阅读说明：本技术 控制系统、控制方法、驱动装置 (Control system, control method, and drive device ) 是由 藤村亮辅 佐藤文明 铃木悠司 神保隆一 松上雅一 田中裕 于 2019-10-28 设计创作，主要内容包括：使安全功能中的有效或无效的设定变得容易。控制系统(1)包括：安全驱动器(300),具有运动安全功能；以及标准控制器(100),在连接于现场网络(2)的装置间管理数据的交换,标准控制器(100)在现场网络(2)中的连接建立时,将SRA参数(60)经由现场网络(2)而发送至安全驱动器(300),在SRA参数(60)中,包含指定信息,所述指定信息用于关于运动安全功能分别指定有效或无效,安全驱动器(300)使由指定信息指定为无效的特定的运动安全功能无效化。(Setting of validity or invalidity in the security function is facilitated. The control system (1) comprises: a safety driver (300) having a motion safety function; and a standard controller (100) that manages data exchange between devices connected to the field network (2), wherein the standard controller (100) transmits, when a connection is established in the field network (2), SRA parameters (60) to the security driver (300) via the field network (2), the SRA parameters (60) including designation information for designating each of the motion security functions as valid or invalid, and the security driver (300) invalidates a specific motion security function designated as invalid by the designation information.)

1. A control system, comprising:

a drive device connected to a network, having at least one safety function, and driving the motor; and

a controller that manages data exchange between devices including the drive devices connected to the network,

the controller transmits a parameter related to setting of the drive device to the drive device via the network when a connection in the network is established,

the parameter includes designation information for designating validity or invalidity with respect to the at least one security function,

the drive device invalidates a specific security function specified as invalid by the specification information included in the parameter, among the at least one or more security functions.

2. The control system of claim 1, wherein the Parameter is a Safety-related Application Parameter (Safety-related Application Parameter).

3. The control system according to claim 1 or 2, wherein the specification information contains information for specifying validity or invalidity, respectively, with respect to the at least one or more safety functions, by a bit string in which bits corresponding to the at least one or more safety functions, respectively, are arranged.

4. The control system according to any one of claims 1 to 3, comprising:

a support device for supporting the setting related to the at least one safety function,

the support apparatus provides a user interface for setting the designation information.

5. The control system according to claim 4, wherein the support device prohibits use of a variable referred to in a program related to the specific safety function in response to a case where the specific safety function of the at least one or more safety functions is specified to be invalid.

6. The control system according to claim 5, wherein the support means notifies prohibition of use of the variable.

7. The control system of any one of claims 1 to 6, comprising:

a second controller that transmits a safety command related to an operation of the at least one safety function to the drive device,

the security instruction includes second specifying information for specifying whether the at least one security function is valid or invalid, respectively,

the drive device activates or deactivates the at least one safety function based on the designation information included in the parameter and the second designation information included in the safety command.

8. A control method, which is a control method in a control system,

the control system includes:

a drive device connected to a network, having at least one safety function, and driving the motor; and

a controller that manages data exchange between devices including the drive devices connected to the network,

the control method comprises the following steps:

transmitting, by the controller, a parameter including designation information for designating validity or invalidity of the at least one safety function, respectively, to the drive device via the network when a connection in the network is established; and

and invalidating, by the drive device, a specific security function specified as invalid by the specification information included in the parameter, among the at least one or more security functions.

9. A drive device connected to a network, having at least one safety function and driving a motor, wherein

Managing the exchange of data between the devices comprising said driving devices connected to said network by a controller,

the driving device includes:

a receiving unit configured to receive, from the controller via the network, a parameter including designation information for designating validity or invalidity of each of the at least one security function when a connection is established in the network; and

and an invalidation unit that invalidates a specific security function specified as invalid by the specification information included in the parameter, among the at least one or more security functions.

Technical Field

The present invention relates to a control system, a control method in the control system, and a drive device included in the control system.

Background

In most manufacturing sites, introduction of security systems (security systems) is being advanced for safe use of equipment or machinery. The safety system is used for providing safety functions conforming to international specifications and comprises safety components (safety components) such as a safety controller, a safety sensor, a safety switch and a safety relay.

For the safety system, it is required to provide a safety function also to a driving device that drives a servo motor or the like for driving a device or a machine. In the security system, as a network for exchanging data, Ethernet Control Automation Technology (EtherCAT (registered trademark)) is used, and non-patent document 1 discloses several regulations related to security functions in the specifications of the Ethernet Control Automation Technology Group (ETG), which is an organization related to EtherCAT.

Documents of the prior art

Non-patent document

Non-patent document 1: safety Drive configuration file PDS (SR) Document ETG.6100.2S (R) V1.2.0(Safety Drive Profile general Safety Drive Profile for adjustable speed electric Drive system for Safety related applications ETG.6100.2S (R) Document ETG.6100.2S (R) V1.2.0

Disclosure of Invention

Problems to be solved by the invention

According to the provision disclosed in non-patent document 1, the settings are fixed in advance for all safety functions to be executed by the drive device so as to be effective at the time of default (default). More specifically, in the specification information for specifying validity or invalidity to the security function, all the flags assigned to each bit of the first byte are fixed as flags indicating validity.

However, in actual use, it is necessary to change the setting of the security function to be enabled/disabled in accordance with the work content in a process so that the security function is enabled in a certain process and disabled in another process. In this case, the user needs to prepare a separate program for changing the valid/invalid setting of the security function from the default state, which may increase the amount of work. In addition, since the source code must be described in the programming operation, there is a possibility that the user may unintentionally describe the contents of the erroneous setting. Further, when a plurality of driving devices are provided in the system, such a program must be created for all the driving devices, which causes a problem that the workload becomes enormous. In addition, when a program is separately prepared to disable the safety function, the number of programs to be executed increases, and the control cycle in the system may deteriorate to cause performance degradation.

An object of the present invention is to solve the above-described problems, and to facilitate setting of validity or invalidity in a security function.

Means for solving the problems

According to an example of the present disclosure, a control system is provided. The control system includes: a drive device connected to a network, having at least one safety function, and driving the motor; and a controller that manages data exchange between devices including the drive devices connected to the network. The controller transmits a parameter related to setting of a drive device to the drive device via a network when a connection in the network is established. In the parameter, specification information for specifying validity or invalidity, respectively, with respect to at least one or more security functions is included. The drive device invalidates a specific security function specified as invalid by the specification information included in the parameter, among the at least one security function.

According to the present disclosure, the user specifies the intention that the specific security function is disabled by the parameter, and thus, when a connection is established in the network, the specific security function can be disabled for the drive device. Further, since the user can invalidate the specific security function by transmitting the parameter to the drive device via the network, the execution performance of the system is not degraded as compared with the case where a program separately prepared for invalidating the security function is executed. This makes it possible to easily set the security function to be valid or invalid.

In the disclosure, the Parameter is a security Related application sra (safety Related application) Parameter (Parameter).

According to the present disclosure, a user can invalidate a specific security function using SRA parameters defined in the specification of ETG.

In the above publication, the designation information includes information for designating validity or invalidity of each of at least one or more security functions by a bit string in which bits corresponding to each of the at least one or more security functions are arranged.

According to the present disclosure, a user is able to use a bit string to invalidate a particular security function.

In the above disclosure, the control system includes a support device that supports settings related to at least one or more safety functions. The support apparatus provides a user interface for setting the designation information.

According to the present disclosure, a user is able to disable a particular security function using a user interface provided by the support apparatus.

In the above disclosure, the support apparatus prohibits the use of the variable referred to in the program related to the specific security function in response to the specification of the invalidation of the specific security function among the at least one security function.

According to the present disclosure, it is possible to avoid a situation in which a user unintentionally sets a variable referred to in a program related to an invalidated security function.

In the disclosure, the support apparatus notifies prohibition of use of a variable.

According to the present disclosure, it is possible to notify the user that the use of a variable referred to in a program related to an invalidated security function has been prohibited.

According to the present disclosure, the control system includes a second controller that transmits a safety command related to an operation of at least one safety function to the drive device. Second specifying information for specifying validity or invalidity, respectively, with respect to at least one or more security functions is included in the security instruction. The drive device activates or deactivates at least one of the security functions based on the designation information included in the parameter and the second designation information included in the security command.

According to the present disclosure, since the security function is validated or invalidated based on the designation information for designating validation or invalidation of the security function in the parameter and the second designation information for designating validation or invalidation of the security function in the security command transmitted from the second controller, respectively, the user can validate or invalidate the security function according to the actual situation.

According to another example of the present disclosure, a control method in a control system is provided. The control system includes: a drive device connected to a network, having at least one safety function, and driving the motor; and a controller that manages data exchange between devices including the drive devices connected to the network. The control method comprises the following steps: when a connection in a network is established, transmitting, by a controller, a parameter including designation information for designating validity or invalidity, respectively, with respect to at least one or more security functions to the drive device via the network; and invalidating, by the drive device, a specific security function specified as invalid by the specification information included in the parameter, among the at least one security function.

According to the present disclosure, the user specifies the intention that the specific security function is disabled by the parameter, and thus, when a connection is established in the network, the specific security function can be disabled for the drive device. Further, since the user can invalidate the specific security function by transmitting the parameter to the drive device via the network, the execution performance of the system is not degraded as compared with the case where a program separately prepared for invalidating the security function is executed.

