JP7779211B2 - Control system, control device and communication method - Google Patents

Description

The present invention relates to a control system, a control device, and a communication method.

With the rapid development of information and communications technology in recent years, there is a growing need for industrial equipment to process larger amounts of data. More specifically, technological innovations using communications technology, such as IoT (Internet of Things) and Industry 4.0, are progressing. As a result, the amount of data exchanged within systems is on the rise.

As one solution to this increasing data processing volume, International Publication No. 2013/137023 (Patent Document 1) discloses a configuration that allows for more appropriate data updates between devices in a configuration including multiple communication lines.

When multiple controllers are connected using multiple networks to form a network distributed control system, a relay unit is used as a gateway responsible for transferring data between networks. Data exchange between control devices is achieved via such a gateway.

International Publication No. 2013/137023

When a control device executes processing using data received from another control device, or when a control device executes processing that transmits data to another control device, it is preferable to confirm that the target data has been transferred properly. The present invention provides a mechanism that enables processing using transferred data to be executed more reliably.

A control system according to one example of the present invention includes a first control device, a second control device, and a relay device connected to the first control device via a first transmission path and connected to the first control device via a second transmission path. The relay device is configured to be able to execute a process of transferring data transmitted from the first control device to the second control device and a process of transferring data transmitted from the second control device to the first control device. The first control device is configured to be able to execute a process of generating first additional information indicating the validity of at least one of the data transfers, data transmitted to the second control device and data received from the second control device. The second control device is configured to be able to execute a process of generating second additional information indicating the validity of at least one of the data transfers, data transmitted to the first control device and data received from the first control device.

With this configuration, the first control device and the second control device each generate additional information indicating the legitimacy of the data transfer, providing a mechanism that allows each of the first control device and the second control device to more reliably execute processing using the transferred data. For example, if the legitimacy of the transferred data cannot be confirmed, it is easy to write a program that does not execute (skips) processing using that data.

The first additional information may be available from a first user program executed by a first control device. The second additional information may be available from a second user program executed by a second control device. With this configuration, the validity of the data can be confirmed before the user program for implementing the control calculation can be executed.

The first additional information may be made available by specifying a predetermined variable in the first user program. The second additional information may be made available by specifying a predetermined variable in the second user program. With this configuration, the process of verifying the validity of data can be realized by specifying a variable in the user program.

When the first control device detects an abnormality in the process of sending and receiving data via the first transmission path, it may notify the relay device of the detected abnormality. With this configuration, the first control device can notify other devices of the detected abnormality via the relay device.

If the second control device detects an abnormality in the process of sending and receiving data via the second transmission path, it may notify the relay device of the detected abnormality. With this configuration, the second control device can notify other devices of the detected abnormality via the relay device.

If the relay device detects an abnormality in the process of sending and receiving data via the first transmission path, it may notify the second control device of the abnormality detection, and if it detects an abnormality in the process of sending and receiving data via the second transmission path, it may notify the first control device of the abnormality detection. With this configuration, an abnormality detected by the relay device regarding one transmission path can be notified to the control device connected to the other transmission path.

When the relay device receives a notification of abnormality detection from the first control device, it may forward the notification to the second control device, and when it receives a notification of abnormality detection from the second control device, it may forward the notification to the first control device. With this configuration, the relay device can notify the control device connected to one transmission path of an abnormality detected by the control device connected to the other transmission path.

When the first control device receives a notification of abnormality detection from another device, it may update the first additional information to a value indicating an invalid state. With this configuration, not only the abnormality detected by the first control device itself but also the abnormality detection notification received from another device can be reflected in the first additional information.

When the second control device receives a notification of abnormality detection from another device, it may update the second additional information to a value indicating an invalid state. With this configuration, not only the abnormality detected by the second control device itself but also the abnormality detection notification received from another device can be reflected in the second additional information.

According to another example of the present invention, a control device is provided that is connected to another control device via a relay device. The relay device is configured to be able to execute a process of transferring data transmitted from the control device to the other control device and a process of transferring data transmitted from the other control device to the control device. The control device is configured to be able to execute a process of generating additional information indicating the validity of the data transfer for at least one of the data to be transmitted to the other control device and the data received from the other control device.

According to yet another example of the present invention, there is provided a communication method for a control system including a first control device, a second control device, and a relay device connected to the first control device via a first transmission path and connected to the first control device via a second transmission path. The communication method includes the steps of: the relay device forwarding data transmitted from the first control device to the second control device; the relay device forwarding data transmitted from the second control device to the first control device; the first control device generating first additional information indicating the validity of the data transfer of at least one of the data to be transmitted to the second control device and the data received from the second control device; and the second control device generating second additional information indicating the validity of the data transfer of at least one of the data to be transmitted to the first control device and the data received from the first control device.

This invention allows the validity of data transfer to be confirmed and monitored, allowing the control device to more reliably execute processing using the transferred data.

