JPH0375882B2 - - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION (1) Field of the Invention The present invention relates to a programmable controller, and particularly to a technique for dealing with abnormal operation of a circuit portion that executes a user program.

(2) Prior art and its problems Many recent programmable controllers, represented by the relay ladder diagram, employ an architecture called a cyclic execution method, in which user programs are sequentially read from memory. , an instruction execution means for performing arithmetic processing on the data stored in the input/output memory according to each instruction, and rewriting the data in the input/output memory with the processing results; input/output updating means for storing input data stored in a predetermined area of the input/output memory in a predetermined area of the input/output memory, and transferring output data of the predetermined area of the input/output memory to an input/output circuit and outputting the output data to the outside;
The sequence control expressed in the user program is realized by alternately repeating one cycle of execution of the user program by the instruction execution means and the operation of the input/output updating means.

Generally, the above-mentioned instruction execution means is constructed using a general-purpose microprocessor (referred to as a CPU). Therefore, in order to prevent this CPU from malfunctioning due to external noise, it is necessary to take sufficient hardware protection measures.

In addition, programmable controllers are usually installed in harsh environmental conditions such as factory production lines, so in addition to taking sufficient noise countermeasures, they can quickly detect if the CPU goes out of control. However, double and triple safety measures are required to prevent controlled equipment from causing serious accidents.

Conventionally, a so-called watchdog timer has often been adopted as a safety measure to monitor CPU runaway. A watchdog timer is a device that monitors whether or not the cycle time of a user program by the CPU is within a predetermined reference time for each cycle. The above reference time is set to be slightly longer than the maximum time required to successfully execute one round of the user program, so if the CPU goes out of control for some reason, the user program will not be executed within the above reference time. It does not finish, and this time exceedance is detected as a runaway CPU.

In conventional programmable controllers, when a runaway of the CPU is detected by the watchdog timer, the CPU stops executing the user program, forcibly turns off the control output of the programmable controller, and stops the control operation. It is configured to completely stop and place the controlled equipment on the safe side.

However, when we analyze the cause of the CPU runaway, we find that
There are permanent failures due to some kind of hardware damage, and abnormalities caused by extremely random and temporary noise. In the case of the former permanent failure, it is appropriate to completely stop the control operations of the programmable controller. However, in the case of the latter accidental and temporary abnormality due to the influence of noise, etc., the CPU
This is not an essential abnormality, and the CPU can operate normally when the cause of the abnormality is gone. Conventionally, control operations of the programmable controller were completely stopped in the latter case, but this
Since the data in the input/output memory had become confused due to a temporary abnormality in the CPU, it was impossible to continue the control operation even if we wanted to, so this was a natural measure.

In this way, with conventional programmable controllers, even if the CPU goes out of control due to an accidental, temporary abnormality due to the influence of noise, etc., and which can return to normal operation immediately afterwards,
As in the case of a permanent failure, the control operation is completely stopped, and if the environment in which the programmable controller is used is especially bad, the inconvenience of frequently stopping the production line that is the object of control may occur. .

(3) Purpose of the Invention The purpose of the present invention is that when CPU runaway is detected by the watchdog timer described above, the control operation is not completely stopped immediately, but the control operation is stopped immediately by the user based on correct data. To provide a programmable controller in which a program can be re-executed and control operations can be continued if an abnormality caused by temporary noise or the like is resolved.

(4) Structure and Effects of the Invention In order to achieve the above object, the present invention sequentially reads a user program from a memory and performs arithmetic processing on data stored in an input/output memory according to each instruction. , and an instruction execution means for rewriting the data in the input/output memory with the processing result; and input/output updating means for transferring output data of a predetermined area of the input/output circuit to the input/output circuit and outputting it to the outside, and a cyclic circuit that alternately repeats one round execution of the user program by the instruction execution means and the operation of the input/output updating means. In an execution-type programmable controller; execution time monitoring means for monitoring whether the execution time of one round of the user program by the instruction execution means is within a predetermined reference time for each execution operation, and the input/output updating means; Data saving means stores the latest data of the input/output memory, which is updated every time the means operates, in a saving memory, and the monitoring means detects whether the program execution time exceeds the reference time T ₁ during the operation of the instruction execution means. When detected, the operation of the instruction execution means is interrupted, the data in the save memory is transferred to the input/output memory, and then the instruction execution means is restarted to re-execute the user program from the beginning. When the monitoring means detects that the input/output updating and data saving processing reference time _T2 has exceeded the control means, the input/output updating means, and the data saving means are in operation, the control operation of the entire device is stopped. It is characterized by having the following: control operation stopping means;

According to this configuration, even if it is detected that the program execution time exceeds the reference time _T1 during the operation of the instruction execution means due to the influence of temporary noise, for example, the influence of the noise is immediately resolved. For example, the re-execution control means correctly executes the user program in accordance with the correct input/output data saved in the save memory, thereby allowing the control operation of the programmable controller to continue without any problem. This eliminates the inconvenience of frequently stopping the production line to be controlled due to small noises.

