Patent Description:
In a control device such as a programmable controller (PLC) or a safety controller, a value of one or more output signals is cyclically determined from one or more input signals in accordance with a control logic specified by a user program.

For example, <CIT> (PTL <NUM>) and <CIT> (PTL <NUM>) disclose techniques for analyzing and evaluating a relationship between one or more input signals and one or more output signals.

<CIT> discloses a device extraction section that extracts description of each device from a control program in which a plurality of devices are described, dependence relations between the devices are described, and a control algorithm for the plurality of devices is defined by the description of the plurality of devices and the description of the dependence relations between the devices. A dependence relation extraction section extracts the description of the dependence relations between the devices from the control program. A graph generation section generates a closed circuit directed graph in which a node shows the device, a directed edge shows the dependence relations between the devices, and the control algorithm defined by the control program is shown by a connection between the node and the directed edge on the basis of the description of the device extracted by the device extraction section and the description of the dependence relations between the devices extracted by the dependence relation extraction section.

<CIT> discloses a display device that displays screen data in which drawing elements containing component figures or characters are disposed. The display device is configured so as to comprise: information display target selecting means for selecting a component displayed on a screen by touching or depressing the component; and information displaying means for displaying attached information of device information of a present device value related to a device associated with the component selected or the like, an explanation related to the device or the like.

<CIT> discloses a program analysis support device that is equipped with an analysis-conditions setting operation unit, a variable-dependent-relationship extraction unit, and a variable-dependent-relationship display processing unit. The analysis-conditions setting operation unit sets a first condition for devices which do not extract an additional forward or backward device-dependent relationship, and a second condition for devices which extract an additional forward or backward device-dependent relationship. The variable-dependent-relationship extraction unit generates a first extraction result by extracting a forward or backward device-dependent relationship from the ladder program using a set origin as the origin, so as not to extract an additional forward or backward device-dependent relationship for a device satisfying the first condition, and so as to extract an additional forward or backward device-dependent relationship for a device satisfying the second condition. The variable-dependent-relationship display processing unit displays the device-dependent relationship according to the first extraction result.

The techniques disclosed in PTL <NUM> and PTL <NUM> described above are typically implemented by an information processing device called a support device. While a facility is in operation, the support device is not often connected to the control device.

When an unintended system shutdown occurs while the facility is in operation, it takes some time and effort to connect the support device for finding the cause, thereby requiring much more time in finding the cause. Such an unintended system shutdown may occur, for example, due to erroneous determination such as a case where a foreign matter (such as an insect or a piece of metal being machined) enters a light projecting/receiving range of a light curtain and is determined to be abnormal, a mechanical failure, or the like.

Therefore, there is a demand for a solution that allows a cause to be found quickly when an unintended system shutdown occurs.

According to a first aspect of the present invention there is provided a support device as specified in claim <NUM>.

According to a second aspect of the present invention there is provided a control system as specified in claim <NUM>.

According to this configuration, it is possible to easily and quickly acquire information used for finding a cause of an unintended system shutdown by referring to the supervisory control screen provided from the display device without connecting the support device to the controller.

The input-output correspondence information may include an address used for referring to a value of a corresponding one of the input and output signals, and information used for identifying the one or more input signals associated with the output signal. According to this configuration, the display device can uniquely identify the input signal associated with each output signal and can uniquely identify a location from which the value of a corresponding one of the input and output signals is acquired.

The display device may include a screen generation means configured to generate the supervisory control screen on the basis of the input-output correspondence information. According to this configuration, the supervisory control screen is generated from the input-output correspondence information transmitted to the display device, so that it is possible to reduce time and effort spent on the creation of the supervisory control screen.

The transmission means may transmit the input-output correspondence information in addition to the screen data used for providing a desired supervisory control screen on the display device. According to this configuration, the input-output correspondence information is transmitted to the display device in accordance with the procedure of transmitting the screen data to the display device, which prevents an increase in operator's time and effort.

The screen data reflecting the input-output correspondence information may be structured to show a current value of one or more input signals associated with any selected output signal generated on the basis of the input-output correspondence information. According to this configuration, the screen data generated on the basis of the input-output correspondence information is transmitted to the display device, so that it is possible to skip the processing of generating the supervisory control screen and thus speed up the processing related to the display.

The generation means may trace back the user program to identify, for each output signal included in the user program, one or more input signals for determining a value of the output signal. According to this configuration, it is possible to easily identify a correspondence relationship between an output signal and one or more input signals included in the user program.

A controller serving as a communication slave may exchange data via a controller serving as a communication master, and the display device may refer to values of input and output signals held by the controller serving as the communication slave via the controller serving as the communication master. According to this configuration, it is possible for the control system including the communication master and the communication slave to provide the supervisory control screen.

According to a third aspect of the present invention there is provided a support program as specified in claim <NUM>.

According to the present invention, it is possible to provide a solution that allows a cause to be found quickly when an unintended system shutdown occurs.

Embodiments of the present invention will be described in detail with reference to the drawings. Note that the same or corresponding parts in the drawings are denoted by the same reference numerals, and no redundant description will be given of such parts.

First, an example of a case to which the present invention is applied will be described.

<FIG> is a diagram schematically illustrating an example of a case to which the present invention is applied. With reference to <FIG>, a control system <NUM> includes, as an example of a controller, a standard controller <NUM> and a safety controller <NUM>. On standard controller <NUM> and safety controller <NUM>, a user program is executed.

Herein, the "user program" is a set of instructions that defines a control operation (control logic) to be executed on the controller, and is created to adapt to a control target. In the following description, a user program executed on standard controller <NUM> is referred to as a standard control program, and a user program executed on safety controller <NUM> is referred to as a safety program. Control system <NUM> includes a support device <NUM> used for developing such user programs.

Control system <NUM> further includes a display device <NUM> that provides a supervisory control screen by referring to information held by the controller.

Herein, the "supervisory control screen" means a user interface that presents, to a user, a state of the control target including information held by the controller and the like and is capable of receiving a user operation.

In the present application example, support device <NUM> executes processing of extracting a relationship between an output signal and one or more input signals defined by the user program and generating input-output correspondence information <NUM>. Support device <NUM> executes processing of transmitting input-output correspondence information <NUM> or screen data reflecting input-output correspondence information <NUM> to display device <NUM>.

