Safety control system and procedures for operating a safety control system

Abstract

Safety control system (1) comprising the following: a) a control unit (3) which includes safety control logic, b) at least one safety sensor arrangement (4), c) at least one machine arrangement (5) which can operate in different modes (F0, F N , F1, F2) can be operated, with each operating mode having a different productivity (P0, P N , P1, P2) of the machine arrangement (5) is characterized, wherein d) the control unit (3) receives and evaluates an input from the at least one safety sensor arrangement (4) and e) in response to the result of the evaluation, an operating mode (F0, F N , F1, F2) of the machine arrangement (5), as determined by the safety control logic (3), is activated, - a machine (2) or machine arrangement (5) which has a nominal productivity (P N ) shows, - a first security zone (Z1) and a second security zone (Z2), where the first security zone (Z1) is a subset of the second security zone (Z2), - a first functionally redundant subsystem (D1, 6) configured to detect a first hazard event (H1) in the first safety zone (Z1), - a second functionally redundant subsystem (D2, 7) configured to detect a second hazard event (H2) in the second safety zone (Z2), characterized by the fact that (1) comprising at least one safety sensor arrangement (4) comprising at least two functionally redundant subsystems (6, 7), (2) the input to the control unit (3) includes information (8) that specifies the availability of the at least two functionally redundant subsystems (6, 7), (3) the control unit (3) is configured to: i. Activating a normal operating mode (F N ), which is characterized by normal productivity (P N ) is characterized if the input specifies the availability of all functionally redundant subsystems (6, 7), ii. Activating a fail-stop operating mode (F0) characterized by zero productivity (P0) if the input (8) indicates the unavailability of all functionally redundant subsystems (6, 7), iii. Activating a fail-safe operating mode (F1, F2) with a productivity that is lower than normal but above zero, if the input (8) indicates at least a temporary unavailability of at least one and an availability of at least one other of the functionally redundant subsystems (6, 7), where an initial failure-functioning mode (F1) leads to an initial reduced machine productivity (P1) that is greater than zero but less than the normal productivity (P N ) is, and a second fail-function mode (F2) leads to a second reduced machine productivity (P2) that is greater than zero but less than the nominal productivity (P N ) and is higher than the first reduced machine productivity (P1), wherein the control unit activates the second fail-to-operate mode (F2) if the input to the control unit indicates availability of both functionally redundant subsystems (D1, 6; D2, 7) and a second hazard event (H2) in the second safety zone (Z2) but no first hazard event in the first safety zone (Z1), and wherein the control unit activates the first fail-to-operate mode (F1) if the input to the control unit indicates temporary unavailability of the first functionally redundant subsystem (D1, 6) but availability of the second functionally redundant subsystem (D2, 7) and a second hazard event (H2) in the second safety zone (Z2).

Description

specification

[0001] The present invention relates to a safety control system according to a preamble of claim 1, wherein the system includes a control unit containing safety control logic, further comprising at least one safety sensor arrangement, and further comprising at least one machine arrangement that can be operated in different operating modes, wherein each operating mode is characterized by a different productivity of the machine arrangement, wherein the control unit receives and evaluates an input from the at least one safety sensor arrangement and, in response to the result of the evaluation, activates an operating mode of the machine arrangement as determined by the safety control logic.

[0002] The present invention also relates to a method for operating a safety control system, wherein the system includes a control unit containing safety control logic, further comprising at least one safety sensor arrangement, and further comprising at least one machine arrangement that can be operated in different operating modes, each operating mode being characterized by a different productivity of the machine arrangement, wherein the control unit receives and evaluates an input from the at least one safety sensor arrangement and, in response to the result of the evaluation, activates an operating mode of the machine arrangement as determined by the safety control logic.

[0003] In general terms, the invention relates to a safety control system in a discrete manufacturing environment or manufacturing site. The term "machine" is intended to encompass any individual machine or individual subsystem of a manufacturing site, for example, a robot, an assembly system, a manufacturing cell, or even an automated guided vehicle (AGV) used in manufacturing sites to move automatically between different manufacturing cells or subsystems.

[0004] Safety control in discrete manufacturing has the primary goal of protecting people from hazards when they work at or enter production sites. Sensors or switches are generally used to signal to a safety control device the presence of people in specific zones or their attempts to enter such zones. Based on the actual status of the automated manufacturing process, the production line or individual equipment is brought into a state that reduces or limits potential hazards to a specified acceptable level. This is very often achieved by stopping the machines, but sometimes it is sufficient to reduce the speed of movement or limit the range of motion of certain mechanisms, such as industrial robots or machine tools.

[0005] In the most important cases, machine stopping is implemented using drives with a safe stop function (STO). In the case of industrial robots, the robot controller also performs the robot's safety control, which includes monitoring the robot tool position. and speed is typically implemented. It is also known that drives offering safety speed or position control are used.

[0006] In the event of (potential) serious hazards, an emergency stop is initiated, e.g., via an emergency stop button or appropriate sensor devices. This puts the machine into a safe stop state, which requires dedicated confirmation to restart the machine.

[0007] The safety control system, designed to achieve the primary goal of protecting people from hazards, relies on the availability and proper functioning of sensors and switches.

[0008] However, sensors and switches could fail, for example, if an internal diagnostic function detects a power outage. Or the communication between the sensors or switches and the control logic could be faulty. Therefore, when implementing safety control, the control logic must include a safety concept for handling situations where the sensors or switches are unavailable, for example, in the case of an internal stop, also known as passivation.

[0009] Another reason could be faulty communication between the sensors and switches and the control logic. Passivation, or in other words, the unavailability of sensors or switches, or disrupted communication between sensors or switches and the control logic, is summarized by the term "failure situation," thus distinguishing it from the previously explained "hazard situation."

[0010] The control logic includes a predefined response even in such a failure situation.

[0011] With current technology, the response to a failure is the same as the response to a hazardous situation. Therefore, if a faulty communication with a safety sensor or a failure in the sensor itself is detected, a corresponding emergency operating mode is activated, even if no hazardous situation has been detected. This is a machine stop according to stop category 0 or 1, combined with a manual reset / restart of the machine. Machine productivity is reduced.