1 is a schematic diagram showing an example of the overall configuration of a control system according to the present embodiment; FIG. 2 is a block diagram showing an example of a hardware configuration of a first arithmetic unit of a first device according to the present embodiment. FIG. 10 is a block diagram showing an example of a hardware configuration of a second arithmetic unit of a second device according to the present embodiment. FIG. 10 is a block diagram showing an example of a hardware configuration of a relay unit of a second device according to the present embodiment. FIG. 2 is a schematic diagram showing an overview of data transfer in the control system according to the present embodiment. FIG. 10 is a diagram showing an example of a process for providing additional information indicating validity in the control system according to the present embodiment. FIG. 10 is a diagram showing another example of processing for providing additional information indicating validity in the control system according to the present embodiment. FIG. 10 is a diagram showing yet another example of processing for providing additional information indicating validity in the control system according to the present embodiment. FIG. 10 is a diagram showing yet another example of processing for providing additional information indicating validity in the control system according to the present embodiment. 10 is a flowchart illustrating an example of a processing procedure for providing additional information indicating validity by the first arithmetic unit according to the present embodiment. 10 is a flowchart illustrating an example of a processing procedure for providing additional information indicating validity by the second arithmetic unit according to the present embodiment. 10 is a flowchart illustrating an example of a processing procedure for providing additional information indicating validity by the relay unit according to the present embodiment. FIG. 10 is a schematic diagram showing an example of processing when additional information indicating validity is used in the control system according to the present embodiment.

Embodiments of the present invention will be described in detail with reference to the drawings. Note that identical or equivalent parts in the drawings will be designated by the same reference numerals and their description will not be repeated.

<A. Overall configuration example>
Next, an example of the overall configuration of control system 1 according to the present embodiment will be described.

Figure 1 is a schematic diagram showing an example of the overall configuration of a control system 1 according to this embodiment. Referring to Figure 1, the control system 1 includes a first device 10 and one or more second devices 20. The first device and the second device may be a type of computer, such as a PLC (programmable logic controller).

The first device 10 and one or more second devices 20 are connected via a field network 4. The field network 4 supports cyclic communication and message communication. The field network 4 may be, for example, EtherCAT (registered trademark), EtherNet/IP (registered trademark), PROFINET (registered trademark), PROFIBUS (registered trademark), DeviceNet (registered trademark), FL-net, CompoNet (registered trademark), or the like.

The first device 10 includes a first calculation unit 100 (an example of a first control device) that performs control calculations. The first calculation unit 100 is capable of data communication via the field network 4. The first device 10 may further include a power supply unit, an I/O unit, a special unit, etc.

The second device 20 includes a second calculation unit 200 (an example of a second control device) that executes control calculations, and a relay unit 250 (an example of a relay device) that has an interface for connecting to the field network 4. The second device 20 may further include a power supply unit, an I/O unit, a special unit, etc.

The second calculation unit 200 and the relay unit 250 are connected via an internal bus 6 (see Figures 3 and 4). If the second device 20 includes an I/O unit and/or a special unit, these units are also connected via the internal bus 6.

The relay unit 250 is a gateway for transferring data between the first calculation unit 100 and the second calculation unit 200. More specifically, the relay unit 250 transfers data sent from the first calculation unit 100 so that the second calculation unit 200 can refer to it, and also transfers data output by the second calculation unit 200 so that the first calculation unit 100 can refer to it.

The control system 1 may include a support device 300 for creating and changing programs, settings, etc. executed by the first device 10 and/or the second device 20. The support device 300 may be connected to the second computing unit 200 of the second device 20, or to the first computing unit 100 of the first device 10.

<B. Hardware Configuration Example>
Next, an example of the hardware configuration of main devices in the control system 1 according to the present embodiment will be described.

(b1: first arithmetic unit 100)
2 is a block diagram showing an example of a hardware configuration of first arithmetic unit 100 of first apparatus 10 according to the present embodiment. Referring to Fig. 2, first arithmetic unit 100 includes a processor 102 such as a CPU (Central Processing Unit) or an MPU (Micro-Processing Unit), a chipset 104, a memory 106, a storage 108, a host network interface 110, a USB (Universal Serial Bus) interface 112, a memory card interface 114, and a field network interface 120.

The processor 102 reads various programs stored in the storage 108, expands them into the memory 106, and executes them to perform the necessary processing in the first computing unit 100. The chipset 104 controls data communication between the processor 102 and each component.

Storage 108 typically stores a system program 131 and a user program 132 containing computer-readable code required for control calculations.

Execution of the program stored in storage 108 causes the first computing unit 100, which is a computer, to execute the processing described in this specification and realizes the functional configuration described in this specification in the first computing unit 100, which is a computer.

The upper network interface 110 controls data communication with other devices via an upper network. The USB interface 112 controls data communication with a support device via a USB connection.

The memory card interface 114 is configured to allow a memory card 116 to be attached and detached, and is capable of writing data to the memory card 116 and reading various data (user programs, trace data, etc.) from the memory card 116.

The field network interface 120 controls data communication with the second device 20 via the field network 4.

