METHOD FOR PROGRAMMING A SAFETY CONTROLLER

• US 20170147300A1
• Filed: 11/11/2016
• Published: 05/25/2017
• Est. Priority Date: 11/24/2015
• Status: Active Grant

• Current Assignee: PILZ GmbH & Company KG
• Original Assignee: PILZ GmbH & Company KG
• Inventors: WOEHRLE, Stefan, VON HAUGWITZ, Frank, BAUER, Ralf
• Granted Patent: US 10,437,571 B2
• Time in Patent Office: Days
• CPC Class Codes: G05B 19/0426 Programming the control sequence
• CPC Class Codes: G05B 2219/13153 Modification, change of program in real time
• CPC Class Codes: G05B 2219/23333 Modify program and store it
• CPC Class Codes: G05B 2219/36174 Program divided into modules
• CPC Class Codes: G06F 8/41 Compilation
• CPC Class Codes: G06F 9/44521 Dynamic linking or loading; Link editing at or after load time, e.g. Java class loading

Abstract

A user program for a safety controller is created by means of a program editor. The user program has a first program portion and at least one additional program portion. The first program portion defines safety-related logical dependencies between selected sensor signals and actuator signals. The user program is compiled and linked, in order to obtain an executable original program code. The original program code is transferred to a first memory of the safety controller and executed by a processor of the safety controller. The first program portion may be modified and compiled in order to obtain a modified first code portion. The modified first code portion is transferred to a second memory of the safety controller while the original program code is executed. The modified first code portion is then executed in addition to the original additional code portion and instead of the original first code portion.

Claims

1. A method for programming a safety controller, which has a plurality of inputs for receiving sensor signals, a plurality of outputs for outputting actuator signals, and at least one processor for executing program code, the method comprising the steps of:

creating a user program which defines logical dependencies between the sensor signals and the actuator signals, using a program editor, wherein the user program has a first program portion and at least one additional program portion, and wherein the first program portion defines safety-related logical dependencies between selected sensor signals and actuator signals,

compiling and linking the first and the at least one additional program portion, in order to obtain an executable original program code for the at least one processor, wherein the original program code has an original first code portion which represents the first program portion, and at least one original additional code portion which represents the at least one additional program portion,

transferring the executable original program code to a first memory of the safety controller,

executing the executable original program code by means of the at least one processor, in order to generate the actuator signals as a function of the sensor signals,

modifying the first program portion using the program editor, in order to obtain a modified first program portion, and

compiling the modified first program portion, in order to obtain a modified first code portion,

wherein the modified first code portion is transferred to a second memory of the safety controller while the original program code is executed by means of the at least one processor, and

wherein the modified first code portion is then executed in addition to the original additional code portion and instead of the original first code portion by means of the at least one processor, in order to generate the actuator signals as a function of the modified first program portion.

2. The method of claim 1, wherein the modified first code portion is executed instead of the original first code portion only during a limited period of time.

3. The method of claim 2, wherein the safety controller enters into a defined safe state after the limited period of time has elapsed.

4. The method of claim 1, wherein the first memory is a non-volatile memory and the second memory is a volatile memory.

5. The method of claim 1, wherein a program code pointer of the safety controller is changed in order to execute the modified first code portion instead of the original first code portion.

6. The method of claim 1, wherein the at least one processor executes the original program code in a cyclical manner defining a plurality of program cycles, and wherein the modified first code portion is executed instead of the original first code portion after completion of one of the plurality of program cycles.

7. The method of claim 1, wherein the safety controller has a visual indicator via which execution of the modified first code portion is indicated.

8. The method of claim 1, wherein the modified first program portion, together with the at least one additional program portion, is compiled and linked in order to obtain a modified executable program code, and wherein the modified executable program code is transferred to the first memory after execution of the original program code has been stopped.

9. The method of claim 1, wherein the modified first program portion is compiled twice in order to generate a modified first code portion and a modified second code portion, wherein the modified first code portion and the modified second code portion are transferred to the second memory and are executed redundantly by means of the at least one processor.

10. The method of claim 1, wherein the safety controller is a distributed safety controller including a plurality of networked control units, on which an individual program code is respectively executed, wherein the modified first code portion is transferred to at least two different control units while the original program code is executed.

11. The method of claim 1, wherein the modification of the first program portion is enabled or disabled as a function of a user identification.

12. The method of claim 1, wherein the transfer of the modified first code portion to the second memory is logged in an additional memory together with a date stamp.

13. A safety controller for fail-safe control of a safety-critical process, comprising:

a plurality of inputs for receiving sensor signals,

a plurality of outputs for outputting actuator signals,

at least one processor for cyclically executing program code,

a first non-volatile memory,

a second volatile memory, and

a programming tool for creating a user program which defines logical dependencies between selected sensor signals and selected actuator signals,

wherein the programming tool has a program editor designed to generate a first program portion and at least one additional program portion,

wherein the first program portion defines safety-related logical dependencies between some selected sensor signals and some selected actuator signals,

wherein the programming tool further has a compiler designed to compile the first and the at least one additional program portion and to link it in order to form an executable original program code for the at least one processor,

wherein the original program code has an original first code portion, which represents the first program portion, and at least one original additional code portion, which represents the at least one additional program portion, and

wherein the programming tool is configured for transferring the original program code into the first memory,

wherein the programming tool is further designed to modify and to compile the first program portion separately from the additional program portion, in order to obtain a modified first code portion, and

wherein the programming tool is further configured for transferring the modified first code portion into the second memory while the original program code is executed by means of the at least one processor, and

wherein the safety controller is configured to execute the modified first code portion in addition to the original additional code portion and instead of the original first code portion by means of the at least one processor, in order to generate the actuator signals as a function of the modified first program portion.

14. A computer program for a safety controller for fail-safe control of a safety-critical process, wherein the safety controller has a plurality of inputs for receiving sensor signals, a plurality of outputs for outputting actuator signals, at least one processor for cyclically executing program code, a first non-volatile memory, a second volatile memory, and a programming tool for creating a user program which defines logical dependencies between selected sensor signals and selected actuator signals, wherein the computer program is stored on a non-transitory data storage medium and is designed to execute a method comprising the steps of:

creating a user program which defines logical dependencies between the sensor signals and the actuator signals, using a program editor, wherein the user program has a first program portion and at least one additional program portion, and wherein the first program portion defines safety-related logical dependencies between selected sensor signals and actuator signals,

compiling and linking the first and the at least one additional program portion, in order to obtain an executable original program code for the at least one processor, wherein the original program code has an original first code portion which represents the first program portion, and at least one original additional code portion which represents the at least one additional program portion,

transferring the executable original program code to a first memory of the safety controller,

executing the executable original program code by means of the at least one processor, in order to generate the actuator signals as a function of the sensor signals,

modifying the first program portion using the program editor, in order to obtain a modified first program portion, and

compiling the modified first program portion, in order to obtain a modified first code portion,

wherein the modified first code portion is transferred to a second memory of the safety controller while the original program code is executed by means of the at least one processor, and

wherein the modified first code portion is then executed in addition to the original additional code portion and instead of the original first code portion by means of the at least one processor, in order to generate the actuator signals as a function of the modified first program portion.