[0012] However, a malfunction, such as a sensor failure, is often only temporary and is resolved more or less automatically within a certain timeframe. With current technology, the machine is nevertheless stopped, causing unnecessary production downtime.

[0013] EP 2 637 068 A1 describes a conveyor system with safety management in which a logic module determines an operating mode of a selected sensor module based on the value of a measurement signal.

[0014] DE 10 2005 003 827 A1 describes a device for cooperation between a human and a robot unit at a workplace with a first and a second sensor unit that detect the approach of a human.

[0015] Accordingly, the object of the present invention is to improve a safety control system and a method for operating a safety control system for controlling a machine in such a way that production losses are reduced in the event of a failure situation as described above.

[0016] The objective of improving the safety control system is achieved according to the invention by a safety control system with the features of claim 1. Accordingly, the at least one safety sensor arrangement according to the invention has at least two functionally redundant subsystems, and an input to the control unit includes information indicating the availability of the at least two functionally redundant subsystems. The control logic is configured to activate a normal operating mode, characterized by normal productivity, if the input indicates the availability of all functionally redundant subsystems, and to activate a fail-stop operating mode, characterized by zero productivity, if the input indicates the unavailability of all functionally redundant subsystems. A fail-function operating mode with a productivity of [missing information] is also configured to activate a fail-function mode.which is lower than normal but above zero, is configured if the input indicates at least a temporary unavailability of at least one and the availability of at least one other of the functionally redundant subsystems.

[0017] In this application, the terms "first and second safety device" are also used for the functionally redundant subsystems of the safety sensor arrangement. This can include two or more safety sensor devices, for example, a proximity sensor monitoring a first safety zone, which is a more critical safety zone, and a camera monitoring a second, third, or nth safety zone, which are less critical, where the first safety zone is a subset of the second, third, or nth safety zone. This can also be a sensor unit with two or more different monitoring zones, for example, a laser scanner or a camera that monitors two different zones.which is configured to monitor a first safety zone near the machine arrangement with high resolution and a second, third, or nth safety zone extending further away from the machine arrangement with lower resolution, or the like. Accordingly, the terms "first" and "second" safety device are used to describe either a sensor or sensor system, or a functional subunit of a more complex sensor or sensor system. The term "second safety device" is intended to denote a functional type; thus, a second safety device is intended to refer to one, two, three, or n sensors or sensor functions in addition to the first sensor device.

[0018] For the purposes of this application, the term “first or second fail-safe mode” is also referred to as “first or second safety mode”.

[0019] In other words, the invention provides a safety control system that includes a second safety device for detecting a second hazardous situation in a second safety zone, or alternatively, is capable of achieving a temporary safe state, for example, with a safety-limited speed, from which one must usually exit after a certain predefined time. In the case of a second safety device, the control logic interacts with the first and second safety devices to detect a failure situation in one of the safety devices and, in response to such a failure, switches to the other safety device or applies one of the failover modes.In the second case, the control logic puts the system into a temporary safe state, from which it usually has to exit after a certain predefined time.

[0020] According to the invention, the safety control system comprises a machine or machine arrangement with a nominal productivity, further comprising a first safety zone and a second safety zone, wherein the first safety zone is a subset of the second safety zone, further comprising a first functionally redundant subsystem configured to detect a first hazardous event in the first safety zone, further comprising a second functionally redundant subsystem configured to detect a second hazardous event in the second safety zone, wherein a first fail-to-operate mode results in a first reduced machine productivity that is greater than zero but less than the normal productivity, and a second fail-to-operate mode results in a second reduced machine productivity.which is greater than zero but less than the nominal productivity and higher than the first reduced machine productivity, wherein the control logic activates the second fail-safe mode if the input to the control logic indicates availability of both functionally redundant subsystems and a second hazardous event in the second safety zone but no hazardous event in the first safety zone, and wherein the control logic activates the first fail-safe mode if the input to the control logic indicates temporary unavailability of the first functionally redundant subsystem but availability of the second functionally redundant subsystem and a second hazardous event in the second safety zone.

[0021] According to another preferred embodiment, the control logic activates the second fail-function mode if the input to the control logic indicates availability of the first functionally redundant subsystem and at least temporary unavailability of the second redundant subsystem, and no first hazard event in the first safety zone.

[0022] According to another preferred embodiment, the control logic activates the first fail-function mode if the input to the control logic indicates at least a temporary unavailability of the second redundant subsystem and a first hazard event in the first safety zone.

[0023] According to another preferred embodiment, the control logic activates the first fail-function mode if the input to the control logic indicates the availability of both the first and second redundant subsystems and a first and second hazard event in both the first and second safety zones.

[0024] According to another preferred embodiment, the control logic activates the normal operating mode if the input to the control logic indicates availability of the second redundant subsystem and temporary unavailability of the first redundant subsystem and no hazardous event in the second safety zone.

[0025] According to another preferred embodiment, the machine or machine arrangement is a robot or an autonomous guided vehicle (AGV) or a discrete manufacturing system or manufacturing cell.

[0026] According to another preferred embodiment, the productivity of the machine or machine arrangement is the speed of moving parts of the machine or machine arrangement.

[0027] According to another preferred embodiment, the first or the second redundant subsystem is a proximity sensor, a light barrier, a laser scanner, or a camera.

[0028] According to another preferred embodiment, the temporary unavailability of a functionally redundant subsystem is caused by a temporary communication error such as a cyclic redundancy error (CRC error) or a watchdog error.

[0029] According to the invention, the objective is achieved by introducing a failover concept for safety control, which avoids unnecessary machine stoppages in cases where a failure occurs in a safety device. Failover refers to switching to a redundant device or function when a dedicated device or function fails.

