JP4032907B2 - Design support apparatus, design support method, and program - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
  The present invention relates to a design support apparatus, a design support method, and a program.LambIt is about.
[0002]
[Prior art]
A programmable controller (PLC) used in FA (factory automation) inputs ON / OFF information of input devices such as switches and sensors, and performs logical operations according to a sequence program (user program) written in a ladder language. Execute. Then, the PLC performs control by outputting a signal of ON / OFF information to an output device such as a relay, a valve, or an actuator according to the obtained calculation result.
[0003]
By the way, the connection form between the PLC and the input device and the output device may be directly connected to the PLC or may be connected via a network. When a network system connected by such a network is constructed, the ON / OFF information is transmitted / received via the network. At this time, information is normally transmitted in a master-slave system in which the PLC side is a master and the device side is a slave.
[0004]
On the other hand, recently, a fail-safe (safety) system is being introduced also in control by PLC. That is, not only the PLC and each device itself, but also the network connecting them is configured with a built-in safety function. Here, the safety function refers to, for example, duplicating the CPU and other processing units so that correct output is performed, a network error (normal communication is not possible), an emergency stop switch being pressed, When the network system is in a dangerous state, such as when a sensor such as a curtain detects the entry of a person (part of the body), fail-safe is activated, the system becomes safe and the operation stops. It is to make.
[0005]
In the case of the network system (safety network system) having the above-described safety function, all devices connected to the network (PLC, slaves, devices connected to the slave, etc.) have to be provided with safety functions. . This is because if even one device without a safety function is incorporated, failsafe cannot be executed for the device or cooperation with the device and data communication, and the safety of the entire system cannot be guaranteed.
[0006]
Therefore, when designing a circuit to build a safety network system, it is necessary to check whether the device to be used is a safety device with a safety function or when connecting multiple devices. It is necessary to confirm whether or not the combination is capable of exhibiting the above. Furthermore, a safety network system cannot be constructed simply by using safety devices, and wiring layout must be performed correctly. In addition, as a setting tool for performing this type of design support, there is one disclosed in Patent Document 1 of the related art.
[0007]
[Patent Document 1]
JP 2000-276508 A
[0008]
[Problems to be solved by the invention]
In circuit design using safety devices, not only ordinary electrical design techniques but also safety design techniques are required. However, it is difficult to understand the design rules related to the safety design technology according to the international standard, and it has been time consuming to spread the safety design technology, and it has been difficult for users and others to design independently. For this reason, circuit design is currently being conducted while inquiring each safety equipment vendor and certification body.
[0009]
Therefore, the circuit design work is very complicated and takes time. Therefore, users and equipment vendors who want to outsource the safety design part and focus on the main business are increasing.
[0010]
In addition, verification (debugging) must be performed on a system for which circuit design has been performed. And especially in the case of a safety network, it is important to achieve a safety level when each component is operating normally, but that is not enough, for example, if a certain component fails. But the safety of the system needs to be guaranteed. However, it is difficult to verify the actual operation at the time of failure.
[0011]
  This invention can reduce design man-hours and design quality, eliminate variations among designers, etc., and even a designer who has little skill in safety design technology can achieve a desired safety level. A design support apparatus and design support capable of designing a safety system, utilizing the designed results as probe technology, and capable of performing fault diagnosis on a system created by circuit design Method andprogramThe purpose is to provide.
[0012]
[Means for Solving the Problems]
  In the design support apparatus according to the present invention, (1)Controllers used in factory automation andUse safety equipmentIn case of danger, fail safe is activated and operation stopsSafety systemTo meet the safety category according to international standardsA design support apparatus to design, safety-related information indicating the relationship between the input device and output device, which are the safety devices, and the corresponding safety category, and corresponding to the safety category for each input device and output device Safety circuitFigureRelated to the safety category database storing the design rules indicating the relationship between the device and the attribute of the device connected to the safety circuit, the types of the input device and the output device constituting the safety circuit, and the input device and the output device. Condition acquisition means for acquiring conditions regarding control operation specifications and safety categories to be achieved in design, and access to the safety category database according to various conditions acquired by the condition acquisition means,Safety categoryEquipment and output equipment that meetCheck whether it isSelected,Call the safety circuit diagram corresponding to the safety category,The selected input device and output device areSafety circuit diagram corresponding to safety categoryAccording toThe controller terminal number and each deviceConnected safety circuitFigureAnd circuit generation means for generating.
