Patent Description:
A PLC (programmable logic controller) is used as a control device for controlling a plurality of machines (motors, robots, sensors, etc.) included in a production line or the like. In addition, in a system in which a plurality of control devices is connected, to simplify the system configuration, the technique of performing communication using an existing standard such as Ethernet (registered trademark) has become common. As such a standard, for example, there exists EtherCAT (registered trademark) (Patent Document <NUM>).

Patent Document <NUM> proposes a safety PLC serving as a master and a safety slave which are connected through a safety network to constitute a network system. The safety slave has a non-safety information storing unit for storing individual information and a state information of the connected safety device, the state information monitors a state of the operating safety device and a stored content is updated based on its monitored result. Then, when the non-safety information satisfies a fixed condition, at least the non-safety information satisfying the condition is transmitted to the safety PLC. That processing is performed by an MPU. Thus, unnecessary non-safety information is not transmitted.

Patent Document <NUM> provides an input device of a safety unit which enables an error diagnostic result referred by a safety unit such as a safety controller (i.e. master) or a safety slave, in a process of generating control data from raw input signal from a safety application switch or the like, to be referred by the controller side using that control data so as to achieve a variety of safety controls based on the control data. The input device contains a function of outputting status data indicating the error diagnosis result referred to when input signal is converted to control data and the control data obtained by the conversion in pair, so that when the logical value of the control data is "LOW", whether it originates from the fact that the raw logical value is "LOW" or from the fact that "LOW" is compulsorily set due to an error in the terminal, can be determined from the logical value of the status data.

In EtherCAT, a network-connected master sends a frame to a plurality of slaves, and the plurality of slaves write data to be sent to the master into the received frame on the fly. The communication used at this time includes process data communication and mailbox communication. Process data communication is communication that is periodically performed for all slaves, and mailbox communication is communication that is performed for specific slaves in a non-specific cycle. Data transmitted in the former is referred to as a PDO (process data object), and data transmitted in the latter is referred to as an SDO (service data object).

In the case of performing process data communication (hereinafter referred to as PDO communication), an instruction (e.g., an operation command is a target value) is transmitted from the master to the plurality of slaves (e.g., motor drivers), and an operating status or a sensed value is transmitted from the plurality of slaves to the master.

For example, EtherCAT slaves including motor drivers have a plurality of PDO mappings such as "a PDO mapping that can use the position control and latch function", "a PDO mapping that can use the position control, speed control, torque control, and latch function", and "a PDO mapping that can use the position control, speed control, torque limit, and latch function". Accordingly, it is possible to select an appropriate mapping according to the requirements of application.

In addition, one of the PDO mappings may include the safety function. EtherCAT slaves having the safety function are generally divided into modules (hereinafter referred to as standard parts) that process the PDO used in normal operations and modules (hereinafter referred to as safety parts) that process the PDO specialized in security functions.

By dividing the modules into the standard parts and the safety parts, it is possible to independently implement the process for ensuring security.

However, in the conventional control device, it is not possible to stop only one of the standard part and the safety part on the slave side. This is because the communication for the standard part and the communication for the safety part are processed at the same time, and once either one stops, it is deemed as a communication abnormality. Therefore, for example, even in the case where the program of the standard part is to be updated, it is necessary to stop the entire device, including the safety part.

The invention has been made in consideration of the above issue, and an object thereof is to provide a control device which achieves both security and convenience. The present invention is provided by the appended claims. The following disclosure serves a better understanding of the present invention. In the following description, any embodiments referred to and not falling within the scope of the appended claims are merely examples useful for the understanding of the invention.

The control device according to the invention is provided in claim <NUM>, the claims dependent on claim <NUM> defining further advantageous embodiments. The following disclosure serves a better understanding of the present invention. Accordingly, the disclosure provides a control device connected to a master device and performing controls of a drive target based on a content of communication with the master device.

The invention may be applied to a control system in which a master device and a control device which controls a drive target are connected. The drive target is typically a servomotor or the like, but is not limited thereto. As long as it is a device of a controlled target, it may be one (e.g., a laser device, etc.) that does not have a movable part.

The first information is information on the controls of the drive target. For example, in the case where the control target is a servomotor, the first information includes position information, speed information, torque information, and the like. Moreover, the second information is information on security of the drive target. The second information includes, for example, an STO (safe torque off) command defined on the FSoE (Fail Safe over EtherCAT) protocol, an abnormality flag, and the like. The control device according to the disclosure performs control processing of the drive target based on the first information and implements processing (e.g., output shut-off, etc.) for ensuring security of the drive target based on the second information.

Further, the control device according to the disclosure determines that the abnormality has occurred in the case where both the first information and the second information are not processed within the prescribed period. The case where the information is not processed includes the case where the information itself cannot be transmitted as well as the case where a normal processing result is not obtained even if packets and frames are sent out (e.g., the case where information to be updated returns without being updated).

According to such a configuration, it is possible to stop only the unit for controlling the drive target while the process for ensuring security remains implemented. In other words, while security of the device remains secured, maintenance and the like may be performed, and convenience is improved.

