit that, when it is determined by the input determination unit that the safety input is being received, does not relay the unsafe output to the output device, and transmits a safety output, which is an output signal for controlling a control state of the output device to a safe state, to the output device; A gateway device comprising:

2. When the input determination unit determines that the safety input has not been received, the activation control unit transmits an unsafe output, which is an output signal for controlling a control state to an unsafe state, to the output device. The gateway device according to claim 1 .

3. When the input determination unit determines that the safety input is being received, the activation control unit stops relaying the non-safety output received from the control device to the output device until the safety output is received from the control device. The gateway device according to claim 1 .

4. When the activation control unit receives the safety output from the control device, the activation control unit starts relaying the non-safety output received from the control device to the output device. The gateway device according to claim 3.

5. The storage period is a period from when an input signal is received from the input device until when an output signal for controlling the output device based on the input signal is received from the control device. The gateway device according to claim 1 .

6. A relay method for relaying communication between an input device, an output device, and a control device that controls the output device based on an input signal from the input device, When the gateway device receives from the control device an unsafe output, which is an output signal for controlling the control state of the output device to an unsafe state, the gateway device determines whether or not a safety input, which is an input signal for controlling the control state to a safe state, has been received from the input device during a storage period before the reception of the unsafe output, A relay method in which, when it is determined that the gateway device is receiving the safety input, the gateway device does not relay the non-safety output to the output device, and transmits a safety output, which is an output signal that controls the control state of the output device to a safe state, to the output device.

7. a relay program for relaying communication between an input device and an output device, and a control device for controlling the output device based on an input signal from the input device; an input determination unit that, when receiving an unsafe output, which is an output signal for controlling a control state of the output device to a unsafe state, from the control device, determines whether or not a safety input, which is an input signal for controlling the control state to a safe state, has been received from the input device during a storage period before the reception of the unsafe output; an activation control unit that, when it is determined by the input determination unit that the safety input is being received, does not relay the unsafe output to the output device, and transmits a safety output, which is an output signal for controlling a control state of the output device to a safe state, to the output device; A relay program that causes a computer to function as a gateway device that performs the above steps.