[0013]
  The design support method according to the present invention corresponding to such a device is (2)Controllers used in factory automation andSafety-related information indicating the relationship between the input device and output device, which are safety devices, and the corresponding safety category, and a safety circuit corresponding to the safety category for each input device and output deviceFigureAnd a safety category database that stores design rules that show the relationship between attributes and the attributes of devices connected to the safety circuitIn order to satisfy safety categories that comply with international standards, the circuit diagram of the safety system in which fail-safe is activated and operation stops in the case of a hazardous conditionA design support method for a design support apparatus to be designed, the type of input device and output device constituting the safety circuit, the operation specification of control related to the input device and output device, and the safety category to be achieved in the design , Obtaining the conditions related to, and accessing the safety category database according to the obtained various conditions,Safety categoryEquipment and output equipment that meetCheck whether it isSelect the selected input device and output device.Safety circuit diagram corresponding to safety categoryAccording toThe controller terminal number and each deviceConnected safety circuitFigureThe process to generate is executed.
[0014]
  Furthermore, the program according to the present invention provides (3)Controllers used in factory automation andSafety-related information indicating the relationship between the input device and output device, which are safety devices, and the corresponding safety category, and a safety circuit corresponding to the safety category for each input device and output deviceFigureAnd a safety category database that stores design rules that show the relationship between attributes and the attributes of devices connected to the safety circuitIn order to satisfy safety categories that comply with international standards, the circuit diagram of the safety system in which fail-safe is activated and operation stops in the case of a hazardous conditionThe computer constituting the design support device to be designed relates to the types of input devices and output devices constituting the safety circuit, the operation specifications of the control related to the input devices and the output devices, and the safety category to be achieved in the design. Condition acquiring means for acquiring a condition, accessing the safety category database according to the acquired various conditions,Safety categoryEquipment and output equipment that meetCheck whether it isSelecting the selected input device and output device.Safety circuit diagram corresponding to safety categoryAccording toThe controller terminal number and each deviceConnected safety circuitFigureIt is assumed to function as circuit generation means for generating
[0015]
According to the present invention, the safety-related information and safety circuit design rules necessary for realizing the desired safety category have been compiled into a database, so the circuit diagram and software can be automatically defined by defining input / output devices and operation specifications. Can be generated.
[0016]
Therefore, the designer can design a circuit having the target safety category even if the proficiency level of the safety design technique is not high. The quality of the generated circuit is also less varied among designers.
[0020]
According to the present invention, it is possible to check whether an input circuit diagram satisfies a desired safety category. Here, the circuit diagram to be checked may be a circuit created by the automatic generation function described above, or may be created separately.
[0021]
  Furthermore, as another solution of the design support apparatus according to the present invention,Based on the invention of (1),Safety circuitConnected toA failure information database that stores failure information associated with the type of failure, the effects when a device breaks down, circuit configuration information acquisition means for acquiring configuration information of the designed safety circuit,RecordAccording to the acquired configuration information, the safety circuitTheSelect the failed device from the specified devices to configure,SaidFailure information about a selected device is extracted from the failure information database, and is configured to include failure diagnosis means for obtaining an influence on the safety circuit.
[0022]
  Further, the design support method according to the present invention includes:Based on the invention of (2),Safety circuitConnected toIt is a design support method in a design support device having a failure information database storing failure information that associates the effects of a device failure with the type of failure, and acquires configuration information of the designed safety circuit,SaidAccording to the acquired configuration information, the safety circuitTheSelect the failed device from the specified devices to configure,SaidThe failure information about the selected device is extracted from the failure information database, and the influence on the safety circuit is obtained.
[0023]
  In addition, the program according to the present inventionLambIsOn the premise of the invention of (3), a computer constituting a design support apparatus having a failure information database storing failure information in which the influence when a device constituting the safety circuit fails is associated with the type of failure,Get configuration information of designed safety circuitCircuit configuration information acquisition meansIn accordance with the acquired configuration information, a failure device is selected from among the predetermined devices constituting the safety circuit, and failure information about the selected device is extracted from the failure information database and given to the safety circuit. Seeking influenceIt was supposed to function as a failure diagnosis means.
[0024]
According to the present invention, the database includes the definition of the failure mode of the device and the operation at the time of failure, so that the desired FMEA or the like is automatically executed on the circuit diagram created in the past, and the diagnosis result is output. be able to. Therefore, it can be confirmed whether it is safe when it breaks down.
[0025]
Moreover, each above-mentioned invention can also be implemented individually, respectively, and can also be implemented in combination suitably. Then, the circuit diagram to be evaluated or diagnosed may be automatically generated and created, or may be created by other methods.
