Patent Description:
Safety controllers and safety systems including the same are being introduced at various manufacturing sites. A safety system is intended to prevent human safety from being threatened by automatically moving devices such as robots. In general, in order to safely use equipment and machinery used in many manufacturing sites, safety systems are often arranged independently of control devices that control the equipment and machinery.

A safety system typically comprises a safety controller that executes a safety program, a detection device that detects whether a person is present, approaches or the like, an input device that receives an emergency operation, an output device that actually stops equipment, machinery and the like, and the like.

Safety systems must employ safety components in accordance with international standards. International standards define various rules and regulations to ensure safety.

For example, <CIT> (PTL <NUM>) discloses a safety control system having a safety controller and a programmable controller. In the safety control system disclosed in Patent Literature <NUM>, for the safety controller, an input terminal unit to be in communication with an input device of safety standards, an output terminal unit to be in communication with an output device, and a diagnosis result output terminal unit for externally sending a normal/error signal are disposed. That is, an input signal from the input device of safety standards is directly input to the safety controller via an input circuit.

Further, PTL <NUM> discloses a function block memory unit which stores a plurality of function blocks by programming each ladder circuit for computing output signals which has to be determined based on input signals from each safety device according to a connection specification of the safety device. The ladder circuit satisfies a predetermined safety standard, and thus, the function blocks satisfying the safety standard are used. The program link unit sequentially links each function block received from the function block memory unit based on the ID number of each I/O module to automatically create the safety program. The corresponding function block can be uniquely determined based on the ID number.

Furthermore, PTL <NUM> discloses a control device that includes a plurality of communication units that receive data from measurement control devices; a control unit that calculates an operation signal for controlling a controlled device on the basis of the data from the communication units and that outputs the operation signal to the controlled device; a storage unit that stores the data; a first monitoring unit and a second monitoring unit that perform a calculation on the basis of the data to calculate a calculation value, that determine whether the calculation value satisfies a blocking condition, and that output a blocking signal when the calculation value satisfies the blocking condition; and a first blocking unit and a second blocking unit that block the operation signal to the controlled device upon receiving the blocking signal output from at least either one of the first monitoring unit and the second monitoring unit.

The safety control system disclosed in PTL <NUM> communicates signals with various safety devices via a safety interface (I/F) unit connected to a CPU unit by a system bus.

At an actual manufacturing site, it may be difficult due to spatial constraints, device layout, and the like to dispose a CPU unit with a safety interface (I/F) unit attached thereto. Therefore, there is a need for a configuration that allows more flexible data communication with safety components.

According to an embodiment of the present invention, a safety system comprises the features of claim <NUM>.

Preferably, the second communication unit and the first communication unit are configured to communicate data in accordance with periods or events independent of each other.

Preferably, the first and second communication units are configured to communicate data with their respective target safety components in accordance with transmission protocols independent of each other.

An embodiment of the present invention can provide a configuration that allows more flexible data communications with safety components.

The present invention will now be described in embodiments hereinafter in detail with reference to the drawings. Note that in the figures, identical or corresponding components are identically denoted, and accordingly, will not be described repeatedly.

Initially, an example in configuration of a safety system according to the present embodiment will be described. The safety system according to the present embodiment communicates data via one or more transmission lines with a detection device, an input device, and an output device (hereinafter, these devices will also collectively be referred to as "safety components") constituting the safety system.

In the present specification, a "safety component" may include not only the above-described detection device, input device and output device but also any device and apparatus necessary to ensure safety.

As used herein, a "transmission line" means any communication path and communication means for communicating signals or data between devices or units. For the transmission line, any communication medium such as a metal circuit, an optical circuit, and a radio signal can be used. Two or more of these communication media may be combined as desired. Specific transmission lines may include buses and networks. For a bus, for example, a daisy chain system may be adopted. As a network, typically, any fixed cycle network may be adopted. As such a fixed cycle network, a known network may be adopted such as EtherCAT®, EtherNet/IP®, DeviceNet®, CompoNet® or the like.

