Patent Description:
In many manufacturing sites, the introduction of safety systems is progressing in order to use facilities and machines safely. The safety systems are used to provide safety functions conforming to international standards, and include safety components such as a safety controller, a safety sensor, a safety switch, and a safety relay.

A safety system is also required to provide the safety function to a drive device that drives a servomotor or the like for driving a facility or a machine. In a safety system, Ethernet for Control Automation Technology (EtherCAT) (registered trademark) may be employed as a network for exchanging data, and Non-Patent Literature <NUM> discloses some provisions regarding safety functions in the standards of the EtherCAT Technology Group (ETG) which is an organization related to EtherCAT.

Siemens Ag Katalog provides a catalog for the motion control drives of SINAMICS S120 and SIMOTICS. Siemens Ag provides a startdrive software for configuring SINAMICS S120.

According to the provisions disclosed in Document: ETG. <NUM>(R) V1. <NUM>, all safety functions executed by a drive device are set in advance to be enabled as a default. More specifically, in designation information for designating enabling or disabling of the safety functions, all flags assigned to respective bits of a first byte are fixed to flags indicating enabling.

However, in the actual use, there may be cases where enabled/disabled settings of the safety functions are required to be changed depending on work details in a process, such as enabling the safety functions in one process and disabling the safety functions in another process. In such a case, a user is required to separately prepare a program for changing the enabled/disabled settings of the safety functions from the default state, which may increase an amount of work. In the programming work, since source code is required to be written, there is a risk that the user will unintentionally write erroneous setting details.

The present invention has been made to solve the above problems, and an objective thereof is to facilitate setting of enabling or disabling of safety functions.

The present invention is provided by the subject-matter of the independent claims. The following disclosure serves a better understanding of the present invention. According to an example of the present disclosure, there is provided a control system. The control system includes a drive device that has at least one or more safety functions and drives a motor; a controller that outputs a command related to the at least one or more safety functions to the drive device according to a safety program; and a support device that supports development of the safety program. The safety program includes information for disabling a specific safety function among the at least one or more safety functions. The support device includes a reception unit that receives designation, given by a user, of enabling or disabling of each of the at least one or more motion safety functions, a generation unit that generates the safety program in accordance with the designation of enabling or disabling received by the reception unit, and a transfer unit that transfers the safety program generated by the generation unit to the controller.

According to this disclosure, the user designates enabling or disabling of a specific safety function for the support device, and thus the safety program is generated in accordance with the designation of enabling or disabling and is transferred to the controller. Consequently, the user can generate the safety program for designating enabling or disabling of the specific safety function without writing source code, and can easily set enabling or disabling of the safety function.

In the above disclosure, the support device provides a user interface for receiving the designation of enabling or disabling of each of the at least one or more safety functions via the reception unit.

According to this disclosure, the user can designate enabling or disabling of each of the at least one or more safety functions by using the user interface provided by the support device.

In the above disclosure, the support device provides a user interface for receiving the designation of enabling or disabling of each of the at least one or more safety functions via the reception unit for a specific drive device selected from among a plurality of the drive devices.

According to this disclosure, the user can designate enabling or disabling of each of the at least one or more safety functions by using the user interface provided by the support device for the specific drive device selected from among a plurality of the drive devices.

In the above disclosure, in response to designation of disabling of the specific safety function among the at least one or more safety functions, the support device prohibits use of a variable referred to by the safety program related to the specific safety function.

According to the invention, it is possible to prevent a situation in which the user unintentionally sets the variable referred to by a program related to the disabled safety function.

In the above disclosure, the support device provides a notification of prohibition of use of the variable.

According to this disclosure, it is possible to notify the user that the variable referred to by a program related to the disabled safety function is prohibited from being used.

According to the invention, the safety program generated by the generation unit is uneditable by the user.

According to this disclosure, since the safety program generated by the support device is not able to be edited by the user, it is possible to prevent the occurrence of a problem that set details of enabling or disabling of a safety function designated for the support device by the user do not coincide with set details in the safety program generated by the support device.

According to the invention, there is provided a support device that supports development of a safety program related to at least one or more safety functions executed by a controller controlling a drive device driving a motor. The safety program includes information for disabling a specific safety function among the at least one or more safety functions. The support device includes a reception unit that receives designation, given by a user, of enabling or disabling of each of the at least one or more safety functions; a generation unit that generates the safety program in accordance with the designation of enabling or disabling received by the reception unit; and a transfer unit that transfers the safety program generated by the generation unit to the controller.

According to the invention, the user designates enabling or disabling of a specific safety function for the support device, and thus the safety program is generated in accordance with the designation of enabling or disabling and is transferred to the controller. Consequently, the user can generate the safety program for designating enabling or disabling of the specific safety function without writing source code, and can thus easily set enabling or disabling of the safety function.

According to the invention, there is provided a support program for supporting development of a safety program related to at least one or more safety functions executed by a controller controlling a drive device driving a motor. The support program includes information for disabling a specific safety function among the at least one or more safety functions. The support program causes a computer to execute receiving designation, given by a user, of enabling or disabling of each of the at least one or more safety functions; generating the safety program in accordance with the received designation of enabling or disabling; and transferring the generated safety program to the controller.

According to the present invention, it is possible to facilitate setting of enabling or disabling of safety functions.

An embodiment of the present invention will be described with reference to the drawings. The same or similar portions in the drawings will be given the same reference numeral, and description thereof will not be repeated.

First, an application example of the present invention will be described.

<FIG> is a schematic diagram illustrating the invention. The control system <NUM> according to the present embodiment provides not only safety functions defined in, for example, IEC <NUM> but also some safety functions related to a drive device, such as safe torque off (STO), safe stop <NUM> (SS1), safe stop <NUM> (SS2), and safe operation stop (SOS) defined in Non-Patent Literature <NUM> ("IEC <NUM>-<NUM>-<NUM>: <NUM> Adjustable speed electrical power drive systems - Part <NUM>-<NUM>: Safety requirements - Functional", International Electrotechnical Commission, <NUM>-<NUM>-<NUM>).

With reference to <FIG>, the control system <NUM> generally includes a standard controller <NUM>, and a safety controller <NUM> and one or a plurality of safety drivers (safety servo drivers) <NUM> connected to the standard controller <NUM> via a field network <NUM>. Each of the safety drivers <NUM> drives a servomotor <NUM> electrically connected thereto. The servomotor <NUM> is only an example, and any type of motor may be used. An entity of the safety driver <NUM> may be a servo driver, and may be a general-purpose inverter device. In the following description, the safety driver <NUM> will be described as an example of a "drive device".

The standard controller <NUM> executes standard control (standard control <NUM> that will be described later) on control targets including the servomotor <NUM> according to a standard control program (a standard control program <NUM> that will be described later) that is created in advance. Typically, the standard controller <NUM> executes control calculation in a cyclic manner in accordance with input signals from one or a plurality of sensors (not illustrated) to calculate commands for an actuator such as the servomotor <NUM> in a cyclic manner.

The safety controller <NUM> corresponds to a "controller", and transmits a safety command related to an operation of a safety function (a safety function <NUM> that will be described later) to the safety driver <NUM> according to a safety program (a safety program <NUM> that will be described later). The safety controller <NUM> executes monitoring and control calculation for realizing the safety function <NUM> for a control target in a cyclic manner separately from the standard controller <NUM>.

The safety controller <NUM> may receive an input signal from any safety device <NUM> and/or may output a command to any safety device <NUM>. The safety program <NUM> is created in advance by a user by using a development environment provided by a support device <NUM> that is communicatively connected to the safety controller <NUM>, and is transferred to the safety controller <NUM>.

The safety driver <NUM> supplies power to the servomotor <NUM> in response to a command from the standard controller <NUM> to drive the servomotor <NUM>. The safety driver <NUM> calculates a rotation position, a rotation speed, a rotation acceleration, and a generated torque of the servomotor <NUM> in a cyclic manner on the basis of a feedback signal or the like from the servomotor <NUM>.

