Apparatus and method for performing security functions

Abstract

The present disclosure relates to a device (10) and a method for performing a safety function, in particular for monitoring a safety area of a technical installation. The device (10) comprises an imaging unit (12) for detecting an event triggering a safety function within a defined work area (24), a controller (14) for performing a safety-related reaction based on the triggering event, and a testing unit (16) for checking the operability of the imaging unit (12), the testing unit (16) comprising a processing unit (18) and a projection unit (20). The projection unit (20) is configured to project a pattern (28) having defined properties into the work area (24), and the processing unit (18) is arranged to evaluate image data acquired by the imaging unit (12), to detect the projected pattern (28), and to extract specific properties of the detected projected pattern. Furthermore, the processing unit (18) compares the specific properties of the detected projected pattern with the defined properties.

Description

TECHNICAL FIELD

[0001] The present invention relates to a device and a method for executing a safety function, in particular for monitoring a safety area of a technical installation. BACKGROUND

[0002] In the sense of the present disclosure, a safety function is a safety-relevant control function of a machine that reduces risks caused by the machine to an acceptable level. For Europe, the term safety function is defined, for example, in the standards DIN EN ISO 13849-1 and DIN EN ISO 12100.

[0003] A device that executes a safety function operates according to the input processes output principle as is common in automation technology, wherein, in addition to the normal control activities, error safety must be ensured in all processing steps. The input includes the acquisition of states within a defined work area by suitable sensors. The processing includes the linking of the detected states, the evaluation of whether the detected states include an event that triggers the safety function, and the actuation of a safety-relevant reaction if such an event has been detected. The output includes the control of the control elements of the installation or process to be monitored and the execution of the safety-relevant reaction to transfer the installation or process to a safe state upon detection of an event that triggers the safety function.

[0004] The use of imaging sensors as sensors for the input has become the focus. These allow the greatest possible flexibility and adaptability. Imaging sensors can be used in different scenarios, thus covering a wide range of applications. However, when using imaging sensors makes them sufficiently fail-safe so that they are suitable as inputs for safety functions, there are problems. It has been shown that although many standard camera systems (2D and 3D) are generally suitable for industrial use as imaging sensors, they are not sufficiently fail-safe themselves for safety-critical applications. From today's perspective, the implementation of a safety camera system that meets the requirements of the relevant safety standards is difficult and complex. DE 10 245 720 A1 discloses an example of a safety camera system. SUMMARY

[0005] It is therefore an object of the present invention to specify a device that enables the use of imaging sensors to execute a safety function in a simpler and less complex manner. In particular, it is an object to specify a device for which a safety function can be executed using standard components.

[0006] According to one aspect of the present application, the object is solved by a device for performing a safety function, in particular for monitoring a safety area of a technical installation, comprising an imaging unit for detecting an event triggering the safety function within a defined working area, a controller for performing a safety-related reaction based on the triggering event, and a test unit for verifying the operability of the imaging unit, the test unit comprising a processing unit and a projection unit. The projection unit is configured to project a pattern having defined properties into the working area, and the processing unit is configured to evaluate image data acquired by the imaging unit, to detect the projected pattern, and to extract specific properties of the detected projected pattern. The processing unit is further configured to compare the specific properties of the detected projected pattern with the defined properties.

[0007] According to another aspect of the present application, the object is solved by a method for performing a safety function, in particular for monitoring a safety area of a technical installation. The method comprises:

[0008] providing an imaging unit for acquiring an event triggering the safety function within a defined working area,

[0009] providing a controller for performing a safety-related reaction based on the triggering event, and

[0010] providing a test unit comprising a processing unit and a projection unit for verifying the operability of the imaging unit,

[0011] wherein the projection unit projects a pattern having defined properties into the working area, wherein the processing unit evaluates image data acquired by the imaging unit, detects the projected pattern, and extracts specific properties of the detected projected pattern, and wherein the processing unit and / or the controller compares the specific properties of the detected projected pattern with the defined properties.