(b2: second arithmetic unit 200)
3 is a block diagram showing an example of a hardware configuration of second arithmetic unit 200 of second device 20 according to the present embodiment. Referring to Fig. 3, second arithmetic unit 200 includes a processor 202 such as a CPU or an MPU, a chipset 204, a memory 206, a storage 208, a host network interface 210, a USB interface 212, a memory card interface 214, and an internal bus interface 220.

The processor 202 reads various programs stored in the storage 208, expands them into the memory 206, and executes them to perform the necessary processing in the second computing unit 200. The chipset 204 controls data communication between the processor 202 and each component.

Storage 208 typically stores a system program 231 and a user program 232 containing computer-readable code required for control calculations.

Execution of the program stored in storage 208 causes the second calculation unit 200, which is a computer, to execute the processing described in this specification and realizes the functional configuration described in this specification in the second calculation unit 200, which is a computer.

The upper network interface 210 controls data communication with other devices via an upper network. The USB interface 212 controls data communication with a support device via a USB connection.

The memory card interface 214 is configured to allow a memory card 216 to be attached and detached, and is capable of writing data to the memory card 216 and reading various data (user programs, trace data, etc.) from the memory card 216.

The internal bus interface 220 controls data communication with one or more units (including the relay unit 250) via the internal bus 6.

The internal bus 6, like the field network 4, supports cyclic communication and message communication. The internal bus 6 may use a communication method proprietary to the manufacturer, or may use a standard such as EtherCAT (registered trademark), EtherNet/IP (registered trademark), PROFINET (registered trademark), PROFIBUS (registered trademark), DeviceNet (registered trademark), FL-net, or CompoNet (registered trademark).

(b3: relay unit 250)
4 is a block diagram showing an example of a hardware configuration of relay unit 250 of second device 20 according to the present embodiment. Referring to FIG. 4, relay unit 250 includes a processing circuit 260, a field network interface 270, and an internal bus interface 280.

The processing circuitry 260 implements the processing and functions of the relay unit 250, as described below. More specifically, the processing circuitry 260 includes a processor 262, memory 264, and storage 266. The processor 262 reads out the system program (firmware) stored in the storage 266, expands it into the memory 264, and executes it, thereby implementing the processing required by the relay unit 250.

The field network interface 270 controls data communication with the first computing unit 100 via the field network 4.

The internal bus interface 280 controls data communication with one or more units (including the second calculation unit 200) via the internal bus 6.

(b4: Other configurations)
2 to 4 show configuration examples in which the necessary functions are provided by the processor executing a program, but some or all of these provided functions may be implemented using dedicated hardware circuits (e.g., an ASIC (Application Specific Integrated Circuit) or an FPGA (Field-Programmable Gate Array)).

In this specification, the term "processor" is not limited to a processor in the narrow sense that executes processing using a stored program, but may also include hardwired circuits such as ASICs and FPGAs. Therefore, the term "processor" can also be interpreted as processing circuitry whose processing is predefined by computer-readable code and/or hardwired circuits.

The main part of the computing unit may be implemented using hardware that follows a general-purpose architecture (for example, an industrial PC based on a general-purpose PC). In this case, virtualization technology may be used to run multiple operating systems (OS) for different purposes in parallel, and the necessary applications may be run on each OS.

(b5: support device 300)
The support device 300 according to the present embodiment is configured, for example, by a general-purpose computer that conforms to a general-purpose architecture. Since examples of the hardware configuration of a general-purpose computer are well known, detailed description thereof will not be given.

C. Data Transfer
Next, a process relating to data transfer in control system 1 according to the present embodiment will be described.

Figure 5 is a schematic diagram showing an overview of data transfer in the control system 1 according to this embodiment. Figure 5 shows an example of data transmission between the first calculation unit 100 and the second calculation unit 200.

Referring to FIG. 5, a relay unit 250 is disposed as a gateway between the first calculation unit 100 and the second calculation unit 200. The relay unit 250 is connected to the first calculation unit 100 via a field network 4, which is an example of a first transmission path, and is connected to the second calculation unit 200 via an internal bus 6, which is an example of a second transmission path.

It is assumed that the output data of the first calculation unit 100 is transmitted to the second calculation unit 200 via the relay unit 250, and that the output data of the second calculation unit 200 is transmitted to the first calculation unit 100 via the relay unit 250.

Data (output data) sent from the first arithmetic unit 100 is sent to the relay unit 250. The relay unit 250 transmits the data received as output data from the first arithmetic unit 100 to the second arithmetic unit 200 as input data for the second arithmetic unit 200.

On the other hand, the data (output data) sent from the second arithmetic unit 200 is sent to the relay unit 250. The relay unit 250 transmits the data received as output data from the second arithmetic unit 200 to the first arithmetic unit 100 as input data for the first arithmetic unit 100.

In this way, the relay unit 250 transfers data between the first calculation unit 100 and the second calculation unit 200. That is, the relay unit 250 performs the process of transferring data transmitted from the first calculation unit 100 to the second calculation unit 200, and the process of transferring data transmitted from the second calculation unit 200 to the first calculation unit 100.