The safety driver <NUM> executes a predetermined motion safety function (a motion safety function <NUM> that will be described later) related to driving of the servomotor <NUM> in response to a safety command from the safety controller <NUM>. More specifically, the safety driver <NUM> provides state information necessary for a safety function to the safety controller <NUM>, and executes a motion safety program (a motion safety program <NUM> that will be described later) corresponding to a required safety function to adjust or interrupt power supplied to the servomotor <NUM>.

The servomotor <NUM> has a motor (a three-phase AC motor <NUM> that will be described later) that is rotated by receiving power from the safety driver <NUM>, and outputs a detection signal as a feedback signal from an encoder (an encoder <NUM> that will be described later) coupled to a rotation shaft of the motor to the safety driver <NUM>.

The support device <NUM> supports development on the standard controller <NUM> side and development on the safety controller <NUM> side. More specifically, the support device <NUM> supports development of a standard control program (the standard control program <NUM> that will be described later) executed by the standard controller <NUM>, setting related to the standard control <NUM>, and the like as the development on the standard controller <NUM> side. The support device <NUM> supports development of a safety program (the safety program <NUM> that will be described later) executed by the safety controller <NUM>, setting related to the safety function <NUM>, and the like as the development on the safety controller <NUM> side. The support device <NUM> combines one or more pieces of instruction information with each other to provide development environments (a program creation/editing tool, a parser, a compiler, and the like) for generating a program to a user.

In the present specification, "device" is a general term for devices that can perform data communication with other devices via any network such as the field network <NUM>. In the control system <NUM> according to the present embodiment, the "device" includes the standard controller <NUM>, the safety controller <NUM>, and the safety driver <NUM>.

In the present specification, the terms "standard control" and "safety control" are used in contrast. "Standard control" is a general term for processes for controlling a control target according to a predefined requirement specification. On the other hand, "safety control" is a general term for processes for preventing human safety from being threatened by facilities or machines. The "safety control" is designed to satisfy the requirements for realizing the safety functions defined in IEC <NUM> and the like.

In the present specification, safety functions specific to the drive device (safety driver <NUM>) are collectively referred to as a "motion safety function" or simply a "safety function". Typically, the "function" includes the safety functions related to the drive device defined in Non-Patent Literature <NUM> described above. For example, the "function" includes control for monitoring a position or a speed of a control shaft to secure safety.

In the present specification, "process data" is a general term for data used in at least either the standard control or the safety control. Specifically, the "process data" includes input information that is acquired from a control target, output information that is output to the control target, internal information that is used for control calculation in each device, and the like.

The input information includes, for example, an ON/OFF signal (digital input) detected by a photoelectric sensor or the like, a physical signal (analog input) detected by a temperature sensor or the like, and a pulse signal (pulse input) generated by a pulse encoder or the like. The output information includes, for example, ON/OFF (digital output) for driving a relay or the like, a speed command (analog output) for giving an instruction for a rotation speed or the like of a servomotor, and a displacement command (pulse output) for giving an instruction for a movement amount or the like of a step motor. The internal information includes, for example, state information determined through control calculation in which any process data is input.

In the field network <NUM> of the control system <NUM>, process data communication is performed, and a communication frame <NUM> is circulated in a cyclic manner (for example, every several to several tens of msec) among devices with the standard controller <NUM> as a communication master. A cycle in which the communication frame <NUM> is transferred will be referred to as a process data communication cycle. In the present embodiment, EtherCAT is used as an example of a protocol for the field network <NUM> via which the communication frame <NUM> is transferred in a cyclic manner.

A data region is allocated to each device in the communication frame <NUM>. When the communication frame <NUM> transferred in a cyclic manner is received, each device writes the current value of preset data into a data region allocated to the device in the received communication frame <NUM>. The communication frame <NUM> in which the current value has been written is sent to the device in the next stage. The current value of data written by each device can be referred to by other devices.

Since each device writes the current value of the present data into the communication frame <NUM>, the communication frame <NUM> that is circulated through the field network <NUM> and returned to the communication master (standard controller <NUM>) includes the latest value collected by each device.

In the present embodiment, a logical connection <NUM> is formed between the safety controller <NUM> and each safety driver <NUM> by using the process data communication. The logical connection <NUM> is used to exchange data for realizing the safety function <NUM>.

As described above, in a case where EtherCAT is used as a protocol for the field network <NUM>, the logical connection <NUM> may be formed by using a protocol called FailSafe over EtherCAT (FSoE).

More specifically, a dedicated data region for storing commands exchanged to form the logical connection <NUM> is allocated to the communication frame <NUM>. The logical connection <NUM> is formed by exchanging commands between the devices by using the dedicated data region.

As illustrated in <FIG>, each safety driver <NUM> stores a safety status <NUM> for managing enabling or disabling of the motion safety function <NUM>. The motion safety function <NUM> realized by the safety driver <NUM> includes safe torque off (STO), safe stop <NUM> (SS1), safe stop <NUM> (SS2), safe operation stop (SOS), safe speed range (SSR), safe direction positive (SDIp), and safe direction negative (SDIn). Designation information for designating enabling or disabling of each motion safety function <NUM> is disposed in a region provided for each bit included in the safety status <NUM>. Error acknowledge (Error Ack) is a function for canceling an error when an error occurs, and is enabled at all times.

Each safety driver <NUM> has only the motion safety function <NUM> that is determined in advance. For example, the specific safety driver <NUM> does not have SSR and has the other functions such as STO, SS1, SS2, SOS, SDIp, and SDIn among the motion safety functions <NUM> illustrated in <FIG>. This is only an example, and the remaining safety drivers <NUM> also have only the motion safety functions <NUM> that are determined in advance.

The safety driver <NUM> enables or disables each motion safety function <NUM> according to the designation information included in the safety status <NUM>. The "designation information" may be any information as long as the information is used to designate enabling or disabling of each of the motion safety functions <NUM>. In the present embodiment, the designation information designates enabling or disabling with a flag represented by "<NUM>" or "<NUM>". More specifically, when the flag is "<NUM>", the motion safety function <NUM> is enabled, and, when the flag is "<NUM>", the motion safety function <NUM> is disabled.

Flags are fixed such that all of the motion safety functions <NUM> are enabled during starting (that is, as a default), and details thereof cannot be changed by a user. In other words, all of the motion safety functions <NUM> are fixed to be enabled as a default. This is required in the provisions disclosed in Document: ETG. <NUM>(R) V1. <NUM> described above.

Here, with reference to <FIG>, enabling/disabling setting of the security functions in the safety status <NUM> defined in the ETG standards will be described. <FIG> is a schematic diagram illustrating information of a first byte for designating enable/disable setting of safety functions defined in the ETG standards.

As illustrated in <FIG>, Document: ETG. <NUM>(R) V1. <NUM> discloses information of a first byte for designating enable/disable setting of safety function. Specifically, control words <NUM> related to the motion safety functions <NUM> disclosed in Document: ETG. <NUM>(R) V1. <NUM> include a bit field <NUM>, a name field <NUM>, and a description field <NUM>. The respective bits such as a zeroth bit to a seventh bit included in the first byte are disposed in the bit field <NUM>. An abbreviated name of the motion safety function <NUM> correlated with each bit is displayed in the name field <NUM>. An official name of each motion safety function <NUM> and an operating state associated with the flag are displayed in the description field <NUM>.

In the present embodiment, the flags are fixed to "<NUM>" indicating enabling in a default state with respect to all of the motion safety functions <NUM>. Each motion safety function <NUM> is required to be set to the flag of "<NUM>" as a default.

In the first byte in which enable/disable setting of the safety function as illustrated in <FIG> is designated, the flag in each bit from the zeroth bit to the seventh bit is fixed to "<NUM>" as a default, and the default state cannot be changed by the user. Although not illustrated, the default state can be changed by the user in a second byte.