[0030] In the hierarchical safety control system according to the invention, the hierarchy with increasing criticality is given by the sequence that one or more second or third, or in a general case N, less critical safety zones, which are supervised by the second safety device, detect one or more second or third, or in a general case N, hazardous situations in the one or more second or third, or in a general case N, safety zones, trigger one or more second or third, or in a general case N, safety function modes, whichwhich does not stop the machine, and the subsequent first critical safety zone, which is monitored by the first safety device that detects a first hazardous situation in the first critical safety zone, triggers a first safety function mode that preferably stops the machine. Accordingly, the hierarchically arranged first and second safety devices according to the invention are used as if they were redundant devices.

[0031] Regarding the response of the safety control system to a failure mode in one of the safety devices, i.e., sensors or switches or the like, the advantage of the safety control system according to the present invention lies in the fact that, in such a failure mode, the control logic does not trigger the emergency function mode, but switches to the other safety device and applies a failover function mode (instead of the severe emergency function mode) by selecting the less critical failover function mode, which still meets the safety requirements, from among two failover function modes. This is evident from the invention in that, if the second safety device is in a failure situation, the first safety device is used instead of the second safety device, but the less critical second safety function mode is applied.This is a surprising finding, since the normal approach would be to apply the more critical first safety function together with the first safety device. An advantage of the invention is that the machine's productivity is reduced less by using the less critical second safety function compared to applying the critical first safety function, while still maintaining a high and appropriate level of safety.

[0032] In other words, a typical hazardous event occurs when a person enters a defined zone where an operating machine could seriously injure them. Conventionally, the machine is stopped if such an event is detected.

[0033] The concept of hierarchical safety control takes into account that the severity of such a hazard can vary, so that sometimes the machine can run at a safely reduced speed instead of being stopped, thus improving the overall productivity of the machine.

[0034] For example, a “Zone 1” can be defined around an industrial robot, where a violation of this zone leads to the immediate stopping of the robot. However, if a person is nearby and outside this zone, the robot can operate at a reduced speed so that it is able to stop when the person enters “Zone 1.” This is an example of a hierarchical control structure according to the invention.

[0035] Another example could be an AGV that could run at reduced speed if obstacles or a human worker are within a certain but larger area, and stop when the distance becomes critical, like "Zone 1" in the example above.

[0036] More generally, the safety response can also depend on more accurately determining the position, size, and speed of people or obstacles. And the safety response can also stop specific parts of a production line, while parts of the line run at variable speeds, and so on.

[0037] The first or second safety device may include first or second safety hazard detection means, which may be, for example, sensors or switches used to report the presence of a person in specific zones, or their attempt to enter such zones, to a safety logic unit, also called a safety control unit. For example, the immediate vicinity of a machine, such as a robot or an AGV, may be defined as a first critical safety zone because there is a critical hazard that a person will be seriously injured by the machine if they enter this first zone. Therefore, the presence of a person in such a first critical zone is an example of a hazardous event according to the present invention.

[0038] A wider area surrounding the machine, for example the robot or AGV, would be defined as a second, less critical safety zone. While there is still a risk of human injury if a person is within this zone, it is less likely, and there is a greater safety distance to the dangerous parts of the machine, allowing for more reaction time. Therefore, the presence of a person in such a second safety zone is also considered a hazardous event according to the present invention, but it will have less serious consequences.

[0039] The first security zone is usually a subset of the second security zone.

[0040] Based on the actual status of the automated manufacturing process, a primary or secondary safety function is triggered upon detection of a hazardous event. This means, for example, that they are put into a state that reduces or limits potential hazards to a specified acceptable level. This is very often achieved by stopping the machines, but sometimes it is sufficient to reduce the speed of movement or to limit the range of motion of certain mechanisms, such as industrial robots or machine tools.

[0041] A first safety function would, for example, mean a rather drastic reduction in movement speed or a limitation of the movement area and would be triggered if it is detected that a person is within the first safety zone.

[0042] A second safety function would, for example, mean a less drastic reduction in movement speed or limitation of the movement area and would be triggered if it is detected that a person is within the second, less critical safety zone.

[0043] According to a further preferred embodiment of the present invention, the safety control logic interacts with the machine arrangement to control the machine arrangement to the normal operating mode in the event of a failure in the first safety device and the absence of a hazardous situation detected by the second safety device.

[0044] According to a further preferred embodiment of the present invention, the safety control logic interacts with the machine to control the machine to the first operating mode in the event of a failure situation in the first safety device and the detection of a hazardous situation by the second safety device.

[0045] According to a further preferred embodiment of the present invention, the control logic interacts with the machine to control the machine to the first safety function mode in the event of a failure situation in the second safety device and the detection of a hazardous situation by the first safety device.

[0046] According to a further preferred embodiment of the present invention, the control logic interacts with the machine to control the machine to the emergency safety function mode in the event of a failure situation in the first and the second safety device.

[0047] According to a further preferred embodiment of the present invention, the control logic interacts with the first and second safety devices to detect communication errors in the first and second safety devices, wherein the failure situation in one of the safety devices is the communication error, for example a CRC or cyclic redundancy check error or watchdog error.

[0048] According to the invention, a method for operating a safety control system is defined in claim 10.

[0049] According to a further preferred embodiment of the present invention, the machine is operable at least in a normal operating mode and in an emergency operating mode, wherein the safety control system comprises a control logic that is communicatively coupled with the machine, a first safety device that is communicatively coupled with the control logic, wherein the control logic uses the first safety device to detect a first hazardous situation in a first critical safety zone, and a second safety device that is communicatively coupled with the control logic, wherein the control logic interacts with the machine in such a way that it operates in normal operating mode when no hazardous situation is present, with the following further steps: - The control logic uses the second safety device instead of the first safety device if a failure situation has been detected in the first safety device, and the control logic triggers the second safety function mode if a failure situation has been detected in the second safety device and no hazardous situation has been detected by the first safety device.

[0050] According to a further preferred embodiment of the present invention, the method comprises the further step that the safety control logic triggers the normal operating mode in the event that a failure situation has been detected in the first safety device and no hazardous situation has been detected by the second safety device.

[0051] According to a further preferred embodiment of the present invention, the method comprises the further step that the control logic triggers the first operating mode in the event that a failure situation has been detected in the first safety device and a danger situation has been detected by the second safety device.