[0026]
DETAILED DESCRIPTION OF THE INVENTION
FIG. 1 shows a preferred embodiment of the present invention. As shown in FIG. 1, the design support tool 10 includes an input interface 11 and an output interface 12 for transmitting / receiving data to / from an external device, an MPU 13 for performing design support processing, and the MPU 13 for performing design support processing. A device information database 14 having necessary data, a safety category database 15 and a failure information database 16 are provided. Of course, the design support tool 10 can be actually realized by a personal computer or other computer, and although not shown, a system ROM storing a program for operating the computer or a program (design support program) executed by the MPU 13 ) And a work memory used during execution of the MPU 13.
[0027]
On the other hand, the external device includes a keyboard 20 and a mouse 21 connected to the input interface 11. The output interface 12 includes a CRT 23, a printer 24, and a storage device 25 as external devices.
Next, each part will be described in detail. The device information database 14 stores the profile information for each device in a library. The device information database 14 stores the device name, vendor name, format, authorized standard information, cost, device symbol to identify the device, and applicable safety category. , Function definition, terminal function information (terminal No., name, property), I / O interface electrical characteristics, time characteristics (response time), failure mode and operation, etc. are registered.
[0028]
  The safety category database 15 stores information for constructing a safety network. Specifically, the safety category database 15 includes design rules including function definitions and wiring rules required for each safety category, and safety device / software functions. Corresponding modules and safety categoriesCategory correspondence tableA safety function table that associates safety devices / software function modules with safety functions, an interface correspondence table that associates safety devices with electrical interfaces, a response time correspondence table that associates safety devices with response times, etc. is there. The data of each table can be constructed by extracting and storing necessary information from the profile information for each device stored in the device information database 14.
[0029]
In the design rule, a wiring pattern corresponding to the category is registered for each device (function). A specific circuit configuration as shown in FIG. 2 and a safety category (see FIG. 3) achieved by the circuit configuration are registered in association with each other. The circuit shown in FIG. 2 is an example of a wiring pattern of “Emergency stop device safety category 4”. The internal circuit and terminal of the unit have attributes, and such attributes are registered in advance. Therefore, the devices to be connected are narrowed down based on the attribute. That is, since the A1 and A2 terminals of the unit UN are power terminals, they are connected to a predetermined power source, and since T11 and T12 are contact terminals, a predetermined switch SW is connected. The switch SW is duplicated by using parts / equipment that can obtain a desired safety category and has redundancy. As described above, since the range that can be used for each device connected to the unit UN is determined to some extent when the safety category is determined, a circuit configuration is created and registered as a template. In the figure, a device surrounded by a frame W is a portion that can be changed by a user's selection or setting. Further, the internal circuit of the IC is not essential in the circuit design, but is described for display in order to facilitate understanding of the contents of the circuit configuration.
[0030]
Further, the table shown in FIG. 3 shows safety categories achieved by the circuit configuration. In other words, the safety category defines which safety category (level, safety level) is to be satisfied under what conditions. The safety category means that the greater the numerical value, the higher the degree of safety, and the safety category “B” indicates the level of general equipment that has not been subjected to safety measures. As is apparent from FIG. 3, when this circuit is used, a safety category 3 or 4 safety network can be configured with respect to redundancy of the input unit and the output unit. And just because a higher higher safety category is satisfied does not necessarily correspond to a lower lower safety category. Therefore, the designer can easily determine from the table whether the safety category desired by the designer is satisfied.
[0031]
  Corresponding safety equipment / software function modules and safety categoriesCategory correspondence tableAn example of the data structure is as shown in FIG. In addition to the device name, model, vendor, operating voltage, contact configuration, and reset function, each device has a table in which a safety category is also associated. Each of the above data can be acquired by accessing the device information database 14. In this example, the usable relay unit for constructing a safety network system with a safety level of 4 is limited to the type “AAAAA” by A company. Of course, in FIG. 4, a specific example is described only for the relay unit, but actually the contents of the same items are registered for other devices.
[0032]
In addition, as shown in FIG. 5, the safety function table in which the safety device / software function module and the safety function are associated with each other is associated with a safety device capable of realizing a function such as “emergency stop” or “two hands”. Stored. If there are multiple applicable items, register them together. Thereby, the user can easily detect the substitute. When software corresponds to a function, a module or a function block of an application program provided for each device is registered. In the case of a control device, the safety function referred to here is a safety function of the control device, and the input / output device is a safety function to be connected.
[0033]
Next, the automatic generation function of the safety circuit constituting the safety network, which is one of the functions of the MPU 13, will be described. This function executes the flowcharts shown in FIGS. That is, first, the device information database 14 and the safety category database 15 are read to enter a standby state (ST1 to ST3). This is the database reading phase.