"Enabling" of the safety function refers to that a function for performing safety control is in an operating state. For example, STO, SS1, SS2, SOS, and SSR are "active" when the flag is "<NUM>". This indicates that the functions for performing safety control are in an operating state. SDIp and SDIn are "disabled" when the flag is "<NUM>". This indicates that the motor is prohibited from operating in a positive direction or a negative direction, that is, the functions for performing safety control are in an operating state.

On the other hand, "disabling" of the safety function refers to that the functions for performing safety control is in a non-operating state. For example, STO, SS1, SS2, SOS, and SSR are "deactivated" when the flag is "<NUM>". This indicates that the functions for performing safety control are in a non-operating state. SDIp and SDIn are "enabled" when the flag is "<NUM>". This indicates that the motor is permitted to operate in the positive direction or the negative direction, that is, the functions for performing safety control are in a non-operating state.

With reference to <FIG> again, in each safety driver <NUM>, the flags corresponding to all of the motion safety functions <NUM> are set to "<NUM>" as a default regardless of whether or not the motion safety functions <NUM> is installed. Thus, regarding the installed motion safety function <NUM>, the default setting is fixed to enabling, so that the function is enabled. In a case where there is the uninstalled motion safety function <NUM>, regarding the uninstalled motion safety function <NUM>, even if a flag is set to enabling, the motion safety function <NUM> is not executed.

As described above, in each safety driver <NUM>, the default setting is fixed to enabling with respect to all of the motion safety functions <NUM> regardless of whether or not the motion safety function <NUM> is installed. However, in actual use, it may be necessary to change the enabled/disabled settings of the safety functions according to work details in the process, such as enabling or disabling the motion safety functions <NUM>.

As a method of changing enabling or disabling of the specific motion safety function <NUM> afterward, it is conceivable that a safety command from the safety controller <NUM> includes designation information for enabling or disabling the specific motion safety function <NUM>. For example, in the present embodiment, after the logical connection <NUM> is established, the safety command can be transmitted to the safety driver <NUM> from the safety controller <NUM>. When designation information for enabling or disabling the specific motion safety function <NUM> is included in the safety command, it is possible to change enabling or disabling of the specific motion safety function <NUM> afterward.

However, in this case, a user is required to create the safety program <NUM> by using a tool such as the support device <NUM> in order to change the enabled/disabled settings of the specific motion safety function <NUM> from the default state. Thus, a situation in which a work amount increases may occur. Therefore, if the user writes source code and frequently creates the safety program <NUM>, the efficiency will be reduced. When the user writes the source code, there is a risk that the user will unintentionally write erroneous setting contents. In a case where a plurality of safety drivers <NUM> is provided in the control system <NUM>, the safety program <NUM> is required to be created for all the safety drivers <NUM>, which causes a problem that a work amount becomes enormous.

Therefore, in the control system <NUM> according to the present embodiment, a method for creating the safety program <NUM> as easily as possible without the user writing the source code is proposed.

For example, as illustrated in <FIG>, the support device <NUM> includes a reception unit <NUM> that receives designation, given by a user, of enabling or disabling for each of one or more motion safety functions <NUM>, a generation unit <NUM> that automatically generates the safety program <NUM> in accordance with the designation of enabling or disabling, received by the reception unit <NUM>, and a transfer unit <NUM> that transfers the safety program <NUM> generated by the generation unit <NUM> to the safety controller <NUM>.

Here, regarding "transfer", the support device <NUM> may convert source code into object code by performing a build, and transfer the safety program <NUM> to the safety controller <NUM> in the form of the object code, or transfer the safety program <NUM> to the safety controller <NUM> in the form of source code without performing the build. The support device <NUM> may transfer the safety program <NUM> to the safety controller <NUM> via the standard controller <NUM>, or may directly transfer the safety program <NUM> to the safety controller <NUM> without using the standard controller <NUM>.

The user can use the support device <NUM> to designate enabling or disabling of each of the motion safety functions <NUM> for the support device <NUM>. The support device <NUM> automatically generates the safety program <NUM> in accordance with enable/disable setting of the motion safety function <NUM> designated by the user. Thus, the user can generate the safety program <NUM> for designating enabling or disabling of each of the motion safety functions <NUM> without taking the trouble to write the source code.

The "designation information" may be any information as long as the information is information for designating enabling or disabling of each of the motion safety functions <NUM>. In the present embodiment, in the designation information, enabling or disabling of each of the motion safety functions <NUM> is designated by a flag indicated by "<NUM>" or "<NUM>" by using a bit string in which bits respectively corresponding to the motion safety functions <NUM> are arranged. As described above, the user can set a flag in the designation information by using the support device <NUM> and can thus change enabling or disabling of the specific motion safety function <NUM> from a default state.

For example, as illustrated in <FIG>, the flags of all of the motion safety functions <NUM> are fixed to "<NUM>" as a default. Here, when it is desired to disable SS2, SOS, and SDIp for the motion safety functions <NUM> of the specific safety driver <NUM>, the user may designate setting of a flag corresponding to each of SS2, SOS, and SDIp to "<NUM>" (disabled state) for the support device <NUM>. In above-described way, the user designates whether to enable or disable the motion safety function <NUM> by using the support device <NUM>, and can thus change afterward enabled/disabled settings of the motion safety function <NUM> defined as a default with the automatically generated safety program <NUM>.

As described above, the user designates enabling or disabling of the specific motion safety function <NUM> for the support device <NUM>, and thus the safety program <NUM> is generated in accordance with the designation of enabling or disabling and is transferred to the safety controller <NUM>. Consequently, the user can generate the safety program <NUM> for designating enabling or disabling of the specific motion safety function <NUM> without writing source code, and can thus easily set enabling or disabling of the motion safety function <NUM>.

Next, a configuration example of the device included in the control system <NUM> will be described.

<FIG> is a schematic diagram illustrating a hardware configuration example of the standard controller <NUM> constituting the control system <NUM> according to the present embodiment. With reference to <FIG>, the standard controller <NUM> includes a processor <NUM>, a main memory <NUM>, a storage <NUM>, a higher-level network controller <NUM>, a field network controller <NUM>, a Universal Serial Bus (USB) controller <NUM>, a memory card interface <NUM>, and a local bus controller <NUM>. These components are connected to each other via a processor bus <NUM>.

The processor <NUM> generally corresponds to a calculation processing part executing control calculation related to the standard control <NUM>, and is configured with a central processing unit (CPU) or a graphics processing unit (GPU). Specifically, the processor <NUM> reads programs (for example, a system program <NUM> and the standard control program <NUM>) stored in the storage <NUM>, loads the programs to the main memory <NUM>, and executes the programs to realize control calculation related to a control target (for example, the safety driver <NUM> or the servomotor <NUM>) and various processes that will be described later.

The main memory <NUM> is configured with a volatile storage device such as a dynamic random access memory (DRAM) or a static random access memory (SRAM). The storage <NUM> is configured with a nonvolatile storage device such as a solid state drive (SSD) or a hard disk drive (HDD).

The storage <NUM> stores not only the system program <NUM> for realizing fundamental functions but also the standard control program <NUM> that is created in accordance with a control target. The storage <NUM> stores setting information <NUM> for setting a variable or the like.

The higher-level network controller <NUM> exchanges data with any information processing device via a higher-level network.

The field network controller <NUM> exchanges data with any devices including the safety controller <NUM> and the safety driver <NUM> via the field network <NUM>. In the control system <NUM> illustrated in <FIG>, the field network controller <NUM> of the standard controller <NUM> functions as a communication master of the field network <NUM>.

The USB controller <NUM> exchanges data with the support device <NUM> or the like via USB connection.

The memory card interface <NUM> accepts a memory card <NUM> that is an example of an attachable and detachable recording medium. The memory card interface <NUM> can record data on the memory card <NUM> or read the various types of data (a log, trace data, or the like) from the memory card <NUM>.