[0052] According to a further preferred embodiment of the present invention, the method comprises the further step that the control logic triggers the first safety function mode in the event that a failure situation has been detected in the second safety device and a hazardous situation has been detected by the first safety device.

[0053] According to a further preferred embodiment of the present invention, the method comprises the further step that the control logic triggers the emergency safety function mode in the event that a failure situation has been detected in the first and the second safety device.

[0054] The invention is described in more detail by describing three embodiments with reference to the accompanying drawings, wherein Fig. 1 an exemplary and schematic representation of a safety control system according to the invention, Fig. 2 an exemplary and schematic representation of a further embodiment of a safety control system according to the invention, Fig. 3 represents an example of a hierarchical safety zone for a robot cell, Fig. 4 presents an example with a hierarchical security zone for an AGV, Fig. 5 schematically represents the generalized scenario of a safety control system with elementary safety logic, Fig. 6 represents a failover and recovery scheme for CRC errors, Fig. Figure 7 ac presents a schematic representation of an embodiment of the invention in various failure situations.

[0055] Fig.Figure 1 represents an exemplary and schematic representation of a safety control system according to the invention. The safety control system 1 includes a control unit 3, which incorporates safety control logic. The control unit 3 receives input from a process via a process sensor arrangement 4. The process can be any technical process, for example, a manufacturing cell, a robot or a robotic system with multiple robots, an autonomous guided vehicle (AGV), a chemical processing plant or a subsystem of a chemical processing plant, or the like. The term "process" is thus also used here in the context of this invention to describe a machine.

[0056] The process or machine has certain safety-critical zones that are detected by the safety sensor arrangement 4. This will be discussed below in the context of the Fig. 2, Fig. 3, Fig. 4 and Fig. 7a-c explained in more detail.

[0057] The control unit 3 receives signals containing information from the safety sensor array 4 and evaluates the received input. For this purpose, the control unit 3 includes at least one input / output unit (I / O unit). The safety control logic initiates the evaluation of the information received at the input and the generation of corresponding output signals containing the respective output information for the process or machine, here in Fig.Figure 1 is schematically represented as machine arrangement 5. The machine arrangement 5, or the machine, or the process, can be operated in different operating modes. If the machine arrangement is, for example, an AGV, the different operating modes can be different speeds, from zero or stop, slow speed, somewhat faster speed, to normal speed. The same applies if the machine arrangement is a robot with at least one robot arm. Here, the different operating modes can also be the movement speed of the robot arm(s), or even the area covered by the robot arm(s), from standstill to just a small segment, a larger segment, to the entire operating zone. Each operating mode is associated with a specific productivity of the machine, machine arrangement, or process.For example, if the robot is stationary, productivity is zero. If it moves slowly, productivity is low. If it moves at normal speed, productivity is normal.

[0058] The examples given above involving robots or AGVs are merely illustrative. It is understood that for all types of processes, including, but not limited to, manufacturing processes with various other types of machines or chemical production processes, different operating modes with assigned productivities can be defined in an equivalent manner.

[0059] In Fig. Figure 1 illustrates the above in an abstract way as a machine arrangement 5, the operating modes are schematically represented as functional blocks or subsystems F0 with reference number 11, F NF1 is specified with reference number 12, F1 with reference number 13, and F2 with reference number 14. Each functional block or subsystem is assigned a specific productivity. Functional block or subsystem F0 is characterized by a productivity P0, and functional block or subsystem F N is through a productivity P N The functional block or subsystem F1 is characterized by a productivity P1, and the functional block or subsystem F2 is characterized by a productivity P2. The productivity P N This is normal productivity. Productivity P0 is zero productivity, equivalent to a system shutdown. Productivity P1 is lower than normal productivity P. N , but greater than zero.

[0060] Productivity P2 is greater than P1, but less than normal productivity P. N .

[0061] The safety sensor arrangement 4 has two functionally redundant subsystems 6 and 7. There could even be more than two. The function of the safety sensor arrangement 4 is to monitor safety zones within the process or in the vicinity of a machine or machine arrangement 5. Monitoring means that the safety sensor arrangement 4, with its functionally redundant subsystems 6 and 7, detects potentially hazardous events H1 and H2 in the safety zones. A hazardous event could be, for example, an obstacle in the path of an AGV or a person within the operating zone of a robot or robotic system within reach of the robot arm(s). Functionally redundant means that both subsystems 6 and 7 can be used redundantly for safety monitoring or the detection of such hazardous events.This could mean, for example, that there are two safety zones around machine 5: a critical and a less critical one. The critical safety zone is characterized, for example, by the fact that there is a high potential danger to the machine if an obstacle is located within this zone, or a high potential safety risk to a person who might be located within this zone.

[0062] Accordingly, functionally redundant subsystems can, for example, consist of two subsystems, each monitoring different security zones. This can be achieved using a single sensor with two or more monitoring modes for different zones, or by using two separate sensors, one for the first zone and one for the other.

[0063] Each of the functionally redundant subsystems 6, 7 transmits information regarding the presence or absence of a hazardous event within its monitoring area to the control unit 3 using first signal input lines 15, 16. In addition, each of the functionally redundant subsystems 6, 7 transmits information regarding its availability to the control unit 3 using availability-indicating input lines 8, 8'. The availability of a functionally redundant subsystem of the sensor arrangement 4 may be limited or incomplete either due to a malfunction of the subsystem 6, 7 itself or due to disrupted communication between the subsystem 6, 7 and the control unit 3.

[0064] The unavailability of a safety sensor subsystem is a potential safety risk. Therefore, in conventional safety control systems, the relevant functional block or subsystem in the machine assembly is put into emergency stop mode, i.e., zero productivity, as soon as a safety sensor assembly or subsystem becomes unavailable. In a significant number of cases, this would be unnecessary, as the availability of the respective safety sensor or subsystem is automatically restored after a short time.