According to another embodiment of the present disclosure, there is provided a driving apparatus connected to a network, having at least one safety function, and driving a motor. Data exchange is managed by a controller between devices including a drive device connected to a network. The drive device includes: a receiving unit configured to receive, from a controller via a network, a parameter including designation information for designating validity or invalidity of at least one security function, respectively, when a connection in the network is established; and an invalidation unit that invalidates a specific security function specified as invalid by the designation information included in the parameter, among the at least one security function.

According to the present disclosure, the user specifies the intention that the specific security function is disabled by the parameter, and thus, when a connection is established in the network, the specific security function can be disabled for the drive device. Further, since the user can invalidate the specific security function by transmitting the parameter to the drive device via the network, the execution performance of the system is not degraded as compared with the case where a program separately prepared for invalidating the security function is executed.

ADVANTAGEOUS EFFECTS OF INVENTION

According to the present invention, it is possible to facilitate setting of validity or invalidity of a security function.

Drawings

Fig. 1 is a schematic diagram showing an application example of the control system of the present embodiment.

Fig. 2 is a schematic diagram showing information of a first byte which specifies valid/invalid setting of a security function defined in the ETG specification.

Fig. 3 is a schematic diagram showing an example of a hardware configuration of a standard controller constituting the control system according to the present embodiment.

Fig. 4 is a schematic diagram showing an example of a hardware configuration of a safety controller constituting the control system of the present embodiment.

Fig. 5 is a schematic diagram showing an example of a hardware configuration of a safety actuator and a servo motor constituting the control system according to the present embodiment.

Fig. 6 is a schematic diagram showing an example of a hardware configuration of a support device constituting the control system according to the present embodiment.

Fig. 7 is a schematic diagram showing an example of sharing functions of the control system according to the present embodiment.

Fig. 8 is a sequence diagram showing an example of a process flow related to the safety function of the safety driver of the control system according to the present embodiment.

Fig. 9 is a diagram showing an example of the exercise safety function provided by the control system of the present embodiment.

Fig. 10 is a schematic diagram showing an example of implementing the standard control, the safety control, and the SRA parameter transfer in the control system according to the present embodiment.

Fig. 11 is a schematic diagram showing an example of transition between activation and deactivation of the motion safety function according to the present embodiment.

Fig. 12 is a diagram showing an example of a user interface for performing the setting of the activation/deactivation of the motion safety function in the SRA parameters provided by the support apparatus according to the present embodiment.

Fig. 13 is a diagram showing an example of a user interface for performing the setting of the activation/deactivation of the motion safety function in the SRA parameters provided by the support apparatus according to the present embodiment.

Fig. 14 is a diagram showing an example of a user interface for setting variables in the security program provided by the support apparatus according to the present embodiment.

Fig. 15 is a flowchart for explaining the security validity/invalidity setting process executed by the support apparatus according to the present embodiment.

Fig. 16 is a flowchart for explaining the SRA parameter reception process executed by the secure drive according to the present embodiment.

Fig. 17 is a flowchart for explaining the secure command receiving process executed by the secure driver according to the present embodiment.

Fig. 18 is a flowchart for explaining the secure command receiving process executed by the secure driver of the modification.

Fig. 19 is a flowchart for explaining the secure command receiving process executed by the secure driver of the modification.

Fig. 20 is a schematic diagram showing an example of the transition between the activation and deactivation of the motion safety function according to the modification.

Fig. 21 is a flowchart for explaining the secure command receiving process executed by the secure driver of the modification.

Fig. 22 is a schematic diagram showing an example of the transition between the activation and deactivation of the motion safety function according to the modification.

Detailed Description

Embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the drawings, the same or corresponding portions are denoted by the same reference numerals, and description thereof will not be repeated.

< A. application example >

First, an example of a scenario to which the present invention is applied will be described.

Fig. 1 is a schematic diagram showing an application example of a control system 1 according to the present embodiment. The control system 1 of the present embodiment provides, in addition to the safety functions defined in IEC61508 and the like, for example, several safety functions related to the drive device, such as Safe Torque Off (STO), Safe Stop 1(Safe Stop 1, SS1), Safe Stop 2(Safe Stop 2, SS2), and Safe Operation Stop (SOS), which are defined in non-patent document 2 ("IEC 61800-5-2:2016 speed-adjustable electric drive system-part 5-2: safety requirement-function", international electrotechnical commission, 2016-04-18).

Referring to fig. 1, a control system 1 mainly includes a standard controller 100, a safety controller 200 connected to the standard controller 100 via a field network 2, and one or more safety drivers (safety servo drivers) 300. The safety drivers 300 respectively drive the electrically connected servo motors 400. The present invention is not limited to the servomotor 400, and any type of motor can be used. The safety driver 300 may be a servo driver or a general inverter device. In the following description, the safety actuator 300 will be described as an example of the "driving device".

The standard controller 100 corresponds to a "controller" and executes standard control (standard control 150 described later) on a control target including the servomotor 400 in accordance with a standard control program (standard control program 1104 described later) prepared in advance. Typically, the standard controller 100 periodically calculates a command to an actuator such as the servo motor 400 by cyclically executing a control operation according to an input signal from one or more sensors (not shown) or the like.

The safety controller 200 transmits a safety command related to the operation of the safety function (safety function 250 described later) to the safety driver 300 in accordance with a safety program (safety program 2104 described later). The safety controller 200 is configured to cyclically execute monitoring and control operations for realizing a safety function 250 of a control target independently of the standard controller 100.

The safety controller 200 can receive an input signal from any safety device 240 and/or can output a command to any safety device 240. The secure program 2104 is prepared in advance by a user using a development environment provided by the support apparatus 500 communicably connected to the secure controller 200, and is forwarded to the secure controller 200.

The safety driver 300 drives the servo motor 400 by supplying power to the servo motor 400 in accordance with a command from the standard controller 100. The safety driver 300 periodically calculates the rotational position, rotational speed, rotational acceleration, generated torque, and the like of the servo motor 400 based on a feedback signal or the like from the servo motor 400.

Further, the safety driver 300 executes a predetermined safety function 250 related to the driving of the servo motor 400 in accordance with a safety command from the safety controller 200. More specifically, the safety driver 300 supplies state information required for the safety function 250 to the safety controller 200, and executes a motion safety program (a motion safety program 3204 described later) corresponding to the required safety function 250, thereby adjusting or blocking the power supplied to the servo motor 400.

The servo motor 400 has a motor (a three-phase ac motor 402 described later) that receives electric power from the safety driver 300 and rotates, and outputs a detection signal from an encoder (an encoder 404 described later) coupled to a rotation shaft of the motor to the safety driver 300 as a feedback signal.

The support device 500 supports the development on the standard controller 100 side and the development on the safety controller 200 side. More specifically, as the development on the standard controller 100 side, the support device 500 supports the development of a standard control program (a standard control program 1104 described later) executed by the standard controller 100, settings related to the standard control 150, and the like. Further, as the development on the side of the safety controller 200, the support device 500 supports the development of a safety program (a safety program 2104 described later) executed by the safety controller 200, the setting of the safety function 250, and the like. The support apparatus 500 provides a user with a development environment (a programming editing tool, an analyzer, a compiler, and the like) for generating a program by combining at least one or more pieces of command information.

In this specification, the "device" is a generic term of a device capable of performing data communication with another device via an arbitrary network such as the field network 2. In the control system 1 of the present embodiment, the "equipment" includes the standard controller 100, the safety controller 200, and the safety driver 300.

In this specification, the terms "standard control" and "safety control" are used in contrast. The "standard control" is a generic term of processing for controlling a control target in accordance with a predetermined requirement specification. On the other hand, "security control" is a generic term for processing for preventing a person from being threatened by equipment, machinery, or the like. The "safety control" is designed to satisfy the requirements for realizing the safety function specified in IEC61508 or the like.

In this specification, the safety function unique to the drive device (safety device 300) is collectively referred to as a "motion safety function" or simply a "safety function". Typically, the "function" includes a safety function relating to the drive device defined in the non-patent document 2. For example, controls for monitoring the position or speed of the control shaft to ensure safety are included.

In this specification, "process data" is a generic term of data used in at least either of standard control and safety control. Specifically, "process data" includes input information acquired from a control target, output information output to the control target, internal information used for control calculations in each device, and the like.

The input information includes an ON/OFF (ON/OFF) signal (digital input) detected by a photosensor or the like, a physical signal (analog input) detected by a temperature sensor or the like, a pulse signal (pulse input) generated by a pulse encoder (pulse encoder) or the like, and the like. The output information includes on/off (digital output) for driving a relay or the like, a speed command (analog output) for instructing a rotation speed or the like of a servo motor, a displacement command (pulse output) for instructing a movement amount or the like of a stepping motor, and the like. The internal information includes status information and the like determined by control calculation or the like using arbitrary process data as input.

The field network 2 of the control system 1 performs process data communication, and makes a communication frame 600 circulate among the devices in a loop (for example, several msec to ten msec) with the standard controller 100 as a communication master. The period of transmission of communication frame 600 is also referred to as a process data communication period. In the present embodiment, EtherCAT is used as an example of a protocol of the field network 2 that cyclically transmits such a communication frame 600.

For the communication frame 600, a data area is allocated for each device. Upon receiving a communication frame 600 transmitted periodically, each device writes a preset current value of data into a data area allocated to the device in the received communication frame 600. Then, the communication frame 600 in which the current value is written is transmitted to the next device. The current value of the data written by each device may be referenced from the other device.

The communication frame 600, which is returned to the communication master (standard controller 100) after one round of the communication frame 600 is completed by writing the current value of the preset data in the communication frame 600 by each device, includes the latest value collected by each device.