The local bus controller <NUM> exchanges data with any unit connected to the standard controller <NUM> via a local bus.

<FIG> illustrates the configuration example in which the necessary functions are provided by the processor <NUM> executing the programs, but some or all of the provided functions may be installed by using a dedicated hardware circuit (for example, an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA)). Alternatively, main parts of the standard controller <NUM> may be realized by using hardware (for example, an industrial PC based on a general-purpose PC) conforming to a general-purpose architecture. In this case, a virtualization technique may be used to execute a plurality of operating systems (OSs) having different uses in parallel and also to execute necessary applications on each OS. A configuration in which functions of a display device, a support device, or the like are integrated into the standard controller <NUM> may be used.

<FIG> is a schematic diagram illustrating a hardware configuration example of the safety controller <NUM> constituting the control system <NUM> according to the present embodiment. With reference to <FIG>, the safety controller <NUM> includes a processor <NUM>, a main memory <NUM>, a storage <NUM>, a field network controller <NUM>, a USB controller <NUM>, and a safety local bus controller <NUM>. These components are connected to each other via a processor bus <NUM>.

The processor <NUM> generally corresponds to a calculation processing part executing control calculation related to the safety control, and is configured with a CPU or a GPU. Specifically, the processor <NUM> reads programs (for example, a system program <NUM> and the safety program <NUM>) stored in the storage <NUM>, loads the programs to the main memory <NUM>, and executes the programs to realize control calculation for providing the necessary safety function <NUM> and various processes that will be described later.

Particularly, the safety controller <NUM> executes the safety program <NUM>, and thus outputs a safety command including designation information for designating enabling or disabling of the motion safety function <NUM> of the safety driver <NUM> to the safety driver <NUM>. The designation information included in the safety status <NUM> of the safety driver <NUM> may be updated on the basis of the designation information included in the safety command.

The main memory <NUM> is configured with a volatile storage device such as a DRAM or an SRAM. The storage <NUM> is configured with a nonvolatile storage device such as an SSD or an HDD.

The storage <NUM> stores not only the system program <NUM> for realizing fundamental functions but also the safety program <NUM> that is created in accordance with the required safety function <NUM>. The storage <NUM> stores setting information <NUM> for setting a variable or the like.

The field network controller <NUM> exchanges data with any devices including the standard controller <NUM> and the safety driver <NUM> via the field network <NUM>. In the control system <NUM> illustrated in <FIG>, the field network controller <NUM> of the safety controller <NUM> functions as a communication slave of the field network <NUM>.

The USB controller <NUM> exchanges data with an information processing device such as the support device <NUM> via USB connection.

The safety local bus controller <NUM> exchanges data with any safety unit connected to the safety controller <NUM> via a safety local bus. <FIG> illustrates a safety I/O unit <NUM> as an example of the safety unit.

The safety I/O unit <NUM> exchanges input and output signals with any safety device <NUM>. More specifically, the safety I/O unit <NUM> receives an input signal from the safety device <NUM> such as a safety sensor or a safety switch. Alternatively, the safety I/O unit <NUM> outputs a command to the safety device <NUM> such as a safety relay.

<FIG> illustrates the configuration example in which the necessary functions are provided by the processor <NUM> executing the programs, but some or all of the provided functions may be installed by using a dedicated hardware circuit (for example, an ASIC or an FPGA). Alternatively, main parts of the safety controller <NUM> may be realized by using hardware (for example, an industrial PC based on a general-purpose PC) conforming to a general-purpose architecture.

<FIG> is a schematic diagram illustrating a hardware configuration example of the safety driver <NUM> and the servomotor <NUM> constituting the control system <NUM> according to the present embodiment. With reference to <FIG>, the safety driver <NUM> includes a field network controller <NUM>, a control part <NUM>, a drive circuit <NUM>, and a feedback reception circuit <NUM>.

The field network controller <NUM> exchanges data with any devices including the standard controller <NUM> and the safety controller <NUM> via the field network <NUM>. In the control system <NUM> illustrated in <FIG>, the field network controller <NUM> of the safety driver <NUM> functions as a communication slave of the field network <NUM>.

The control part <NUM> executes a calculation process required to operate the safety driver <NUM>. As an example, the control part <NUM> includes processors <NUM> and <NUM>, a main memory <NUM>, and a storage <NUM>.

The processor <NUM> generally corresponds to a calculation processing part executing control calculation for driving the servomotor <NUM>. The processor <NUM> generally corresponds to a calculation processing part executing control calculation for providing the safety function <NUM> related to the servomotor <NUM>. In the present embodiment, the processor <NUM> disables the specific motion safety function <NUM> in response to the safety command. Both of the processors <NUM> and <NUM> are configured with CPUs and the like.

The storage <NUM> stores a servo control program <NUM> for realizing servo control <NUM> that will be described later, a motion safety program <NUM> for realizing the motion safety function <NUM> that will be described later, and setting information <NUM> for setting a variable or the like that is open to other devices. The safety status <NUM> for managing enabled/disabled settings of the motion safety function <NUM> is stored in the setting information <NUM>.

<FIG> exemplifies a configuration in which the two processors <NUM> and <NUM> execute control calculation for different purposes to improve reliability, but the present invention is not limited thereto, and any configuration may be employed as long as the configuration can realize the required safety function <NUM>. For example, in a case where a single processor includes a plurality of cores, control calculation corresponding to each of the processors <NUM> and <NUM> may be executed. <FIG> illustrates the configuration example in which the necessary functions are provided by the processors <NUM> and <NUM> executing the programs, but some or all of the provided functions may be installed by using a dedicated hardware circuit (for example, an ASIC or an FPGA).

The drive circuit <NUM> includes a converter circuit, an inverter circuit, and the like, generates power with designated voltage, current, and phase in response to a command from the control part <NUM>, and supplies the power to the servomotor <NUM>.

The feedback reception circuit <NUM> receives a feedback signal from the servomotor <NUM>, and outputs the reception result to the control part <NUM>.

The servomotor <NUM> typically includes a three-phase AC motor <NUM> and an encoder <NUM> provided at a rotation shaft of the three-phase AC motor <NUM>.

The three-phase AC motor <NUM> is an actuator that receives power supplied from the safety driver <NUM> and generates torque. <FIG> illustrates the three-phase AC motor as an example, but the present invention is not limited thereto, and a DC motor may be used, and a single-phase AC motor or a multi-phase AC motor may be used. An actuator that generates torque along a straight line, such as a linear servo, may be used.

The encoder <NUM> outputs a feedback signal (typically, a pulse signal corresponding to a rotation speed) corresponding to the rotation speed of the three-phase AC motor <NUM>.

<FIG> is a schematic diagram illustrating a hardware configuration example of the support device <NUM> constituting the control system <NUM> according to the present embodiment. The support device <NUM> is implemented by using hardware (for example, a general-purpose PC) conforming to a general-purpose architecture as an example.

With reference to <FIG>, the support device <NUM> includes a processor <NUM>, a main memory <NUM>, an input part <NUM>, an output part <NUM>, a storage <NUM>, an optical drive <NUM>, and a USB controller <NUM>. These components are connected to each other via a processor bus <NUM>.

The processor <NUM> is configured with a CPU or a GPU, reads programs (for example, an OS <NUM> and a support program <NUM>) stored in the storage <NUM>, loads the programs to the main memory <NUM>, and executes the programs to perform various processes that will be described later. In other words, the processor <NUM> has a function of a computer executing the support program <NUM>. Particularly, the processor <NUM> has the function of the generation unit <NUM> illustrated in <FIG>, and generates a safety source program <NUM> in accordance with designation of enabling or disabling of the motion safety function <NUM> received from a user.

The main memory <NUM> is configured with a volatile storage device such as a DRAM or an SRAM. The storage <NUM> is configured with a nonvolatile storage device such as an HDD or an SSD.