[0065] Therefore, the control logic 3 in the safety control system 1 according to the invention, as shown in Fig. 1 shown, to activate a normal operating mode F N , which is characterized by normal productivity P NThe system is configured to activate a fail-stop operating mode F0, characterized by zero productivity P0, if the input indicates the unavailability of all functionally redundant subsystems 6 and 7. Furthermore, it is configured to activate a fail-operate operating mode F1, F2 with lower-than-normal but above-zero productivity if the input indicates temporary unavailability of at least one and availability of at least one other of the functionally redundant subsystems 6 and 7. Thus, the fail-stop mode with zero productivity is only activated if all subsystems are unavailable.In the event of a temporary unavailability of one of the subsystems, as long as at least one of the redundant subsystems is available, the machine arrangement is placed in a state with only reduced productivity, not zero productivity, which greatly increases the overall availability of the safety-controlled machine arrangement 5.

[0066] Now Fig. 2, this represents an exemplary and schematic representation of a further embodiment of a safety control system 1' according to the invention. Fig.Figure 2 schematically represents a safety control system 1' for controlling a machine 2. The machine 2 can be a robot, an AGV, or any other machine used in a discrete manufacturing system or manufacturing cell. A first, critical safety zone Z1 and a second, less critical safety zone Z2 are defined with respect to machine 2. The first safety zone Z1 is located closer to machine 2 than the second safety zone Z2. The first, critical safety zone Z1 is a subset of the second, less critical safety zone Z2.

[0067] The safety control system 1 further comprises a control unit 3, which includes safety logic and is communicatively linked to the machine 2. Furthermore, a first safety device D1, reference number 6, is present, which is communicatively linked to the safety logic 3. It has a first hazard detection device configured to detect a hazard event H1 in the first safety zone Z1. Furthermore, a second safety device D2, reference number 7, is present, which is communicatively linked to the safety logic 3. It has a second hazard detection device configured to detect a hazard event H2 in the second safety zone Z2. The safety devices 6 and 7 with the hazard detection devices can be any type of sensor known to be used for this purpose, for example, proximity sensors, a light barrier, a laser scanner, or the like.The safety devices 6, 7 are examples of what the more general and abstract expression “functionally redundant sensor subsystems 6, 7 of a safety sensor arrangement 4” refers to. Here in . Fig. 2 The first and second hazard detection means 6, 7 together form a type of virtual safety sensor arrangement 4.

[0068] Machine 2 further includes a first actuator system with a first safety function device configured to be triggered in order to execute a first safety function through the safety logic 3.

[0069] Machine 2 also includes a second actuator system with a second safety function device configured to be triggered in order to execute a second safety function through safety logic 3.

[0070] The first and second actuator systems could, for example, be the drives for the robot axes or the drives for the AGV, or similar devices. The safety functions in this example would then be, for example, different drive speeds, and the emergency function would be stopping the drives.

[0071] The control unit 3 further comprises an input evaluation means 10, which is configured to determine the functional status and / or availability of the first and second safety devices 6, 7. The control unit 3 further comprises an activation means 9, which is configured to trigger or activate the first actuator system to execute the first safety function upon detection of a hazardous event in the first safety zone Z1, and to trigger or activate the second actuator system to execute the second safety function upon detection of a hazardous event in the second safety zone Z2, if the first and second safety devices 6, 7 are functioning and available.The input evaluation device 10 and the activation device 9 can, for example, be implemented as I / O devices and associated program routines as part of a control operating program, which is stored in memory in a microcomputer as part of the control unit 3 and its control logic and is executed by it.

[0072] The activation device 9 is configured to trigger or activate the first actuator system to perform the first safety function F1 upon determining a malfunction and / or unavailability of the first safety device 6 and the functioning and availability of the second safety device 7 and upon detecting a hazardous event in the second safety zone Z2.

[0073] The activation device 9 is further configured to trigger or activate the second actuator system to execute the second safety function F2 if the input evaluation device 10 determines a malfunction and / or unavailability of the second safety device 7 and determines the functioning and availability of the first safety device 6, as long as the first safety device or the hazard detection device 6 does not detect a hazard in the first safety zone Z1.

[0074] The activation device 9 is further configured to trigger or activate the second actuator system to execute the second safety function F2 if the input evaluation device 10 determines a malfunction and / or unavailability of the second safety device 7 and the functioning and availability of the first safety device 6 if the first hazard detection device or the first safety device 6 detects a hazard in the first safety zone Z1.

[0075] The activation device 9 is further configured to logically trigger the machine 2 for a transition to a safe state, i.e., for example, an emergency stop, if the input evaluation device 10 detects a malfunction and / or unavailability of the first and second safety devices 6, 7.

[0076] The following explains the concept of a hierarchical safety control system as applied in the safety control system according to the invention.

[0077] A typical hazardous event occurs when a person enters a defined zone where an operating machine could seriously injure them. Conventionally, the machine is stopped if such an event is detected. However, the severity of such a hazard can vary, so sometimes the machine can run at a reduced speed instead of being stopped, thus significantly improving the machine's overall productivity.

[0078] For example, see Fig. 2 or Fig.3, a first, critical safety zone Z1 can be defined around a machine 2 or a machine arrangement 5, for example an industrial robot, where the violation of this zone leads to the immediate stopping of the robot, but if the person is nearby outside this zone Z1, the robot can run at a reduced speed so that the robot is able to stop when the person enters zone Z1.

[0079] Another example could be an AGV, see Fig. 4, which could run at reduced speed if obstacles or a human worker are located within a certain but larger area Z2, and stops when the distance becomes critical, like zone Z1 in the example above, as in Fig. 4 shown.

[0080] More generally, the safety response can also depend on more accurately determining the position, size, and speed of people or obstacles. And the safety response can also stop specific parts of a production line, while parts of the line run at variable speeds, and so on.

[0081] All of these lead to a hierarchical safety control scheme, which is advantageous in terms of improved productivity while ensuring the same level of safety.