In the present embodiment, a logical connection 4 is formed between the safety controller 200 and the safety driver 300 by such process data communication. The logical connection 4 is used for the exchange of data to implement the security function 250.

As described above, in the case of employing EtherCAT as the protocol of the field network 2, the logical connection 4 can be formed using a protocol called FailSafe over EtherCAT (FSoE) based on EtherCAT.

More specifically, a dedicated data area for holding commands exchanged for forming the logical connection 4 is allocated to the communication frame 600. The logical connection 4 is formed by exchanging commands between the devices using the dedicated data area.

As shown in fig. 1, each security driver 300 maintains a secure state 70 for managing the activation or deactivation of the motion security function 360. Motion safety functions 360 that may be implemented by safety drive 300 include Safe Torque Off (STO), Safe Stop 1(Safe Stop 1, SS1), Safe Stop 2(Safe Stop 2, SS2), Safe operation Stop (Safe Operating Stop, SOS), Safe Speed Range (SSR), Safe Direction positive (SDIp), and Safe Direction negative (SDIn). Designation information for designating validity or invalidity of the respective motion safety functions 360 is arranged in an area provided for each bit included in the safety state 70. Error acknowledgement (Error Ack) is a function for releasing an Error when an Error occurs, and is always activated.

Each safety drive 300 has only a predetermined motion safety function 360. For example, in the specific safety drive 300, the SSR in each motion safety function 360 shown in fig. 1 is not installed, and STO, SS1, SS2, SOS, SDIp, and SDIn are installed in addition thereto. This is merely an example, and other safety drivers 300 similarly have only the predetermined motion safety function 360.

The security driver 300 validates or invalidates each motion security function 360 in accordance with the designation information included in the security state 70. The "designation information" may be any information as long as it is information for designating validity or invalidity, respectively, with respect to the motion safety function 360. In the present embodiment, the designation information designates validity or invalidity by a flag indicated by "0" or "1". More specifically, when the flag is "0", the motion safety function 360 becomes active, and when the flag is "1", the motion safety function 360 becomes inactive.

All motion safety functions 360 fix the flag so that it becomes active at startup (i.e., default) and the user cannot change their contents. That is, the motion safety function 360 by default is all fixed as active. This is required in the regulations disclosed in non-patent document 1.

Here, with reference to fig. 2, the setting of the validity/invalidity of the security function in the security state 70 defined in the ETG standard will be described. Fig. 2 is a schematic diagram showing information of a first byte specifying valid/invalid setting of a security function defined in the ETG specification.

As shown in fig. 2, non-patent document 1 shows information of a first byte that specifies valid/invalid setting of a security function. Specifically, the control word 700 related to the motion safety function 360 shown in non-patent document 1 includes a bit column 702, a name column 704, and an explanation column 706. In the bit column 702, each bit of 0 bit to 7 bits is arranged as a bit included in the first byte. In the name column 704, an abbreviation of the motion safety function 360 associated with each bit is shown. In the description column 706, the formal name of each motion safety function 360 and the operation state associated with the mark are indicated.

In the present embodiment, the flag is fixed to indicate "0" which is valid in the default state for all the motion safety functions 360. Each motion safety function 360 requires that the flag be activated with a "0" by default.

In the first byte shown in fig. 2, which designates the valid/invalid setting of the security function, the flag of each of bits from 0 bit to 7 bits is fixed to "0" by default, and the default state cannot be changed by the user. Although not shown, the user can change the default state with respect to the second byte.

The "effective" of the safety function means that the function for performing the safety control is in an operating state. For example, STO, SS1, SS2, SOS, and SSR are "active" when labeled "0". This means that the function for safety control is in operation. Also, regarding SDIp or SDIn, when marked as "0", it is "disable (disable) …". This means that the motor is prohibited from running in the positive direction or the negative direction, that is, the function for performing the safety control is in a running state.

On the other hand, the "invalidation" of the safety function means that the function for performing the safety control is in a non-operating state. For example, with respect to STO, SS1, SS2, SOS, and SSR, it is "invalid" when marked as "1". This means that the function for safety control is in a non-operating state. Also, with respect to SDIp or SDIn, it is at "enable (enable) …" when labeled "1". This means that the motor is allowed to run in the positive or negative direction, i.e., the function for safety control is in a non-running state.

Returning to fig. 1, each safety driver 300, whether installed or not, is activated with a flag of "0" by default for all motion safety functions 360. Therefore, the attached motion safety function 360 is validated by fixing the default setting to be valid. Assuming an uninstalled motion safety function 360, with respect to the uninstalled motion safety function 360, it is not executed even if the flag is set to be valid.

In this way, in each safety driver 300, the settings at the time of default are fixed to be valid for all the motion safety functions 360, regardless of whether they are installed or not. However, in actual use, it is also necessary to change the setting of the safety function to enable or disable the exercise safety function 360 depending on the work content in the process.

As a method of changing the activation or deactivation of the specific motion safety function 360 later, it is conceivable to include designation information for activating or deactivating the specific motion safety function 360 in a safety command from the safety controller 200. For example, in the present embodiment, after the logical connection 4 is established, a safety command can be transmitted from the safety controller 200 to the safety driver 300. If the security command includes designation information for activating or deactivating the specific motion safety function 360, activation or deactivation of the specific motion safety function 360 can be changed later.

However, in this case, in order to change the valid/invalid setting of the specific exercise safety function 360 from the default state, the user needs to create the safety program 2104 using a tool such as the support apparatus 500, and there is a possibility that a situation in which the amount of work increases occurs. Thus, frequent production of security program 2104 may result in reduced efficiency. In addition, since the source code must be described in the programming operation, the user may unintentionally describe the contents of the erroneous setting. Further, when a plurality of safety drivers 300 are provided in the control system 1, such safety programs 2104 must be created for all the safety drivers 300, and the amount of work becomes enormous.

Therefore, in the control system 1 of the present embodiment, the SRA parameter 60 is used as another method of changing the valid/invalid setting of the motion safety function 360 from the default state. The SRA parameters are defined in the ETG specification as disclosed in non-patent document 3(EtherCAT protocol enhancement, ETG.5100FSoE specification revision, document: ETG.5120S (R) V1.1.0', EtherCAT technical Association, 2017-07-14). The SRA parameter 60 is an example of "parameter" related to setting of the secure drive 300.

The SRA parameters 60 are slaves (in this embodiment, the security drivers 300) that are forwarded to the FSoE from the standard controller 100 that manages data exchange between devices on the field network 2. Specifically, the standard controller 100 transmits the SRA parameters 60 to the security driver 300 by including the SRA parameters 60 in an initial command after the connection in the field network 2 is established. The security driver 300 executes the motion security function 360 while referring to the SRA parameters 60 when executing the motion security program 3204.

In the SRA parameter 60, designation information for designating validity or invalidity, respectively, with respect to at least one or more motion safety functions 360 is included. The "designation information" may be any information as long as it is information for designating validity or invalidity, respectively, with respect to the motion safety function 360. In the present embodiment, the designation information is a bit string in which bits corresponding to the motion safety functions 360 are arranged, and the motion safety functions 360 are designated as valid or invalid by flags indicated by "0" or "1", respectively. The user can change the validity or invalidity of the specific exercise safety function 360 from the default state by setting the flag in the specification information using a tool such as the support apparatus 500.

For example, as shown in FIG. 1, by default, all of the indicia of the motion safety function 360 are fixed to "0". Here, when the SS2, the SOS, and the SDIp are to be invalidated with respect to the motion safety function 360 of the specific safety drive 300, the user may set a flag corresponding to each of the SS2, the SOS, and the SDIp to "1" (invalid state) as the specification information of the SRA parameter 60. In this way, by setting the specification information of the SRA parameter 60, the user can change the valid/invalid setting of the motion safety function 360 defined by default at a later time.

In this way, the user specifies, by the SRA parameter 60, that the specific motion safety function is invalid, and when a connection is established in the field network 2, the specific motion safety function can be changed from the default valid state to the invalid state for the safety driver 300. Further, since the user can activate or deactivate the specific motion safety function 360 by transmitting the SRA parameter 60 to the safety driver 300 via the field network 2, the execution performance of the control system 1 is not degraded as compared with executing a program separately prepared to change the activation/deactivation setting of the motion safety function 360 from the default. Further, the control cycle of the safety controller 200 is not deteriorated by the increase of the program for performing the valid/invalid setting of the motion safety function 360.

< B. structural example of the apparatus included in the control System 1 >

Next, a configuration example of the devices included in the control system 1 will be described.

(b 1: Standard controller 100)

Fig. 3 is a schematic diagram showing an example of a hardware configuration of a standard controller 100 constituting the control system 1 according to the present embodiment. Referring to fig. 3, a standard controller 100 includes a processor 102, a main memory 104, a storage 110, a master network controller 106, a field network controller 108, a Universal Serial Bus (USB) controller 120, a memory card interface 112, and a local Bus controller 116. These components are connected via a processor bus 118.

The processor 102 corresponds to an arithmetic Processing Unit that mainly executes control operations related to the standard control 150, and includes a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), and the like. Specifically, the processor 102 reads programs (for example, a system program 1102 and a standard control program 1104) stored in the storage 110, develops the programs in the main memory 104, and executes the programs, thereby realizing control operations according to a control target (for example, the safety drive 300 or the servo motor 400) and various processes described below.

