Method and device for programming a safety controller

The present invention relates to a method for programming A safety controller, comprising the steps of:<ul><li>Set logical links between input signals The safety control system and</li><li>Assigning link products to output signals of the safety control,</li></ul>Wherein the setting of the links and the assigning by means of Predefined function - specific program modules, the From a set of such program modules.

The invention further relates to a device for programming A safety control system, with first means for Select and parameterize predefined function-specific Program modules, using their logical links Between input signals from the safety controller And linking products to output signals of the safety control Can be assigned.

A method and a device of the type mentioned are made of WO 98/44399 or from US Pat. No. 5,452,201.

A safety control in the sense of the present invention Is a device or device that is made by sensors And the input signal is obtained therefrom by logical And possibly other signal or data processing steps Output signals. The output signals Actuators can then be fed, which are then activated as a function of the load Actions targeted by the input signals; or Reactions in the environment. A preferred field of application For such safety controls is in the range The machine safety, the monitoring of emergency stop buttons, Two-hand controls, protective doors or light grids. Such Sensors are used, for example, to provide a machine, Which in operation is a threat to people or material goods Out. When opening the protective door or pressing Of the emergency-stop button, a signal is generated which Is fed as an input signal to the safety controller. In As a result, the safety control then switches, for example With the help of an actuator the dangerous part Of the machine.

Characteristic of a safety control is in contrast To a "normal" control that the safety control Even when connected to it or a device connected to it A malfunction occurs, always a safe state of the Dangerous machinery or machine. Therefore Are extremely demanding in safety control systems Their own fault safety posed, which is a considerable Expenditure on development and production. In Usually require safety controls before their use A special authorization by competent supervisory authorities, Such as in Germany by the employers' cooperatives Or the TÜV. The safety control must be predefined Safety standards, which, for example, Of the European standard EN 954-1. Hereinafter A device or a Device which is at least the safety category 3 of the European standard.

A programmable safety control is available to the user The possibility of the logical links and, if necessary, the logical links Further signal or data processing steps with the aid of A software called the user program Individually. This results A great flexibility compared to previous solutions, In which the logical links are defined by a defined Wiring between different safety devices Have been. A problem with the programming of a safety control Is that the user program to be created Is itself a safety critical element An error in the user program causes an uncontrolled situation And thus a dangerous condition in the monitored Machine or system. In addition, the user program In the monitoring of a large machine plant With many security devices very complex and confusing Can be, ensuring the necessary Failure safety considerably more difficult. This can lead to the following Error in the user program not only by human Failure in programming, but also by Non-fail-safe programming tools. For example, the user program for safety control With the aid of a non-fail-safe, commercially available Personal Computers (PC) could be memory errors Of the PC to a subsequent falsification of the user program to lead.

In WO 98/44399 mentioned at the beginning, As with a commercial PC a safety - oriented Control system, ie a safety control, Can be programmed. For this are in the safety control Function-specific program modules in the form of so-called Software macros. To create the user program The user uses the PC to generate program module function calls, Which are subsequently transmitted to the safety controller will. Using the program module function calls The required program modules are called in the safety control And to the actual user program. The programming device, ie the PC, To select and compile the required program modules. The program modules themselves can not be changed , And thus the PC can not exert any influence on it.

The known method simplifies the programming of a safety controller. In addition, some security is added Is achieved by means of the control signals sent to the safety control Transmitted program module function calls into the programming device Are read back and confirmed there by the user Need to become. However, the known method is in view To the error tolerance when creating a user program Not yet optimal.

US Pat. No. 5,452,201 likewise relates to a process For programming an industrial control. The programming is then carried out in a graphic Programming area, in which graphic symbols, the components Of the control are connected to one another via lines , The lines symbolizing a desired wiring. Within the graphical programming area The selectable symbols are freely placed and accordingly also Are freely interconnected.

It is therefore an object of the present invention to provide a method And a device of the type mentioned at the outset, To provide even more error-proof programming Of the safety control.