The storage <NUM> stores not only the OS <NUM> for realizing fundamental functions but also the support program <NUM> for providing functions of the support device <NUM>. In other words, the support program <NUM> is executed by a computer connected to the control system <NUM> to implement the support device <NUM> according to the present embodiment. The support program <NUM> includes an enable/disable setting support program <NUM>. The support device <NUM> executes the enable/disable setting support program <NUM> to receive designation of enabling or disabling of the motion safety function <NUM> from a user, and also generates the safety source program <NUM> by using the processor <NUM> in accordance with the received designation of enabling or disabling.

The storage <NUM> stores project data <NUM> that is created by the user in a development environment that is provided by executing the support program <NUM>.

In the present embodiment, the support device <NUM> provides a development environment in which setting on each device included in the control system <NUM> and creation of a program executed by each device can be integrally performed. The project data <NUM> includes data generated by using such an integrated development environment. Typically, the project data <NUM> includes a standard control source program <NUM>, standard controller setting information <NUM>, a safety source program <NUM>, safety controller setting information <NUM>, and safety driver setting information <NUM>.

The standard control source program <NUM> is converted into object codes that are then transmitted to the standard controller <NUM> to be stored in the standard control program <NUM> (refer to <FIG>). The standard control source program <NUM> may be transmitted to the standard controller <NUM> without being converted into object codes. Similarly, the standard controller setting information <NUM> is also transmitted to the standard controller <NUM> to be stored in the setting information <NUM> (refer to <FIG>).

The safety source program <NUM> is converted into object codes that are then transmitted to the safety controller <NUM> to be stored in the safety program <NUM> (refer to <FIG>). The safety source program <NUM> may be transmitted to the safety controller <NUM> without being converted into object codes. Similarly, the safety controller setting information <NUM> is also transmitted to the safety controller <NUM> to be stored in the setting information <NUM> (refer to <FIG>).

The safety driver setting information <NUM> is transmitted to the safety driver <NUM> to be stored in the setting information <NUM> (refer to <FIG>).

The input part <NUM> is an interface that receives information that is input with a keyboard or a mouse, and has the function of the reception unit <NUM> illustrated in <FIG>. Particularly, the input part <NUM> receives designation, given by the user, of enabling or disabling of the motion safety function <NUM>. The output part <NUM> is configured with a display, various indicators, a printer, and the like, and outputs a processing result or the like from the processor <NUM>.

The USB controller <NUM> has the function of the transfer unit <NUM> illustrated in <FIG>, and exchanges data with the standard controller <NUM> or the like through USB connection. Particularly, the USB controller <NUM> transfers the safety source program <NUM> that is automatically generated by the processor <NUM> to the safety controller <NUM>. The USB controller <NUM> may transfer the safety source program <NUM> to the safety controller <NUM> via the standard controller <NUM>, and may transfer the safety source program <NUM> to the safety controller <NUM> without using the standard controller <NUM>.

The support device <NUM> has the optical drive <NUM>, and a program is read from a recording medium <NUM> (for example, an optical recording medium such as a digital versatile disc (DVD)) that stores computer-readable programs in a non-transitory manner and is installed in the storage <NUM> or the like.

The support program <NUM> or the like executed by the support device <NUM> may be installed via the computer-readable recording medium <NUM>, or may be downloaded from a server device or the like on the network to be installed. The functions provided by the support device <NUM> according to the present embodiment may be realized in a form of using some modules provided by the OS.

<FIG> illustrates the configuration example in which the necessary functions of the support device <NUM> are provided by the processor <NUM> executing the programs, but some or all of the provided functions may be installed by using a dedicated hardware circuit (for example, an ASIC or an FPGA).

During an operation of the control system <NUM>, the support device <NUM> may be detached from the standard controller <NUM>.

Next, an example of function sharing in the control system <NUM> will be described. <FIG> is a schematic diagram illustrating an example of function sharing in the control system <NUM> according to the present embodiment.

With reference to <FIG>, the safety driver <NUM> executes the servo control <NUM> in relation to the standard control <NUM> executed by the standard controller <NUM>. The standard control <NUM> includes a process of cyclically calculating commands for driving the servomotor <NUM> according to a user program that is set in a control target in advance. The servo control <NUM> includes control for driving the servomotor <NUM> in response to commands that are cyclically calculated through the standard control <NUM> and a process of acquiring and outputting a state value indicating an operation state of the servomotor <NUM>. The servo control <NUM> is performed by the processor <NUM> (refer to <FIG>) of the safety driver <NUM>.

On the other hand, the safety driver <NUM> provides the motion safety function <NUM> in correspondence to the safety function <NUM> provided by the safety controller <NUM>. The motion safety function <NUM> is realized by the processor <NUM> (refer to <FIG>) of the safety driver <NUM>.

When a predefined condition is established, the safety function <NUM> enables the predefined safety function <NUM> on the basis of a state value stored in the standard control <NUM> executed by the standard controller <NUM>, a state value indicated by a signal from the safety device <NUM>, a state value stored in the safety driver <NUM>, and the like.

The process of enabling the predefined safety function <NUM> includes, for example, output of a safety command for the safety driver <NUM> or output of a safety command for the safety device <NUM> (for example, a safety relay related to the supply of power to a specific device is turned off).

The safety driver <NUM> executes the motion safety program <NUM> to realize the designated motion safety function <NUM> in response to a safety command from the safety controller <NUM>. The motion safety function <NUM> that can be executed is defined in advance in each safety driver <NUM>. Depending on the type of the designated motion safety function <NUM>, a process of intervening in the control of the servomotor <NUM> based on the servo control <NUM> to interrupt the supply of power to the servomotor <NUM>, or a process of monitoring whether or not a state value of the control of the servomotor <NUM> based on the servo control <NUM> is within a predefined restriction range is executed. The motion safety program <NUM> enables or disables each motion safety function <NUM> in accordance with enable/disable setting of a safety function designated by designation information included in the safety status <NUM>.

<FIG> is a sequence diagram illustrating an example of a process procedure related to the safety functions <NUM> of the safety driver <NUM> of the control system <NUM> according to the present embodiment. With reference to <FIG>, a command is cyclically calculated through the standard control <NUM> of the standard controller <NUM> and is output to the safety driver <NUM> (servo control <NUM>) (sequence SQ2). The servo control <NUM> of the safety driver <NUM> drives the servomotor <NUM> in response to the command from the standard control <NUM> (sequence SQ4).

When a safety event from the safety device <NUM> (for example, a safety sensor) occurs at a certain timing (sequence SQ6), the safety controller <NUM> outputs a safety command to the safety driver <NUM> (motion safety function <NUM>) (sequence SQ8). The motion safety function <NUM> of the safety driver <NUM> enables the designated safety function <NUM> in response to the safety command (sequence SQ10).

In response to enabling of the safety function <NUM>, a command corresponding to the enabled safety function <NUM> is calculated and output from the standard control <NUM> of the standard controller <NUM> (sequence SQ12). On the other hand, the safety driver <NUM> (motion safety function <NUM>) monitors whether or not an operation state of the servomotor <NUM> is within a predefined restriction range. When it is determined that the operation state of the servomotor <NUM> is not within the predefined restriction range, or a predefined stoppage time comes, the safety driver <NUM> (motion safety function <NUM>) interrupts the supply of power to the servomotor <NUM> (sequence SQ14).

As described above, the safety driver <NUM> can drive the servomotor <NUM> in response to a command from the standard controller <NUM> (standard control <NUM>), and can also realize the motion safety function <NUM> for the safety controller <NUM> (safety function <NUM>) in response to a command for enabling the safety function <NUM>.

Next, an example of the motion safety function <NUM> provided by the control system <NUM> will be described.