The main Memory 104 includes a volatile Memory device such as a Dynamic Random Access Memory (DRAM) or a Static Random Access Memory (SRAM). The storage 110 includes, for example, a nonvolatile storage device such as a Solid State Drive (SSD) or a Hard Disk Drive (HDD).

In addition to the system program 1102 for realizing the basic functions, the storage 110 stores a standard control program 1104 created from a control object. The storage 110 stores setting information 1106 for setting variables and the like as described later. Further, the SRA parameters 60 created by the support apparatus 500 are stored in the storage 110. The SRA parameters 60 are sent to the safety driver 300 as a slave via the field network 2 having the standard controller 100 as a master.

The upper network controller 106 exchanges data with an arbitrary information processing apparatus via an upper network.

The field network controller 108 exchanges data with any device including the safety controller 200 and the safety driver 300 via the field network 2. In the control system 1 shown in fig. 1, the field network controller 108 of the standard controller 100 functions as a communication master (master) of the field network 2.

The USB controller 120 exchanges data with the support apparatus 500 and the like via a USB connection.

The memory card interface 112 receives a memory card 114 as an example of a removable recording medium. The memory card interface 112 can write data into the memory card 114 and read various data (log, trace data, and the like) from the memory card 114.

The local bus controller 116 exchanges data with any unit connected to the standard controller 100 via a local bus.

Fig. 3 shows an example of a configuration in which the processor 102 executes a program to provide a desired function, but some or all of the provided functions may be implemented by a dedicated hardware Circuit (e.g., an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA), or the like). Alternatively, the main part of the standard controller 100 may also be implemented using hardware following a general-purpose architecture (e.g., an industrial personal computer with a general-purpose personal computer as a base). In this case, a plurality of Operating Systems (OSs) having different applications may be executed in parallel using a virtualization technique, and a desired application may be executed on each OS. Further, a configuration may be adopted in which the functions of the display device, the support device, and the like are integrated into the standard controller 100.

(b 2: safety controller 200)

Fig. 4 is a schematic diagram showing an example of a hardware configuration of the safety controller 200 constituting the control system 1 according to the present embodiment. Referring to fig. 4, the secure controller 200 includes a processor 202, a main memory 204, a storage 210, a field network controller 208, a USB controller 220, and a secure local bus controller 216. These components are connected via a processor bus 218.

The processor 202 corresponds to an arithmetic processing unit that mainly executes control operations related to safety control, and includes a CPU, a GPU, and the like. Specifically, the processor 202 reads programs (for example, a system program 2102 and a security program 2104) stored in the storage 210, expands the programs in the main memory 204, and executes the programs, thereby realizing control operations for providing the required security function 250 and various processes described below.

In particular, the secure controller 200 outputs a secure instruction containing designation information for designating the validity or invalidity of the motion security function 360 of the secure drive 300 to the secure drive 300 by executing the secure program 2104. The designation information contained in the secure state 70 of the secure drive 300 may be updated based on the designation information contained in the secure command.

The main memory 204 includes a volatile memory device such as a DRAM or an SRAM. The storage 210 includes, for example, a nonvolatile storage device such as an SSD or an HDD.

In the storage 210, a security program 2104 created in accordance with the required security function 250 is stored in addition to a system program 2102 for realizing a basic function. Further, the storage 210 stores setting information 2106 for setting variables and the like as described later.

The field network controller 208 exchanges data with any device including the standard controller 100 and the security driver 300 via the field network 2. In the control system 1 shown in fig. 4, the field network controller 208 of the safety controller 200 functions as a communication slave of the field network 2.

The USB controller 220 exchanges data with an information processing apparatus such as the support apparatus 500 via a USB connection.

The secure local bus controller 216 exchanges data with any secure unit connected to the secure controller 200 via the secure local bus. Fig. 4 shows a secure IO unit 230 as an example of a secure unit.

The secure IO unit 230 exchanges input/output signals with an arbitrary secure device 240. More specifically, the secure IO unit 230 receives an input signal from a security device 240 such as a security sensor or a security switch. Alternatively, the safety IO unit 230 outputs a command to a safety device 240 such as a safety relay.

Fig. 4 shows an example of a configuration in which the processor 202 executes a program to provide necessary functions, but some or all of the provided functions may be implemented by using a dedicated hardware circuit (e.g., ASIC or FPGA). Alternatively, the main part of the security controller 200 may also be implemented using hardware following a general-purpose architecture (e.g., an industrial personal computer with a general-purpose personal computer as a base).

(b 3: safety drive 300 and servomotor 400)

Fig. 5 is a schematic diagram showing an example of the hardware configuration of the safety driver 300 and the servo motor 400 constituting the control system 1 according to the present embodiment. Referring to fig. 5, the security driver 300 includes a field network controller 302, a control section 310, a driving circuit 330, and a feedback receiving circuit 332.

The field network controller 302 exchanges data with any device including the standard controller 100 and the safety controller 200 via the field network 2. In the present embodiment, the field network controller 302 functions as a "receiving unit" that receives an initial command including the SRA parameters 60 from the standard controller 100. In the control system 1 shown in fig. 5, the field network controller 302 of the safety driver 300 functions as a communication slave of the field network 2.

The control unit 310 executes arithmetic processing necessary for operating the safety driver 300. For example, the control unit 310 includes a processor 312, a processor 314, a main memory 316, and a storage 320.

The processor 312 corresponds to an arithmetic processing unit that mainly executes control calculations for driving the servomotor 400. The processor 314 primarily performs control operations for providing the safety function 250 associated with the servo motor 400. In the present embodiment, the processor 314 functions as an "invalidation unit" that invalidates the specific motion safety function 360 based on the SRA parameters 60 or the safety command. The processors 312, 314 each include a CPU or the like.

The main memory 316 includes a volatile memory device such as a DRAM or an SRAM. The storage 320 includes, for example, a nonvolatile storage device such as an SSD or an HDD.

The storage 320 stores a servo control program 3202 for realizing the servo control 350 described later, a motion safety program 3204 for realizing the motion safety function 360 described later, and setting information 3206 for setting variables and the like disclosed in other devices. Further, in the setting information 3206, the security state 70 for managing the valid/invalid setting with respect to the motion security function 360 is stored.

In fig. 5, the configuration in which the two processors 312 and 314 respectively execute control operations of different targets to improve reliability is illustrated, but the present invention is not limited thereto, and any configuration may be adopted as long as the required safety function 250 can be realized. For example, when a plurality of cores are included in a single processor, control operations corresponding to the processors 312 and 314 may be executed. Further, although fig. 5 shows an example of a configuration in which the processors 312 and 314 execute programs to provide necessary functions, some or all of the functions provided may be realized by using dedicated hardware circuits (for example, ASICs or FPGAs).

The drive circuit 330 includes a converter circuit, an inverter circuit, and the like, generates electric power of a specified voltage, current, and phase in accordance with a command from the control unit 310, and supplies the electric power to the servo motor 400.

The feedback receiving circuit 332 receives a feedback signal from the servo motor 400 and outputs the reception result to the control unit 310.

Typically, the servomotor 400 includes a three-phase ac motor 402 and an encoder 404 attached to a rotary shaft of the three-phase ac motor 402.

The three-phase ac motor 402 is an actuator that generates a rotational force upon receiving electric power supplied from the safety driver 300. In fig. 5, a three-phase ac motor is illustrated as an example, but the present invention is not limited to this, and a dc motor, a single-phase ac motor, or a multi-phase ac motor may be used. Further, an actuator that generates a driving force along a straight line, such as a linear servo (linear servo), may be used.

The encoder 404 outputs a feedback signal (typically, a pulse signal of a number corresponding to the rotation speed) corresponding to the rotation speed of the three-phase ac motor 402.

(b 4: supporting device 500)

Fig. 6 is a schematic diagram showing an example of a hardware configuration of a support device 500 constituting the control system 1 according to the present embodiment. As an example, the support apparatus 500 is implemented using hardware (e.g., a general-purpose personal computer) conforming to a general-purpose architecture.

Referring to fig. 6, the support apparatus 500 includes a processor 502, a main memory 504, an input unit 506, an output unit 508, a storage 510, an optical drive 512, and a USB controller 520. These components are connected via a processor bus 518.

The processor 502 includes a CPU, a GPU, and the like, reads programs (for example, an OS5102 and a support program 5104) stored in the storage 510, expands the programs in the main memory 504, and executes the programs, thereby realizing various processes described below. That is, the processor 502 has a function of a computer that executes the supporting program 5104.

The main memory 504 includes a volatile memory device such as a DRAM or an SRAM. The storage 510 includes, for example, a nonvolatile storage device such as an HDD or SSD.

In the repository 510, a support program 5104 for providing a function as the support apparatus 500 is stored in addition to the OS5102 for realizing the basic function. That is, the support program 5104 is executed by a computer connected to the control system 1, thereby realizing the support apparatus 500 of the present embodiment.

Further, in the depository 510, project data (project data)5106 is held, and the project data 5106 is created by the user in a development environment provided by the execution of the supporting program 5104.

In the present embodiment, the support apparatus 500 provides a development environment capable of comprehensively implementing setting of each device included in the control system 1 and creation of a program executed in each device. Project data 5106 contains data generated by such a comprehensive development environment. Typically, the project data 5106 includes a standard control source program 5108, standard controller setting information 5110, a security source program 5117, security controller setting information 5114, and security driver setting information 5116. Further, the SRA parameter 60 created by the user is stored in the secure drive setting information 5116.