Display device <NUM> provides, on the basis of input-output correspondence information <NUM> or the screen data reflecting input-output correspondence information <NUM>, the supervisory control screen showing the current value of a selected output signal and the current value of one or more input signals associated with the output signal by referring to the values of input and output signals held by the controller (standard controller <NUM> and safety controller <NUM>).

Such a configuration allows, even when an unintended system shutdown occurs, a cause of the system shutdown (for example, the value of any of the input signals is abnormal) to be easily and quickly identified by referring to the supervisory control screen presented on display device <NUM> without using support device <NUM>.

Herein, the "input signal" includes a signal input, from the control target or the like, to an input unit connected to the controller directly or over a network. Examples of the input signal include an ON/OFF signal (digital input) detected by a photoelectric sensor or the like, a physical signal (analog input) detected by a temperature sensor or the like, and a pulse signal (pulse input) generated by a pulse encoder or the like. A description of the following embodiment will be given on the assumption that the user program is developed in a variable programming environment, and thus, an "input variable" indicating the value of each input signal is treated as being substantially equivalent to the "input signal".

Herein, the "output signal" includes a signal output from an output unit connected to the controller directly or over a network. Examples of the output signal include an ON/OFF signal (digital output) for driving a relay or the like, a speed command (analog output) indicating a rotation speed of a servomotor or the like, and a displacement command (pulse output) indicating a movement amount of a stepping motor or the like. The description of the following embodiment will be given on the assumption that the user program is developed in a variable programming environment, and thus, an "output variable" indicating the value of each output is treated as being substantially equivalent to the "output signal".

Next, an example of a configuration of control system <NUM> according to the present embodiment will be described. <FIG> is a diagram schematically illustrating an example of the configuration of control system <NUM> according to the present embodiment.

With reference to <FIG>, control system <NUM> primarily includes standard controller <NUM>, and safety controller <NUM>, a safety slave coupler <NUM>, and one or more safety drivers <NUM> connected to standard controller <NUM> over a field network <NUM>.

EtherCAT (registered trademark) may be used as an example of the protocol used on field network <NUM>.

Standard controller <NUM> executes standard control on a desired control target in accordance with a standard control program created in advance. Safety controller <NUM> executes safety control on a desired control target independently of standard controller <NUM>.

Herein, the "standard control" is a generic name for processing of controlling the control target in accordance with a predetermined required specification. On the other hand, the "safety control" is a generic name for processing of preventing the safety of a person from being threatened by a facility, a machine, or the like. The "safety control" is designed to satisfy requirements for implementing the safety function defined by IEC <NUM> or the like.

Safety slave coupler <NUM> is capable of transferring an input signal received from a desired safety device <NUM> to safety controller <NUM> and/or transferring a command from safety controller <NUM> to a desired safety device <NUM>. Note that safety device <NUM> may be directly connected to safety controller <NUM>.

Safety driver <NUM> drives servomotor <NUM> electrically connected to safety driver <NUM>. Safety driver <NUM> also has a safety function related to driving of servomotor <NUM>.

Display device <NUM> and/or support device <NUM> is connectable to standard controller <NUM>.

Display device <NUM> is also referred to as a human machine interface (HMI) or a programmable terminal (PT), and display device <NUM> provides the supervisory control screen by referring to information held by the controller (standard controller <NUM> and/or safety controller <NUM>) and sends a command corresponding to a user operation to standard controller <NUM>.

Support device <NUM> provides an environment in which the user program (a standard control program <NUM> and/or a safety program <NUM>) executed on the controller (standard controller <NUM> and/or safety controller <NUM>) is developed. Support device <NUM> may provide a support function of making various settings necessary for the operation of control system <NUM> in addition to creating or modifying the program executed on standard controller <NUM> and/or safety controller <NUM>.

Next, an example of a configuration of a device included in control system <NUM> will be described.

<FIG> is a diagram schematically illustrating an example of a hardware configuration of standard controller <NUM> that is a part of control system <NUM> according to the present embodiment. As illustrated in <FIG>, standard controller <NUM> includes a processor <NUM>, a main memory <NUM>, a storage <NUM>, a host network controller <NUM>, a field network controller <NUM>, a universal serial bus (USB) controller <NUM>, a memory card interface <NUM>, and a local bus controller <NUM>. Such components are connected over a processor bus <NUM>.

Processor <NUM> primarily serves as an operation processor that executes a control operation related to the standard control, and includes a central processing unit (CPU), a graphics processing unit (GPU), or the like. Specifically, processor <NUM> reads a program (for example, a system program <NUM> and standard control program <NUM>) stored in storage <NUM>, loads the program into main memory <NUM>, and executes the program, thereby enabling the control operation and various processing as described later to be executed in a manner that depends on the control target.

Main memory <NUM> includes a volatile storage device such as a dynamic random access memory (DRAM) or a static random access memory (SRAM). Storage <NUM> includes, for example, a non-volatile storage device such as a solid state drive (SSD) or a hard disk drive (HDD).

Storage <NUM> stores system program <NUM> via which basic functions are implemented, standard control program <NUM> created to adapt to the control target, and setting information <NUM> for defining processing to be executed on standard controller <NUM>.

Host network controller <NUM> exchanges data with a desired information processor over a host network.

Field network controller <NUM> exchanges data with a desired device over field network <NUM>. In the configuration illustrated in <FIG>, field network controller <NUM> serves as a communication master of field network <NUM>.

USB controller <NUM> exchanges data with support device <NUM> or the like over a USB connection.

Memory card interface <NUM> receives memory card <NUM> that is an example of a removable storage medium. Memory card interface <NUM> can read and write desired data from and to memory card <NUM>.

Local bus controller <NUM> exchanges data with a desired unit connected to standard controller <NUM> over a local bus.

<FIG> is a diagram schematically illustrating an example of a hardware configuration of safety controller <NUM> that is a part of control system <NUM> according to the present embodiment. With reference to <FIG>, safety controller <NUM> includes a processor <NUM>, a main memory <NUM>, a storage <NUM>, a field network controller <NUM>, a USB controller <NUM>, and a safety local bus controller <NUM>. Such components are connected over a processor bus <NUM>.