The safety system according to the present embodiment can communicate data with safety components via a plurality of transmission lines, respectively, and the transmission lines are independent of one another. That is, an event such as an error caused on one of the transmission lines does not have any effect on communication of data on another transmission line. A configuration for implementing such a function will be described later.

<FIG> schematically show an example in configuration of a safety system according to the present embodiment.

<FIG> shows a configuration allowing data communication with safety components via a bus and a field network. Specifically, <FIG> shows a safety system <NUM> comprising a safety controller <NUM> and one or more remote IO (input/output) devices <NUM>. Safety controller <NUM> and one or more remote IO devices <NUM> are connected via a field network <NUM>.

Safety controller <NUM> includes a central processing unit (CPU) unit <NUM>, a power supply unit <NUM>, a host communication unit <NUM>, a field communication unit <NUM>, a bus master unit <NUM>, and one or more safety IO units <NUM>.

Safety IO unit <NUM> is an example of a safety component, and collects data from a field referred to in a safety program (i.e., input data), and/or outputs to a field the data calculated by execution of the safety program (i.e., output data). Safety IO unit <NUM> is an IO unit having a safety-specific function in addition to the function of inputting and outputting a signal. The following description focuses on safety IO unit <NUM> as a typical example of a safety component. Note, however, that an entirety including various safety switches and safety detectors connected to safety IO unit <NUM> can also be regarded as a safety component.

CPU unit <NUM> is a computing device including a processor that executes a safety program. Note that the name "CPU unit" is for convenience, and for example, any implementation that is a computing device capable of executing a safety program by using any processor such as a GPU (graphic processing unit), rather than CPU, can be encompassed.

Power supply unit <NUM> supplies power having voltage necessary for CPU unit <NUM> and other units.

Host communication unit <NUM> manages and controls communication of data with a PLC (programmable controller) or the like. Field communication unit <NUM> manages and controls data communicated with other devices via field network <NUM>. Bus master unit <NUM> manages and controls communication of data between CPU unit <NUM> and safety IO unit <NUM> via a local bus <NUM>. These units involved in data transmission via transmission lines will be described more specifically hereinafter.

Remote IO device <NUM> includes a communication coupler unit <NUM> and one or more safety IO unit <NUM>. Communication coupler unit <NUM> is connected to CPU unit <NUM> of safety controller <NUM> and communication coupler unit <NUM> of another remote IO device <NUM> via field network <NUM>.

In the configuration shown in <FIG>, CPU unit <NUM> can communicate data with safety IO unit <NUM> via local bus <NUM>, and communicate data via field network <NUM> with safety IO unit <NUM> connected to communication coupler unit <NUM> of remote IO device <NUM>.

<FIG> shows a configuration allowing data communication with safety components via two mutually independent field networks. Specifically, <FIG> shows a safety system <NUM> including a safety controller <NUM> and a plurality of remote IO devices <NUM>. Safety controller <NUM> and the plurality of remote IO devices <NUM> are connected via field networks <NUM> and <NUM>, respectively.

Safety controller <NUM> includes CPU unit <NUM>, power supply unit <NUM>, host communication unit <NUM>, field communication units <NUM> and <NUM>, and one or more safety IO units <NUM>.

CPU unit <NUM>, power supply unit <NUM>, host communication unit <NUM>, and field communication unit <NUM> are similar to those described for safety controller <NUM> described above. Field communication unit <NUM> basically has the same configuration as field communication unit <NUM>, and manages and controls data communicated with another device via field network <NUM>.

Remote IO device <NUM> is similar to that described for safety controller <NUM> described above.

In the configuration shown in <FIG>, CPU unit <NUM> can communicate data via field network <NUM> with safety IO unit <NUM> connected to communication coupler unit <NUM> of remote IO device <NUM>, and communicate data via field network <NUM> with safety IO unit <NUM> connected to communication coupler unit <NUM> of remote IO device <NUM>.