[0034]
Next, the condition input phase of steps 4 to 8 is executed. Specifically, input / output devices are registered for each control group (ST4). Specifically, the input / output device registration processing is performed as follows.
[0035]
That is, first, for example, an input screen as shown in FIG. 8, that is, an input including a parts tree column for displaying a list of usable parts (function blocks) and a work area screen G for assembling an actual circuit. The screen is output and displayed on the CRT 23. In the work area screen G, an input device arrangement region R1, a control unit arrangement region R2, and an output device arrangement region R3 are prepared.
[0036]
In this input screen, the designer operates the mouse 21 and drags and drops a desired part displayed in the part tree column to place it in any of the areas R1 to R3 in the work area screen G. Thus, the input / output device can be registered. A virtual control BOX is arranged in the control unit.
For example, it is assumed that a circuit satisfying the following (1) to (3) is designed as a design condition.
[0037]
(1) “Emergency stop A”, “emergency stop B”, and “emergency stop C” are monitored, and the power supply for load A is closed by “contactor A” in a safe state and shut off in an unsafe state.
(2) Start and restart of the monitor function are based on “manual switch input”.
(3) The above function is realized by “safety category 3” defined by EN954-1 / ISO13849-1.
[0038]
Then, by drag and drop, the three emergency push buttons are arranged in the input device arrangement region R1, and the contactor is arranged in the output device arrangement region R3. As described above, a virtual control BOX is arranged in the control unit arrangement region R2. However, since at least one virtual BOX is always installed, it may be automatically arranged. Similarly to the input / output device, the control box prepared in the parts list field may be arranged by dragging and dropping. When a part is placed in each of the regions R1 to R3, an ID No. is automatically assigned to each part. This ID No. is assigned, for example, by assigning # 00 to the control BOX, assigning the input devices in ascending order from the top, and then ascending in order from the top of the output device from the last ID No. of the input device Assign by method. Thereby, the input screen is in a state in which the components are arranged as shown in FIG.
[0039]
Each component displayed in the component tree column is associated with an actual product. That is, the same "emergency stop push button" is prepared for each product. Therefore, the designer selects and drags and drops a component icon for a product that conforms to the target safety level. Accordingly, in the state where each component is arranged on the work area screen G, only the component icon is displayed in FIG. 9, but each component is associated with an actual product.
[0040]
That is, in FIG. 9, for example, the emergency stop push button with ID No. # 01 is “device name: E-STOP push button, type: AAAAA, vendor: Company A, attribute: φ22, push lock”. The emergency stop push button is “device name: E-STOP push button, model: BBBBB, vendor: Company A, attribute: φ16, push-pull”, and the contactor of # 01 is “device name: contactor, model: CCCCC” , Vendor: Company B, Capacity: 200 V, 3.7 kW, Input: AC 100 V ”. Such device information is also associated with each device. Therefore, for example, it is preferable that the machine information can be displayed by specifying a part by double-clicking.
[0041]
In the above example, all parts are displayed in the part tree column, but, for example, parts that can be selected according to the function of the control BOX are narrowed down to some extent. Therefore, if a part that can be selected on the design support tool 10 side is extracted and a function of displaying only the extracted part in the part tree column is provided, the convenience is improved and the possibility of erroneous selection can be suppressed.
[0042]
Next, each component is associated. That is, association and registration of component parts (input / output devices) and input of user comments are performed. First, as shown in FIG. 10, the association is performed by dragging and dropping the input device and the output device to the control BOX. That is, since the coordinate position of each part is recognized, for example, the mouse 21 is operated, the emergency stop push button # 01 is dragged to move to the position of the control box # 00, and dropped there, the MPU 13 side of the tool Then, it is recognized that the emergency stop push button # 01 is dropped in a state where it overlaps the control box # 00. Therefore, the emergency stop push button # 01 and the overlapped control box # 00 are associated with each other. Thereby, the tool side can recognize that it is necessary to design the circuit so that the signal from the emergency stop push button # 01 is input to the control box # 00.
[0043]
Along with this association, a table indicating the association of control devices is created. This table is the minimum unit of compilation. As an example, a table as shown in FIG. 11 is created. As apparent from the title of each item to be registered, since it is stored in the device information database 14 in many cases, the corresponding data is stored in a predetermined position of the table. Furthermore, this table can be output and displayed, and the naming of each device (door A, pendant A, etc.) and various comments can be registered in a predetermined area in the table.
[0044]
Furthermore, in this embodiment, layout information can also be input. That is, it has a function of grouping devices assuming that the installation areas of the devices are separated from each other. Specifically, as shown in FIG. 12, the output of a certain control box is used as the input of another control box, and such cooperation is utilized as a component of “network” and “relay terminal block”. By doing.