Processor <NUM> primarily serves as an operation processor that executes a control operation related to the safety control, and includes a CPU, a GPU, or the like.

Main memory <NUM> includes a volatile storage device such as a DRAM or an SRAM. Storage <NUM> includes, for example, a non-volatile storage device such as an SSD or an HDD.

Storage <NUM> stores a system program <NUM> via which basic functions are implemented, safety program <NUM> created to adapt to the required safety function, and setting information <NUM> for defining processing to be executed on safety controller <NUM>.

Field network controller <NUM> exchanges data with a desired device over field network <NUM>. In the configuration illustrated in <FIG>, field network controller <NUM> serves as a communication slave of field network <NUM>.

Safety local bus controller <NUM> exchanges data with a desired safety IO unit <NUM> connected to safety controller <NUM> over a safety local bus.

<FIG> is a diagram schematically illustrating an example of a hardware configuration of safety slave coupler <NUM> that is a part of control system <NUM> according to the present embodiment. With reference to <FIG>, safety slave coupler <NUM> includes a processor <NUM>, a main memory <NUM>, a storage <NUM>, a field network controller <NUM>, and a safety local bus controller <NUM>. Such components are connected over a processor bus <NUM>.

Processor <NUM> primarily serves as an operation processor that executes a control operation to operate safety slave coupler <NUM>, and includes a CPU, a GPU, or the like.

Storage <NUM> stores a system program <NUM> via which basic functions are implemented and setting information <NUM> for defining processing to be executed on safety slave coupler <NUM>.

Safety local bus controller <NUM> exchanges data with a desired safety IO unit <NUM> connected to safety slave coupler <NUM> over a safety local bus.

<FIG> is a diagram schematically illustrating examples of hardware configurations of safety driver <NUM> and servomotor <NUM> that are parts of control system <NUM> according to the present embodiment. With reference to <FIG>, safety driver <NUM> includes a field network controller <NUM>, a control unit <NUM>, a drive circuit <NUM>, and a feedback receiving circuit <NUM>.

Control unit <NUM> executes operation processing necessary for the operation of safety driver <NUM>. As an example, control unit <NUM> includes processors <NUM>, <NUM>, a main memory <NUM>, and a storage <NUM>. Processor <NUM> primarily executes a control operation for driving servomotor <NUM>, and processor <NUM> primarily executes a control operation for providing the safety function related to servomotor <NUM>. Processors <NUM>, <NUM> each include a CPU or the like. The configuration is not limited to the configuration illustrated in <FIG>, and may be a configuration including a single processor.

Storage <NUM> stores a servo control program <NUM> via which servo control is implemented, a motion safety program <NUM> via which a motion safety function is implemented, and setting information <NUM> for defining processing to be executed on safety driver <NUM>.

Drive circuit <NUM> includes a converter circuit, an inverter circuit, and the like, and generates power having a designated voltage, current, and phase and supplies the power to servomotor <NUM> in accordance with a command from control unit <NUM>.

Feedback receiving circuit <NUM> receives a feedback signal from servomotor <NUM> and outputs the reception result to control unit <NUM>.

Servomotor <NUM> typically includes a three-phase AC motor <NUM> and an encoder <NUM> attached to a rotation shaft of three-phase AC motor <NUM>.

<FIG> is a diagram schematically illustrating an example of a hardware configuration of display device <NUM> that is a part of control system <NUM> according to the present embodiment. As an example, display device <NUM> is implemented by hardware (for example, a general-purpose personal computer) adhering to a standard architecture.

With reference to <FIG>, display device <NUM> includes a processor <NUM>, a main memory <NUM>, an input unit <NUM>, a display unit <NUM>, a storage <NUM>, a memory card interface <NUM>, and a communication controller <NUM>. Such components are connected over a processor bus <NUM>.

Processor <NUM> includes a CPU, a GPU, or the like, and reads a program (for example, an operating system (OS) <NUM> and a screen generation program <NUM>) stored in storage <NUM>, loads the program into main memory <NUM>, and executes the program, thereby enabling processing related to display and monitoring to be executed. Storage <NUM> further stores screen data <NUM> and input-output correspondence information <NUM> (details will be described later).

Main memory <NUM> includes a volatile storage device such as a DRAM or an SRAM. Storage <NUM> includes, for example, a non-volatile storage device such as an HDD or an SSD.

Storage <NUM> stores OS <NUM> via which basic functions are implemented and screen data <NUM> used for providing a function as display device <NUM>.

Input unit <NUM> typically includes a touchscreen or the like, and receives a user operation. As input unit <NUM>, a keyboard, a mouse, or the like may be used. Display unit <NUM> includes a display, various indicators, or the like, and outputs a processing result or the like received from processor <NUM>.

Communication controller <NUM> exchanges data with standard controller <NUM> or the like via desired local communication.

<FIG> is a diagram schematically illustrating an example of a hardware configuration of support device <NUM> that is a part of control system <NUM> according to the present embodiment. As an example, support device <NUM> is implemented by hardware (for example, a general-purpose personal computer) adhering to a standard architecture.

With reference to <FIG>, support device <NUM> includes a processor <NUM>, a main memory <NUM>, an input unit <NUM>, an output unit <NUM>, a storage <NUM>, an optical drive <NUM>, and a USB controller <NUM>. Such components are connected over a processor bus <NUM>.

Processor <NUM> includes a CPU, a GPU, or the like, and reads a program (for example, an OS <NUM> and a support program <NUM>) stored in storage <NUM>, loads the program into main memory <NUM>, and executes the program, thereby enabling various processing as described later to be executed.

Storage <NUM> stores OS <NUM> via which basic functions are implemented, support program <NUM> for providing a function as support device <NUM>, and project data <NUM> created by a user in a development environment.

Support device <NUM> provides a development environment in which settings of each device included in control system <NUM> and creation of a program to be executed on each device can be made in an integrated manner. Project data <NUM> includes data generated in such an integrated development environment. Typically, project data <NUM> includes a standard control source program <NUM>, standard controller setting information <NUM>, a safety source program <NUM>, safety controller setting information <NUM>, and safety driver setting information <NUM>.