<FIG> shows a configuration allowing communication of data with a safety component via a bus and a field network, and communication of data with a PLC or the like via a host network <NUM>. Specifically, <FIG> shows a safety system <NUM> including safety controller <NUM>, one or more remote IO devices <NUM>, one or more PLCs <NUM>, and a network hub <NUM>. CPU unit <NUM> and safety IO unit <NUM> are connected via local bus <NUM>, and safety controller <NUM> and one or more remote IO devices <NUM> are connected via field network <NUM>. Furthermore, safety controller <NUM> and one or more PLCs <NUM> are connected via host network <NUM>.

Safety controller <NUM> includes CPU unit <NUM>, power supply unit <NUM>, host communication unit <NUM>, field communication unit <NUM>, and one or more safety IO units <NUM>.

In the configuration shown in <FIG>, CPU unit <NUM> can communicate data via field network <NUM> with safety IO unit <NUM> connected to communication coupler unit <NUM> of remote IO device <NUM>, and communicate data via field network <NUM> with safety IO unit <NUM> connected to communication coupler unit <NUM> of remote IO device <NUM>. Furthermore, safety controller <NUM> can communicate data with one or more PLCs <NUM> via host network <NUM>.

Safety controller <NUM> is similar to that described above with reference to <FIG>. Host communication unit <NUM> of safety controller <NUM> is connected to one port of network hub <NUM>. One or more PLCs <NUM> are connected to other ports of network hub <NUM>. Safety controller <NUM> and one or more PLCs <NUM> are thus connected.

In the configuration shown in <FIG>, CPU unit <NUM> can communicate data with safety IO unit <NUM> via local bus <NUM>, and communicate data via field network <NUM> with safety IO unit <NUM> connected to communication coupler unit <NUM> of remote IO device <NUM>. Furthermore, safety controller <NUM> can communicate data with one or more PLCs <NUM> via host network <NUM>.

The configurations shown in <FIG> are merely examples, and any configuration can be adopted depending on the application of the safety system. As has been discussed above, the safety system according to the present embodiment can communicate data with a plurality of safety components via a plurality of transmission lines. In doing so, a configuration is adopted to prevent an effect caused on a transmission line from reaching another transmission line. Details will be described hereinafter.

While <FIG> show a CPU unit, a power supply unit, a host communication unit, a field communication unit, and a bus master unit each configured as an independent unit by way of example, some or all of the units may be integrated together or any unit may have a function thereof further separated.

Hereinafter, an example in configuration of safety controllers <NUM> and <NUM> included in the safety system according to the present embodiment will be described.

<FIG> schematically shows an example in configuration of a safety controller according to the present embodiment. Referring to <FIG>, safety controllers <NUM> and <NUM> include CPU unit <NUM>, host communication unit <NUM>, field communication units <NUM> and <NUM>, and bus master unit <NUM>. These units are connected via an internal bus <NUM>. Note that safety IO unit <NUM> is not shown for convenience of explanation. Safety controllers <NUM>, <NUM> may typically be configured with a PLC serving as a base.

CPU unit <NUM> includes a processor <NUM>, a memory <NUM> and a storage <NUM> as main components.

Processor <NUM> is connected to memory <NUM> and storage <NUM>, and reads a system program <NUM> and a safety program <NUM> that are stored in storage <NUM> into memory <NUM> and executes them to implement various types of processing as will be described hereinafter. Memory <NUM> is composed of a volatile storage device such as dynamic random access memory (DRAM) or static random access memory (SRAM). Storage <NUM> is composed of a nonvolatile storage device such as a flash memory or a hard disk. Storage <NUM> has stored therein system program <NUM> for controlling CPU unit <NUM> and units associated therewith, and in addition thereto, safety program <NUM> designed depending on the target equipment and the like.