[0045]
Since these “network” and “relay terminal block” are used as parts, the “network” etc. arranged in the parts tree list are dragged and dropped in the input device arrangement area R1 in the same way as normal input devices and output devices. In addition, the layout information described above can be input by associating with the control BOX by arranging these components in the output device arrangement region R3. Note that the “network” must be assigned a slave address and the like.
[0046]
When the input / output device registration process is completed as described above, the control box operation specification (circuit operation) input process is performed (ST5). That is, it is a safety function selection process, and specifically, a control BOX for which input device and output device registration has been completed is clicked.
[0047]
Accordingly, an operation specification input screen as shown in FIG. 13 is displayed on the display screen of the CRT 23. In this operation specification input screen, an area for displaying a list of control functions is set on the left side, and an input area for a control BOX to be processed is set on the right side. The output device registered in the control BOX is arranged in the output device column, and the input device registered in the control BOX is arranged in the control condition 1 column. Such arrangement is automatically performed based on the information obtained by the execution of step 4 and displayed. Control condition 2 is an area for registering setting information unique to safety control.
[0048]
Then, using the above operation specification input screen, the displayed control function is assigned to the control condition 1 area of the device to be output, and the ID of the input device is assigned. Also, setting information unique to safety control is set in the control condition 2. These assignments and settings can also be executed by dragging and dropping the prepared control function to a predetermined position.
[0049]
The above processing will be described with a specific example as follows. Using the operation specification input screen shown in FIG. 13, for example, the following contents can be set for the control BOX (# 00) shown in FIG.
[0050]
(1) Input condition (control condition 1)
A condition for activating the output device contactor # 04 is set as an input condition of the control BOX # 00. The input device in this case has three emergency stop push buttons (operating on condition that none of the three buttons are pressed) as shown in FIG. Therefore, three “emergency stop monitors” are arranged.
[0051]
(2) Output conditions (“Output device” in the figure)
This column is a column for setting various conditions of the output device. For example, when shutting off with an off delay, “OFF delay” at the bottom of the control FB column is selected by drag and drop, and a control off delay value (for example, 30 seconds) is set.
[0052]
(3) Restart condition ("Control condition 2" in the figure)
After the input condition is not satisfied and the fail-safe is once applied and the output is turned off, a restart (reset) condition when the output is turned on (started up) is set. It can also be said to be a system recovery condition and restart condition. This is also set by selecting a predetermined item from the control FB column by drag & drop or the like.
[0053]
The “manual reset” shown in the figure is for setting to be reset when a manual reset button different from the emergency stop push button is pressed. Although not shown in the drawings, “automatic reset” is also registered as the control condition 2. This is set so as to be automatically reset when the input condition is satisfied, and the system can be restarted when the emergency stop push button is changed from ON to OFF.
[0054]
Next, input of a safety category to be achieved is performed (ST6). Specifically, as shown in FIG. 14, a “safety category input screen” is displayed over the operation specification input screen, and numerical values are input in the field of the safety category. In the example of FIG. 14, since the design specification is “safety category = 3”, “3” is input by operating the keyboard 20, but the values input here are “B, 1, 2, 3, 4”. ”(See FIG. 3 and the like), it is possible to prepare a numerical value in advance and select it from a pull-down menu.
[0055]
Next, compile condition input processing is performed (ST7). Specifically, as shown in FIG. 15, a “compile condition input screen” is displayed over the operation specification input screen, and the requested compile condition is received. The designer inputs a compile condition on the compile condition input screen by inputting a specific condition via the keyboard 20 or by operating the mouse 21 to select a corresponding one by clicking. The response time can be a safe distance. “Cost” is a column for inputting the presence / absence of an estimate. Then, by inputting Y in response to “Do you want to compile? (Y / N)” and pressing the “Enter key”, the input content is confirmed and the process proceeds to the next processing.
[0056]
First, prior to the actual compilation process, the device information database 14 is accessed based on the input information, and a device that meets the input compile conditions is selected. Then, the category correspondence table stored in the safety category database 15 is read, and a collation check is performed to determine whether or not the selected device is correct (ST8). That is, it is checked whether there is a selection mistake such as a mismatch between the category and the device. If there is an error, the process returns to step 4 to perform the input process again. At this time, an error notification may be sent.
[0057]
As a result of the collation check, if the device selection is correct, the circuit generation phase is entered. That is, the compiling process is executed (ST9). That is, from the information stored in the safety category database 15, an external connection diagram for connecting corresponding devices is called and generated while confirming the input / output interface between the selected devices.