<FIG> is a diagram illustrating an example of the motion safety function <NUM> provided by the control system <NUM> according to the present embodiment. (A) of <FIG> illustrates an example of a behavior of the servomotor <NUM> corresponding to STO, and (B) of <FIG> illustrates an example of a behavior of the servomotor <NUM> corresponding to SS1.

With reference to (A) of <FIG>, when a safety command (STO) is output at time point t1 in a state in which the servomotor <NUM> is being operated at a certain rotation speed, the safety driver <NUM> interrupts the supply of power to the servomotor <NUM> to make torque generated by the servomotor <NUM> zero. As a result, the servomotor <NUM> is rotated by the inertia and is then stopped. In a case where the servomotor <NUM> is provided with a brake, the servomotor <NUM> may be immediately stopped.

With reference to <FIG>, when a safety command (SS1) is output at time point t1 in a state in which the servomotor <NUM> is being operated at a certain rotation speed, the safety driver <NUM> reduces the rotation speed at a predefined acceleration. In this case, the safety driver <NUM> may perform power recovery (that is, regeneration) from the servomotor <NUM>. When the rotation speed of the servomotor <NUM> becomes zero at time point t2, the safety driver <NUM> interrupts the supply of power to the servomotor <NUM> to make torque generated by the servomotor <NUM> zero. After time point t2, the same state as the state corresponding to STO illustrated in <FIG> is brought.

Of STO illustrated in <FIG> and SS1 illustrated in <FIG>, a safety function that causes more safe stoppage is selected as appropriate in accordance with characteristics or the like of a facility that is mechanically connected to the servomotor <NUM>.

Document: ETG. <NUM>(R) V1. <NUM> described above defines not only the motion safety functions illustrated in <FIG> but also a plurality of motion safety functions. Settings for defining a behavior of the servomotor <NUM> are necessary to realize each motion safety function.

As described above, in the control system <NUM> according to the present embodiment, safety communication can be performed through data communication and the logical connection <NUM>. Next, installation examples of standard control and safety control using each type of communication will be described.

<FIG> is a schematic diagram illustrating installation examples of standard control and safety control in the control system <NUM> according to the present embodiment. For convenience of description, <FIG> illustrates an example of the control system <NUM> including the single safety driver <NUM> in addition to the standard controller <NUM> and the safety controller <NUM>.

As illustrated in <FIG>, the standard controller <NUM> includes a data communication layer <NUM> and an I/O management module <NUM> as principal functional constituents. The safety controller <NUM> includes a data communication layer <NUM>, an I/O management module <NUM>, a logical connection layer <NUM>, and a safety function state management engine <NUM> as principal functional constituents. The safety driver <NUM> includes a data communication layer <NUM>, a logical connection layer <NUM>, and a motion safety function state management engine <NUM>, a servo control execution engine <NUM>, and a motion safety function execution engine <NUM> as principal functional constituents.

The data communication layer <NUM>, the data communication layer <NUM>, and the data communication layer <NUM> are used to transfer the communication frame <NUM> on the field network <NUM>.

The logical connection layer <NUM> of the safety controller <NUM> and the logical connection layer <NUM> of the safety driver <NUM> exchange safety communication frames <NUM>. In other words, the logical connection layer <NUM> and the logical connection layer <NUM> exchange commands and data by using the safety communication frame <NUM> included in the communication frame <NUM> according to a protocol (FSoE in the present embodiment) for establishing the logical connection <NUM>. The safety controller <NUM> includes an establishment module <NUM> for establishing the logical connection <NUM> with the safety driver <NUM> via the logical connection layer <NUM>.

In the standard controller <NUM>, the I/O management module <NUM> exchanges signals with a control target to update process data <NUM>. The standard control program <NUM> executed in the standard controller <NUM> executes control calculation by referring to the process data <NUM>, and updates the process data <NUM> as an execution result of the control calculation.

In the safety controller <NUM>, the I/O management module <NUM> exchanges signals with the safety device <NUM> to update process data <NUM>.

The safety program <NUM> executed in the safety controller <NUM> executes control calculation by referring to the process data <NUM> and the safety function state management engine <NUM>, and updates the process data <NUM> or outputs an internal command to the safety function state management engine <NUM> on the basis of an execution result of the control calculation.

The safety function state management engine <NUM> generates a safety command for enabling or disabling the specific motion safety function <NUM> for the specific safety driver <NUM> in accordance with the execution result of the control calculation performed by the safety program <NUM>. The logical connection layer <NUM> exchanges necessary commands and data with the logical connection layer <NUM> of the target safety driver <NUM> by using the safety communication frames <NUM> in response to the command from the safety function state management engine <NUM>.

In the safety driver <NUM>, the servo control execution engine <NUM> executes control calculation related to servo control by referring to process data <NUM> and information regarding a feedback signal acquired via the feedback reception circuit <NUM>. The servo control execution engine <NUM> updates the process data <NUM> and outputs an internal command to the drive circuit <NUM> on the basis of an execution result of the control calculation. The drive circuit <NUM> drives the servomotor <NUM> in response to the command from the servo control execution engine <NUM>.

The motion safety function state management engine <NUM> manages a state of the motion safety function <NUM> in response to a safety command from the safety controller <NUM>. The safety status <NUM> is stored in the motion safety function state management engine <NUM>. The motion safety function state management engine <NUM> outputs an internal command to the motion safety function execution engine <NUM> according to designation information included in the safety status <NUM>.

In the motion safety function execution engine <NUM>, the motion safety program <NUM> is executed to realize the designated motion safety function <NUM>.

The logical connection layer <NUM> exchanges necessary commands and data with the logical connection layer <NUM> of the safety controller <NUM> by using the safety communication frames <NUM> in response to a command from the motion safety function state management engine <NUM>.

<FIG> is a schematic diagram illustrating an example of transition in enabling or disabling of the motion safety function <NUM> according to the present embodiment.

As described above, in the safety driver <NUM>, the flags corresponding to all of the motion safety functions <NUM> are set to "<NUM>" as a default regardless of whether or not the motion safety functions <NUM> is installed. In other words, the flags of all bits included in the safety status <NUM> are set to "<NUM>" as a default.

When a user designates enabling or disabling of the motion safety functions <NUM> such that the flag of the second bit corresponding to SS2 is set to "<NUM>" in order to disable SS2, the flag of the third bit corresponding to SOS is set to "<NUM>" in order to disable SOS, and the flag of the fifth bit corresponding to SDIp is set to "<NUM>" in order to disable SDIp, by using the support device <NUM>, the safety program <NUM> is automatically generated in accordance with the designation of enabling or disabling. The safety controller <NUM> executes the safety program <NUM> to transmit a safety command including the information regarding the designation, given by the user, of enabling or disabling of the motion safety function <NUM> to the safety driver <NUM>.

When the safety driver <NUM> receives the safety command from the safety controller <NUM>, the designation information included in the safety status <NUM> is updated according to the designation information included in the safety command. More specifically, the designation information included in the safety status <NUM> is overwritten to be the same as the designation information included in the safety command.

As described above, in the control system <NUM> according to the present embodiment, after connection in the field network <NUM> is established, setting of enabling or disabling of the specific motion safety function <NUM> can be changed from a default state by using a safety command.

Next, with reference to <FIG>, an example of an enable/disable setting portion for the safety functions in the safety program <NUM> will be described. <FIG> is a schematic diagram illustrating an enable/disable setting portion for the safety functions in the safety program <NUM> according to the present embodiment.

As illustrated in <FIG>, source code for designating enabling or disabling of the motion safety function <NUM> is written in a part of the safety program <NUM> for each of one or a plurality of safety drivers <NUM> included in the control system <NUM>.

More specifically, "TRUE" is designated for SS2, SOS, and SDIp with respect to the safety driver <NUM> correlated with the identification code "E010". "TRUE" is designated for SS1, SOS, SSR, and SDIn with respect to the safety driver <NUM> correlated with the identification code "E011".