Host communication unit <NUM> provides an interface allowing CPU unit <NUM> to communicate data with another device (such as PLC <NUM>) via host network <NUM>. Host communication unit <NUM> includes, as main components, a reception circuit (RX) <NUM>, a reception buffer <NUM>, a transmission and reception controller <NUM>, a transmission buffer <NUM>, and a transmission circuit (TX) <NUM>.

Reception circuit <NUM> receives a packet transmitted on host network <NUM>, and writes data stored in the received packet to reception buffer <NUM>. Transmission and reception controller <NUM> sequentially reads received packets written in reception buffer <NUM>, and outputs to processor <NUM> only read data that is necessary for processing in CPU unit <NUM>. In response to a command received from processor <NUM>, transmission and reception controller <NUM> sequentially writes to transmission buffer <NUM> data or packets to be transmitted to another device. In accordance with a timing of transferring a packet on host network <NUM>, transmission circuit <NUM> sequentially sends out data stored in transmission buffer <NUM>.

Field communication unit <NUM> provides an interface allowing CPU unit <NUM> to communicate data with one or more safety IO units <NUM> via field network <NUM>. Field communication unit <NUM> includes, as main components, a reception circuit (RX) <NUM>, a reception buffer <NUM>, a transmission and reception controller <NUM>, a transmission buffer <NUM>, and a transmission circuit (TX) <NUM>. These components are functionally, substantially identical or similar to the corresponding components of host communication unit <NUM>, and accordingly, will not be described repeatedly.

Similarly, field communication unit <NUM> provides an interface allowing CPU unit <NUM> to communicate data with one or more safety IO units <NUM> via field network <NUM>. Field communication unit <NUM> includes, as main components, a reception circuit (RX) <NUM>, a reception buffer <NUM>, a transmission and reception controller <NUM>, a transmission buffer <NUM>, and a transmission circuit (TX) <NUM>. These components are functionally, substantially identical or similar to the corresponding components of field communication unit <NUM>, and accordingly, will not be described repeatedly.

Bus master unit <NUM> provides an interface for communicating data via local bus <NUM> with one or more safety IO units <NUM> attached to CPU unit <NUM>. Bus master unit <NUM> includes, as main components, a reception circuit (RX) <NUM>, a reception buffer <NUM>, a transmission and reception controller <NUM>, a transmission buffer <NUM>, and a transmission circuit (TX) <NUM>. These components are functionally, substantially identical or similar to the corresponding components of host communication unit <NUM> or field communication units <NUM>, <NUM>, and accordingly, will not be described repeatedly.

In the following description, host communication unit <NUM>, field communication units <NUM> and <NUM>, and bus master unit <NUM> will collectively be referred to as a "communication unit. " In the present specification, a "communication unit" means any communication unit responsible for communicating data via a corresponding transmission line. The "communication unit" communicates data with one or more components (typically, safety components) via a corresponding transmission line. Note that internal bus <NUM> shown in <FIG> functions as an interface for connecting processor <NUM> to one or more communication units.

As shown in <FIG>, in CPU unit <NUM> of the safety system according to the present embodiment, each communication unit can communicate uniquely without being affected by other communication units. That is, each communication unit performs processing relating to data communication independently of one another. In order to implement such processing, a memory structure as will be described hereinafter may be employed.

Transmission and reception controllers <NUM>, <NUM>, <NUM>, and <NUM> in the communication units described above may be implemented by implementation of hardware such as an application specific integrated circuit (ASIC) or a fieldprogrammable gate array (FPGA) or by implementation of a micro processor and firmware or similar software. Alternatively, processor <NUM> may be responsible for a portion or all of a process that each transmission and reception controller performs.

CPU unit <NUM> of the safety system may adopt a configuration in which the main components such as processor <NUM>, memory <NUM>, and storage <NUM> are all or partially duplicated depending on performance required.