The control system 1 according to this embodiment has a mechanism for confirming and monitoring the legitimacy of data transfer. In this specification, "legality of data transfer" refers to information indicating that the target data has been transferred appropriately and/or that the data to be sent or received is in a state where it can be transferred appropriately.

More specifically, the first computing unit 100 executes a process to generate additional information indicating the validity of at least one of the data transfers: data to be sent to the second computing unit 200 and data received from the second computing unit 200. This allows the user program 132 executed by the first computing unit 100 to use additional information indicating the validity of the output data sent from the first computing unit 100 to the second computing unit 200, and additional information indicating the validity of the input data received by the first computing unit 100 from the second computing unit 200.

Similarly, the second arithmetic unit 200 executes a process to generate additional information indicating the validity of at least one of the data transfers: data to be sent to the first arithmetic unit 100 and data received from the first arithmetic unit 100. This allows the user program 232 executed by the second arithmetic unit 200 to use additional information indicating the validity of the output data sent from the second arithmetic unit 200 to the first arithmetic unit 100, and additional information indicating the validity of the input data received by the second arithmetic unit 200 from the first arithmetic unit 100.

In this specification, "additional information indicating the legitimacy of data transfer" may be information whose value varies depending on whether the target data was transferred appropriately (and/or whether the data to be sent or received is in a state where it can be transferred appropriately). If an abnormality occurs in the transfer path, the additional information indicating legitimacy is set to a value indicating that the corresponding data is invalid. Note that, hereinafter, "additional information indicating legitimacy" may be abbreviated to simply "additional information."

The additional information may be assigned, for example, to device variables or system variables managed by each of the first computing unit 100 and the second computing unit 200. In other words, it may be possible to monitor whether the corresponding data is valid based on the value indicated by the target device variable or system variable. Note that the device variable or system variable may be a member variable of a data object.

<D. Providing additional justification>
Next, a description will be given of a process for providing additional information indicating validity in the first arithmetic unit 100 and the second arithmetic unit 200. An example of a process for providing additional information indicating validity will be described below.

In the following explanation, additional information indicating validity will be exemplified by additional information for input data 401 and additional information for output data 402 managed by the first processing unit 100, and additional information for input data 411 and additional information for output data 412 managed by the second processing unit 200. Note that additional information for input data 401 and additional information for output data 402 may be treated as common additional information without being distinguished. Similarly, additional information for input data 411 and additional information for output data 412 may be treated as common additional information without being distinguished.

Figure 6 shows an example of processing for providing additional information indicating validity in the control system 1 according to this embodiment. Figure 6 shows an example of processing when the second arithmetic unit 200 detects some kind of abnormality in the processing of sending and receiving data via the internal bus 6. For example, this may be the case when some kind of abnormality occurs in the sending and receiving of data by the internal bus interface 220 (Figure 3) of the second arithmetic unit 200.

Referring to FIG. 6, first, the second arithmetic unit 200 detects some kind of abnormality in the process of sending and receiving data via the internal bus 6 ((1) Abnormality Detection). Then, the second arithmetic unit 200 updates the input data additional information 411 and the output data additional information 412 to values indicating an invalid state ((2) and (3) Update).

In this case, when the relay unit 250 receives notification of an abnormality detection from the second calculation unit 200, or when it detects an abnormality in the process of sending and receiving data via the internal bus 6 by itself ((4) Abnormality Detection), it notifies the first calculation unit 100 of the abnormality detection ((5) Notification).

When the first calculation unit 100 receives notification of abnormality detection from the relay unit 250, it updates the input data additional information 401 and the output data additional information 402 to values indicating an invalid state (updates (6) and (7)).

As described above, if the second arithmetic unit 200 detects any abnormality in the process of sending and receiving data via the internal bus 6, it is determined that data cannot be sent and received between the first arithmetic unit 100 and the second arithmetic unit 200, and the additional information is updated to indicate an invalid state.

Figure 7 shows another example of processing for providing additional information indicating validity in the control system 1 according to this embodiment. Figure 7 shows an example of processing when the relay unit 250 detects some kind of abnormality in the processing of sending and receiving data via the internal bus 6. For example, this may be the case when some kind of abnormality occurs in the sending and receiving of data by the internal bus interface 280 (Figure 4) of the relay unit 250.

Referring to Figure 7, first, the relay unit 250 detects some kind of abnormality in the process of sending and receiving data via the internal bus 6 ((1) Abnormality detection).

The relay unit 250 then notifies the second calculation unit 200 of the abnormality detection ((2) Notification). Upon receiving the abnormality detection notification from the relay unit 250, the second calculation unit 200 updates the input data additional information 411 and the output data additional information 412 to values indicating an invalid state ((3) Update, (4) Update).

The relay unit 250 also notifies the first calculation unit 100 of the abnormality detection ((5) Notification). Upon receiving the abnormality detection notification from the relay unit 250, the first calculation unit 100 updates the input data additional information 411 and the output data additional information 412 to values indicating an invalid state ((6) Update, (7) Update).