Standard control source program <NUM> is converted into an object code, transmitted to standard controller <NUM>, and stored as a standard control program <NUM> (see <FIG>). Similarly, standard controller setting information <NUM> is transmitted to standard controller <NUM> and stored as setting information <NUM> (see <FIG>).

Safety source program <NUM> is converted into an object code, transmitted to safety controller <NUM>, and stored as safety program <NUM> (see <FIG>). Similarly, safety controller setting information <NUM> is transmitted to safety controller <NUM> and stored as setting information <NUM> (see <FIG>).

Safety driver setting information <NUM> is transmitted to safety driver <NUM> and stored as setting information <NUM> (see <FIG>).

Input unit <NUM> includes a keyboard, a mouse, or the like, and receives a user operation. Output unit <NUM> includes a display, various indicators, a printer, or the like, and outputs a processing result or the like received from processor <NUM>.

USB controller <NUM> exchanges data with standard controller <NUM> or the like over a USB connection.

Support device <NUM> includes optical drive <NUM> so as to allow a computer-readable program stored in a non-transitory storage medium <NUM> (for example, an optical storage medium such as a digital versatile disc (DVD)) to be read and installed in storage <NUM> or the like.

Support program <NUM> or the like executed on support device <NUM> may be installed via computer-readable storage medium <NUM>, or may be downloaded from a server device or the like on a network and then installed. Functions provided by support device <NUM> according to the present embodiment may be implemented via some of the modules provided by the OS.

Not that support device <NUM> may be removed from standard controller <NUM> while control system <NUM> is in operation.

<FIG> illustrate the configuration examples where one or more processors execute a program to provide necessary functions, but some or all of the functions thus provided may be implemented by a dedicated hardware circuit (for example, an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or the like).

Further, core parts of standard controller <NUM>, safety controller <NUM>, and safety slave coupler <NUM> may be each implemented by hardware (for example, an industrial personal computer based on a general-purpose personal computer) adhering to a standard architecture. Further, a plurality of OSs having different uses may be executed in parallel using a virtualization technology, and a necessary application may be executed on each OS. Furthermore, a configuration where functions such as display device <NUM> and support device <NUM> are integrated into standard controller <NUM> may be employed.

Next, a problem that may occur in control system <NUM> will be described.

<FIG> is a diagram for describing a problem that may occur in control system <NUM>. With reference to <FIG>, in control system <NUM>, standard controller <NUM> executes the standard control, and safety controller <NUM> executes the safety control.

Safety controller <NUM> exchanges safety IO data with safety slave coupler <NUM> and safety driver <NUM>.

When EtherCAT is used as the protocol on field network <NUM>, devices connected to field network <NUM> share data via a communication frame cyclically transmitted over field network <NUM>. The communication frame including the safety IO data is relayed from one communication slave to another communication slave via standard controller <NUM> serving as the communication master. Such a relay of the communication frame allows the safety IO data to be exchanged between safety controller <NUM> and safety slave coupler <NUM> and between safety controller <NUM> and safety driver <NUM>.

More specifically, a logical connection can be established between safety controller <NUM> and safety slave coupler <NUM> and between safety controller <NUM> and safety driver <NUM> using a protocol called FailSafe over EtherCAT (FSoE).

That is, the controller (safety controller <NUM>) serving as the communication slave exchanges data via the controller (standard controller <NUM>) serving as the communication master.

For example, it is assumed that any control target (for example, any production facility) is stopped due to the safety control executed by safety controller <NUM> (safety operation).

In order to identify the cause of the stop of the control target, support device <NUM> is connected to safety controller <NUM>, safety program <NUM> to be executed on support device <NUM> is read, process values (variables) managed by safety controller <NUM> are checked for identifying a safety IO (safety device <NUM>) that is the cause of the stop, and then a necessary measure is taken.

More specifically, the user (maintenance engineer) connects support device <NUM> to safety controller <NUM>, operates support device <NUM> to read safety program <NUM> (program upload), and starts to monitor the process values (variables) managed by safety controller <NUM> (variable monitoring). A safety input that makes a safety output False is identified on the basis of safety program <NUM> and a result of monitoring the process values. Then, the user operates safety device <NUM> corresponding to the safety input thus identified to take a measure to restore the safety input.

On the other hand, the operation of connecting support device <NUM> to safety controller <NUM> to identify the cause requires a relatively long time and thus may lead to an opportunity loss for the production facility. Therefore, there is a demand for introduction of a mechanism that allows a cause to be identified more quickly.

Next, a solution to a problem as described above that may occur in control system <NUM> will be described.

Control system <NUM> according to the present embodiment provides a mechanism capable of presenting, in a simple manner, a control status of the standard control executed by standard controller <NUM> and/or the safety control executed by safety controller <NUM> on display device <NUM>. Support device <NUM> extracts a relationship between an output signal defined by the user program (standard control program <NUM> and/or safety program <NUM>) and one or more input signals and generates input-output correspondence information <NUM>.

More specifically, support device <NUM> generates input-output correspondence information <NUM> on the basis of operation logic of standard control program <NUM> executed by standard controller <NUM> and/or safety program <NUM> executed by safety controller <NUM> in the development environment of standard control program <NUM> and/or safety program <NUM>. Support device <NUM> transmits input-output correspondence information <NUM> thus generated or screen data reflecting input-output correspondence information <NUM> to display device <NUM>.

Display device <NUM> provides, on the basis of input-output correspondence information <NUM> or the screen data reflecting input-output correspondence information <NUM>, the supervisory control screen showing the current value of a selected output signal and the current value of one or more input signals associated with the output signal by referring to the values of input and output signals held by the controller (standard controller <NUM> and safety controller <NUM>). More specifically, display device <NUM> provides a screen that allows the control status of the standard control executed by standard controller <NUM> and/or the safety control executed by safety controller <NUM> to be checked by referring to input-output correspondence information <NUM> thus provided.

<FIG> is a diagram schematically illustrating a solution applied to control system <NUM> according to the present embodiment. With reference to <FIG>, support device <NUM> analyzes standard control source program <NUM> and/or safety source program <NUM> included in project data <NUM> and generates input-output correspondence information <NUM> on the basis of the operation logic included in the program being monitored.