Hereinafter, an example of a memory structure in CPU unit <NUM> of the safety system according to the present embodiment will be described. The safety system according to the present embodiment is such that an event such as an error caused on one of transmission lines does not have any effect on communication of data on another transmission line. In order to implement such a function, in CPU unit <NUM>, independent data areas are allocated to units responsible for communicating data on transmission lines, respectively, and an environment is provided in which a safety program easily accesses to data stored in the respective data areas. That is, in memory <NUM> of CPU unit <NUM> of the safety system according to the embodiment, a data area holding data communicated by a communication unit and a data area holding data communicated by another communication unit are arranged independently of each other. Hereinafter, an example of a configuration in which each data area is arranged independently of each other will be described.

<FIG> schematically shows an example of a memory structure in CPU unit <NUM> of the safety system according to the present embodiment. <FIG> shows a configuration in which four communication units (host communication unit <NUM>, field communication units <NUM> and <NUM>, and bus master unit <NUM>) are attached to CPU unit <NUM>.

Memory <NUM> of CPU unit <NUM> is provided with IO data areas <NUM> to <NUM> allocated to their respective communication units. In IO data areas <NUM> to <NUM>, data received via their respectively associated communication units (input data) and data sent from their respectively associated communication units (output data) are stored and updated as occasion demands. As used herein, "IO data" includes at least one of input data and output data.

In the example shown in <FIG>, IO data areas <NUM>, <NUM>, <NUM> and <NUM> are allocated to host communication unit <NUM>, field communication unit <NUM>, field communication unit <NUM>, and bus master unit <NUM>, respectively. Note that IO data area <NUM> is allocated for reservation.

Such a correspondence between the IO data areas and the communication units is defined by a setting for collecting IO data, and can be set as desired. That is, the IO data areas allocated to the communication units can be set as desired.

<FIG> schematically shows an example of a user interface screen for implementing an allocation of an I/O data area in CPU unit <NUM> of the safety system according to the present embodiment. <FIG> shows a user interface screen <NUM> provided by a support device (not shown) or the like connected to CPU unit <NUM>. User interface screen <NUM> is provided with type indications <NUM> to <NUM> for communication units connected to CPU unit <NUM>, and selection dialogs <NUM> to <NUM> indicating which IO data area is to be allocated to each of type indications <NUM> to <NUM>.

The user operates each of selection dialogs <NUM> to <NUM> to set to which IO data area each communication unit is to be allocated. User interface screen <NUM> allows a user to easily set an IO data area to be allocated to any communication unit attached to CPU unit <NUM>.

Thus, a correspondence can be made between IO data areas and communication units flexibly in accordance with a setting for collecting IO data, and any type and number of communication units can be attached to CPU unit <NUM>. That is, no matter what communication unit may be adopted as a component of the safety controller, in CPU unit <NUM> IO data communicated via each communication unit can be accessed without mutually being affected by the communication units.

More specifically, when processor <NUM> executes system program <NUM> and safety program <NUM>, one or more system tasks <NUM> and one or more application tasks <NUM> are repeatedly executed periodically as prescribed or in response to a prescribed event. A work memory area <NUM> is formed in memory <NUM> for these tasks to refer to data.

Work memory area <NUM> includes an IO variable area <NUM> associated with IO data areas <NUM> to <NUM>, an internal variable area <NUM>, and a system variable area <NUM>. Work memory area <NUM> arranged in memory <NUM> corresponds to a memory area to which the safety program executed by processor <NUM> refers. Work memory area <NUM> includes IO variable area <NUM> respectively associated with IO data areas <NUM> to <NUM> allocated to their respectively associated communication units.

IO variable area <NUM> is an area for a task executed in processor <NUM> to refer to or update IO data. IO variable area <NUM> is sectioned into IO variable areas <NUM> to <NUM>, and each sectioned area is managed to synchronize with a corresponding one of the IO data areas <NUM> to <NUM>. The sectioned areas of IO variable area <NUM> and IO data areas <NUM> to <NUM> are defined by a variable allocation setting.

The variable allocation setting defines variable names, variable ranges and the like for referring to data (or values) stored in IO data areas <NUM> to <NUM>. Such a variable name for referring to data may be set, as desired, under a predetermined condition. Note that it is not essential to define a variable for reference, and the addresses of IO data areas <NUM> to <NUM> may per se be directly designated.