The standard control source program 5108 is converted into an object code, and then transmitted to the standard controller 100, and is saved as the standard control program 1104 (see fig. 3). Alternatively, the standard control source program 5108 may be directly transmitted to the standard controller 100 without being converted into the target code. Similarly, the standard controller setting information 5110 is also transmitted to the standard controller 100 and stored as the setting information 1106 (see fig. 3).

The secure source program 5117 is converted into the object code, and then transmitted to the secure controller 200, and stored as the secure program 2104 (see fig. 4). Alternatively, the secure source program 5117 may be transmitted to the secure controller 200 without being converted into the target code. Similarly, the safety controller setting information 5114 is also transmitted to the safety controller 200 and stored as the setting information 2106 (see fig. 4).

The secure drive setting information 5116 including the SRA parameter 60 is transmitted to the secure drive 300 and stored as the setting information 3206 (see fig. 5). The designation information contained in security state 70 saved in setting information 3206 may be updated based on the designation information contained in SRA parameters 60.

The input unit 506 includes a keyboard, a mouse, and the like, and receives a user operation. The output unit 508 includes a display, various indicators (indicators), a printer, and the like, and outputs the processing result from the processor 502.

The USB controller 520 exchanges data with the standard controller 100 and the like via a USB connection.

The support apparatus 500 includes an optical drive 512, and reads a program stored in a recording medium 514 (for example, an optical recording medium such as a Digital Versatile Disc (DVD)) which does not store a computer-readable program at a time, and installs the program in a storage 510 or the like.

The support program 5104 and the like executed by the support apparatus 500 may be installed via the computer-readable recording medium 514 or may be installed in a form downloaded from a server apparatus or the like on the network. Furthermore, the functions provided by the support apparatus 500 according to the present embodiment may be implemented as a part of a module provided by the OS.

Fig. 6 shows an example of a configuration in which the processor 502 executes a program to provide functions required as the support apparatus 500, but some or all of the provided functions may be implemented by using a dedicated hardware circuit (for example, ASIC or FPGA).

In addition, the support device 500 may be detached from the standard controller 100 during operation of the control system 1.

< C. function sharing of control System 1 >

Next, an example of the function sharing in the control system 1 will be described. Fig. 7 is a schematic diagram showing an example of sharing functions of the control system 1 according to the present embodiment.

Referring to fig. 7, the safety driver 300 performs a servo control 350 with respect to the standard control 150 performed by the standard controller 100. The standard control 150 includes the following processes: the command for driving the servo motor 400 is periodically calculated according to a user program preset for the control target. The servo control 350 includes control for driving the servo motor 400 in accordance with a command periodically calculated by the standard control 150, and processing for acquiring and outputting a state value indicating an operation state of the servo motor 400. The servo control 350 is performed by the processor 312 (see fig. 5) of the safety drive 300.

On the other hand, the safety driver 300 provides a motion safety function 360 corresponding to the safety function 250 provided by the safety controller 200. The motion safety function 360 is responsible for the processor 314 (see fig. 5) of the safety drive 300.

The safety function 250 enables a predetermined safety function 250 when a predetermined condition is satisfied, based on a state value held in the standard control 150 executed by the standard controller 100, a state value indicated by a signal from the safety device 240, a state value held in the safety driver 300, and the like.

The process of validating the previously designated safety function 250 includes, for example, output of a safety command to the safety driver 300, output of a safety command to the safety device 240 (for example, blocking a safety relay related to power supply to a specific device), and the like.

The security driver 300 implements the designated motion security function 360 in response to a security instruction from the security controller 200 by executing the motion security program 3204. In addition, each safety actuator 300 is predefined with an executable motion safety function 360. Depending on the type of the designated motion safety function 360, a process of interrupting the supply of electric power to the servo motor 400 by the servo control 350 or a process of monitoring whether or not the state value of the control of the servo motor 400 by the servo control 350 is within a predetermined limit range is executed in response to the control of the servo motor 400 by the servo control 350. The sports security program 3204 validates or invalidates each sports security function 360 in accordance with the validation/invalidation setting of the security function specified by the specification information included in the security state 70.

Fig. 8 is a sequence diagram showing an example of a process flow related to the safety function 250 performed by the safety driver 300 of the control system 1 according to the present embodiment. Referring to fig. 8, a command is periodically calculated by the standard control 150 of the standard controller 100 and is output to the safety driver 300 (servo control 350) (sequence SQ 2). The servo control 350 of the safety drive 300 drives the servo motor 400 according to the instruction from the standard control 150 (sequence SQ 4).

When a safety event (safety event) occurs from the safety device 240 (e.g., a safety sensor) at a certain timing (sequence SQ6), the safety controller 200 outputs a safety instruction to the safety drive 300 (motion safety function 360) (sequence SQ 8). In response to the security command, the motion security function 360 of the security drive 300 validates the specified security function 250 (sequence SQ 10).

In response to the activation of the secure function 250, an instruction corresponding to the activated secure function 250 is output and outputted from the standard control 150 of the standard controller 100 (sequence SQ 12). On the other hand, the safety driver 300 (motion safety function 360) monitors whether or not the operation state of the servomotor 400 is within a predetermined limit range. If it is determined that the operating state of the servo motor 400 does not fall within the predetermined limit range or if the predetermined stop time has come, the safety driver 300 (the motion safety function 360) blocks the supply of power to the servo motor 400 (sequence SQ 14).

In this way, the safety driver 300 can drive the servo motor 400 in accordance with a command from the standard controller 100 (standard control 150), and can realize the motion safety function 360 for the safety controller 200 (safety function 250) in accordance with a command for validating the safety function 250.

< D. motion safety function 360 of control system 1 >

Next, an example of the movement safety function 360 provided by the control system 1 will be described.

Fig. 9 is a diagram showing an example of the exercise safety function 360 provided in the control system 1 according to the present embodiment. Fig. 9(a) shows an example of the behavior of servo motor 400 corresponding to STO, and fig. 9(B) shows an example of the behavior of servo motor 400 corresponding to SS 1.

Referring to fig. 9 a, when a safety command (STO) is given at time t1 while servo motor 400 is operating at a certain rotational speed, safety driver 300 blocks the supply of electric power to servo motor 400 and sets the torque generated by servo motor 400 to zero. As a result, the servomotor 400 is rotated by inertia and then stopped. In addition, even when the brake is attached to the servo motor 400, the servo motor 400 can be immediately stopped.

Referring to fig. 9B, when a safety command is given at time t1 (SS1) while servo motor 400 is operating at a certain rotational speed, safety actuator 300 reduces the rotational speed at a predetermined acceleration. At this time, the safety drive 300 may also perform power recovery (i.e., regeneration) from the servo motor 400. When the rotation speed of the servomotor 400 becomes zero at time t2, the safety driver 300 blocks the power supply to the servomotor 400 and sets the torque generated by the servomotor 400 to zero. After time t2, the state is the same as STO shown in fig. 9 (a).

In STO shown in fig. 9(a) and SS1 shown in fig. 9(B), a safety function capable of stopping more safely is appropriately selected according to the characteristics of the equipment mechanically connected to the servo motor 400 and the like.

The non-patent document 1 defines not only the motion safety functions shown in fig. 9(a) and 9(B), but also a plurality of motion safety functions. In order to realize each motion safety function, a setting for specifying the behavior of the servomotor 400 is required.

Implementation example of Standard control, Security control and SRA parameter Forwarding

As described above, the control system 1 of the present embodiment can realize secure communication by data communication and the logical connection 4. Next, an example of implementation of standard control, security control, and forwarding of the SRA parameters 60 by each communication will be described.

Fig. 10 is a schematic diagram showing an example of implementing the standard control, the safety control, and the SRA parameter transfer in the control system 1 according to the present embodiment. For convenience of explanation, fig. 10 shows an example of the control system 1 including one safety driver 300 in addition to the standard controller 100, the safety controller 200, and the support device 500.

As shown in fig. 10, the standard controller 100 includes a data communication layer 170 and an IO management module 172 as main functional structures. The security controller 200 includes a data communication layer 270, an IO management module 272, a logical connection layer 276, and a security function state management engine 278 as main functional structures. The security driver 300 includes a data communication layer 370, a logic connection layer 376, a motion security function status management engine 378, a servo control execution engine 352, and a motion security function execution engine 362 as main functional structures.

The data communication layer 170, the data communication layer 270, and the data communication layer 370 are responsible for forwarding the communication frame 600 on the field network 2.

The logical connection layer 276 of the secure controller 200 and the logical connection layer 376 of the secure driver 300 are responsible for the exchange of the secure communication frames 630. That is, the logical connection layer 276 and the logical connection layer 376 exchange commands and data using the secure communication frame 630 included in the communication frame 600 in accordance with the protocol (FSoE in the present embodiment) for establishing the logical connection 4. The secure controller 200 includes an establishment module 277, the establishment module 277 being used to establish a logical connection 4 with the secure driver 300 via the logical connection layer 276.

In the standard controller 100, the IO management module 172 updates the process data 174 by exchanging signals with the control object. The standard control program 1104 executed in the standard controller 100 performs a control operation with reference to the process data 174, and updates the process data 174 according to the execution result of the control operation.

In the secure controller 200, the IO management module 272 updates the process data 274 by exchanging signals with the secure device 240.

The secure program 2104 executed in the secure controller 200 executes a control operation with reference to the process data 274 and the secure function state management engine 278, and updates the process data 274 based on the execution result of the control operation or outputs an internal instruction to the secure function state management engine 278.