[0058]
Then, after compiling, the design rule is checked (ST10). In other words, is there a grammatical error, or is there a place where logical compression is possible? Etc. are judged.
[0059]
Examples of syntax errors include when the emergency stop push button is connected to the 2-hand SW monitor FB, the input / output interface is inconsistent between devices, or the selected device does not meet the required safety category There is. Examples of these errors can be registered in the database, and corresponding error messages can be output. Also, whether or not logical compression is appropriate determines whether there is a redundant circuit configuration or the like, and since it is a conventionally known technique, its detailed description is omitted.
[0060]
If the result of the collation check is inadequate and the circuit diagram cannot be generated, error notification and cause notification are performed, and then the process returns to step 4 to register the input / output device again.
[0061]
If the collation check results in OK, the process proceeds to step 11, and if logical compression is possible, the process is simplified (ST11). Until this processing, the check is made in relation to the safety function and the input / output device.
[0062]
Thereafter, mapping is performed (ST12). That is, the safety function is converted into a device or software registered in the library. If the mapping is performed correctly, each device is placed and wired (ST14), and the generated circuit diagram / parts table is output to repair the processing (ST15). Note that the above simplification, mapping, placement / wiring, circuit diagram / parts list output processing steps are basically a support tool for conventional general circuit design that does not support safety functions. Since the function used can be utilized, the detailed description is abbreviate | omitted.
[0063]
An example of a circuit diagram output after completion of automatic generation is as shown in FIG. 16, and an example of a parts table is as shown in FIG. The circuit diagram can be output and displayed on the CRT 23 or printed out by the printer 24. Further, the circuit diagram and the parts table may be stored in the storage device 25 as a file.
[0064]
Next, a circuit check function that is a second function of the MPU 13 will be described. The automatic generation function is used when a new circuit is created. This circuit check function evaluates a circuit created by the automatic generation function and other methods. Specifically, it has a function of executing the flowchart shown in FIG.
[0065]
That is, first, the device information database 14 and the safety category database 15 are read to enter a standby state (ST1 to ST3). This is the database reading phase.
[0066]
Next, the circuit diagram to be checked stored in the storage device 25 is read (ST20). Thereby, for example, a circuit diagram as shown in FIG. 16 is displayed. Then, the safety category to be achieved is input (ST21). Although specific illustration is omitted, for example, the safety category input screen shown in FIG. 14 may be displayed on top of FIG. 16 and the designer may input the safety category in this state.
[0067]
Next, the category correspondence table stored in the safety category database 15 is read, and a verification check is performed to determine whether or not the devices constituting the read circuit diagram are correct in relation to the safety category (ST22). That is, it is checked whether there is a selection mistake such as a mismatch between the safety category and the device. If there is no selection mistake, the process proceeds to step 23 where a design rule check for a grammatical error is performed.
[0068]
On the other hand, if the result of the collation check is an error in steps 22 and 23, an abnormality notification (ST25) is passed, and the process proceeds to step 26. After the circuit editing of the part in which there is a mistake, the process proceeds to step 20 and the check is performed again. . If the result of the collation check is OK, the result is notified to that effect (ST24), and the process is terminated.
[0069]
Next, the failure diagnosis function of the MPU 13 will be described. First, the failure information database 16 stores “FMEA rules”, “failure mode and output operation, system influence table”, and the like in advance. Here, FMEA is called failure mode and effect analysis, and FMEA rule is one of failure analysis methods, and examines the influence on the entire circuit (system) when a certain part of the circuit fails. It is. Even the same part may have different effects if the type of failure (failure mode) is different.
[0070]
In the safety system, after circuit design, check whether there are any selection mistakes or design rule failures, and if there is an abnormality, what will happen to the system (what will happen to the output device). Need to check. For this purpose, the “failure information database 16” is a database of information on what failure mode, self-diagnosis function, etc. a certain device / part has, and what influences externally when a failure occurs.
[0071]
The “failure mode and output operation, system influence table” stored in the failure information database 16 defines the failure mode and the operation (behavior) at that time for each device stored in the device information database 14. It is a table. An example of a specific data structure is shown in FIGS. 19 and 20.
[0072]
In FIG. 19 and FIG. 20, “Grade” indicates that A is “equipment can detect failure”, B is “not detectable but cumulative failure does not impair safety function”, and C is “not detectable” A single failure does not directly impair the safety function, D is “a single failure directly impairs the safety function”.
[0073]
Then, the MPU 13 reads the created circuit diagram (circuit configuration) stored in the storage device 25 and executes FMEA. Specifically, it has a function of executing the flowcharts of FIGS.