Internal variable area <NUM> is an area for holding a variety of types of variables necessary for executing a task in processor <NUM>. For example, in internal variable area <NUM>, a variable value (or an instance value) or the like necessary for executing a task is stored.

System variable area <NUM> is an area for holding values indicating an execution of a task in CPU unit <NUM>, a state of each part of CPU unit <NUM>, and the like. For example, a flag value indicating whether CPU unit <NUM> is normally operating is stored.

System program <NUM> and safety program <NUM> executed in processor <NUM> refer to a necessary value stored in work memory area <NUM>, and update the necessary value depending on a result of processing or the like.

Although <FIG> shows an exemplary configuration in which a plurality of IO data areas are each independently arranged in common memory <NUM>, separate memories respectively corresponding to the IO data areas may be prepared or separate circuits may be provided for communicating IO data with the communication units.

As described above, the safety system according to the present embodiment provides an IO data area and a corresponding IO variable area prepared for each communication unit so that even when any type and number of communication units are attached, mutually independent processes can be performed. This can prevent a failure or the like caused in any communication unit from affecting another communication unit.

In the safety system according to the present embodiment, each communication unit (host communication unit <NUM>, field communication units <NUM> and <NUM>, bus master unit <NUM>, etc.) attached to CPU unit <NUM> manages communication processing performed on a transmission line. Management of communication processing includes detection of any error that can occur on each transmission line, loss of data transmitted, detection of an error that can occur in a recipient or sender device or unit, and the like.

How periodically or when each communication unit communicates data on the corresponding transmission line can also be independent of the other communication units. That is, a plurality of communication units attached to the same CPU unit <NUM> can communicate data in accordance with periods or events independent of each other. This is implemented by using dedicated IO data areas <NUM> to <NUM> previously allocated to the respective communication units.

In doing so, transmission protocols used by the communication units respectively to communicate data via the respective transmission lines can also be determined independently of one another. That is, each communication unit communicates data with a target safety component according to a different transmission protocol.

Meanwhile, performing synchronous processings (or refresh processings) between the work memory area <NUM> IO variable area <NUM> and IO data areas <NUM> to <NUM> all together can also reduce temporal offset of IO data in executing safety program <NUM>. As a matter of course, synchronous processings (or refresh processings) between IO variable area <NUM> and IO data areas <NUM> to <NUM> may each be performed as uniquely timed.

From the safety program's viewpoint, as has been described above, what communication path is followed to take input data from the side of a field, that is, from safety IO unit <NUM>, into CPU unit <NUM>, and what communication path is followed to send the output data calculated in CPU unit <NUM> to safety IO unit <NUM> are abstracted. Accordingly, whatever transmission line and transmission protocol may be adopted, the same safety program can also be adopted.

That is, the safety system according to the present embodiment can enhance a safety program in versatility and reusability.

In the example of the configuration of the safety system as shown in <FIG> described above, for example, a network according to EtherCAT® can be adopted as field network <NUM>, and a network according to EtherNet/IP® can be adopted as field network <NUM>. These two systems are both Ethernet® based transmission protocols, and allow similar hardware to be adopted. When such different transmission protocols can be supported by a single CPU unit <NUM>, safety IO units which support different communication systems can be used by the same safety controller, which can for example reduce a burden on a cost in introducing a safety system.

While in the embodiment described above an example has been illustrated in which data is communicated between CPU unit <NUM> and a safety component via a transmission line, a target of communication of data via a transmission line is not necessary be a safety component. For example, a plurality of communication units are connected to the same CPU unit <NUM>, and one communication unit may communicate data with a safety component via the corresponding transmission line, while another communication unit may communicate data with a normal, control component (for example, various operation switches, various detectors, and the like) via the corresponding transmission line. That is, the safety system according to the present embodiment allows data communications via respective transmission lines to be performed independently of one another, and data having different purposes and characteristics may be transmitted on the respective transmission lines.