This object is achieved in the method mentioned at the outset That each selected program module is unique Defined function group, wherein a first Function group contains the input signals of the Safety control and, depending on this, first A second function group Program modules containing the first intermediate variables logical And second intermediate variables as a function thereof With a third function group Program modules containing the second intermediate values ​​of the output signals To the safety controller, and wherein Each program module of the first function group has a defined Signal source.

The object is achieved with a device of the initially mentioned type In that there are other means which can be used Is clearly defined Function group and that the program modules Of the first function group are designed to perform a defined Signal source.

The mandatory assignment of a selected program module One of the defined function groups causes one Very clear and structured programming of the safety control. This has the consequence that errors are possible When programming. In an unstructured It is possible, for example, for unrecognized Reactions between different parts of the generated user program Are formed. Such reac- tions can occur Run-time problems or even to "vibrations" which An unstable and dangerous condition. These sources of error are represented by the forcible, Structuring during programming is considerably reduced, If not completely avoided. Further simplified Due to the clear and uniform structure Also a plausibility check of the generated user program. For example, Is now easier and thus also more reliable To check if a program module from the first function group Only via a unique intermediate size to a logic module From the second function group.

Moreover, a structure structured according to the invention can be used The program is easier to maintain, ie it can be modified later Which can lead to errors in such activities Are reduced. Furthermore, the predetermined structure also leads When programming itself to a greater clarity, Whereby the danger of human errors such as, for example, Forgetting individual required links, as well Is reduced.

Defined signal sources in this sense are for example Emergency stop buttons, protective doors and any other sensors that are Relevant signals. The program modules of the First function group evaluate these sensors independently And therefore provide a fail-safe as the first intermediate quantity Information about in we lchem state, the corresponding Sensor is located. The measure has the advantage that the First intermediate quantity has a "physical" meaning which For the programmer of the user program very well understandable Is. Therefore, the structure becomes particularly important when programming , Whereby error sources are further reduced.

The programming is done by the breakdown into the defined Function groups as a whole more clearly and thus even more Also more comfortable. At the same time, a great advantage of the Known method, namely, that the Create the user program only on prefabricated Program modules, can be maintained in full. The user program is made exclusively from verified, Fail - safe program modules Error sources are also reduced.

In a preferred embodiment of the invention, Program module exactly one of a total of three defined function groups .

In this embodiment, the structure is described in Exactly three levels. This corresponds to the natural one Basic structure of the user programs to be created, in which First input signals are recorded (first level), Then the recorded signals are processed (Second level) and finally the processing results according to Outside to trigger actions (third level). In this embodiment, the programming structure is therefore optimal Adapted to the circumstances and therefore particularly simple And clear. The risk of programming errors Is therefore further reduced.

In a further embodiment of the invention, Of each program module is a program module function call Generated and stored in a processing table.

This embodiment of the invention makes it possible to prepare prepared, And certified program modules stationary in the safety control To be deposited. The programmer with the help of his Programmer To a combination of program module function calls restrict. Such a user program requires comparatively Little memory space and can thus easily and quickly The safety control. It can also be easier Be checked. In addition, the program modules are essential Critical elements of the programmer's access Withdrawn. All in all, the comfort as Also improves the error-proofness during programming.

In a further embodiment, the program module function calls Separated by the function groups in the waste table Stored.

This measure has the advantage that the inventive Structure not only in programming itself, but Also in the user program generated thereby. In This is followed by the generated user program itself Less error sources, which further improves the error safety Is.

In a further embodiment of the aforementioned measure The program module function calls are executed in the order of the Function groups.

In this embodiment, therefore, all program module function calls are initially made The first function group, then The second and lastly the third function group Is stored. The measure has the advantage that: The order of the program module function calls The creation of the user program Which further increases the error safety.

In a further embodiment of the invention, the program modules By means of graphic symbols on a graphic User interface.

Because of this measure, it is possible to perform the actual operation Of programming is particularly vivid and clear To create error sources due to human failure Or volatility. Failure safety Is again considerably increased.