Further, the abnormality determining unit may determine that the abnormality has occurred in the case where the first information is not processed within the prescribed period while the drive target is being driven, and may determine that the abnormality has occurred in the case where both the first information and the second information are not processed within the prescribed period while the drive target is not being driven.

While the drive target is being driven, it is preferable to perform abnormality determination by limiting the target only to the first information. As a result, in the case where an unintended communication interruption occurs, it is possible to safely stop the drive target.

Further, the first information and the second information may be respectively transmitted and received via independent packets.

By transmitting and receiving the first information and the second information respectively via independent packets, it is possible to transmit and receive them respectively in different cycles. As a result, for example, it is possible to separately perform communication for performing control of the drive target at a high frequency, and communication for ensuring security at a low frequency. In addition, resource allocation for communication and processing can be optimized.

Further, the cycle for the transmission and reception of the first information may be shorter than the cycle for the transmission and reception of the second information.

According to such a configuration, it is possible to perform communication for controlling the drive target at a higher frequency. Also, in the case where the communication capacity is limited, it is possible to allocate more information capacity to the first information.

The invention may be specified as a control device including at least a part of the above means. Moreover, it may also be specified as a control method performed by the above control device. The above processes and means may be freely combined and implemented as long as no technical confliction arises.

According to the invention, it is possible to provide a control device which achieves both security and convenience.

Hereinafter, preferred embodiments of the invention will be described with reference to the drawings.

<FIG> is a schematic view showing a control system according to the first embodiment. The control system according to the first embodiment is configured to include a master PLC, which is a master node, and a plurality of slaves, which are slave nodes.

The master PLC <NUM> is a device that controls the plurality of slaves <NUM>. Specifically, management of programs executed by the slaves <NUM>, monitoring of the operating state of the slaves <NUM>, and the like are performed.

The slave <NUM> is a device that is electrically connected to the master PLC <NUM>, a servomotor <NUM> and a sensor <NUM>, drives the servomotor <NUM> according to a command received from the master PLC <NUM>, obtains information on the driving of the servomotor <NUM> from the sensor <NUM>, and transmits the information to the master PLC <NUM>. Moreover, the slave <NUM> has a safety controller function.

The slave <NUM> typically includes a communication unit <NUM> which performs network communication, a CPU unit <NUM> which is an entity that executes a program, and an I/O unit which inputs and outputs signals from the field. Specifically, an output unit <NUM> drives the servomotor <NUM> based on the execution result of the program executed by the CPU unit <NUM>, and an input unit <NUM> obtains an input signal from the sensor <NUM> which senses the servomotor <NUM>.

Although not shown, the CPU unit <NUM> may have a part for performing input and output (such as a touch panel or a display). For example, information on the operation of the PLC may be provided to a user.

The master PLC <NUM> and the slaves <NUM> are connected via a network such as Ethernet (registered trademark). In the present embodiment, the master PLC <NUM> and the slaves <NUM> are configured to communicate using EtherCAT (registered trademark).

Different servomotors <NUM> are respectively connected to the plurality of slaves <NUM>. Although <FIG> shows an example in which one servomotor <NUM> is connected to one slave <NUM>, the number of motors connected to the slave <NUM> may also be plural. In the case where the number of motors connected to the slave <NUM> is plural, information on the driving of each servomotor <NUM> is unified by the slave and transmitted to the master PLC <NUM>.

Moreover, although three slaves <NUM> are shown in <FIG>, the number of slaves connected to the network is not limited.

Next, the module configuration of the CPU unit <NUM> will be described. <FIG> is a module configuration view of the CPU unit <NUM> in the conventional art.

Moreover, in the description of this example not being part of the invention, only the modules that perform process data communication are shown, and illustration and description of the modules that perform mailbox communication are omitted.

The CPU unit <NUM> has a module that transmits and receives a PDO to and from the master PLC, and a module that processes the received PDO.

In this example, a PDO reception module 221A receives a PDO transmitted from the master PLC and divides the received PDO respectively into a standard PDO and a safety PDO.

Here, the standard PDO and the safety PDO will be described.

In the control system to which the invention is applicable, the master PLC and the slaves perform information exchange through PDO communication. The PDO communication is performed cyclically (periodically), and a PDO transmitted from the master PLC circulates in all the slaves. Moreover, in this example, the PDO transmitted from the master PLC includes, in the same one packet, a standard PDO in which information for performing control on the motor (e.g., position information, speed information, torque information, etc.) is stored, and a safety PDO in which information on security (e.g., FSoE command, emergency stop command, etc.) is stored.

<FIG> is a view showing transmission of a PDO. As shown in the drawing, the PDO is transmitted periodically (e.g., in every few microseconds to every few milliseconds).

Referring back to <FIG>, the description will be continued.

The PDO reception module 221A divides the received PDO into a standard PDO and a safety PDO, and transmits the standard PDO to a module (222A) that processes the standard PDO. Moreover, the safety PDO is transmitted to a module (222C) that processes the safety PDO. Each module performs predetermined processing according to the received PDO and generates a control signal to be output to the servomotor <NUM>.