Support device <NUM> provides a screen that allows the control status to be checked on the basis of input-output correspondence information <NUM> thus generated.

Next, a processing example and a screen example in control system <NUM> according to the present embodiment will be described.

<FIG> is a diagram illustrating an example of a program to be analyzed by control system <NUM> according to the present embodiment. <FIG> illustrates an example of safety source program <NUM> (safety program <NUM>). In safety source program <NUM> illustrated in <FIG>, operation logic having four input variables <NUM>, <NUM>, <NUM>, <NUM> as input and three output variables <NUM>, <NUM>, <NUM> as output is defined.

More specifically, output variable <NUM> indicating an output signal of "SafetyRelay1" (meaning a safety relay <NUM>) is calculated as a logical AND (AND gate <NUM>) of input variable <NUM> indicating an input signal of "ESOP1" (meaning an emergency stop switch <NUM>), input variable <NUM> indicating an input signal of "ESOP2" (meaning an emergency stop switch <NUM>), input variable <NUM> indicating an input signal of "SLC1" (meaning a light curtain <NUM>), and input variable <NUM> indicating an input signal of "FromStd1" (meaning input from standard PLC <NUM>).

Further, output variable <NUM> indicating an output signal of "SafetyRelay2" (meaning a safety relay <NUM>) is calculated as a logical AND (AND gate <NUM>) of input variable <NUM>, input variable <NUM>, and input variable <NUM>.

Further, output variable <NUM> indicating an output signal of "ToStd1" (meaning output to standard PLC <NUM>) is calculated as a logical AND (AND gate <NUM>) of input variable <NUM> and input variable <NUM>.

Input-output correspondence information <NUM> is determined on the basis of the operation logic as illustrated in <FIG>.

<FIG> and <FIG> are diagrams each illustrating an example of the monitor screen provided by display device <NUM> of control system <NUM> according to the present embodiment.

A monitor screen <NUM> illustrated in <FIG> and <FIG> includes an output variable list <NUM> showing a list of output variables included in the program being monitored, and an input variable list <NUM> showing a list of input variables included in the program being monitored.

Output variable list <NUM> includes output variable entries <NUM>, <NUM>, <NUM> corresponding to output variables <NUM>, <NUM>, <NUM> illustrated in <FIG>. Input variable list <NUM> includes input variable entries <NUM>, <NUM>, <NUM>, <NUM> corresponding to input variables <NUM>, <NUM>, <NUM>, <NUM> illustrated in <FIG>.

Monitor screen <NUM> includes a target message <NUM> indicating a program or controller being monitored. The user can identify the program or controller being monitored by referring to the content of target message <NUM>.

When standard control program <NUM> and/or safety program <NUM> is provided to display device <NUM>, a display button <NUM> for displaying the content of such a program may be provided.

<FIG> and <FIG> each illustrate an example where both output variable <NUM> and output variable <NUM> are False.

First, in order to identify the cause of making output variable <NUM> False, the user selects output variable entry <NUM> corresponding to output variable <NUM> as illustrated in <FIG>. This causes input variable entries <NUM>, <NUM>, <NUM>, <NUM> corresponding to input variables <NUM>, <NUM>, <NUM>, <NUM> for determining the value of output variable <NUM> to be displayed in input variable list <NUM>.

The user finds out that input variable <NUM> is False by referring to the content of input variable entry <NUM> of input variable list <NUM> and a display mode different from the others. That is, the user finds out that the cause of making output variable <NUM> False is due to input variable <NUM> being False.

Next, in order to identify the cause of making output variable <NUM> False, the user selects output variable entry <NUM> corresponding to output variable <NUM> as illustrated in <FIG>. This causes input variable entries <NUM>, <NUM>, <NUM> corresponding to input variables <NUM>, <NUM>, <NUM> for determining the value of output variable <NUM> to be displayed in input variable list <NUM>.

As described above, in control system <NUM> according to the present embodiment, even when any control target stops, the cause of the stop can be identified on display device <NUM> without connecting support device <NUM> to standard controller <NUM> and/or safety controller <NUM>.

As described above, in control system <NUM> according to the present embodiment, when transferring screen data <NUM> to display device <NUM>, support device <NUM> also transfers input-output correspondence information <NUM> generated as a result of analysis of standard control source program <NUM> and/or safety source program <NUM> included in project data <NUM>. When any control target stops, display device <NUM> allows the cause of the stop to be easily identified on the basis of input-output correspondence information <NUM>.

More specifically, the user (maintenance engineer) operates support device <NUM> to transfer input-output correspondence information <NUM> generated as a result of analysis of standard control source program <NUM> and/or safety source program <NUM> at the time of transferring screen data <NUM> to display device <NUM>. This allows display device <NUM> to provide information on process values (variables) managed by standard controller <NUM> and/or safety controller <NUM>.

Thereafter, when any problem occurs, the user (maintenance engineer or facility operator) operates display device <NUM> to display monitor screen <NUM> generated on the basis of input-output correspondence information <NUM>. Display device <NUM> acquires, in response to a user operation, the value of each variable being monitored from a target controller or device in accordance with a definition included in input-output correspondence information <NUM>.

Display device <NUM> acquires the value of each variable being monitored from a controller or a device using a preset communication command. Then, the user identifies an input variable that makes an output signal False from a relationship between the output variable and the input variables displayed on display device <NUM>. Finally, the user takes a necessary measure on a device or the like to which the input variable thus identified is assigned to restore the input signal.

Next, an example of input-output correspondence information <NUM> used by control system <NUM> according to the present embodiment will be described.

<FIG> is a diagram illustrating an example of input-output correspondence information <NUM> used by control system <NUM> according to the present embodiment. With reference to <FIG>, input-output correspondence information <NUM> includes an input variable definition section <NUM>, an output variable definition section <NUM>, and an association definition section <NUM>. Input-output correspondence information <NUM> further includes a safety signature <NUM>, target node information <NUM>, and target unit information <NUM>.

Safety signature <NUM> may be validated when safety controller <NUM> is set as an object being monitored. Safety signature <NUM> is information used for ensuring that safety program <NUM> executed by safety controller <NUM> is not falsified, and shows identity with the user program (safety program <NUM>) executed by safety controller <NUM>. A safety signature assigned in advance at the time of creating safety program <NUM> may be used as safety signature <NUM>. Alternatively, a value (for example, a CRC value) calculated from safety program <NUM> using a predetermined expression may be used as safety signature <NUM>.