[0012] According to one aspect of the present application, the object is solved by a device for performing a safety function, in particular for monitoring a safety area of a technical installation, comprising an imaging unit for detecting an event triggering the safety function within a defined working area, a controller for performing a safety-related reaction based on the triggering event, and a test unit for verifying the operability of the imaging unit, the test unit comprising a processing unit and a projection unit. The projection unit is configured to project a pattern having defined properties into the working area, and the processing unit is configured to evaluate image data acquired by the imaging unit, to detect the projected pattern, and to extract specific properties of the detected projected pattern. The processing unit is further configured to compare the specific properties of the detected projected pattern with the defined properties.

[0013] Furthermore, the imaging units do not have to perform runtime tests (RAM tests, ROM tests, shutdown tests, etc.) that are common for safety sensors. Instead, the operability of the one or more imaging units is verified (checked) by a separate test unit. Thus, a device can be provided that can guarantee sufficient safety overall, even though not every individual component is fail-safe in itself. This has the advantage that only those components that must be fail-safe are fail-safe, while standard components that are not fail-safe in themselves can also be used for other components. Thus, a cost-effective and at the same time fail-safe system can be provided that is suitable for performing safety functions using imaging sensors as input and thus allows a flexible design. In this way, functional safety can be implemented particularly efficiently, flexibly and cost-effectively.

[0014] In a further development, the controller is configured to perform a safety-related reaction based on a comparison of the specific characteristic with the defined characteristic.

[0015] According to this development, the controller thus triggers a safety-related reaction not only when an event has been detected that triggers a safety function, but also when a pattern recognition failure occurs, since it is assumed that the imaging unit is not operating correctly. Thus, a high level of safety can be guaranteed even if the imaging unit and the coupling of the imaging unit and the controller in itself are not configured in a fail-safe manner. This development thus also contributes to a particularly simple implementation of the device.

[0016] In a further development, the controller is a safety controller with safety-related settings, wherein the safety controller is configured to ensure a fail-safe execution of the safety-related reaction.

[0017] According to this development, only the controller has to be configured as safety equipment. This development has the advantage that the imaging unit and the test unit do not have to be fail-safe in themselves, but the entire fail-safe evaluation is performed by the controller as a safety controller (FS controller). Thus, the safety-related settings can be concentrated in one device. Therefore, only this device has to meet the requirements of a fail-safe design and receives certification according to standards. Thus, safety applications can be implemented easily and cost-effectively.

[0018] In a further development, the test unit is at least partially integrated into the safety controller or is configured as a module for the safety controller, and at least the processing unit is equipped with safety-related settings to ensure that the processing unit is fail-safe.

[0019] Therefore, according to this improvement, the test unit is partially integrated into the security controller. For example, this can be implemented as software modules that execute on the security controller and use security-related settings within the security controller during execution. For example, such software modules can benefit from the redundant design of the security controller's processor to verify their own program flow. Thus, the test unit can be implemented at low cost because it can utilize already available components of the security controller.

[0020] In another improvement, the controller is configured to set the defined characteristics of the pattern.

[0021] According to this improvement, the controller can therefore specify a pattern and, in combination with this, define the desired image data provided by the imaging sensor. Therefore, security devices in which the basic components are concentrated within the controller can be implemented particularly easily.

[0022] In another improvement, the pattern is a dynamic pattern, wherein the defined characteristics change continuously over time.

[0023] By continuously changing the pattern, the correct operation of the imaging sensor can be easily and reliably determined. In particular, the interval of pattern changes can be selected in a way that ensures a sufficiently large overall system response time. Therefore, the device can be used for high security levels. The interval can be selected such that it is less than or equal to the response time required for security applications.

[0024] In another improvement, the defined characteristics vary systematically at least with an initial time interval.

[0025] In this context, "systematic" means that the pattern changes over time in a predetermined manner. This is advantageous because the expected value is also predefined through the predefined changes. This systematic approach also has the advantage of not only detecting certain errors but also identifying the source of those errors when necessary.

[0026] In another improvement, the defined characteristic varies randomly at least at a second time interval.

[0027] Random variations have the advantage of reliably detecting system errors. Therefore, it is advantageous to combine system variations with random variations in such a way that the maximum possible range of errors can be detected and their causes identified.