Further, the information obtained by the sensor <NUM> is obtained by a module (222B) that processes the standard PDO and a module (222D) that processes the safety PDO. Then, a PDO transmission module 221B generates information to be stored in the PDO, configures a packet, and transmits the packet to the network. As a result, the PDO transmitted from the master PLC <NUM> is relayed by each of the slaves and circulates in the network.

In the description of the embodiment, the modules (222A and 222B) that process the standard PDO are referred to as standard parts, and the modules (222C and 222D) that process the safety PDO are referred to as safety parts.

In addition, in such a configuration, there is an issue that the standard parts and the safety parts cannot be paused separately. For example, in the case where the modules 222A and 222B responsible for the standard parts are to be updated, transmission and reception of the standard PDO must be stopped. However, in the configuration in which the standard PDO and the safety PDO are integrally transmitted and received, once the standard parts are stopped, the communication of the standard PDO is stopped, which causes a watchdog (not shown) of the CPU unit <NUM> to detect a communication abnormality. Further, when a communication abnormality is detected, the operation of the entire device, including the safety parts, is stopped. Therefore, there is an issue that the security of the device cannot be sufficiently ensured. In addition, when the entire device is stopped, there is an issue that it takes time to restart.

Next, the module configuration of the CPU unit <NUM> in the present embodiment will be described with reference to <FIG>. The CPU unit <NUM> in the present embodiment has a module that receives a PDO from the network and a module that transmits the PDO to the network as in the conventional example, but has a feature that the module that transmits and receives the standard PDO and the module that transmits and receives the safety PDO are divided.

Specifically, a standard PDO reception module 221E performs reception of the standard PDO, and a standard PDO transmission module 221F performs transmission of the standard PDO. Moreover, a safety PDO reception module <NUM> performs reception of the safety PDO, and a safety PDO transmission module <NUM> performs transmission of the safety PDO.

The parts (222A to 222D) for processing reception of the PDO and transmission of the PDO are the same as in the conventional example.

Further, in the present embodiment, as shown in <FIG>, the standard PDO and the safety PDO are respectively transmitted and received by independent packets. In other words, the standard PDO reception module 221E and the standard PDO transmission module 221F perform transmission and reception operations by taking only the standard PDO as a target, and the safety PDO reception module <NUM> and the safety PDO transmission module <NUM> perform transmission and reception operations by taking only the safety PDO as a target.

Furthermore, in the present embodiment, a watchdog (not shown) operating in the CPU unit <NUM> has the following features.

In addition, the case where communication has stopped refers to the case where the modules 222A to 222D stop communication or input/output, but even in the case where communication or input/output is possible, if the modules 222A to 222D do not process the PDO normally, it is deemed that communication has stopped.

In the case where a communication abnormality event occurs, the CPU unit <NUM> stops the operation of the entire device as in the conventional configuration to thereby stop the motor.

According to such a configuration, it is possible to stop only one of the standard part and the safety part while the servomotor is stopped. In other words, while security remains ensured, maintainability can be further improved. As a result, it is possible to reduce the preparation time of restarting the device or the like.

During operation of the servomotor, if the communication with the standard part is stopped, a communication abnormality event occurs. This is similar to the conventional configuration.

The second embodiment is an embodiment in which, in addition to the first embodiment, the standard PDO and the safety PDO are respectively further configured to be transmitted and received in different cycles.

<FIG> is a view showing a communication sequence in the second embodiment. In the example as shown, the standard PDO is transmitted and received every two time slots, and the safety PDO is transmitted and received every four time slots. Accordingly, by making the communication cycle different between the standard PDO and the safety PDO, the processing load of the device and the load of the network can be optimally designed. During PDO communication, although the capacity of the message which can be communicated is determined in advance, by optimizing the arrangement of the safety PDO, the communication capacity for the standard part can be increased, for example.

In addition, the description of the embodiments is an example for describing the invention, and the invention may also be implemented by being appropriately changed or combined within the scope that does not deviate from the invention as defined by the appended claims.

For example, although the term "module" is used in the description of the CPU unit <NUM>, the module may be a software module, or may be a specifically designed hardware (circuit or board) module or the like.

Claim 1:
A control device connected to a master device (<NUM>) and adapted for performing controls of a drive target (<NUM>) based on a content of communication with the master device (<NUM>), characterized in that the control device comprises:
a communication unit (<NUM>) which is adapted to periodically transmit and receive, to and from the master device (<NUM>), first information which is information being processed by the control device for controlling the drive target (<NUM>) and second information which is information being processed by the drive target (<NUM>) for performing security functions, wherein a cycle for transmission and reception of the first information is different from and not overlapped with a cycle for transmission and reception of the second information;
a first processing unit (222A, 222B) which is adapted to control the drive target by processing the first information;
a second processing unit (222C, 222D) which is adapted to securely control the drive target (<NUM>) by processing the second information; and
an abnormality determining unit (<NUM>) which is adapted to determine that an abnormality has occurred in a case where the first information or both the first information and the second information are not processed within a prescribed period.