The secure function state management engine 278 generates a secure instruction for validating or invalidating the specific motion secure function 360 to the specific secure driver 300, based on the execution result of the control operation performed by the secure program 2104. The logical connection layer 276 exchanges required commands and data with the logical connection layer 376 of the security driver 300 as an object using the secure communication frame 630 in response to an instruction from the security function state management engine 278.

In the safety driver 300, the servo control execution engine 352 executes a control operation related to servo control with reference to the process data 374 and information of the feedback signal acquired via the feedback receiving circuit 332. The servo control execution engine 352 updates the process data 374 based on the execution result of the control operation, and outputs an internal instruction to the drive circuit 330. The driving circuit 330 drives the servo motor 400 according to an instruction from the servo control execution engine 352.

The motion safety function state management engine 378 manages the state of the motion safety function 360 in accordance with safety instructions from the safety controller 200 or the SRA parameters 60 from the standard controller 100. Secure state 70 is maintained by motion security function state management engine 378. The motion safety function state management engine 378 outputs internal instructions to the motion safety function execution engine 362 based on the specified information contained in the safety state 70.

In the motion safety function execution engine 362, the motion safety program 3204 is executed, thereby implementing the designated motion safety function 360.

The logical connection layer 376 exchanges required commands and data with the logical connection layer 276 of the security controller 200 using the secure communication frame 630 in response to instructions from the motion security function state management engine 378.

The support apparatus 500 includes a data communication layer 533 and a parameter manager 532 as main functional structures. The data communication layer 533 exchanges data with each device including the standard controller 100. The parameter manager 532 sets the SRA parameters 60 in accordance with the user operation received by the operation receiving unit 530 through the input unit 506. Specifically, the SRA parameter 60 is set, thereby performing the valid/invalid setting of the security function. The SRA parameters 60 are forwarded to the security driver 300 as an object via the field network 2.

Example of efficient or inefficient migration of motion safety function >

Fig. 11 is a schematic diagram showing an example of active or inactive transitions of the motion safety function 360 according to the present embodiment.

As previously described, the flags corresponding to all motion safety functions 360 are "0" by default and activate, whether or not the safety driver 300 is installed. That is, by default, all bits contained in secure state 70 are labeled "0".

When the user sets the flag of the second bit corresponding to SS2 to "1" to invalidate SS2, sets the flag of the third bit corresponding to SOS to "1" to invalidate SOS, and sets the flag of the fifth bit corresponding to SDIp to "1" to validate SDIp, among the designation information included in SRA parameters 60, the designation information included in the secure state 70 is updated in accordance with the designation information of SRA parameters 60 included in the initial command. More specifically, the designation information contained in the secure state 70 is overwritten so as to become identical to the designation information contained in the SRA parameters 60.

Subsequently, when the user creates the security program 2104 such that the flag of the second digit corresponding to the SS2 is set to "0" in order to validate the SS2 again and the flag of the first digit corresponding to the SS1 is set to "1" in order to invalidate the SS1, the designation information included in the security state 70 is updated in accordance with the security command. More specifically, the second-order flag, which is the flag corresponding to SS2, among the designation information included in security state 70 is changed to "0", and the first-order flag, which is the flag corresponding to SS1, is changed to "1".

As described above, in the control system 1 according to the present embodiment, after the connection is established in the field network 2, the setting of the specific motion safety function 360 to be enabled or disabled can be changed from the default state by the SRA parameter 60 or the safety command.

G. user interface associated with motion safety function 360 >

Next, an example of a user interface related to the exercise security function 360 provided by the support apparatus 500 will be described.

Fig. 12 and 13 are diagrams showing an example of a user interface for setting the activation/deactivation of the motion safety function 360 in the SRA parameters 60 provided by the support apparatus 500 according to the present embodiment. Fig. 14 is a diagram showing an example of a user interface for setting variables in the security program 2104 provided by the support apparatus 500 according to the present embodiment. The user can display screens related to the user interfaces shown in fig. 13 to 15 by executing the support program 5104 on the support apparatus 500.

As shown in fig. 12, on the left side of the screen related to the user interface 601, a multi view explorer (multi view explorer) column 610 is provided. The multiview resource manager column 610 includes a switch 612 for specifying a program to be developed. In this example, the changeover switch 612 designates "new _ secure CPU 0" corresponding to the secure program 2104.

Further, the multi-view resource manager column 610 includes a configuration/setting switch 614 for setting a configuration for performing network connection in the control system 1. The lower layer expanded by the configuration/setting switch 614 includes an SRA parameter icon 616 for developing the SRA parameter 60 and an I/O map icon 618 for mapping a variable referred to by the security program 2104. The "variable" refers to the data itself, a container or a storage area for storing the data, and the like. For example, as the variables to be referred to in the safety program 2104, state values of the servo motor 400 and the like are associated, and the motion safety functions 360 are realized based on the state values associated with the variables.

The SRA parameter icon 616 is provided for each of one or more secure drives 300 connected to the control system 1, and in this example, the SRA parameter icon 616 corresponding to the secure drive 300 of the Node 10 is selected.

A screen 620 for setting the SRA parameters 60 is displayed in the center of the screen related to the user interface 601. The screen 620 includes a number column 622 and a mark column 624.

In the number column 622, each motion safety function 360 is indicated with a number in the same arrangement as the designation information included in the safety state 70, in order from the first digit. In this example, since the motion safety function 360 of the SSR of the fourth position is not installed, all the information corresponding to the fourth position is "Reserved".

In the mark column 624, a check box that can be checked by the user is prepared. In the designation information included in the SRA parameter 60, the flag is set to "0" by checking the check box of the flag field 624, and the flag is set to "1" by canceling the check in the check box of the flag field 624. In this way, the user can easily set the motion safety function 360 in the SRA parameter 60 to be valid/invalid by checking or canceling the check in the check box of the mark column 624.

In addition, with regard to the valid/invalid setting of the motion safety function 360, the default state can be changed by the user for the second byte of the safety state 70, but as shown in fig. 12, the user can also perform valid/invalid setting by the SRA parameter 60 for the second byte.

In the example shown in fig. 12, the checkings of SS2, SOS, and SDIp are canceled in the check box of the mark bar 624. Therefore, in the SRA parameter 60, flags corresponding to SS2, SOS, and SDIp are designated as "1".

As shown in fig. 13, when the specific motion safety function 360 is invalidated in the check box of the mark column 624, the screen related to the user interface 602 is switched to, and the output window 670 located below the screen notifies that the variable associated with the invalidated specific motion safety function 360 has been cleared.

As shown in fig. 14, when the I/O map icon 618 is selected, it switches to a screen associated with the user interface 603. In the center of the screen related to the user interface 603, a screen 650 for variable mapping each motion safety function 360 is displayed. The screen 650 includes a port column 652, a variable column 654, and a variable comment column 656.

In the port bar 652, the respective motion safety functions 360 installed in the safety drive 300 under selection (node 10 in this example) are shown. In the variable column 654, variables associated with each motion safety function 360 are represented. In the variable annotation column 656, annotations relating to variables associated with each motion safety function 360 are represented.

Here, as shown in fig. 13, when the specific motion safety function 360 is invalidated in the check box of the mark column 624, the variable associated with the invalidated specific motion safety function 360 is released. Therefore, on the screen related to the user interface 603 shown in fig. 14, the variable column 654 and the variable comment column 656 become blank. For example, in the present example, the check boxes in the mark column 624 invalidate the SS2 and the SOS and cancel the variables, so the variable column 654 and the variable comment column 656 corresponding to the SS2 and the SOS are blank.

In this way, the support apparatus 500 prohibits the use of the variable referred to in the security program 2104 related to the specific motion safety function 360 in response to the case where the specific motion safety function 360 is designated as invalid. This can prevent the user from unintentionally setting the state of the variable referred to in the security program 2104 related to the disabled exercise security function 360.

< H. safe valid/invalid setting processing >

Next, a security validity/invalidity setting process performed by the support apparatus 500 will be described. Fig. 15 is a flowchart for explaining the security validity/invalidity setting process executed by the support apparatus 500 according to the present embodiment.

As shown in fig. 15, the support apparatus 500 determines whether or not the display of the setting screen of the SRA parameters 60 is accepted (S502). If the display of the setting screen for the SRA parameters 60 is not accepted (no in S502), the support apparatus 500 ends the present process.

On the other hand, when the display of the setting screen of the SRA parameter 60 is accepted (yes in S502), the support apparatus 500 determines whether or not the valid/invalid setting of the security function is supported (S504). If the security function valid/invalid setting is not supported (no in S504), the support apparatus 500 displays the setting screen of the SRA parameter 60 in a state in which the security function valid/invalid setting is not possible (S506). For example, the support apparatus 500 sets the content of the check box in the mark column 624 to a non-editable state on the screen related to the user interface 601 shown in fig. 12. Subsequently, the support apparatus 500 ends the present process.

On the other hand, if the security function valid/invalid setting is supported (yes in S504), the support apparatus 500 displays the setting screen of the SRA parameter 60 in a form in which the security function valid/invalid setting is possible (S508). For example, the support apparatus 500 sets the contents of the check box in the mark column 624 to an editable state on the screen related to the user interface 601 shown in fig. 12.

Next, the support apparatus 500 determines whether or not the valid/invalid setting of the security function is accepted (S510). Specifically, the support apparatus 500 determines whether the user has checked or canceled the check box of the mark column 624 on the screen related to the user interface 601 shown in fig. 12. If the valid/invalid setting of the security function is not accepted (no in S510), the support apparatus 500 repeats the process of S510 until the valid/invalid setting is accepted.