[0028] In another improvement, the defined characteristics include position information, and the projection unit is configured to project a pattern onto the working area based on the position information.

[0029] Location information can be easily converted into a pattern and verified by the processing unit. Location information can be, for example, spatial coordinates, or another location within the work area / space where the pattern will appear. This improvement also facilitates implementation.

[0030] In another improvement, the working area is divided into multiple defined segments, and the projection unit is configured to generate a pattern at least once in each defined segment within a defined time period.

[0031] Therefore, according to this improvement, the working area is divided into segments, in which a pattern is created at least once within a defined time period. Segmentation allows for flexible adjustment of the areas where the operability of the imaging unit must be checked. Thus, verification can be restricted to certain defined areas, which simplifies the verification process for the imaging unit and allows for adaptation to different scenarios.

[0032] In another improvement, the working area is a three-dimensional workspace, and the pattern has three-dimensional features that are defined by the imaging unit and change continuously over time.

[0033] According to this improvement, the device can also be used to monitor a three-dimensional workspace, where patterns with three-dimensional features are used to verify the operability of the imaging unit. For example, the three-dimensional features can be three-dimensional spatial coordinates. The advantage of monitoring a three-dimensional workspace is that the device can be flexibly adjusted according to different application scenarios.

[0034] In another improvement, the pattern is a dot pattern, and the projection unit can be a laser projector.

[0035] Dot patterns are easy to create, and their occurrence can be readily extracted from image data. Using a laser projector, the dot patterns can be easily projected onto defined points within the work area. Therefore, this improvement contributes to the highly cost-effective implementation of the device.

[0036] In another improvement, the imaging unit is a non-safety camera unit that cannot guarantee automatic (independent) fault-safe detection.

[0037] Using a non-safety camera unit has the following advantages: a standard camera can be used, which makes the device particularly cost-effective.

[0038] It goes without saying that, without departing from the scope of the invention, the features mentioned above and the features described below can be used not only in the combinations indicated in each case, but also in other combinations or individually. Attached Figure Description

[0039] Examples of the invention are shown in the accompanying drawings, and the following description provides a more detailed account of these examples.

[0040] Figure 1 A schematic representation of a device for performing security functions according to an exemplary embodiment of the present invention is shown.

[0041] Figure 2 A schematic representation of monitoring of a defined work area by a device according to an exemplary embodiment of the present invention is shown, and

[0042] Figure 3 A flowchart of a method for performing security functions according to an exemplary embodiment of the present invention is shown. Detailed Implementation

[0043] Figure 1 A schematic representation of a device for performing security functions according to an exemplary embodiment of the present invention is shown.

[0044] The device is indicated by reference numeral 10 in the accompanying drawings, and includes an imaging unit 12, a controller 14, and a testing unit 16. The testing unit includes a processing unit 18 and a projection unit 20.

[0045] Imaging unit 12 is configured to monitor the security area of ​​a surveillance facility. Specifically, imaging unit 12 may be a video camera capable of capturing and, if necessary, storing moving images of a defined work area. Imaging unit 12 may be a single camera or a network of cameras (camera network). In a camera network, recordings from multiple cameras can be combined to generate image data.

[0046] The image data provided by the imaging unit 12 may include information in addition to two-dimensional information. In particular, the image data may include information from which three-dimensional information of the working area can be derived. The three-dimensional information may be provided directly by certain types of cameras (e.g., time-of-flight cameras) or determined from different images through appropriate image processing.

[0047] Specifically, the imaging unit 12 may be a standard camera. In this context, the term "standard camera" refers to a camera that has no safety-related settings other than recording equipment. Safety-related settings refer to equipment used to perform or monitor safety-related actions without errors and to reliably perform defined actions in the event of errors. In other words, in the sense of this invention, a standard camera is a camera whose data cannot be directly used to independently perform safety functions. Therefore, a standard camera cannot verify and guarantee its correct operation according to relevant safety standards.

[0048] Imaging unit 12 is connected to controller 14. Controller 14 can be any controller that can affect the technical facility in a defined manner. In particular, controller 14 can be a safety controller (FS controller) configured to perform control tasks in a fail-safe manner.