A flag is set to "<NUM>" in each bit included in designation information with respect to the motion safety function <NUM> for which "TRUE" is designated. In other words, in a case where the safety program <NUM> generated on the basis of the source code illustrated in <FIG> is executed, designation information for designating flags respectively corresponding to SS2, SOS, and SDIp as "<NUM>" with respect to the safety driver <NUM> correlated with "E010" is included in a safety command, and designation information for designating flags respectively corresponding to SS1, SOS, SSR, and SDIn as "<NUM>" with respect to the safety driver <NUM> correlated with "E011" is included in a safety command.

In the related art, such source code is required to be written through an input operation of a user, but, in the present embodiment, the user only designates enable/disable setting of the safety function in the support device <NUM>, and thus the safety program <NUM> in which the same source code is written is automatically generated.

The safety program <NUM> that is automatically generated by the support device <NUM> cannot be edited by the user. For example, the generated safety program <NUM> is not displayed on a display part of the support device <NUM> or the like, and the user cannot recognize details of the program and cannot edit the program either. Alternatively, the generated safety program <NUM> may be displayed on the display part of the support device <NUM> or the like, but the user cannot edit details of the program.

Consequently, since the safety program <NUM> generated by the support device <NUM> is not able to be edited by the user, it is possible to prevent the occurrence of a problem that set details of enabling or disabling of a safety function designated for the support device <NUM> by the user do not coincide with set details in the safety program <NUM> generated by the support device <NUM>.

Next, an example of a user interface related to the motion safety function <NUM> provided by the support device <NUM> will be described.

<FIG> and <FIG> are diagrams illustrating examples of user interfaces for setting enabling or disabling of the motion safety function <NUM> provided by the support device <NUM> according to the present embodiment. <FIG> is a diagram illustrating an example of a user interface for setting a variable in the safety program <NUM> provided by the support device <NUM> according to the present embodiment. The user may execute the support program <NUM> (enable/disable setting support program <NUM>) in the support device <NUM> to display screens related to user interfaces as illustrated in <FIG>.

As illustrated in <FIG>, a multiview explorer field <NUM> is provided on the left of a screen related to a user interface <NUM>. The multiview explorer field <NUM> includes a switching switch <NUM> for designating a development target program. In this example, "new_SafetyCPU0" corresponding to the safety program <NUM> is designated in the switching switch <NUM>.

The multiview explorer field <NUM> includes a configurations and setup switch <NUM> for setting a constituent connected to a network in the control system <NUM>. A lower-level layer developed by the configurations and setup switch <NUM> includes an enable/disable setting icon <NUM> for designating enabling or disabling of the motion safety function <NUM> and an I/O map icon <NUM> for mapping a variable referred to by the safety program <NUM>. The "variable" includes data and a container or a storage region in which the data is stored. For example, the variable referred to by the safety program <NUM> is correlated with a state value of the servomotor <NUM> or the like, and each motion safety function <NUM> is realized according to the state value correlated with the variable.

The enable/disable setting icon <NUM> is provided in each of one or a plurality of safety drivers <NUM> connected to the control system <NUM>, and, in this example, the enable/disable setting icon <NUM> corresponding to the safety driver <NUM> of Node10 is selected.

A screen <NUM> for designating enabling or disabling of the motion safety function <NUM> is displayed at the center of the screen related to the user interface <NUM>. The screen <NUM> includes a number field <NUM> and a flag field <NUM>.

In the number field <NUM>, numbers are shown for the respective motion safety functions <NUM> in order from the first bit in the same order as the designation information included in the safety status <NUM>. In this example, since the motion safety function <NUM> of SSR in the fourth bit is not installed, all information corresponding to the fourth bit is "Reserved".

The flag field <NUM> is provided with a check box that can be checked by the user. In a case where the user designates "TRUE" in the source code of the safety program <NUM>, the user may uncheck the check box of the flag field <NUM>. For the motion safety function <NUM> for which the check box is unchecked, the flag is set to "<NUM>" in the designation information included in the safety command. On the other hand, for the motion safety function <NUM> for which the check box is checked, the flag is set to "<NUM>" in the designation information included in the safety command. In above-described way, the user can easily perform enable/disable setting of the motion safety function <NUM> in the safety command by checking or unchecking the check box of the flag field <NUM>.

With respect to enable/disable setting of the motion safety function <NUM>, the user can change the default state in the second byte of the safety status <NUM>, and, as illustrated in <FIG>, the user can easily perform enable/disable setting in the second byte by checking or unchecking the check box of the flag field <NUM>.

In the example illustrated in <FIG>, SS2, SOS, and SDIp are unchecked in the check box of the flag field <NUM>. Thus, in the safety command, the flags corresponding to SS2, SOS, and SDIp are designated as "<NUM>".

As described above, the user designates enabling or disabling of each motion safety function <NUM> in the safety driver <NUM>, and then selects a transfer icon <NUM>, and thus the safety program <NUM> corresponding to the designation of enabling or disabling can be generated. The generated safety program <NUM> is transferred to the safety controller <NUM>.

As illustrated in <FIG>, when the specific motion safety function <NUM> is disabled in the check box of the flag field <NUM>, the screen is switched to a screen related to a user interface <NUM>, and a notification that the variable correlated with the disabled specific motion safety function <NUM> has been canceled is provided in an output window <NUM> located at the lower part of the screen.

As illustrated in <FIG>, when the I/O map icon <NUM> is selected, the screen is switched to a screen related to a user interface <NUM>. A screen <NUM> for mapping a variable to each motion safety function <NUM> is displayed at the center of the screen related to the user interface <NUM>. The screen <NUM> includes a port field <NUM>, a variable field <NUM>, and a variable comment field <NUM>.

Each motion safety function <NUM> installed in the selected safety driver <NUM> (Node10 in this example) is shown in the port field <NUM>. A variable correlated with each motion safety function <NUM> is shown in the variable field <NUM>. A comment to the variable correlated with each motion safety function <NUM> is shown in the variable comment field <NUM>.

Here, as illustrated in <FIG>, when the specific motion safety function <NUM> is disabled in the check box of the flag field <NUM>, the variable correlated with the disabled specific motion safety function <NUM> is canceled. Thus, the variable field <NUM> and the variable comment field <NUM> become blank in the screen related to the user interface <NUM> illustrated in <FIG>. For example, in this example, since SS2 and SOS are disabled in the check boxes of the flag field <NUM>, and the variables are canceled, the variable field <NUM> and the variable comment field <NUM> corresponding to SS2 and SOS become blank.

As described above, in response to designation of disabling of the specific motion safety function <NUM>, the support device <NUM> prohibits the use of the variable referred to by the safety program <NUM> related to the specific motion safety function <NUM>. Consequently, it is possible to prevent a situation in which the user unintentionally sets a variable referred to by the safety program <NUM> related to the disabled motion safety function <NUM>.

Next, a safety enable/disable program generation process executed by the support device <NUM> will be described. <FIG> is a flowchart for describing a safety enable/disable program generation process executed by the support device <NUM> according to the present embodiment.

As illustrated in <FIG>, the support device <NUM> determines whether or display of a safety function enable/disable setting screen has been received (S502). In a case where display of safety function enable/disable setting screen has not been received (NO in S502), the support device <NUM> finishes the present process.

On the other hand, in a case where display of safety function enable/disable setting screen has been received (YES in S502), the support device <NUM> displays the safety function enable/disable setting screen as illustrated in <FIG> (S504).

Next, the support device <NUM> determines whether or not safety function enable/disable setting has been received (S506). Specifically, the support device <NUM> whether the check box of the flag field <NUM> has been checked or unchecked by a user in the screen related to the user interface <NUM> illustrated in <FIG>. In a case where safety function enable/disable setting has not been received (NO in S506), the support device <NUM> repeatedly performs the process in S506 until enable/disable setting is received.