[0074]
First, the device information database 14 and the failure information database 16 are read to enter a standby state (ST1, ST2 ', ST3). This is the database reading phase.
[0075]
Next, the circuit diagram to be checked stored in the storage device 25 is read (ST20). Thereby, for example, a circuit diagram as shown in FIG. 16 is displayed. If the read circuit diagram is the target, FMEA condition input processing is performed (ST21). Specifically, for example, an FMEA condition input screen as shown in FIG. 23 may be displayed on the circuit diagram read out in the previous process, and the designer may input the FEMA condition in that state. In this case, the FEMA condition is a case where a single failure analysis for examining the effect when one component fails or a cumulative failure analysis for examining the effect when a plurality of components fail is selected. In addition, the number of accumulated failures is input. The type of analysis can be selected by clicking on one of them, and the number of failures is performed by inputting a specific numerical value.
[0076]
When the above condition input is completed, FMEA is executed according to the condition (ST28, ST29). An example of the execution process of this FMEA gives a number to each part and the failure mode for that part, and selects parts in order from the first according to the number as shown in the flowchart of FIG. The effect when the failure mode prepared for the selected part occurs is sequentially verified based on the information acquired from the failure information database 16. That is, it is determined what operation the entire circuit (system) performs when it is operated in the failure mode under verification, and whether it is safe or not. In addition, in the cumulative mode, after step 33 is executed and a failure mode of a part is identified, FMEA is not executed immediately, but is similar to steps 32 to 38 (except step 34). By performing a process to identify a failure mode of another failed part by repeating a predetermined number of times according to the cumulative number, a certain set of events is identified and FMEA is executed.
[0077]
If FMEA is executed for all failure cases, the result is output (ST30). An example of the execution result display list is shown in FIG. Here, if the determination result is OK, it means that it is safe, that is, fail-safe works and a safety system is guaranteed.
[0078]
In this way, by using the design tool of the above-described embodiment, regardless of the level of skill in safety design technology, the safety category can be entered and the input / output device can be registered to obtain the target safety. Safety circuits that satisfy the category can be designed. In addition, it is possible to check whether or not a desired safety category is satisfied for a circuit that has already been created, and to perform a failure diagnosis such as whether the circuit is safe even if a component caused by FEMA fails.
[0079]
【The invention's effect】
As described above, according to the present invention, even a designer who is not proficient in safety design technology can design a safety system with a desired safety level, and there is no variation among designers, and the design man-hours can be reduced. Reduction and design quality can be obtained
[Brief description of the drawings]
FIG. 1 is a block diagram showing a preferred embodiment of the present invention.
FIG. 2 is a diagram showing an example of design rules stored in a safety category database.
FIG. 3 is a diagram illustrating an example of a data structure of safety category information achieved by a circuit configuration stored in a safety category database.
FIG. 4 is stored in the safety category databaseCategory correspondence tableIt is a figure which shows an example of this data structure.
FIG. 5 is a diagram illustrating an example of a data structure of a safety function table stored in a safety category database.
FIG. 6 is a part of a flowchart showing an automatic generation function of a safety circuit.
FIG. 7 is a part of a flowchart showing an automatic generation function of a safety circuit.
FIG. 8 is a diagram illustrating an example of a screen displayed on the CRT during execution of the automatic safety circuit generation function.
FIG. 9 is a diagram showing an example of a screen displayed on the CRT during execution of the automatic safety circuit generation function.
FIG. 10 is a diagram showing an example of a screen displayed on the CRT during execution of the automatic safety circuit generation function.
FIG. 11 is a diagram showing an example of a screen displayed on the CRT during execution of the automatic safety circuit generation function.
FIG. 12 is a diagram showing an example of a screen displayed on the CRT during execution of the automatic safety circuit generation function.
FIG. 13 is a diagram showing an example of a screen displayed on the CRT during execution of the automatic safety circuit generation function.
FIG. 14 is a diagram showing an example of a screen displayed on the CRT during execution of the automatic safety circuit generation function.
FIG. 15 is a diagram showing an example of a screen displayed on the CRT during execution of the automatic safety circuit generation function.
FIG. 16 is a diagram showing an example of a screen displayed on the CRT during execution of the automatic safety circuit generation function.
FIG. 17 is a diagram showing an example of a screen displayed on the CRT during execution of the automatic safety circuit generation function.
FIG. 18 is a part of a flowchart showing a circuit check function;
FIG. 19 is a diagram illustrating an example of a failure mode, output operation, and system impact table stored in a failure information database.
FIG. 20 is a diagram illustrating an example of a failure mode, output operation, and system impact table stored in a failure information database.