Additionally, if it is detected that the processing standard time _T2 for input/output updating and data saving is exceeded while the input/output updating means and data saving means are operating, the control operation will be completely stopped, thereby causing serious damage to the controlled equipment. It has the effect of preventing from

(5) Description of Embodiments FIG. 1 is a block diagram showing a schematic configuration of a programmable controller according to the present invention. This programmable controller has a user program memory 3 in which user programs are stored.
, an input/output circuit 6 that receives an external input signal and sends out an external output signal, an input/output memory 4 that serves as a buffer memory for input/output data corresponding to the input/output circuit 6, and an input/output memory 4 that stores the latest data in the input/output memory 4. Each instruction in the save memory 5 for saving and the user program memory 3 is executed in sequence at high speed, and the data stored in the input/output memory 4 is processed according to each instruction, and the processing results are an instruction execution means for rewriting data in the input/output memory 4, and storing input data given to the input/output circuit 6 from the outside in a predetermined area of the input/output memory 4; The input/output update means that transfers the output data to the input/output circuit 6 and outputs it to the outside, and the instruction execution means check for each execution operation whether the round execution time of the user program is within a predetermined reference time. Execution time monitoring means centered on the watchdog timer 8 for monitoring; data saving means for storing data in the input/output memory 4 updated each time the input/output updating means operates in the saving memory 5; and the above instructions. When the watchdog timer 8 detects an overtime while the execution means is operating, the operation of the instruction execution means is interrupted, the data in the save memory 5 is transferred to the input/output memory 4, and then the instruction is executed. A flip-flop 10, a reset pulse generation circuit 7, and a gate 11 as re-execution control means for restarting the means and re-executing the user program from the beginning.
etc.

The above instruction execution means, input/output updating means, data saving means and other overall timing control are
This is realized by CPU1. In other words, the CPU
1 implements the operations of each control means described above by executing a system program stored in a system program memory 2.

The CPU 1 is related to the execution time monitoring means,
Prior to execution of the user program, a reference time T1 of the program execution time is input to the watchdog timer 8, and a signal LD is generated to preset the reference time T1 in the watchdog timer 8. Thereafter, the watchdog timer 8 is counted down by the clock signal from the pulse generating circuit 9, and when the time is up, it outputs the signal TU and sets the flip-flop 10. When one cycle of execution of the user program by the CPU 1 is completed within the reference time T1, the CPU 1 uses a watchdog timer to set the processing reference time T2 for input/output updating and data saving before operating the input/output updating means and data saving means. Preset to 8.
After the CPU 1 performs the input/output update process and the data save process, it again presets the above-mentioned reference time T1 in the watchdog timer 8 and executes the user program.

In this way, the CPU 1 repeats each operation of the instruction execution means, input/output updating means, and data saving means while presetting the reference time T1 and reference time T2 in the watchdog timer 8, so that each operation is performed normally within the reference time. If the value is within , the watchdog timer 8 will not time up and the flip-flop 10 will remain reset.

Watchdog timer 8 due to some abnormality.
When the time-up occurs and flip-flop 10 is set, the output of flip-flop 10 becomes Q=
“1” is applied to the input terminal ERF of the CPU 1 and is also applied to the gate 15. At the same time, in response to the output Q of the flip-flop 10 rising to "1", a differential pulse of a predetermined width is generated from the reset pulse generation circuit 7, and the pulse signal is sent to the restart input of the CPU 1 via the gate 11. edge pres
is applied to

FIG. 2 is a flowchart showing an overview of the system program executed by the CPU 1.
The control operations of the CPU 1 will be explained below in order according to this flowchart.

When power is applied to this programmable controller, a power-on reset signal is generated from a power-on detection circuit (not shown), and this reset signal is passed through gate 12 to flip-flop 10.
is input to the restart input terminal RES of CPU1 via gate 11.
is applied, and the CPU 1 starts executing the system program from the beginning.

In the first step 100, the input terminal ERF of CPU1 is
The output Q of flip-flop 10 applied to
Check the logical state of Since the flip-flop 10 is reset when the power is turned on,
ERF is "0" and the process advances to step 101. step
At step 101, the signal CLR is set to "1" to keep the flip-flop 10 in the reset state, at the next step 102, initial processing is executed, and at the next step 103, the reference time T1 of the instruction execution operation described above is set by the watchdog timer 8. In the next step 104, the signal CLR is returned to "0".