As described above, if the relay unit 250 detects any abnormality in the process of sending and receiving data via the internal bus 6, it determines that data cannot be sent and received between the first calculation unit 100 and the second calculation unit 200, and updates the additional information to indicate an invalid state.

Figure 8 shows yet another example of processing for providing additional information indicating validity in the control system 1 according to this embodiment. Figure 8 shows an example of processing when the relay unit 250 detects some kind of abnormality in the processing of sending and receiving data via the field network 4. For example, this may be the case when some kind of abnormality occurs in the sending and receiving of data by the field network interface 270 (Figure 4) of the relay unit 250.

Referring to Figure 8, first, the relay unit 250 detects some kind of abnormality in the process of sending and receiving data via the field network 4 ((1) Abnormality detection).

The relay unit 250 then notifies the first calculation unit 100 of the abnormality detection ((2) Notification). Upon receiving the abnormality detection notification from the relay unit 250, the first calculation unit 100 updates the input data additional information 401 and the output data additional information 402 to values indicating an invalid state ((3) Update, (4) Update).

The relay unit 250 also notifies the second calculation unit 200 of the abnormality detection ((5) Notification). Upon receiving the abnormality detection notification from the relay unit 250, the first calculation unit 100 updates the input data additional information 411 and the output data additional information 412 to values indicating an invalid state ((6) Update, (7) Update).

As described above, if the relay unit 250 detects any abnormality in the process of sending and receiving data via the field network 4, it determines that data cannot be sent and received between the first calculation unit 100 and the second calculation unit 200, and updates the additional information to indicate an invalid state.

Figure 9 shows yet another example of processing for providing additional information indicating validity in the control system 1 according to this embodiment. Figure 9 shows an example of processing when the first computing unit 100 detects some kind of abnormality in the processing of sending and receiving data via the field network 4. For example, this may be the case when some kind of abnormality occurs in the sending and receiving of data by the field network interface 120 (Figure 2) of the first computing unit 100.

Referring to FIG. 9 , first, the first calculation unit 100 detects some kind of abnormality in the process of sending and receiving data via the field network 4 ((1) Abnormality Detection). Then, the first calculation unit 100 updates the input data additional information 401 and the output data additional information 402 to values indicating an invalid state ((2) and (3) Update).

The first calculation unit 100 also notifies the relay unit 250 of the abnormality detection ((4) Notification). The relay unit 250 then notifies the second calculation unit 200 of the abnormality detection ((5) Notification).

When the second calculation unit 200 receives notification of abnormality detection from the relay unit 250, it updates the input data additional information 411 and the output data additional information 412 to values indicating an invalid state (updates (6) and (7)).

As described above, if the first calculation unit 100 detects any abnormality in the process of sending and receiving data via the field network 4, it is determined that data cannot be sent and received between the first calculation unit 100 and the second calculation unit 200, and the additional information is updated to indicate an invalid state.

In addition, some or all of the first calculation unit 100, second calculation unit 200, and relay unit 250 may record information indicating the content and type of detected abnormality using any method. In this case, the stored information may be read out via the support device 300, etc.

<E. Example of processing procedure>
Next, an example of a processing procedure for providing additional information indicating validity will be described.

Figure 10 is a flowchart showing an example of a processing procedure for providing additional information indicating validity by the first computing unit 100 according to this embodiment. Each step shown in Figure 10 may be realized by the processor 102 of the first computing unit 100 executing the system program 131.

Referring to FIG. 10, the first calculation unit 100 determines whether any abnormality has occurred in the process of sending and receiving data via the field network 4 (step S100).

If an abnormality has occurred in the process of sending and receiving data via the field network 4 (YES in step S100), the first calculation unit 100 notifies the relay unit 250 of the abnormality detection (step S102). Next, the first calculation unit 100 updates the input data additional information 401 and the output data additional information 402 to values indicating an invalid state (step S104). Then, the processing from step S100 onwards is repeated.

In this way, when the first calculation unit 100 detects an abnormality in the process of sending and receiving data via the field network 4, it notifies the relay unit 250 of the abnormality detection.

On the other hand, if no abnormality has occurred in the process of sending and receiving data via the field network 4 (NO in step S100), the first calculation unit 100 determines whether or not it has received a notification of abnormality detection from the relay unit 250 (step S106). If it has not received a notification of abnormality detection from the relay unit 250 (NO in step S106), the process from step S100 onwards is repeated.

If a notification of abnormality detection has been received from the relay unit 250 (YES in step S106), the processing from step S104 onwards is executed. That is, when the first calculation unit 100 receives a notification of abnormality detection from another device, it updates the input data additional information 401 and the output data additional information 402 to values indicating an invalid state.

In addition, when the detected abnormality is resolved and/or when a notification of recovery from the abnormality is received from the relay unit 250, the additional information for input data 401 and the additional information for output data 402 may be updated to indicate valid values.