[0082] In a simplified and generalized way, the following scenario is assumed: D1 := Safety device 1 H1 := Localized hazard event to be detected by D1 F1 := (Safety) Function 1 (e.g., safe stop) P1 := Productivity when working with F1 D2 := Safety device 2 H2 := Less localized hazard event to be detected by D2 F2 := (Safety) Function 2 (e.g. reduced speed) P2 := Productivity when working with F2 with 100%=PN>P2>P1≥P0=0 and H1 is a subset of H2, which means that H1 is the same type as H2 and is covered by H2, but is more localized and detailed.

[0083] In the robot example, Fig. 3 or Fig. 2. In the AGV example, D1 would be a local sensor protecting the robot's workspace, and D2 would be a sensor monitoring the surroundings. Similarly, in the AGV example, D1 could be a local sensor (e.g., a laser scanner) capturing the area in front, and D2 could be a remote camera monitoring the work cell.

[0084] The safety control logic would be as follows: If H1 then F1 / / Productivity P1 Else If H2 then F2 / / Productivity P2 End If

[0085] Fig. Figure 5 illustrates this generalized scenario with corresponding elementary safety logic, where any detected or implied safety device failures lead to an emergency stop. The corresponding safety control implementation can follow the rules below: D1 status s H1 detected D2 status H2 detected F x P x remark OK incorrect OK incorrect - P N No security action OK incorrect OK true F2 P2 e.g. reduced speed OK true OK true F1 P1 e.g. lower speed or stop OK true OK incorrect F E P0 Emergency stop, not consistent with "H1 is a subset of H2" NOK any OK any F E P0 Emergency stop OK any NOK any F E P0 Emergency stop NOK any NOK any F E P0 Emergency stop NOK means either a malfunction or unavailability of the safety device for any reason, including a temporary communication error.

[0086] The following explains the concept of a failover as it is used in the safety control system according to the invention.

[0087] Generally speaking, failover refers to switching to a redundant facility or function when a dedicated facility or function fails.

[0088] As described above, if H1 cannot be detected due to a malfunction of D1 or other reasons, e.g. a communication error, the emergency stop F would be activated. e cause the machine to run at P0.

[0089] After F e The system must undergo fault diagnosis and recovery, and then restart. The average time for this process would be T e be.

[0090] However, in the event of a temporary unavailability of the facility, that is, if the function of the facility is restored after an acceptable period without having to manually repair and restart the system, an attempt can be made to bridge this period by using redundant facilities or functions.

[0091] Assume that H1 is indirectly covered by H2, thus H1 is a subset of H2. It is then possible to modify the logic using D2 as a failover mechanism for D1, as follows: If (D1 is OK) then If H1 then F1 / / Productivity P1 Else If H2 then F2 / / Productivity P2 End If Else If H2 then F1 / / Productivity P1 End If

[0092] In this case, the machine would run at 100% if no safety zone violation is detected. Therefore, if D1 fails, the safety control remains intact by switching from (H2 implies F2) to (H2 implies F1) and runs at 100% if no safety zone violation occurs, or at least at P1 if H2 fails. Productivity is lower than if D1 were functioning, but higher compared to constantly stopping the machine if D1 fails.

[0093] If D2 is unavailable, at least temporarily, the situation is slightly different. H2 is only partially covered by H1, and D1 cannot be used as a failover mechanism to detect H2. However, we can use F2 as a failover function for when D2 is NOK in conjunction with H1, thus activating F2 as soon as D2 is NOK and activating F1 when H1 is detected by D1. Since H1 is a subset of H2, H2 is adequately considered with this failover strategy.

[0094] The resulting security control implementation follows the following rules: D1 status s H1 detected D2 status H2 detected F x P x remark OK incorrect OK incorrect - P N No security action OK incorrect OK true F2 P2 e.g. reduced speed OK true OK true F1 P1 e.g. lower speed or stop OK true OK incorrect F E P0 Not matching H1 is a subset of H2 NOK any OK incorrect - P n -Failover to (D2, H2→F1) NOK any OK true F1 P1 Failover to (D2, H2→F1) OK incorrect NOK eternal F2 P2 Failover to (D2 NOK)→F2 OK true NOK any F1 P1 H2 considered with H1 is a subset of H2 NOK any NOK any F E P0 Emergency stop

[0095] The following is an example scenario where the failure situation is a CRC error (cyclic redundancy check error).

[0096] In the example scenario, it is assumed that the safety device D1 is remotely connected via PROFINET (using the PROFIsafe protocol) and that temporary communication errors such as CRC or watchdog errors can occur, which in current practice lead to an emergency shutdown of the system. The following describes how the failover concept can be applied in such scenarios.

[0097] In fact, a failover is only a temporary solution to keep the machine running until a recovery from the partial failure can be performed. Typically, if a safety device fails, manual intervention is required to recover from the failure, such as replacing the device and restarting the safety controller. However, in some cases, the failure is only temporary.

[0098] This scenario examines CRC errors in more detail, which are typical examples of temporary communication failures with the safety device. CRC errors can be detected by the safety controller. According to the prior art prior to the present invention, an occasional single CRC error would cause an emergency stop if no additional measure is implemented to cover this situation in the safety protocol implementation.

[0099] However, in most cases, CRC errors disappear after a short period, and stable communication with the system is restored. In such a situation, if the failover concept described above is applied, the system does not need to be stopped by a single CRC error because a redundant safety mechanism is in place. It can automatically recover by switching back to normal safety functions when the next telegram becomes valid. Fig. 6.

[0100] Multiple CRC errors within a defined time interval are interpreted as a serious failure, in which case the machine must be stopped; see also Fig. 6. The commonly used time interval for detecting a CRC error accumulation is currently 100 hours.

[0101] A CRC error can be detected by verifying the checksum. Therefore, the safety controller registers the communication failure and interprets it as a malfunction of the corresponding safety device if CRC errors occur repeatedly.

[0102] In the event of a failure of the security device itself, automatic recovery is unfortunately not possible. The security controller must be restarted.

[0103] The following is an example scenario where the failure situation is a watchdog error.

[0104] Another typical example of a temporary communication error is a watchdog timer. Depending on the parameters used, these errors can occur every minute or even more frequently. The watchdog time defines the trade-off between safety function response time and availability. The shorter the watchdog time is set, which is closer to the black channel performance, the higher the probability that the machine will have to be stopped due to a sudden black channel performance failure.