Next, in step 105, the signal SCAN indicating that the user program is being executed is set to "1", and in the next step 106, the user program is executed once,
Complete the user program to the end (until the END instruction)
When the execution is completed, the signal SCAN is returned to "0" in step 107.

Note that when the signal SCAN becomes “1”, gate 1
3, that is, the read/write signal of the save memory 5 is kept in the read state "1" to prevent the data in the save memory 5 from being rewritten. Also, the signal
When SCAN="1" is input to the gate 15 via the inverter 14, the output of the gate 15 becomes "0"
In this state, even if the watchdog timer 8 times up and the output Q of the flip-flop 10 becomes "1", the stop signal HALT is not applied to the CPU 1, and the all output OFF command signal of the input/output circuit 6 is not applied. It has become impossible for me to utter it.

Next, CPU1 performs input/output update and data saving processing, but before that, it first performs a step
At 108, a processing reference time T2 for input/output updating and data saving is preset in the watchdog timer 8. In the next step 109, input/output update operation is performed,
In the next step 110, data saving processing is performed, and once these are completed, in step 111, the reference time T1 for program execution processing is preset in the watchdog timer 8, and the process proceeds to the previous steps 105→106, and the user program is Perform execution processing.

While the CPU 1 is operating normally, steps 105, 106, 107, 108, 109, 110, and 111 described above are repeated.

Assume that during the above-described operation, the watchdog timer 8 times out while the user program for which the signal SCAN is "1" is being executed. In this case, the flip-flop 10 is set, the output Q becomes "1", and the reset pulse generating circuit 7
A reset pulse is generated from
Applied to RES.

Upon receiving this restart pulse signal, the CPU 1 interrupts the current operation and starts executing the system program from the beginning (from step 100).
At step 100, the output state of the flip-flop 10 is checked, and since Q=ERF="1" at this time, the process advances to step 112.

In step 112, the data saved in the save memory 5 at the time of the latest input/output update is returned to the input/output memory 4, where the data may have been destroyed due to an abnormality in which the execution time of the user program exceeded. In the next step 113, the reference time T1 of the user program processing time is preset in the watchdog timer 8, and in the next step 114, the signal CLR is generated to reset the flip-flop 10 via the gate 12. The process then proceeds to steps 105 and 106, and the user program is re-executed from the beginning.

At this time, the user program is executed based on the input/output data saved in the save memory 5, so if the CPU 1 temporarily goes out of control due to small noise, the user program described above will be executed. If it is re-executed, it can be executed correctly, and the continuity of sequence control will not be impaired at all.

Note that if the CPU 1 goes out of control during an input/output update operation or a data save operation, and the watchdog timer 8 times up and the flip-flop 10 is set, the signal SCAN is "0" at this time, so the output of the flip-flop 10 is When Q becomes "1", the output of gate 15 becomes "1",
The halt input HALT of CPU1 becomes “1”
The operation of the CPU 1 is stopped, and all external output signals of the input/output circuit 6 are forcibly turned off.
In other words, if the CPU 1 goes out of control during an input/output update operation or a data save operation, the data in the input/output memory 4, save memory 5, or input/output circuit 6 will be confused and cannot be recovered. Control operations have been completely stopped.

[Brief explanation of drawings]

FIG. 1 is a block diagram showing the overall configuration of a programmable controller according to an embodiment of the present invention, and FIG. 2 is a flowchart showing an overview of the system program of CPU 1 in FIG. 1...CPU, 3...User program memory,
4... Input/output memory, 5... Save memory, 6...
Input/output circuit, 8...Watchdog timer.

Claims (1)

[Claims] 1. Read a user program in order from memory, perform arithmetic processing on the data stored in the input/output memory according to each instruction, and use the processing results to read the data in the input/output memory. A command execution means for rewriting and storing input data given to the input/output circuit from the outside in a predetermined area of the input/output memory, and transferring output data of the predetermined area of the input/output memory to the input/output circuit. In a programmable controller of a cyclic execution type, the programmable controller has input/output updating means for outputting to the outside, and alternately repeats one round execution of a user program by the instruction execution means and the operation of the input/output updating means; Execution time monitoring means for monitoring whether the program round execution time is within a predetermined reference time for each execution operation, and the latest input/output memory updated every time the input/output updating means operates. When the monitoring means detects that the program execution time exceeds the reference time _T1 during the operation of the data saving means for storing data in the saving memory and the instruction execution means, the operation of the instruction execution means is interrupted. , re-execution control means for restarting the instruction execution means to re-execute the user program from the beginning after moving the data in the save memory to the input/output memory; and the input/output updating means and the data saving means. A programmable device comprising: control operation stopping means for stopping the control operation of the entire device when the monitoring means detects that the input/output update and data saving processing reference time T ₂ has exceeded during operation. ·controller.