In a further embodiment of the aforementioned measure The program modules are drag-and-drop selected.

A drag-and-drop function is already graphical User interfaces of standard PCs. In this case An element with an input device, for example with the aid of A so-called mouse, and then using the input device To a desired location. Such a type of selection is very simple for the programmer And comfortable. Consequently, mistakes and The resulting error sources during programming Significantly reduced.

In a further embodiment of the invention, Function groups by means of graphical symbols on a graphic User interface.

Also with this measure becomes the clarity and clarity Significantly improved when programming Programmer directly visualizes the structure according to the invention becomes. The risk of errors is due to the thus immediate Possible optical control.

In a further embodiment of the method according to the invention The representation of a selected program module is displayed Of the user interface from a stored, associated Program module function call generated. The corresponding inventive Device therefore has a memory for storing Of a program module function call From a selected program module and a display unit Depending on the stored program module function call A representation of the selected program module Generated.

In this embodiment of the invention, a selected Program module on the user interface only after a detour Visualization. First, the corresponding program module function call Stored in the format in which It is later fed to the safety control. Only then Is the representation of the selected program module From the stored program module function call. The programmer therefore always receives a visualization of the Actually stored program module function calls and Can thus directly recognize whether the storage with its Specification. The control of the stored Program module function calls are thus performed directly at the Selection, causing errors during programming again considerably Are reduced. In addition, further checks of the stored Program module function calls are omitted, whereby the Programming in case of high error-protection overall Simple and comfortable.

In addition, the measure has the advantage that the programmer The created user program very simply graphically Can be documented. Therefore, the later maintenance of the user program Very simple and error-proof possible.

It is to be understood that the above and the following Still to be explained, not only in the respectively Indicated combination, but also in other combinations Or can be used in a single setting, without the frame of the The present invention.

Embodiments of the invention are given in the drawing And will become more apparent in the following description Is explained. Show it:<dl tsize="6"><dt>FIG</dt><dd>4 shows a schematic representation of a device according to the invention Apparatus in connection with a program to be programmed Safety control and</dd><dt>FIG</dt><dd>A simplified representation of a graphical user interface For programming a safety control.</dd></dl>

FIG. 1 shows a device according to the invention in its entirety With the reference numeral 10.

The apparatus 10 includes a conventional PC 12 A monitor 14 on which a computer program 16 is executed becomes. The computer program 16 allows the creation of a Application programs for safety control. It is in the Specialist terminology is often referred to as a programming tool.

The safety control to be programmed is shown in FIG Of the reference numeral 18. It is dual-channel redundant To provide the required error-proofing for controlling Safety-critical processes. Substitute For the two-channel structure are two in FIG. 1 Separate processors 20, 22, which are connected via a bidirectional Communication interface 24 with each other Stand to control each other and data Exchange. Preferably, the two channels of the Safety control 18 and the two processors 20, 22 are diversified, Ie, differently from each other, to make systematic Error to a large extent.

Reference numeral 26 designates an input / output unit, Which is connected to each of the two processors 20, 22 stands. The input / output unit receives input signals 28 from external ones Sensors 30 and derives them in an adapted data format To each of the two processors 20, 22. Further Generates the input / output unit depending on the processors 20, 22 output signals 32, by means of which actuators 34 are actuated will. The sensors 30 are, for example, To provide emergency stop buttons, two-hand controls, protective doors, Speed ​​monitoring devices or other sensors for recording Related parameters. The actuators 34 are, for example, So-called contactors, with which the power supply A drive or a complete machine can be.

Reference numeral 36 denotes a chip card on which A user program 38 is stored. The user program 38 is created with the aid of the device 10 and it The safety control 18 to be carried out Control tasks. The use of a chip card 36 as Storage medium allows a simple exchange of the User program 38 also without direct connection to the device 10. Alternatively, the user program 38 Also in a fixed manner in the safety control 18 Memory, for example an EEPROM.