Target node information <NUM> and target unit information <NUM> are information used for identifying the controller being monitored in control system <NUM>. Such pieces of information may constitute a part of a reference address. Target node information <NUM> is used for identifying a location (node address) on field network <NUM> where the controller being monitored is located. Target unit information <NUM> is auxiliary information used for identifying the controller being monitored and for identifying a location (unit address) of the unit being monitored among devices (including a plurality of units) specified by target node information <NUM>.

The example illustrated in <FIG> shows that a unit having a unit address of "<NUM>" of a device located at a node address of "<NUM>" is an object being monitored.

Input variable definition section <NUM> includes a number definition <NUM>. Input variable definition section <NUM> further includes, for each variable, a variable name <NUM>, a data type <NUM>, a comment <NUM>, a data location <NUM>, an offset <NUM>, and a data length <NUM>. Such elements are separated by commas and defined for each input variable.

Number definition <NUM> starts with "NumInput" and is used for specifying the number of input variables included in input-output correspondence information <NUM>. The example illustrated in <FIG> shows that the number of input variables is four.

Variable name <NUM> represents a variable name of an input variable such as "ESTOP1".

Data type <NUM> represents a data type of an input variable such as "SAFEBOOL" (safety Boolean type).

Comment <NUM> represents a comment of a variable such as "emergency stop switch <NUM>".

Data location <NUM> represents a reference address such as "Location=//Unit#<NUM>/0x7000:<NUM>". Data location <NUM> may be, for example, a memory address of the target controller.

Offset <NUM> is auxiliary information used for accessing an input variable and represents an offset from data location <NUM>. When a frame of a communication protocol or the like is included in data location <NUM>, specifying offset <NUM> makes it possible to remove unnecessary data.

Data length <NUM> represents a length of data to be read as an input variable. Data length <NUM> is used for specifying, for example, the number of bits or the number of bytes. Data of a length specified by data length <NUM> is read from a start point specified by data location <NUM> and offset <NUM>.

Output variable definition section <NUM> includes a number definition <NUM>. Output variable definition section <NUM> further includes, for each variable, a variable name <NUM>, a data type <NUM>, a comment <NUM>, a data location <NUM>, an offset <NUM>, and a data length <NUM>. Such elements are separated by commas and defined for each output variable.

Number definition <NUM> starts with "NumOutput" and is used for specifying the number of output variables included in input-output correspondence information <NUM>. The example illustrated in <FIG> shows that the number of output variables is three.

Variable name <NUM> represents a variable name of an output variable such as "SafeRelay1".

Data type <NUM> represents a data type of an output variable such as "SAFEBOOL" (safety Boolean type).

Comment <NUM> represents a comment of a variable such as "safety relay <NUM>".

Data location <NUM> represents a reference address such as "Location=//Unit#<NUM>/0x6000:<NUM>". Data location <NUM> may be, for example, a memory address of the target controller.

Offset <NUM> is auxiliary information used for accessing an output variable and represents an offset from data location <NUM>. When a frame of a communication protocol or the like is included in data location <NUM>, specifying offset <NUM> makes it possible to write data to a specific location in the frame.

Data length <NUM> represents a length of data to be written as an output variable. Data length <NUM> is used for specifying, for example, the number of bits or the number of bytes. Data of a length specified by data length <NUM> is write from a start point specified by data location <NUM> and offset <NUM>.

Association definition section <NUM> starts with "IOMatrix" and is used for specifying one or more input variables associated with each output variable. More specifically, association definition section <NUM> includes, for each variable, an output variable name <NUM>, an input variable number <NUM>, and one or more input variable names <NUM>. Such elements are separated by commas and defined for each output variable.

Output variable name <NUM> is used for specifying a variable name of the target output signal.

Input variable number <NUM> is used for specifying the number of input variables associated with the target output variable. Input variable number <NUM> is used for specifying the number of input variables input to a logical AND (AND) that determines the value of the target output variable.

Input variable name <NUM> is used for specifying a variable name of an input variable associated with the target output variable. The input variable name specified by input variable name <NUM> is selected from one or more input variables specified by input variable definition section <NUM>.

The data structure of input-output correspondence information <NUM> illustrated in <FIG> is merely an example, and any data structure may be employed as long as the function explicitly or implicitly described herein can be implemented.

As described above, input-output correspondence information <NUM> includes addresses (data location <NUM> and data location <NUM>) used for referring to the value of each of the input and output signals, and information (association definition section <NUM>) used for identifying one or more input signals associated with an output signal.

Next, data transfer processing in control system <NUM> according to the present embodiment will be described. <FIG> is a schematic diagram for describing data transfer processing in control system <NUM> according to the present embodiment. With reference to <FIG>, for example, when EtherCAT is used as the protocol on field network <NUM>, a communication frame <NUM> is cyclically transferred over field network <NUM>.

For example, input data indicating an input signal that is input from safety device <NUM> to safety slave coupler <NUM> is written to communication frame <NUM> that has arrived at safety device <NUM> (write data). Communication frame <NUM> to which the input data has been written is transferred to standard controller <NUM> and further transferred to safety controller <NUM>. Safety controller <NUM> reads the input data included in arrived communication frame <NUM> and executes the safety control.

As described above, since communication frame <NUM> is transferred via standard controller <NUM> (the communication master of field network <NUM>), standard controller <NUM> can refer to (can access) data exchanged between safety slave coupler <NUM> and safety controller <NUM>.

From display device <NUM> connected to standard controller <NUM>, not only the process values managed by standard controller <NUM> but also the process values exchanged between safety slave coupler <NUM> and safety controller <NUM> can be referred to (accessed). Note that the FSoE allows data to be exchanged by a command/response method using a plurality of communication frames <NUM>. Even in such a case, it is possible to refer to data exchanged by standard controller <NUM>.

As described above, display device <NUM> can refer to the values of the input and output signals held by the controller (safety controller <NUM>) serving as the communication slave via the controller (standard controller <NUM>) serving as the communication master.