Figure 11 is a flowchart showing an example of a processing procedure for providing additional information indicating validity by the second computing unit 200 according to this embodiment. Each step shown in Figure 11 may be realized by the processor 202 of the second computing unit 200 executing the system program 231.

Referring to FIG. 11, the second calculation unit 200 determines whether any abnormality has occurred in the process of sending and receiving data via the internal bus 6 (step S200).

If an abnormality has occurred in the process of sending and receiving data via the internal bus 6 (YES in step S200), the second calculation unit 200 notifies the relay unit 250 of the abnormality detection (step S202). Next, the second calculation unit 200 updates the input data additional information 411 and the output data additional information 412 to values indicating an invalid state (step S204). Then, the processing from step S200 onwards is repeated.

In this way, when the second calculation unit 200 detects an abnormality in the process of sending and receiving data via the internal bus 6, it notifies the relay unit 250 of the abnormality detection.

On the other hand, if no abnormality has occurred in the process of sending and receiving data via the internal bus 6 (NO in step S200), the second calculation unit 200 determines whether or not it has received notification of abnormality detection from the relay unit 250 (step S206). If it has not received notification of abnormality detection from the relay unit 250 (NO in step S206), the process from step S200 onwards is repeated.

If a notification of abnormality detection has been received from the relay unit 250 (YES in step S206), the processing from step S204 onwards is executed. That is, when the second calculation unit 200 receives a notification of abnormality detection from another device, it updates the input data additional information 411 and the output data additional information 412 to values indicating an invalid state.

In addition, when the detected abnormality is resolved and/or when a notification of recovery from the abnormality is received from the relay unit 250, the additional information for input data 411 and the additional information for output data 412 may be updated to indicate valid values.

FIG. 12 is a flowchart showing an example of a processing procedure for providing additional information indicating legitimacy by the relay unit 250 according to this embodiment. Each step shown in FIG. 12 may be realized by the processor 262 of the relay unit 250 executing a system program.

Referring to FIG. 12, the relay unit 250 determines whether any abnormality has occurred in the process of sending and receiving data via the field network 4 (step S300).

If an abnormality has occurred in the process of sending and receiving data via the field network 4 (YES in step S300), the relay unit 250 notifies the first calculation unit 100 of the abnormality detection (step S302) and also notifies the second calculation unit 200 of the abnormality detection (step S304).

In this way, when the relay unit 250 detects an abnormality in the process of sending and receiving data via the field network 4, it notifies the second calculation unit 200 of the abnormality detection.

If no abnormality has occurred in the process of sending and receiving data via field network 4 (NO in step S300), steps S302 and S304 are skipped.

Next, the relay unit 250 determines whether any abnormality has occurred in the process of sending and receiving data via the internal bus 6 (step S306).

If an abnormality has occurred in the process of sending and receiving data via the internal bus 6 (YES in step S306), the relay unit 250 notifies the first calculation unit 100 of the abnormality detection (step S308) and also notifies the second calculation unit 200 of the abnormality detection (step S310).

In this way, when the relay unit 250 detects an abnormality in the process of sending and receiving data via the internal bus 6, it notifies the first calculation unit 100 of the abnormality detection.

If no abnormality has occurred in the process of sending and receiving data via the internal bus 6 (NO in step S306), steps S308 and S310 are skipped.

Next, the relay unit 250 determines whether or not it has received a notification of abnormality detection from the first calculation unit 100 (step S312). If it has received a notification of abnormality detection from the first calculation unit 100 (YES in step S312), the relay unit 250 notifies the second calculation unit 200 of the abnormality detection (step S314).

In this way, when the relay unit 250 receives a notification of abnormality detection from the first calculation unit 100, it forwards the notification to the second calculation unit 200.

If no notification of abnormality detection has been received from the first calculation unit 100 (NO in step S312), processing in step S314 is skipped.

The relay unit 250 then determines whether or not it has received a notification of abnormality detection from the second calculation unit 200 (step S316). If it has received a notification of abnormality detection from the second calculation unit 200 (YES in step S316), the relay unit 250 notifies the first calculation unit 100 of the abnormality detection (step S318).

In this way, when the relay unit 250 receives a notification of abnormality detection from the second calculation unit 200, it forwards the notification to the first calculation unit 100.

If no notification of abnormality detection has been received from the second calculation unit 200 (NO in step S316), the processing of step S318 is skipped.

Then, the processes from step S300 onwards are repeated.
In addition, when receiving a notification of recovery from an abnormality from the first arithmetic unit 100 and/or the second arithmetic unit 200, the relay unit 250 may be configured to transfer the notification of recovery from an abnormality to the second arithmetic unit 200 and/or the first arithmetic unit 100.

F. Use of Additional Information to Show Legitimacy
Next, a processing example will be described in which the user program 132 executed by the first arithmetic unit 100 and the user program 232 executed by the second arithmetic unit 200 use additional information indicating the validity.

Figure 13 is a schematic diagram showing an example of processing when using additional information indicating validity in the control system 1 according to this embodiment.