The computer program 16 is displayed on the monitor 14 of the personal computer 12 A user interface explained in more detail below. The user interface allows a programmer to choose And parameterization of predefined function - specific Program modules, which in turn are firmly in the safety control 18 are stored. The programmer can customize the individual However, only select and combine program modules, He can not change it himself.

The selection and parameterization of the predefined program modules Is symbolized in FIG. 1 by a function block 40. After this The programmer selects a desired program module And if necessary, has been parameterized, this is stored in a memory 42 of the PC, in the format of the safety control 18. "In the format of safety control" means: In that a program module function call is generated and Which in this form is later also the chip card 36. The stored program module function call Provides a program command in the user program 38.

According to the exemplary embodiment illustrated here, Computer program 16 by means of the function block 44 from the Stored program module function call a symbolic Representation of the respective associated program module The user interface of the PC 12. For the programmer means In the manner described in more detail below A program module, and only from the fact, That the desired selection is visualized, it follows that The correct associated program module function call in the Memory 42 has been stored.

If the programmer needs all the programs required for his user program Program modules and, if necessary, parameterized The complete user program is located in the Store 42. It is preferably additionally provided with a CRC (Cyclic Redundancy Check). From the memory 42 The user program can then use the function block 46 in FIG Can be transmitted to the chip card 36 in a known manner. By securing with the CRC, That the user program stored on the chip card 36 Exactly with the previously generated and stored in the memory 42 User program.

The chip card 36 can be transmitted in the safety control 18, which is a corresponding communication link Between the PC 12 and the safety controller 18 is required. Alternatively, the chip card 36 may also be Via a charging device known per se (not shown here) With the user program 38. The safety control 18 is then made by simple insertion of the described Chip card 36 with the user program 38.

According to a further preferred embodiment of the invention The two processors 20, 22 operate the user program 38 diversified. This can be done, for example, with the help of But different program modules Done by a uniform program module function call to be activated. A comparison of the respective results Between the two processors 20, 22 then allows A fail-safe verification of the user program 38. On This way it is possible to make a user program 38 fail-safe Without any conceivable combinations of the Available program modules.

FIG. 2 is a graphical user interface showing the computer program 16 provides the programmer on the monitor 14, In their entirety, with the reference number 50.

The user interface 50 includes a programming field 52, According to the preferred embodiment shown here Of the invention graphically into three separate functional groups 54, 56, 58. Outside the programming field 52 is a set 60 of selectable program modules 62, 64, 66, 68, 70, 72 in the form of graphical symbols. The selection of one of these program modules takes place by the Corresponding icon using a drag and drop function in The function group of the programming field 52 provided for this purpose As exemplified by an arrow 74 Is. Selected program modules are exemplary With the reference numerals 76, 78, 80.

The program modules 62-72 available for selection are rough In three different types, the three defined ones Function groups 54, 56, 58. The function group 54 Receives program modules 62-68, each having a defined signal source, Ie, a defined sensor 30, is independently fail-safe evaluate. The program modules 62-68 become accordingly Also referred to as sensor modules. Each sensor module 62-68 Is adapted to a specific type of sensor, for example An emergency stop button, a protective door or a two-hand control. The sensor module 62 is for example A program module for error-proof evaluation A signal source with two redundant normally open contacts and With supervised start. Sensor module 64 is used for example Fail-safe evaluation of a signal source with a make- And an NC contact as well as with non-monitored start. Sensor module 66 is used, for example, for evaluating a signal source With only one NC contact. Other sensor modules 68 are used for evaluating signal sources with semiconductor outputs, Such as photocells. Total includes The set of 60 sensor modules for all relevant sensors 30.

The sensor modules 62-68, which are assigned to the first function group 54 The input signals are obtained as input parameters 28 of the sensors 30. Set as transfer parameters They first intermediate sizes prepared in the specialist terminology Can be referred to as flags. In the exemplary illustration In FIG. 2, the first intermediate variables are the markers M1, M2 and M3 at the outputs of a total of three selected sensor modules Respectively.