On the other hand, in a case where safety function enable/disable setting has been received (YES in S506), the support device <NUM> determines whether or not an instruction for transfer has been received (S508). Specifically, the support device <NUM> determines whether or not the transfer icon <NUM> has been selected in the screen related to the user interface <NUM> illustrated in <FIG>. In a case where an instruction for transfer has not been received (NO in S508), the support device <NUM> returns to the process in S506.

On the other hand, in a case where an instruction for transfer has been received (YES in S508), the support device <NUM> determines whether or not a variable has been mapped to the motion safety function <NUM> set to be disabled (S510). In a case where a variable has not been mapped to the motion safety function <NUM> set to be disabled (NO in S510), the support device <NUM> finishes the present process.

On the other hand, in a case where a variable has been mapped to the motion safety function <NUM> set to be disabled (YES in S510), the support device <NUM> cancels the variable corresponding to the motion safety function <NUM> set to be disabled (S512), and provides a notification of cancelation (S514). For example, the support device <NUM> provides a notification that the variable correlated with the disabled specific motion safety function <NUM> has been canceled in the output window <NUM> illustrated in <FIG>.

Next, the support device <NUM> maps a variable for generating the safety program <NUM> to the safety function set to be disabled (S516). Regarding the variable used in this case, it is preferable that a unique name that is not set by the user is used as a variable name. If the same name is used for the variable name, the name may be identified by adding a subscript such as a number. The support device <NUM> generates the safety program <NUM> by using the variable mapped in S516 (S518). In a case where a variable for generating the safety program <NUM> has already been mapped to a safety function set to be disabled, the support device <NUM> may generate the safety program <NUM> by using the variable.

The support device <NUM> prohibits mapping of a variable to the motion safety function <NUM> set to be disabled (S520), and transfers the generated safety program <NUM> to the safety controller <NUM> (S522). In this case, the support device <NUM> may convert source code into object code by performing a build, and transfer the safety program <NUM> to the safety controller <NUM> in the form of the object code, or transfer the safety program <NUM> to the safety controller <NUM> in the form of source code without performing the build. The support device <NUM> may transfer the safety program <NUM> to the safety controller <NUM> via the standard controller <NUM>, or may directly transfer the safety program <NUM> to the safety controller <NUM> without using the standard controller <NUM>. Thereafter, the support device <NUM> finishes the present process.

As described above, the support device <NUM> generates the safety program <NUM> in accordance with designation, given by the user, of enabling or disabling of the specific motion safety function <NUM>, and transfers the generated safety program <NUM> to the safety controller <NUM>. Consequently, the user can generate the safety program <NUM> for designating enabling or disabling of the specific motion safety function <NUM> without writing source code, and can thus easily set enabling or disabling of the motion safety function <NUM>.

In response to designation of disabling of the specific motion safety function <NUM>, the support device <NUM> prohibits the use of the variable referred to by the safety program <NUM> related to the specific motion safety function <NUM>. Consequently, it is possible to prevent a situation in which the user unintentionally sets a variable referred to by the safety program <NUM> related to the disabled motion safety function <NUM>.

The support device <NUM> can notify the user that a variable referred to by the safety program <NUM> related to the disabled motion safety function <NUM> is prohibited from being used.

Next, a safety command reception process executed by the safety driver <NUM> will be described. <FIG> is a flowchart for describing a safety command reception process executed by the safety driver <NUM> according to the present embodiment. The safety driver <NUM> executes a safety command reception process illustrated in <FIG> after connection in the field network <NUM> is established and the logical connection <NUM> is established.

As illustrated in <FIG>, the safety driver <NUM> determines whether or not a safety command has been received from the safety controller <NUM> (S322). In a case where a safety command has not been received (NO in S322), the safety driver <NUM> finishes the present process.

On the other hand, in a case where a safety command has been received (YES in S322), the safety driver <NUM> determines whether or not enable/disable setting of the motion safety function <NUM> is included in the safety command (S324). In other words, the safety driver <NUM> determines whether or not designation of enabling or disabling of the safety function that is given by the user and is input from the support device <NUM> is included in the safety command that is transferred due to execution of the safety program <NUM> automatically generated by the support device <NUM>.

In a case where enable/disable setting of the motion safety function <NUM> is not included in the safety command (NO in S324), the safety driver <NUM> finishes the present process.

On the other hand, in a case where enable/disable setting of the motion safety function <NUM> is included in the safety command (YES in S324), the safety driver <NUM> performs enable/disable setting of the specific motion safety function <NUM> according to designation information included in the safety command (S326). For example, as illustrated in <FIG>, in a case where the safety command including designation information indicating that SS2 and SOS are disabled and SDIp is enabled is received, the safety driver <NUM> also disables SS2 and SOS and enables SDIp in the designation information included in the safety status <NUM>. Thereafter, the safety driver <NUM> finishes the present process.

As described above, the safety driver <NUM> performs enable/disable setting of the motion safety function <NUM> in response to a safety command that is received after the logical connection <NUM> is established. Consequently, the user can change enabling or disabling of the specific motion safety function <NUM> from a default state by using the safety command.

In the user interface <NUM> for setting enabling or disabling of the safety function illustrated in <FIG>, the support device <NUM> receives checking or unchecking of the check box of the flag field <NUM> with respect to the motion safety function <NUM> (SSR in this example) that is not installed in the safety driver <NUM>, but is not limited thereto. For example, the support device <NUM> may not receive checking or unchecking of the check box of the flag field <NUM> with respect to the motion safety function <NUM> that is not installed in the safety driver <NUM>. More specifically, the support device <NUM> does not need to display the check box of the flag field <NUM> with respect to the motion safety function <NUM> that is not installed in the safety driver <NUM>, and may bring the motion safety function into a non-operating state even if the check box is displayed.

In the user interface <NUM> for setting enabling or disabling of the safety function illustrated in <FIG>, the support device <NUM> receives enable/disable setting of the motion safety function <NUM> for each safety driver <NUM>, but is not limited thereto. For example, since a user may want to make enabled/disabled settings of the motion safety function <NUM> common to the plurality of safety drivers <NUM>, the support device <NUM> may provide a user interface for receiving enabled/disabled settings of the motion safety function <NUM> common to the plurality of safety drivers <NUM>. In this case, the support device <NUM> may collectively generate the safety programs <NUM> including the enabled/disabled settings of the motion safety function <NUM> having the same details for the plurality of safety drivers <NUM>, and collectively transfer the generated safety programs <NUM> to the plurality of respective safety drivers <NUM> when the transfer icon <NUM> is selected.

The present embodiment described above includes the following technical concept.

In the control system <NUM> according to the present embodiment, a user designates enabling or disabling of the specific motion safety function <NUM> for the support device <NUM>, and thus the safety program <NUM> is generated in accordance with the designation of enabling or disabling and is transferred to the safety controller <NUM>. Consequently, the user can generate the safety program <NUM> for designating enabling or disabling of the specific motion safety function <NUM> without writing source code, and can thus easily set enabling or disabling of the motion safety function <NUM>.

Claim 1:
A support device (<NUM>) that is adapted to support development of a safety program (<NUM>) related to at least one or more safety functions (<NUM>) executed by a controller (<NUM>) which controller is adapted to control a drive device (<NUM>) driving a motor (<NUM>), the safety program (<NUM>) comprising information for disabling a specific safety function (<NUM>) among the at least one or more safety functions (<NUM>), the support device (<NUM>) comprising:
a reception unit (<NUM>) that is adapted to receive designation, given by a user, of enabling or disabling of each of the at least one or more safety functions (<NUM>);
a generation unit (<NUM>) that is adapted to generate the safety program (<NUM>) in accordance with the designation of enabling or disabling received by the reception unit (<NUM>); and
a transfer unit (<NUM>) that is adapted to transfer the safety program (<NUM>) generated by the generation unit (<NUM>) to the controller (<NUM>), the support device (<NUM>) characterized in that
the safety program (<NUM>) generated by the generation unit (<NUM>) is uneditable by the user.