With reference to FIG. 13 , in the first calculation unit 100 and the second calculation unit 200, for example, the input data and output data may each be referenced as a data object. A data object 430 for input data includes one or more pieces of input data 432 and corresponding additional information for input data 401 (or additional information for input data 411). Similarly, a data object 440 for output data includes one or more pieces of output data 442 and corresponding additional information for output data 402 (or additional information for output data 412).

In user programs 132 and 232, member data (variables) contained in these data objects 430 and 440 can be specified as appropriate.

The variables (or variable names) indicating additional information may be defined arbitrarily by the user, or may be predefined by the system. For example, one or more variables may be prepared in advance for additional information, and the user may assign (map) additional information of their choice to each variable. The user's operation determines which additional information each variable indicates. In this case, the variable names of variables prepared for additional information may include a prefix or suffix indicating that they are for additional information. Alternatively, any variable name may be assigned to any additional information.

On the other hand, if the additional information is defined in advance as a system, a system variable may be assigned to each available piece of additional information. Even in this case, the variable name assigned to each piece of additional information may include a prefix or suffix indicating that it is for additional information.

In this way, by specifying a variable indicating predetermined additional information in the user program 132 executed by the first calculation unit 100, it is possible to use the input data additional information 401 and/or the output data additional information 402. Similarly, by specifying a variable indicating predetermined additional information in the user program 232 executed by the second calculation unit 200, it is possible to use the input data additional information 411 and/or the output data additional information 412.

Implementing such data objects 430 and 440 simplifies the creation of user programs.

G. Modifications
In the above explanation, a configuration example in which the first arithmetic unit 100 and the second arithmetic unit 200 manage additional information has been mainly explained, but the relay unit 250 can also manage additional information in addition to the first arithmetic unit 100 and the second arithmetic unit 200. The additional information managed by the relay unit 250 can be substantially synchronized with the additional information managed by the first arithmetic unit 100 and/or the second arithmetic unit 200.

Furthermore, rather than the first arithmetic unit 100 and the second arithmetic unit 200 managing the substance of the additional information, the relay unit 250 may manage it. In this case, when additional information is requested by a user program executed by the first arithmetic unit 100 and/or the second arithmetic unit 200, the relay unit 250 may provide the requested additional information to the first arithmetic unit 100 and/or the second arithmetic unit 200.

The support device 300 may also be connected to the relay unit 250 so that additional information managed by the relay unit 250 can be monitored.

In this way, instead of only the first calculation unit 100 and the second calculation unit 200 managing the additional information, the relay unit 250 may also manage the additional information.

<H. Notes>
The present embodiment as described above includes the following technical idea.

[Configuration 1]
A control system (1), comprising:
A first control device (100) and a second control device (200),
a relay device (250) connected to the first control device via a first transmission path (4) and connected to the first control device via a second transmission path (6);
the relay device is configured to be able to execute a process of transferring data transmitted from the first control device to the second control device and a process of transferring data transmitted from the second control device to the first control device,
the first control device is configured to be able to execute a process of generating first additional information (401, 402) indicating validity of data transfer of at least one of data to be transmitted to the second control device and data to be received from the second control device;
A control system, wherein the second control device is configured to be able to execute a process of generating second additional information (411, 412) indicating the legitimacy of data transfer of at least one of the data to be sent to the first control device and the data received from the first control device.

[Configuration 2]
The first additional information is available from a first user program (132) executed on the first control device,
2. The control system of claim 1, wherein the second additional information is available to a second user program (232) running on the second controller.

[Configuration 3]
the first additional information is available by specifying a predetermined variable in the first user program;
3. The control system according to claim 2, wherein the second additional information is available by specifying a predetermined variable in the second user program.

[Configuration 4]
The control system according to any one of configurations 1 to 3, wherein when the first control device detects an abnormality in the process of transmitting and receiving data via the first transmission path, the first control device notifies the relay device of the abnormality detection (S100, S102).

[Configuration 5]
The control system according to any one of configurations 1 to 4, wherein when the second control device detects an abnormality in the process of transmitting and receiving data via the second transmission path, the second control device notifies the relay device of the abnormality detection (S200, S202).

[Configuration 6]
The relay device
When an abnormality is detected in the process of transmitting and receiving data via the first transmission path, the second control device is notified of the abnormality detection (S300, S304);
The control system according to any one of configurations 1 to 5, wherein when an abnormality is detected in the process of transmitting and receiving data via the second transmission path, the first control device is notified of the abnormality detection (S306, S308).

[Configuration 7]
The relay device
When receiving a notification of abnormality detection from the first control device, the notification is transferred to the second control device (S312, S314).
The control system according to any one of configurations 1 to 6, wherein, when a notification of abnormality detection is received from the second control device, the notification is transferred to the first control device (S316, S318).

[Configuration 8]
A control system described in any one of configurations 1 to 7, wherein when the first control device receives a notification of abnormality detection from another device, it updates the first additional information to a value indicating an invalid state (S104).

[Configuration 9]
A control system described in any one of configurations 1 to 8, wherein when the second control device receives a notification of abnormality detection from another device, it updates the second additional information to a value indicating an invalid state (S204).