The function group 56 is used exclusively for recording Program modules, the first intermediate variables logically to each other And, depending on this, second intermediate variables provide. In the representation in FIG. 2, for example, The two flags M1 and M2 are combined with a logical AND. The flags M2 and M3 are provided with a logical OR connected. At the outputs of the corresponding program modules The second intermediate quantities M4 and M5 are then ready.

In addition to the logic modules shown here, the second is used Function group 56 also for receiving other program modules, Which are the first intermediate variables to second intermediate variables Such as negations or time delays.

The third function group 58 is used to receive so-called Actuator modules, ie those program modules which are derived from the Second intermediate quantities output signals for actuating the actuators 34. The actuator module 80 is used in FIG For example, for activating two redundant contactors The power supply of a monitored drive is dual-channel And thus can be switched off in a fail-safe manner.

The creation of the user program 38 for safety control 18 by selecting and linking the desired one Program modules 62-72. Selecting a desired one Program module 16 generates the computer program 16 Corresponding to the corresponding program module function call, which in A so-called run-off table is stored in the memory 42 becomes. For the programming process illustrated by way of example in FIG The following sequence table follows:<tables><table><tgroup cols="7"><tbody><row><entry align="left"><b>row</b></entry><entry align="center"><b>Module type</b></entry><entry align="center"><b>Output 1</b></entry><entry align="center"><b>Output 2</b></entry><entry align="center"><b>Input 1</b></entry><entry align="center"><b>Input 2</b></entry><entry align="center"><b>Input 3</b></entry></row><row><entry align="left">1</entry><entry align="left">Sensing Type 1</entry><entry align="center">M1</entry><entry align="center">-</entry><entry align="center">E 1.1</entry><entry align="center">E 1.2</entry><entry align="center">Start 1</entry></row><row><entry align="left">2</entry><entry align="left">Type of sensor 2</entry><entry align="center">M2</entry><entry align="center">-</entry><entry align="center">E 2.1</entry><entry align="center">E 2.2</entry><entry align="center">Start 2</entry></row><row><entry align="left">3</entry><entry align="left">Type of sensor 3</entry><entry align="center">M3</entry><entry align="center">-</entry><entry align="center">E 3.1</entry><entry align="center">-</entry><entry align="center">-</entry></row><row><entry align="left">4</entry><entry align="left">AND</entry><entry align="center">M4</entry><entry align="center">-</entry><entry align="center">M1</entry><entry align="center">M2</entry><entry align="center">-</entry></row><row><entry align="left">5</entry><entry align="left">OR</entry><entry align="center">M5</entry><entry align="center">-</entry><entry align="center">M2</entry><entry align="center">M3</entry><entry align="center">-</entry></row><row><entry align="left">6</entry><entry align="left">Type of actuator 1</entry><entry align="center">A 4.0</entry><entry align="center">A 4.1</entry><entry align="center">M4</entry><entry align="center">-</entry><entry align="center">-</entry></row><row><entry align="left">7</entry><entry align="left">Type of actuator 2</entry><entry align="center">A 4.2</entry><entry align="center">-</entry><entry align="center">M5</entry><entry align="center">-</entry><entry align="center">-</entry></row></tbody></tgroup></table></tables>

In the "Module type" column, the respective program module function call appears, In a coding which is controlled by the safety controller 18 can be read. In the following Columns are called the transfer parameters, the corresponding Retrieved program module.

According to a particularly preferred embodiment of the invention The computer program 16 arranges the individual program module function calls In the sequence table in chronological Order, ie in the order of the three function groups 54, 56, 58. Thus, the structure resulting from the Graphical user interface 50 already during programming In the ultimately generated and used user program 38 continued. The result is a clearly structured one And structured user program 38.

In preferred exemplary embodiments of the invention, the user program 38 when transferring from memory 42 to the chip card 36 is always protected with a CRC. In this way A falsification of the user program when transferred to the Chip card 36 is reliably detected and possibly prevented will.