On the other hand, if the security function valid/invalid setting is accepted (yes in S510), the support apparatus 500 reflects the security function valid/invalid setting to the SRA parameter 60 (S512). Then, the support apparatus 500 determines whether or not a mapping of variables exists for the motion safety function 360 set to be invalid (S514). If there is no mapping of variables for the motion safety function 360 that is set to be invalid (no in S514), the support apparatus 500 ends the present process.

On the other hand, if the mapping of the variable exists for the sports security function 360 that is set to be invalid (yes in S514), the support apparatus 500 releases the variable corresponding to the sports security function 360 that is set to be invalid (S516), and notifies that the release has been made (S518). For example, the support apparatus 500 notifies the output window 670 shown in fig. 13 that the variable associated with the invalidated specific motion safety function 360 has been released.

Then, the support apparatus 500 prohibits the mapping of the variable of the motion safety function 360 set to be invalid (S520), and ends the present process.

In this way, the support apparatus 500 prohibits the use of the variable referred to in the security program 2104 related to the specific motion safety function 360 in response to the invalidation of the specific motion safety function 360 being designated. This can prevent the user from unintentionally setting the state of the variable referred to in the security program 2104 related to the disabled exercise security function 360.

Furthermore, the support apparatus 500 can notify the user that the use of the variable referred to in the security program 2104 related to the invalidated motion security function 360 has been prohibited.

SRA parameter reception processing

Next, SRA parameter reception processing performed by the secure drive 300 will be described. Fig. 16 is a flowchart for explaining the SRA parameter reception process executed by the secure driver 300 according to the present embodiment. In addition, the secure driver 300 executes the SRA parameter receiving process shown in fig. 16 upon receiving an initial command from the standard controller 100.

As shown in fig. 16, the secure drive 300 determines whether the SRA parameters 60 are received (S302). That is, the secure driver 300 determines whether the SRA parameter 60 is included in the initial command received from the standard controller 100. If the SRA parameters 60 are not received (NO in S302), the security driver 300 maintains the active/inactive settings of all the motion security functions 360 according to the information specified for the secure state 70 in the default state (S304). That is, all motion safety functions 360 are maintained active. Subsequently, the secure driver 300 ends the present process.

On the other hand, if the SRA parameters 60 have been received (yes in S302), the secure drive 300 sets the specific motion security function 360 to be valid/invalid according to the specification information of the SRA parameters 60 (S308). For example, as shown in fig. 11, when the secure driver 300 invalidates the SS2 and the SOS and receives the SRA parameter 60 including the designation information for designating the validation of the SDIp, the secure driver also invalidates the SS2 and the SOS and validates the SDIp in the designation information of the secure state 70. Subsequently, the secure driver 300 ends the present process.

In this way, the security driver 300 can change the active/inactive settings of the particular motion security function 360 from the default state based on the SRA parameters 60.

< J. safe instruction reception processing >

Next, a secure command reception process performed by the secure driver 300 will be described. Fig. 17 is a flowchart for explaining the security command reception process executed by the security driver 300 according to the present embodiment. Further, the security driver 300 executes the security instruction receiving process shown in fig. 17 after the connection in the field network 2 is established and the logical connection 4 is established.

As shown in fig. 17, the safety driver 300 determines whether a safety command is received from the safety controller 200 (S322). If the security command is not received (no in S322), the secure driver 300 ends the present process.

On the other hand, if the safety command has been received (yes in S322), the safety driver 300 determines whether the safety command includes the valid/invalid setting of the motion safety function 360 (S324). If the valid/invalid setting of the motion safety function 360 is not included in the safety command (no in S324), the safety driver 300 ends the present process.

On the other hand, if the security command includes the enable/disable setting of the motion safety function 360 (yes in S324), the security driver 300 performs the enable/disable setting of the specific motion safety function 360 based on the designation information included in the security command (S326). For example, as shown in fig. 11, when the secure driver 300 receives a secure command including designation information for validating the SS2 and invalidating the SS1, the SS2 is validated and the SS1 is invalidated in the designation information of the secure state 70. Subsequently, the secure driver 300 ends the present process.

In this way, the security driver 300 preferentially performs the active/inactive setting of the motion security function 360 according to the security command received after the logical connection 4 is established, compared to the active/inactive setting according to the SRA parameter 60 performed at the time of the initial command reception. In addition, the secure driver 300 updates the specifying information of the secure state 70 according to the latest valid/invalid setting at all times, either when the SRA parameter 60 is received or when a security command is received. Thus, the user can implement the motion safety function 360 based on the latest valid/invalid settings, regardless of which of the SRA parameters 60 and the safety command is.

< K. modification

In the above-described embodiment, the motion safety function 360 is implemented in accordance with the latest valid/invalid setting by the user regardless of the SRA parameter 60 and the safety command, but the invention is not limited thereto.

(k 1: valid/invalid setting with SRA parameter 60 as priority)

For example, as shown in fig. 18, the motion safety function 360 may be implemented by preferentially referring to the SRA parameters 60 as compared to the safety command. Fig. 18 is a flowchart for explaining the secure command receiving process executed by the secure driver 300a of the modification. Further, the security driver 300a executes the security command receiving process shown in fig. 18 after the connection in the field network 2 is established and the logical connection 4 is established.

As shown in fig. 18, the safety driver 300a determines whether a safety command is received from the safety controller 200 (S342). If the security command is not received (no in S342), the secure driver 300 ends the present process.

On the other hand, when the safety command is received (yes in S342), the safety driver 300a determines whether the safety command includes the valid/invalid setting of the sports safety function 360 (S344). If the valid/invalid setting of the motion safety function 360 is not included in the safety command (no in S344), the safety driver 300a ends the present process.

On the other hand, if the security command includes the valid/invalid setting of the motion security function 360 (yes in S344), the security driver 300a determines whether the valid/invalid setting of the motion security function 360 has been performed based on the specification information of the SRA parameter 60 received at the time of the initial command (S346).

If the setting of the activation/deactivation of the motion safety function 360 has not been performed based on the specification information of the SRA parameter 60 (no in S346), the security driver 300a performs the setting of the activation/deactivation of the specific motion safety function 360 based on the specification information of the security command (S348).

On the other hand, if the motion safety function 360 is set to be enabled/disabled based on the specification information of the SRA parameters 60 (yes in S346), the safety drive 300a maintains the enabled/disabled settings of all the motion safety functions 360 based on the specification information of the SRA parameters 60 with priority given to the specification information of the SRA parameters 60 (S350). After S348 or S350, the secure driver 300a ends the present process.

In this way, in the modification shown in fig. 18, the security driver 300a preferentially sets the motion security function 360 to be valid/invalid based on the SRA parameter 60 received together with the initial command, compared to the security command received after the logical connection 4 is established. Thus, even if the user unintentionally describes the source code of the wrong setting content, the wrong setting content is not reflected in the valid/invalid setting of the exercise safety function 360.

(k 2: setting valid/invalid according to the AND (AND) of the SRA parameter 60 AND the safety instruction)

For example, as shown in fig. 19 and 20, the motion safety function 360 may be implemented based on the and operation result of the flag of the specification information included in the SRA parameter 60 and the flag of the specification information included in the safety command. Fig. 19 is a flowchart for explaining the secure command receiving process executed by the secure driver 300b of the modification. Further, the security driver 300b executes the security command receiving process shown in fig. 19 after the connection in the field network 2 is established and the logical connection 4 is established. Fig. 20 is a schematic diagram showing an example of active or inactive transitions of the motion safety function 360 according to a modification.

As shown in fig. 19, the safety driver 300b determines whether or not a safety command is received from the safety controller 200 (S362). If the security command is not received (no in S362), the secure driver 300b ends the present process.

On the other hand, when the safety command is received (yes in S362), the safety driver 300b determines whether the safety command includes the valid/invalid setting of the motion safety function 360 (S364). If the valid/invalid setting of the motion safety function 360 is not included in the safety command (no in S364), the safety driver 300b ends the present process.

On the other hand, if the security command includes the valid/invalid setting of the motion security function 360 (yes in S364), the security driver 300b performs an and operation of the set valid/invalid setting and the valid/invalid setting specified by the specification information of the received security command with respect to the specific motion security function 360, and determines whether or not the and operation result is "0" (S366). For example, if the active/inactive setting of the motion safety function 360 has been performed based on the specification information of the SRA parameter 60, the safety driver 300b determines whether the and operation result of the active/inactive setting set by the SRA parameter 60 and the active/inactive setting specified by the specification information of the received safety command is "0".

If the and operation result is not "0" (no in S366), the security driver 300b sets the flag of the designation information of the security state 70 corresponding to the specific motion security function 360 as the operation target to "1" (S368). For example, as shown in fig. 20, when the flag of SOS is set to "1" by the SRA parameter 60, if the flag of SOS is "1" based on the designation information 80 of the safety command, the and operation result is "1". At this time, the secure driver 300b sets the flag of the SOS in the specification information of the secure state 70 to "1".

On the other hand, if the arithmetic result is "0" (yes in S366), the security driver 300b sets the flag of the designation information of the security state 70 corresponding to the specific motion security function 360 as the arithmetic object to "0" (S370). For example, as shown in fig. 20, when the flag of SS2 is set to "1" by the SRA parameter 60, if the flag of SS2 is "0" in accordance with the designation information 80 of the security command, the and operation result is "0". At this time, the secure drive 300b sets the flag of SS2 in the specification information of the secure state 70 to "0".