[0105] With the current state of the art, as practiced before the invention was developed, there is no limit to the frequency with which a watchdog error can occur. However, each time, the process would stop, similar to a CRC error, if no action is taken to address it at the application level.

[0106] A failover concept for the watchdog error according to the present invention is particularly advantageous for automated guided vehicles (AGVs) in automated warehouse management systems. Such AGVs are very often connected via wireless networks and controlled by a central system.

[0107] In the event that the wireless connection suddenly becomes too slow due to interference or a blocking wall impeding data transfer, etc., the AGV control system loses communication with the central unit and displays a watchdog error because the wireless connection is too slow. Instead of stopping the AGV, a timer could be started in the event of a watchdog error. If communication is not restored within, for example, 3 seconds, the AGV is stopped. Otherwise, it uses local safety sensors, such as a laser scanner, as failover devices.

[0108] In this scenario, the local sensor D1, equivalent to the first safety device 6, detects the presence of obstacles or people at the immediate front of the vehicle and triggers a controlled stop. Furthermore, D2, equivalent to the second safety device 7, monitors the wider area and is wirelessly connected to the local AGV controller. If D2 is temporarily unavailable, the local AGV can switch to a reduced speed and rely on the local sensor for an acceptable period.

[0109] Naturally, the specific implementation of a safety control system with failover of facilities or functions must take into account all aspects that have an impact on the achievable safety rating.

[0110] Fig.Figures 7a - c represent a schematic representation of an embodiment of the invention in various failure situations as an example of a preferred embodiment of the control system according to the present invention.

[0111] Fig. Figure 7a presents a schematic and exemplary safety control system 1, which corresponds to the one described in Fig. The one shown resembles the one depicted. Fig. Figures 7a - c illustrate the method for operating a safety control system according to the invention. Fig. 7a represents the situation in which both safety sensor subsystems 6, 7 are available and functioning.

[0112] If the first safety sensor subsystem 6, D1, detects a hazardous situation, H1, in zone Z1, the more safety-critical zone, then the safety logic in the control unit 3 activates the machine arrangement 5, the respective actuator, into the first operating mode F1 with greatly reduced productivity P1, where F1 and P1 are defined and explained as above.

[0113] If the second safety sensor subsystem 7, D2, detects a hazardous situation, H2, in zone Z2, which incidentally includes Z1, since Z1 is a subunit of Z2, which is a less safety-critical zone, then the safety logic in the control unit 3 activates the machine arrangement 5, the respective actuator, in the second operating mode F2 with less severely reduced productivity P2, where F2 and P1 are defined and explained as above.

[0114] Fig.Figure 7b represents the situation where safety sensor subsystem 6 is unavailable, symbolized by the dashed lines, but safety sensor subsystem 7 is available. In this scenario, a failover from D1 to D2 is applied, with a failover from F2 to F1. This means that if the second safety sensor subsystem 7, D2, detects a hazardous event, the safety logic in the control unit 3 activates the machine arrangement 5, the respective actuator, in the first operating mode F1 with significantly reduced productivity P1. This is a failover in the sense that the more restrictive safety function F1 is applied for safety reasons in a hazardous situation detected by subsystem D2, which monitors the less critical safety zone Z2.

[0115] However, since Z2 contains Z1, it is possible that the hazardous situation detected by D2 occurred in safety zone Z1. Therefore, from a safety control perspective, it makes sense to activate the more restrictive safety function F1. Consequently, the combined subsystem 1.2 - 2, 3.1, or 7 - F1 is provided as a failover.

[0116] Fig.Figure 7c represents the situation where safety sensor subsystem 7, D2, is unavailable, symbolized by the dashed lines, but safety sensor subsystem 6, D1, is available. In the event of D2's unavailability, there is no explicit failover of the setup function. Instead, the safety function for H2 is assumed to be a general failover function; that is, F2 is triggered if D2 is NOK. In other words, if D2 is NOK, then F2 is triggered as a safety precaution, reducing speed and productivity from P0 to P2, even if D1 does not detect a hazardous situation. If D1 then additionally detects a hazardous situation in zone Z1, F1 is triggered, further reducing speed and productivity to P1. List of reference figures 1 Safety control system 1' Safety control system 3 Control unit, 4 Safety sensor arrangement 5 Machine arrangement 6 first safety sensor subsystem D1 7 second safety sensor subsystem D2 8 pieces of information that indicate the availability of the subsystem 8' Information indicating the availability of the subsystem 9 Activating Agents 10 Input evaluation tools 11 Functional block / Functional subsystem 12 Functional block / Functional subsystem 13 Functional block / Functional subsystem 14 Functional block / Functional subsystem 15 first signal input line 16 second signal input line Z1 first, critical safety zone Z2 second, less critical safety zone