Thus, according to the present embodiment, a system depending on the equipment of interest can be easily constructed.

According to the present embodiment, any type and number of communication units can be attached to CPU unit <NUM>. The number and type of communication units to be attached can be appropriately selected depending on the environment in which the safety system of interest is installed. Such flexibility of communication units allows an approach such as adopting any field bus, as appropriate, to be taken for example when it is necessary to introduce safety IO units exceeding a maximum number of thereof connectable to a local bus extending from the bus master unit. In contrast, in a method for connection by the local bus extending from the bus master unit, when a sufficient installation space can be ensured, a field bus or the like can be dispensed with, and the local bus can alone be used to reduce cost.

Thus, the safety system according to the present embodiment allows a flexible system configuration to be adopted in accordance with constraints on footprint, cost and the like.

Moreover, the safety system according to the present embodiment, allowing one or more communication units to be attached to a CPU unit, allows these communication units to communicate data via their own transmission lines without interfering with one another. Accordingly, when a system configuration including a plurality of communication units and a plurality of transmission lines respectively corresponding thereto or the like is adopted, it can adopt different transmission protocols for them or the same transmission protocol for them. Furthermore, a form of use is also possible in which data communication is performed with a safety component through a communication unit, while data necessary for normal control is communicated through another communication unit.

By adopting such a configuration in which mutually independent communication units can be attached, even if any error occurs in any communication unit or a transmission line connected thereto, data communication with another communication unit is continued, which can enhance the operation rate or working rate of the entire system, including the safety system, and thus contribute to stable operation of equipment.

It should be understood that the presently disclosed embodiments have been described for the purpose of illustration only and in a non-restrictive manner in any respect. The scope of the present invention is defined by the terms of the claims, rather than the above description, and is intended to include any modifications within the meaning and scope equivalent to the terms of the claims.

Claim 1:
A safety system (<NUM>, <NUM>, <NUM>) comprising:
a memory (<NUM>);
a processor (<NUM>) connected to the memory (<NUM>) and configured to execute a safety program (<NUM>);
a first communication unit (<NUM>, <NUM>, <NUM>, <NUM>), connected to the memory (<NUM>) via an internal bus (<NUM>), configured to communicate data with one or more first safety components (<NUM>) via a first transmission line (<NUM>, <NUM>, <NUM>, <NUM>); and
a second communication unit (<NUM>, <NUM>, <NUM>, <NUM>), connected to the memory (<NUM>) via the internal bus (<NUM>), configured to communicate data with one or more second safety components (<NUM>) via a second transmission line (<NUM>, <NUM>, <NUM>, <NUM>), wherein
the second communication unit and the first communication unit (<NUM>, <NUM>, <NUM>, <NUM>) are configured to independently of each other perform communication processing via the respective transmission lines (<NUM>, <NUM>, <NUM>, <NUM>) in accordance with respective transmission protocols,
the memory (<NUM>) includes
a first data area (<NUM>-<NUM>), dedicated to the first communication unit (<NUM>, <NUM>, <NUM>, <NUM>), that holds data communicated by the first communication unit (<NUM>, <NUM>, <NUM>, <NUM>),
a second data area (<NUM>-<NUM>), dedicated to the second communication unit (<NUM>, <NUM>, <NUM>, <NUM>), that holds data communicated by the second communication unit (<NUM>, <NUM>, <NUM>, <NUM>) which is arranged independently of the first data area (<NUM>-<NUM>), and
the safety system being characterized in that:
the memory further includes a work memory area corresponding to a memory area to which the safety program executed by the processor refers and wherein the work memory area includes an IO variable area including a plurality of memory areas respectively associated with the first data area and the second data area allocated to their respectively associated communication units;
wherein the respectively associated memory areas are configured to be synchronized with its corresponding data area;
the safety system further comprises means for providing a user interface screen configured to receive allocation from a user to set which data area each communication unit is to be allocated.