After S368 or S370, the safety driver 300b determines whether the operation is completed with respect to all the motion safety functions 360 (S372). If the operation has not been completed with respect to all the motion safety functions 360 (no in S372), the safety driver 300b repeats the process of S366 again. On the other hand, when the operation has been completed for all the motion safety functions 360 (yes in S372), the safety driver 300b ends the present process.

In this way, in the modification shown in fig. 19 and 20, the security driver 300b performs the valid/invalid setting of the motion security function 360 based on the and operation result of the flag of the specification information included in the SRA parameter 60 and the flag of the specification information included in the security command. Thus, the user can validate or invalidate the motion safety function 360 in consideration of both the SRA parameters 60 and the safety command, depending on the actual situation.

(k 3: valid/invalid setting based on the OR of the SRA parameter 60 and the Security instruction)

For example, as shown in fig. 21 and 22, the motion safety function 360 may be implemented based on the or operation result of the flag of the specification information included in the SRA parameter 60 and the flag of the specification information included in the safety command. Fig. 21 is a flowchart for explaining the secure command receiving process executed by the secure driver 300c of the modification. Further, the security driver 300c executes the security command receiving process shown in fig. 21 after the connection in the field network 2 is established and the logical connection 4 is established. Fig. 22 is a schematic diagram showing an example of active or inactive transitions of the motion safety function 360 according to a modification.

As shown in fig. 21, the safety driver 300c determines whether or not a safety command is received from the safety controller 200 (S382). If the security command is not received (no in S382), the security driver 300c ends the present process.

On the other hand, when the safety command is received (yes in S382), the safety driver 300c determines whether the safety command includes the valid/invalid setting of the motion safety function 360 (S384). If the valid/invalid setting of the motion safety function 360 is not included in the safety command (no in S384), the safety driver 300c ends the present process.

On the other hand, if the motion safety function 360 is included in the safety command (yes in S384), the safety driver 300c performs an or operation of the set valid/invalid setting and the valid/invalid setting specified by the specification information of the received safety command with respect to the specific motion safety function 360, and determines whether or not the or operation result is "0" (S386). For example, when the active/inactive setting of the motion safety function 360 has been performed based on the specification information of the SRA parameter 60, the safety driver 300c determines whether or not the or operation result of the active/inactive setting set by the SRA parameter 60 and the active/inactive setting specified by the specification information of the received safety command is "0".

If the or operation result is not "0" (no in S386), the security driver 300c sets the flag of the designation information of the security state 70 corresponding to the specific motion security function 360 as the operation target to "1" (S388). For example, as shown in fig. 22, when the flag of SS2 is set to "1" by the SRA parameter 60, if the flag of SS2 is "0" in accordance with the designation information 80 of the security command, the or operation result is "1". At this time, the secure driver 300c sets the flag of SS2 in the specification information of the secure state 70 to "1".

On the other hand, if the or operation result is "0" (yes in S386), the security driver 300c sets the flag of the designation information of the security state 70 corresponding to the specific motion security function 360 as the operation target to "0" (S390). For example, as shown in fig. 22, when the flag of STO is set to "0" by the SRA parameter 60, if the flag of STO is "0" in accordance with the designation information 80 of the security command, the or operation result is "0". At this time, the secure driver 300c sets the flag of STO in the designation information of the secure state 70 to "0".

After S388 or S390, the safety driver 300c determines whether the operations have been completed with respect to all the motion safety functions 360 (S392). If the operation has not been completed with respect to all the motion safety functions 360 (no in S392), the safety driver 300c repeats the process of S386 again. On the other hand, if the operation has been completed for all the motion safety functions 360 (yes in S392), the safety driver 300c ends the present process.

In this way, in the modification shown in fig. 21 and 22, the security driver 300c performs the valid/invalid setting of the motion security function 360 based on the or operation result of the flag of the specification information included in the SRA parameter 60 and the flag of the specification information included in the security command. Thus, the user can validate or invalidate the motion safety function 360 in consideration of both the SRA parameter 60 and the safety command, depending on the actual situation.

< L, attached notes >

As described above, the present embodiment includes the following disclosure.

[ Structure 1]

A control system (1) comprising:

a drive device (300) which is connected to the network (2), has at least one safety function, and drives the motor (400); and

a controller (100) that manages data exchange between devices including the drive devices connected to the network,

the controller transmits a parameter (60) related to setting of the drive device to the drive device via the network when a connection in the network is established,

the parameter includes designation information for designating validity or invalidity with respect to the at least one security function,

the drive device invalidates a specific security function specified as invalid by the specification information included in the parameter, among the at least one or more security functions.

[ Structure 2]

The control system according to structure 1, wherein the Parameter is a Safety-related Application Parameter (Safety-related Application Parameter).

[ Structure 3]

The control system according to configuration 1 or configuration 2, wherein the designation information includes information for designating validity or invalidity of each of the at least one or more safety functions with respect to a bit string in which bits corresponding to each of the at least one or more safety functions are arranged.

[ Structure 4]

The control system according to any one of structures 1 to 3, comprising:

a support device (500) that supports settings related to the at least one security function,

the support apparatus provides a user interface (600) for setting the designation information.

[ Structure 5]

The control system according to configuration 4, wherein the support device prohibits use of the variable referred to in the program (2104) related to the specific safety function in response to a case where the specific safety function of the at least one or more safety functions is specified to be invalid.

[ Structure 6]

The control system according to structure 5, wherein the support means notifies prohibition of use of the variable.

[ Structure 7]

The control system according to any one of structures 1 to 6, comprising:

a second controller (200) that transmits a safety command related to the operation of the at least one safety function to the drive device,

the security instruction includes second specifying information for specifying whether the at least one security function is valid or invalid, respectively,

the drive device activates or deactivates the at least one safety function based on the designation information included in the parameter and the second designation information included in the safety command.

[ Structure 8]

A control method is a control method in a control system (1),

the control system includes:

a drive device (300) which is connected to the network (2), has at least one safety function, and drives the motor (400); and

a controller (100) that manages data exchange between devices including the drive devices connected to the network,

the control method comprises the following steps:

at the time of connection establishment in the network, transmitting, by the controller, a parameter (60) containing specification information for specifying validity or invalidity, respectively, with respect to the at least one or more safety functions to the drive device via the network; and

and invalidating, by the drive device, a specific security function specified as invalid by the specification information included in the parameter, among the at least one or more security functions.

[ Structure 9]

A drive device (300) connected to a network (2), having at least one safety function and driving a motor (400), wherein

Managing the exchange of data between the devices comprising said drive devices connected to said network by a controller (100),

the drive device (300) comprises:

a receiving unit (302) that receives, from the controller via the network, a parameter (60) containing specification information for specifying whether the at least one security function is valid or invalid, respectively, when a connection in the network is established; and

and an invalidation unit (314) that invalidates a specific security function specified as invalid by the specification information included in the parameter, among the at least one or more security functions.

< M. advantage >

According to the control system 1 of the present embodiment, the user specifies the specific motion safety function 360 as invalid by using the SRA parameter 60, and thus, when a connection is established in the field network 2, the specific motion safety function 360 can be invalidated for the safety driver 300. Further, since the user can invalidate the specific motion safety function 360 by transmitting the SRA parameter 60 to the safety driver 300 via the field network 2, the execution performance of the control system 1 is not degraded as compared with the execution of the safety program 2104 separately prepared to invalidate the motion safety function 360.

The presently disclosed embodiments are to be considered in all respects as illustrative and not restrictive. The scope of the present invention is indicated by the claims rather than the description, and all changes which come within the meaning and range of equivalency of the claims are intended to be embraced therein.

Description of the symbols

1: control system

2: on-site network

4: logical connection

60: SRA parameters

70: safe state

80: specifying information

100: standard controller

102. 202, 312, 314, 502: processor with a memory having a plurality of memory cells

104. 204, 316, 504: main memory

106: upper network controller

108. 208, 302: on-site network controller

110. 210, 320, 510: storage container

112: memory card interface

114: memory card

116: local bus controller

118. 218, 518: processor bus

120. 220, 520: USB controller

150: standard control

170. 270, 370, 533: data communication layer

172. 272: management module

174. 274, 374: process data

200: safety controller

216: safe local bus controller

230: secure IO cell

240: security device

250: safety function

276. 376: logical connection layer

277: building module

278: security function state management engine

300. 300a, 300b, 300 c: safety driver

310: control unit

330: driving circuit

332: feedback receiving circuit

350: servo control

352: servo control execution engine

360: sports safety function

362: motion security function execution engine

378: motion security function state management engine

400: servo motor

402: three-phase AC motor

404: encoder for encoding a video signal

500: support device

506: input unit

508: output unit

512: optical drive

514: recording medium

530: operation accepting unit

532: parameter manager

600: communication frame

601. 602, 603: user interface

610: multi-view explorer bar

612: change-over switch

614: setting switch

616: parameter icon

618: I/O mapping icon

620. 650: picture frame

622: number column

624: mark column

630: secure communication frame

652: port fence

654: variable column

656: variable annotation column

670: output window

700: control word

702: position fence

704: name column

706: explanation column

1102. 2102: system program

1104: standard control program

1106. 2106, 3206: setting information

2104: security procedure

3202: servo control program

3204: exercise safety program

5104: support program

5106: project data

5108: standard control source program

5110: standard controller setting information

5114: security controller setting information

5116: secure drive setup information

5117: secure source program