Claims

[1] Safety control system (1) wherein the system includes: a) a control unit (3) which includes safety control logic, b) at least one safety sensor arrangement (4), c) at least one machine arrangement (5) which can operate in different modes (F0, F N , F1, F2) can be operated, with each operating mode having a different productivity (P0, P N , P1, P2) of the machine arrangement (5) is characterized, wherein d) the control unit (3) receives and evaluates an input from the at least one safety sensor arrangement (4) and e) in response to the result of the evaluation, an operating mode (F0, F N , F1, F2) of the machine arrangement (5), as determined by the safety control logic (3), is activated, - a machine (2) or machine arrangement (5) which has a nominal productivity (P N ) shows, - a first security zone (Z1) and a second security zone (Z2), where the first security zone (Z1) is a subset of the second security zone (Z2), - a first functionally redundant subsystem (D1, 6) configured to detect a first hazard event (H1) in the first safety zone (Z1), - a second functionally redundant subsystem (D2, 7) configured to detect a second hazard event (H2) in the second safety zone (Z2), characterized by , that (1) comprising at least one safety sensor arrangement (4) comprising at least two functionally redundant subsystems (6, 7), (2) the input to the control unit (3) includes information (8) that specifies the availability of the at least two functionally redundant subsystems (6, 7), (3) the control unit (3) is configured to: i. Activating a normal operating mode (FN ), which is characterized by normal productivity (P N ) is characterized if the input specifies the availability of all functionally redundant subsystems (6, 7), ii. Activating a fail-stop operating mode (F0) characterized by zero productivity (P0) if the input (8) indicates the unavailability of all functionally redundant subsystems (6, 7), iii. Activating a fail-safe operating mode (F1, F2) with a productivity that is lower than normal but above zero, if the input (8) indicates at least a temporary unavailability of at least one and an availability of at least one other of the functionally redundant subsystems (6, 7), where an initial failure-functioning mode (F1) leads to an initial reduced machine productivity (P1) that is greater than zero but less than the normal productivity (P N) is, and a second fail-function mode (F2) leads to a second reduced machine productivity (P2) that is greater than zero but less than the nominal productivity (P N ) and is higher than the first reduced machine productivity (P1), wherein the control unit activates the second fail-to-operate mode (F2) if the input to the control unit indicates availability of both functionally redundant subsystems (D1, 6; D2, 7) and a second hazard event (H2) in the second safety zone (Z2) but no first hazard event in the first safety zone (Z1), and wherein the control unit activates the first fail-to-operate mode (F1) if the input to the control unit indicates temporary unavailability of the first functionally redundant subsystem (D1, 6) but availability of the second functionally redundant subsystem (D2, 7) and a second hazard event (H2) in the second safety zone (Z2). [2] Safety control system (1) according to claim 1, wherein the control unit activates the second fail-function mode (F2) if the input to the control unit indicates an availability of the first functionally redundant subsystem (D1, 6) and an at least temporary unavailability of the second redundant subsystem (D2, 7) and no first hazard event (H1) in the first safety zone (Z1). [3] Safety control system (1) according to claim 1, wherein the control unit activates the first fail-function mode (F1) if the input to the control unit indicates at least a temporary unavailability of the second redundant subsystem (D2, 7) and a first hazard event (H1) in the first safety zone (Z1). [4] Safety control system (1) according to claim 1, wherein the control unit detects the first failure -Operating mode (F1) is activated if the input to the control unit indicates the availability of both the first and second redundant subsystems (D1, 6; D2, 7) and a first and second hazard event (H1, H2) in both the first and second safety zones (Z1, Z2). [5] Safety control system (1) according to claim 1, wherein the control unit selects the normal operating mode (F N ) activated if the input to the control unit indicates availability of the second redundant subsystem (D2, 7) and temporary unavailability of the first redundant subsystem (D1, 6) and no first hazard event in the second safety zone (Z2). [6] Safety control system (1) according to any of the preceding claims, wherein the machine (2) or the machine arrangement (5) is a robot or an autonomous guided vehicle or a discrete manufacturing system or a manufacturing cell. [7] Safety control system (1) according to any of the preceding claims, wherein the productivity of the machine (2) or the machine arrangement (5) is the speed of moving parts of the machine (2) or the machine arrangement (5). [8] Safety control system (1) according to any of the preceding claims, wherein the first or the second redundant subsystem (D1, 6; D2, 7) is a proximity sensor or a light barrier or a laser scanner or a camera. [9] Safety control system (1) according to any of the preceding claims, wherein the temporary unavailability of a functionally redundant subsystem is caused by a temporary communication error such as a cyclic redundancy error (CRC error) or a watchdog error. [10] Method for operating a safety control system (1) wherein the system includes: - a control unit (3) that includes safety control logic, - at least one safety sensor arrangement (4), - at least one machine arrangement (5) that operates in different operating modes (F0, F N , F1, F2) can be operated, with each operating mode having a different productivity (P0, P N , P1, P2) of the machine arrangement (5) is characterized, wherein - the control unit (3) receives and evaluates an input from at least one safety sensor arrangement (4) and - in response to the result of the evaluation, an operating mode (F0, F N , F1, F2) of the machine arrangement (5), as determined by the safety control logic (3), is activated, - which has at least one safety sensor arrangement (4) and at least two functionally redundant subsystems (6, 7), - the input to the control unit (3) includes information (8) that specifies the availability of at least two functionally redundant subsystems (6, 7), - a machine (2) or machine arrangement (5) which has a nominal productivity (P N ) shows, - a first security zone (Z1) and a second security zone (Z2), where the first security zone (Z1) is a subset of the second security zone (Z2), - a first functionally redundant subsystem (D1, 6) configured to detect a first hazard event (H1) in the first safety zone (Z1), - a second functionally redundant subsystem (D2, 7) configured to detect a second hazardous event (H2) in the second safety zone (Z2), characterized by the following steps: - Activation of a normal operating mode (F N ), which is characterized by normal productivity (P N ) is characterized if the input specifies the availability of all functionally redundant subsystems (6, 7), - Activation of a fail-stop operating mode (F0) characterized by zero productivity (P0) if the input (8) indicates the unavailability of all functionally redundant subsystems (6, 7), - Activation of a fail-safe operating mode (F1, F2) with a productivity that is lower than normal but above zero, if the input (8) indicates at least a temporary unavailability of at least one and an availability of at least one other of the functionally redundant subsystems (6, 7), where an initial failure-functioning mode (F1) leads to an initial reduced machine productivity (P1) that is greater than zero but less than the normal productivity (P N ) is, and a second fail-function mode (F2) leads to a second reduced machine productivity (P2) that is greater than zero but less than the nominal productivity (P N) and is higher than the first reduced machine productivity (P1), wherein the control unit activates the second fail-to-operate mode (F2) if the input to the control unit indicates availability of both functionally redundant subsystems (D1, 6; D2, 7) and a second hazard event (H2) in the second safety zone (Z2) but no first hazard event in the first safety zone (Z1), and wherein the control unit activates the first fail-to-operate mode (F1) if the input to the control unit indicates temporary unavailability of the first functionally redundant subsystem (D1, 6) but availability of the second functionally redundant subsystem (D2, 7) and a second hazard event (H2) in the second safety zone (Z2).

Images