Next, a processing procedure in control system <NUM> according to the present embodiment will be described.

<FIG> is a flowchart illustrating a processing procedure of generating input-output correspondence information <NUM> in control system <NUM> according to the present embodiment. Typically, processor <NUM> of support device <NUM> runs support program <NUM> to execute each step illustrated in <FIG>.

With reference to <FIG>, support device <NUM> receives the selection of the target program (standard control source program <NUM> and/or safety source program <NUM>) from the user (step S100). Support device <NUM> determines whether the target program thus selected is the safety program (step S102). When the selected target program is the safety program (YES in step S102), support device <NUM> determines whether the validity of the selected safety program has been confirmed (step S104). When the validity of the selected safety program has yet to be confirmed (NO in step S104), the subsequent processing is canceled.

When the selected target program is not the safety program (NO in step S102) or when the validity of the selected safety program has been confirmed (YES in step S104), support device <NUM> extracts variables mapped to output variables in the target program (step S106) and extracts variables mapped to input variables in the target program (step S108).

Support device <NUM> selects one of the output variables extracted in step S106 as a target output variable (step S110). Support device <NUM> identifies a location where the value of the target output variable is finally set in the target program (step S112), and traces back the target program from the location thus identified to extract all input variables related to the value of the target output variable (step S114). Support device <NUM> associates all the input variables extracted in step S114 with the target output variable (step S116).

Subsequently, support device <NUM> determines whether the processing on all the output variables extracted in step S106 has been completed (step S118). When there is an output variable on which the processing has yet to be completed among the extracted output variables (NO in step S118), support device <NUM> selects, as a target output variable, the output variable on which the processing has yet to be completed from among the extracted output variables (step S120). Support device <NUM> repeats the processing from step S112.

When the processing on all the output variables extracted in step S106 has been completed (YES in step S118), support device <NUM> outputs a list of each output variable and input variables associated with the output variable as input-output correspondence information <NUM> (step S122). Then, the processing of generating input-output correspondence information <NUM> is brought to an end.

As described above, support device <NUM> traces back the user program (safety program) for each of the output signals included in the user program to identify one or more input signals for determining the value of the output signal.

<FIG> is a flowchart illustrating a processing procedure of transferring input-output correspondence information <NUM> in control system <NUM> according to the present embodiment. Typically, processor <NUM> of support device <NUM> runs support program <NUM> to execute each step illustrated in <FIG>.

With reference to <FIG>, support device <NUM> receives, from the user, the selection of screen data <NUM> of the transfer target (step S200). Support device <NUM> determines whether input-output correspondence information <NUM> has been generated in addition to selected screen data <NUM> of the transfer target (step S202).

When input-output correspondence information <NUM> has not been generated (NO in step S202), support device <NUM> transfers, to support device <NUM>, only screen data <NUM> of the transfer target (step S204). Then, the processing is brought to an end.

When input-output correspondence information <NUM> has been generated (YES in step S202), support device <NUM> refers to standard controller setting information <NUM> representing the settings of standard controller <NUM> and/or safety controller setting information <NUM> representing the settings of safety controller <NUM> to determine reference destination addresses where the input and output variables included in input-output correspondence information <NUM> are acquired (step S206), and incorporates the reference destination addresses into input-output correspondence information <NUM> (step S208).

Then, support device <NUM> determines whether input-output correspondence information <NUM> is already present in display device <NUM> of the transfer destination (step S210). When input-output correspondence information <NUM> is already present in display device <NUM> of the transfer destination (YES in step S210), support device <NUM> deletes input-output correspondence information <NUM> in display device <NUM> of the transfer destination (step S212).

When no input-output correspondence information <NUM> is present in display device <NUM> of the transfer destination (NO in step S210), or after the deletion of input-output correspondence information <NUM> (step S212), support device <NUM> transfers screen data <NUM> of the transfer target and input-output correspondence information <NUM> to display device <NUM> (step S214). As described above, support device <NUM> transmits input-output correspondence information <NUM> to display device <NUM> in addition to screen data <NUM> used by display device <NUM> for providing a desired supervisory control screen. Then, the processing is brought to an end.

<FIG> is a flowchart illustrating a processing procedure of providing the monitor screen on the basis of input-output correspondence information <NUM> in control system <NUM> according to the present embodiment. Display device <NUM> generates the supervisory control screen on the basis of input-output correspondence information <NUM>. Typically, processor <NUM> of display device <NUM> runs screen generation program <NUM> to execute each step illustrated in <FIG>.

With reference to <FIG>, upon receipt of a command to start the display of the monitor screen (see <FIG> and <FIG>) (YES in step S300), display device <NUM> determines whether input-output correspondence information <NUM> has been transferred (step S302). When input-output correspondence information <NUM> has not been transferred (NO in step S302), the processing is brought to an end.

When input-output correspondence information <NUM> has been transferred (YES in step S302), display device <NUM> reads input-output correspondence information <NUM> (step S304) and determines whether a safety signature is included in input-output correspondence information <NUM> thus read (step S306).

When a safety signature is included in read input-output correspondence information <NUM> (YES in step S306), display device <NUM> acquires a safety signature from target safety controller <NUM> (step S308) and determines whether the safety signature thus acquired coincides with the safety signature of input-output correspondence information <NUM> (step S310). When the acquired safety signature does not coincide with the safety signature of input-output correspondence information <NUM> (NO in step S310), the processing is brought to an end.

When the acquired safety signature coincides with the safety signature of input-output correspondence information <NUM> (YES in step S310), display device <NUM> internally generates a list of one or more input variables associated with each output variable on the basis of read input-output correspondence information <NUM> (step S312).

Then, display device <NUM> acquires the value of each of the output and input variables on the basis of a corresponding reference address with reference to the list thus generated (step S314), and generates and displays a monitor screen for the selected output variable (step S316). As described above, the screen data reflecting input-output correspondence information <NUM> is structured to show the current value of one or more input signals associated with any selected output signal generated on the basis of input-output correspondence information <NUM>.

Display device <NUM> determines whether a command to terminate the display of the monitor screen has been received (step S318). When the command to terminate the display of the monitor screen has not been received (NO in step S318), step S314 and the subsequent steps are repeatedly executed.