[Configuration 10]
A control device (100; 200) connected to another control device (200; 100) via a relay device (250),
the relay device is configured to be able to execute a process of transferring data transmitted from the control device to the other control device and a process of transferring data transmitted from the other control device to the control device,
The control device is configured to be able to execute a process of generating additional information (401, 402; 411, 412) indicating the legitimacy of data transfer for at least one of data to be sent to the other control device and data received from the other control device.

[Configuration 11]
A communication method in a control system (1) including a first control device (100), a second control device (200), and a relay device (250) connected to the first control device via a first transmission path (4) and connected to the first control device via a second transmission path (6),
a step of the relay device transferring the data transmitted from the first control device to the second control device;
a step of the relay device transferring the data transmitted from the second control device to the first control device;
a step (S104) in which the first control device generates first additional information (401, 402) indicating validity of data transfer of at least one of data to be transmitted to the second control device and data to be received from the second control device;
A communication method comprising a step (S204) in which the second control device generates second additional information (411, 412) indicating the legitimacy of data transfer of at least one of the data to be sent to the first control device and the data received from the first control device.

The embodiments disclosed herein should be considered in all respects to be illustrative and not restrictive. The scope of the present invention is indicated by the claims, not the above description, and is intended to include all modifications that are equivalent in meaning to and within the scope of the claims.

1 Control system, 4 Field network, 6 Internal bus, 10 First device, 20 Second device, 100 First arithmetic unit, 102, 202, 262 Processor, 104, 204 Chip set, 106, 206, 264 Memory, 108, 208, 266 Storage, 110, 210 Upper network interface, 112, 212 Interface, 114, 214 Memory card interface, 116, 216 Memory card, 120, 270 Field network interface, 131, 231 System program, 132, 232 User program, 200 Second arithmetic unit, 220, 280 Internal bus interface, 250 Relay unit, 260 Processing circuit, 300 Support device, 401, 411 Additional information for input data, 402, 412 Additional information for output data, 430, 440 Data object, 432 Input data, 442 output data.

Claims (11)

1. A control system comprising:
a first control device and a second control device;
a relay device connected to the first control device via a first transmission line and connected to the first control device via a second transmission line;
the relay device is configured to be able to execute a process of transferring data transmitted from the first control device to the second control device and a process of transferring data transmitted from the second control device to the first control device,
the first control device is configured to be able to execute a process of generating first additional information indicating validity of data transfer of at least one of data to be transmitted to the second control device and data received from the second control device;
A control system in which the second control device is configured to execute a process of generating second additional information indicating the legitimacy of data transfer of at least one of data to be sent to the first control device and data received from the first control device. the first additional information is available from a first user program executed by the first control device;
The control system of claim 1 , wherein the second additional information is available from a second user program executed on the second control device. the first additional information is available by specifying a predetermined variable in the first user program;
The control system according to claim 2 , wherein the second additional information is available by specifying a predetermined variable in the second user program. The control system described in any one of claims 1 to 3, wherein the first control device notifies the relay device of the abnormality detection when it detects an abnormality in the process of sending and receiving data via the first transmission path. The control system described in any one of claims 1 to 3, wherein the second control device notifies the relay device of the abnormality detection when it detects an abnormality in the process of sending and receiving data via the second transmission path. The relay device
When an abnormality is detected in the process of transmitting and receiving data via the first transmission path, the second control device is notified of the abnormality detection;
4. The control system according to claim 1, wherein when an abnormality is detected in the process of transmitting and receiving data via the second transmission path, the control system notifies the first control device of the abnormality detection. The relay device
When receiving a notification of abnormality detection from the first control device, the notification is transferred to the second control device;
4. The control system according to claim 1, wherein, when a notification of abnormality detection is received from the second control device, the notification is transferred to the first control device. The control system described in any one of claims 1 to 3, wherein the first control device updates the first additional information to a value indicating an invalid state when it receives a notification of abnormality detection from another device. The control system described in any one of claims 1 to 3, wherein the second control device updates the second additional information to a value indicating an invalid state when it receives a notification of abnormality detection from another device. A control device connected to another control device via a relay device,
the relay device is configured to be able to execute a process of transferring data transmitted from the control device to the other control device and a process of transferring data transmitted from the other control device to the control device,
The control device is configured to be able to execute a process of generating additional information indicating the legitimacy of data transfer for at least one of the data to be sent to the other control device and the data received from the other control device. A communication method in a control system including a first control device, a second control device, and a relay device connected to the first control device via a first transmission path and connected to the first control device via a second transmission path,
a step of the relay device transferring the data transmitted from the first control device to the second control device;
a step of the relay device transferring the data transmitted from the second control device to the first control device;
generating first additional information indicating validity of data transfer of at least one of data to be transmitted to the second control device and data to be received from the second control device by the first control device;
A communication method comprising a step in which the second control device generates second additional information indicating the legitimacy of data transfer of at least one of the data to be sent to the first control device and the data received from the first control device.