FIG. 21 is a part of a flowchart showing a failure diagnosis function (FMEA).
FIG. 22 is a part of a flowchart showing a failure diagnosis function (FMEA).
FIG. 23 is a diagram illustrating an example of a screen displayed on the CRT during execution of a failure diagnosis function.
FIG. 24 is a diagram showing an example of an execution result screen displayed on the CRT obtained by executing the failure diagnosis function.
[Explanation of symbols]
10 Design support tools
11 Input interface
12 Output interface
13 MPU

Claims (6)

A design support device that uses a controller and safety equipment used in factory automation to design a safety system that stops operation due to fail-safe operation in the event of a hazardous condition so as to satisfy safety categories that conform to international standards. There,
Safety-related information indicating the relationship between the input device and the output device, which are the safety devices, and the safety category corresponding thereto, and a safety circuit diagram corresponding to the safety category for each of the input device and the output device, and its safety circuit A safety category database that stores design rules indicating the relationship with the attributes of the connected devices;
Condition acquisition means for acquiring conditions relating to the types of input devices and output devices constituting the safety circuit, operation specifications of control related to the input devices and output devices, and safety categories to be achieved in design,
The conditions to access the safety category database according to various conditions acquired by acquisition means, said safety category matches whether the input device and output device matches properly selected, the safety circuit corresponding to the safety category Circuit generating means for calling a diagram and generating a safety circuit diagram in a state in which the selected input device and output device are connected to the controller terminal number and each device according to the safety circuit diagram corresponding to the safety category. Design support device characterized by A failure information database that stores failure information that correlates the effects of failure of equipment connected to the safety circuit with the type of failure;
Circuit configuration information acquisition means for acquiring configuration information of the designed safety circuit;
According to the acquired configuration information, among the predetermined devices constituting the safety circuit, a failure device is selected, the failure information about the selected device is extracted from the failure information database, and the influence on the safety circuit The design support apparatus according to claim 1, further comprising failure diagnosis means for obtaining Safety-related information indicating the relationship between the input device and output device, which are controllers and safety devices used in factory automation , and the corresponding safety category, and a safety circuit corresponding to the safety category for each input device and output device A safety system circuit that has a safety category database that stores the design rules that show the relationship between the diagram and the attributes of the devices connected to the safety circuit . A design support method in a design support apparatus for designing a figure so as to satisfy a safety category conforming to international standards ,
Obtaining conditions relating to the types of input devices and output devices constituting the safety circuit, operation specifications of control related to the input devices and output devices, and safety categories to be achieved in design;
Access the safety category database according to the acquired various conditions , check whether the input device and the output device match the safety category , and select correctly .
A design support method for executing a process of generating a safety circuit diagram in which the terminal number of the controller and each device are connected according to the safety circuit diagram corresponding to the safety category for the selected input device and output device . . A design support method in a design support apparatus having a failure information database storing failure information associated with the type of failure, the effect when a device connected to a safety circuit fails,
Obtain configuration information of the designed safety circuit,
According to the acquired configuration information, select a malfunctioning device from among the predetermined devices constituting the safety circuit,
The design support method according to claim 3, wherein failure information about the selected device is extracted from the failure information database, and an influence on the safety circuit is obtained. Safety-related information indicating the relationship between the input device and output device, which are controllers and safety devices used in factory automation , and the corresponding safety category, and a safety circuit corresponding to the safety category for each input device and output device A safety system circuit that has a safety category database that stores the design rules that show the relationship between the diagram and the attributes of the devices connected to the safety circuit . A computer that constitutes a design support device that designs a diagram so as to satisfy safety categories conforming to international standards.
Condition acquisition means for acquiring conditions relating to the types of input devices and output devices constituting the safety circuit, operation specifications for control related to the input devices and output devices, and safety categories to be achieved in design,
According to the acquired various conditions, the safety category database is accessed, the input device and the output device that match the safety category are collated and selected correctly , and the selected input device and output device are selected as the safety device. Circuit generating means for generating a safety circuit diagram in a state in which the terminal number of the controller and each device are connected in accordance with the safety circuit diagram corresponding to the category ;
Program to function as. A computer that constitutes a design support apparatus having a failure information database that stores failure information that associates the effects of failure of equipment constituting the safety circuit with the type of failure,
Circuit configuration information acquisition means for acquiring configuration information of the designed safety circuit;
According to the acquired configuration information, among the predetermined devices constituting the safety circuit, a failure device is selected, the failure information about the selected device is extracted from the failure information database, and the influence on the safety circuit Failure diagnosis means for obtaining
The program of Claim 5 for functioning as.

Images