When the command to terminate the display of the monitor screen has been received (YES in step S318), display device <NUM> terminates the processing.

The above description shows an example where support device <NUM> is responsible for generating input-output correspondence information <NUM>, and display device <NUM> is responsible for storing generated input-output correspondence information <NUM> and generating the monitor screen on the basis of input-output correspondence information <NUM>, but the present invention is not limited to such an example, and each function may be implemented as desired.

That is, (<NUM>) the function of generating input-output correspondence information <NUM>, (<NUM>) the function of storing generated input-output correspondence information <NUM>, and (<NUM>) the function of generating the monitor screen on the basis of input-output correspondence information <NUM> may be assigned to any device in control system <NUM>.

Note that (<NUM>) the function of storing generated input-output correspondence information <NUM> and (<NUM>) the function of generating the monitor screen on the basis of input-output correspondence information <NUM> may be combined to generate the monitor screen including information on the association of the variable values included in input-output correspondence information <NUM>. In this case, (<NUM>) the function of storing the generated input-output correspondence information <NUM> is merged with (<NUM>) the function of generating the monitor screen on the basis of input-output correspondence information <NUM>.

<FIG> is a diagram illustrating an example of function sharing in control system <NUM> according to the present embodiment. <FIG> illustrates eight, that is Nos. <NUM> to <NUM>, function sharing examples.

The function sharing example of No. <NUM> corresponds to the above-described embodiment. Display device <NUM> generates monitor screen <NUM> on the basis of input-output correspondence information <NUM>.

The function sharing example of No. <NUM> corresponds to a mode where input-output correspondence information <NUM> is stored in safety controller <NUM> rather than display device <NUM>. Display device <NUM> reads input-output correspondence information <NUM> from safety controller <NUM>, and generates monitor screen <NUM> on the basis of input-output correspondence information <NUM> thus read.

The function sharing example of No. <NUM> is similar to the function sharing example of No. <NUM> and corresponds to a mode where input-output correspondence information <NUM> is stored in standard controller <NUM> rather than display device <NUM>. Display device <NUM> reads input-output correspondence information <NUM> from standard controller <NUM>, and generates monitor screen <NUM> on the basis of input-output correspondence information <NUM> thus read.

The function sharing example of No. <NUM> is implemented using an integrated controller that is a combination of standard controller <NUM> and display device <NUM> in one. In this function sharing example, the integrated controller is responsible for storing input-output correspondence information <NUM> and generating monitor screen <NUM>.

The function sharing examples of Nos. <NUM> to <NUM> correspond to a configuration where (<NUM>) the function of storing generated input-output correspondence information <NUM> is merged with (<NUM>) the function of generating the monitor screen on the basis of input-output correspondence information <NUM>.

More specifically, in the function sharing example of No. <NUM>, support device <NUM> generates both input-output correspondence information <NUM> and screen data reflecting input-output correspondence information <NUM>. Display device <NUM> provides monitor screen <NUM> on the basis of the screen data reflecting input-output correspondence information <NUM>.

Further, in the function sharing example of No. <NUM>, support device <NUM> generates both input-output correspondence information <NUM> and screen data reflecting input-output correspondence information <NUM>. The integrated controller provides monitor screen <NUM> on the basis of the screen data reflecting input-output correspondence information <NUM>.

Further, in the function sharing example of No. <NUM>, display device <NUM> itself generates both input-output correspondence information <NUM> and screen data reflecting input-output correspondence information <NUM>. Display device <NUM> provides monitor screen <NUM> on the basis of the screen data reflecting input-output correspondence information <NUM>.

In the function sharing example of No. <NUM>, safety controller <NUM> generates input-output correspondence information <NUM> and stores input-output correspondence information <NUM> thus generated. Display device <NUM> reads input-output correspondence information <NUM> from safety controller <NUM>, and generates monitor screen <NUM> on the basis of input-output correspondence information <NUM> thus read.

Note that the function sharing examples illustrated in <FIG> are merely examples, and any function sharing may be employed according to a control system to be implemented.

Although <FIG> illustrates a configuration where control system <NUM> includes field network <NUM>, even a configuration where control system <NUM> further includes another field network can provide the monitor screen as described above.

<FIG> is a diagram schematically illustrating an example of a configuration of a control system 1A according to a modification of the present embodiment. With reference to <FIG>, control system 1A includes a field network <NUM> in addition to field network <NUM>. Standard controller <NUM> can perform data communication with one or more safety IO terminals <NUM> and a robot <NUM> over field network <NUM>.

A protocol used on field network <NUM> may be the same as or different from the protocol used on field network <NUM>. Examples of the different protocol may include EtherNet/IP.

As described above, the monitor screen according to the present embodiment can be made by the control system having a desired configuration.

Control system <NUM> according to the present embodiment can present a list of input signals associated with a stopped output signal and their current values on the display device, for example, when a device of a production facility or the like is stopped by a safety function. It is therefore possible to easily identify an input signal that has caused the facility to stop by referring to the information thus presented. In most cases, the cause can be found only with the display device, so that it is not necessary to connect the support device or the like to the controller, which in turn allows quick recovery.

It should be understood that the embodiment disclosed herein is illustrative in all respects and not restrictive. The scope of the present invention is defined by the claims rather than the above description.

Claim 1:
A support device (<NUM>) usable for developing a user program to be executed on a controller (<NUM>, <NUM>), the controller being connected with a display device (<NUM>) configured to provide a supervisory control screen by referring to information held by the controller, the support device comprising:
a generation means (S100 to S122) configured to extract a relationship between an output signal and one or more input signals defined by the user program and generate input-output correspondence information (<NUM>); and
a transmission means (S200 to S214) configured to transmit the input-output correspondence information or screen data reflecting the input-output correspondence information to the display device, wherein
the display device is configured to provide, on the basis of the input-output correspondence information or the screen data reflecting the input-output correspondence information, the supervisory control screen showing a current value of a selected output signal and a current value of one or more input signals associated with the output signal by referring to values of input and output signals held by the controller (S300 to S318), wherein
the controller includes a safety controller (<NUM>), the support device characterised in that
the input-output correspondence information includes a safety signature (<NUM>) usable for ensuring that a user program executed on the safety controller is not falsified.