[0049] The safety controller is configured to implement safety functions according to standards DIN EN ISO 13849-1 and DIN EN ISO 12100. In this context, the term safety function is defined as a safety-related control function of a machine that reduces the risks generated by the machine to an acceptable level. The specific definition of the safety functions for a technical facility is influenced by an individual assessment of the technical facility to be monitored.

[0050] Safety controllers ensure the proper execution of safety functions during the operation of technical facilities. In cases where safety functions cannot be guaranteed, the safety controller transfers the technical facility to a safe state, specifically by shutting it down. Safety controllers can be implemented as simple switching devices, modular combinations of single switching devices, configurable controllers, or programmable logic controllers (PLCs). When referred to below as "controller," it means "safety controller" in the above sense.

[0051] Typically, a controller operates based on an input-processing-output principle. The controller receives input signals (inputs) via one or more sensors, evaluates (processes) those signals, and controls the technical facilities (outputs) via defined outputs. In particular, a safety controller has a safety output that allows the technical facilities to operate only when a corresponding input signal is present and a corresponding output signal is provided by the controller.

[0052] Needless to say, in this case, in addition to safety controllers and safety outputs, the sensor system must be designed in a way that ensures it transmits reliable values ​​only when it is operating correctly. This means that it must be ensured that the sensors only provide input signals when they and their communication interfaces with the controller are functioning correctly. In the case of imaging sensors, such a design is complex and expensive from today's perspective, which is why only a few truly safe camera systems on the market use safety sensor technology.

[0053] For the reasons mentioned above, the combination of a standard camera and a safety controller cannot guarantee sufficient security. Therefore, the device according to the invention has a test unit 16 in addition to the standard camera and controller, which verifies the operability of the standard camera. In other words, the test unit 16 is configured to ensure the correct operation of the imaging unit 12 according to relevant safety standards.

[0054] The test unit 16 includes a processing unit 18 and a projection unit 20. The processing unit 18 and the projection unit 20 can form a functional unit and can be implemented in various ways.

[0055] according to Figure 1 In the exemplary embodiment shown, the processing unit 18 is part of the controller 14. Specifically, the processing unit 18 may be a hardware and / or software module of the controller 14 or may be integrated into the controller 14. The processing unit 18 may particularly utilize the safety-related settings of the safety controller. Therefore, the test unit can be implemented cost-effectively because components of the already-in-place safety controller can be shared. Alternatively, the processing unit 18 may also be designed as a standalone unit, either independently or in combination with the projection unit 20, located in a separate housing spatially separated from the controller 14. Thus, for example, the test unit can be easily adapted from an existing system.

[0056] Regardless of its design, the processing unit 18 is configured to control the projection unit 20 and evaluate image data from the imaging unit 12. The projection unit 20 may be a device capable of projecting a pattern onto a specific location in the working area. The projection unit 20 may be a laser projector, a video projector, or a holographic projector.

[0057] Specifically, the projection unit 20 can project a pattern with defined characteristics that is detectable by the imaging unit 12 onto the working area. In this context, "detectable" means that the defined characteristics can be extracted from the recorded image data of the imaging unit 12 by the processing unit 18.

[0058] The pattern can be a dynamic pattern, wherein the defined characteristics change continuously over time. The defined characteristics can be determined by the pattern itself or by the projection type. For example, the defined characteristics can be the shape or intensity of the pattern. Alternatively or additionally, the defined characteristics can be determined by the position of the pattern projected onto the working area. Furthermore, the projected pattern can be projected into a spectrum invisible to humans, as long as the pattern can be detected by the imaging unit 12. Furthermore, according to another exemplary embodiment, the pattern can be displayed discontinuously, but rather periodically at defined intervals.

[0059] The processing unit 18 is configured to receive and process image data from the imaging unit 12. Specifically, the processing unit 18 can extract a projection pattern from the image data and determine specific characteristics of the projection pattern. If these extracted specific characteristics correspond to expectations, it can be determined that the imaging unit 12 is operating correctly. On the other hand, if the processing unit 18 cannot extract a projection pattern from the image data, or if the specific characteristics deviate from a certain expected defined characteristic, it can be determined that the imaging sensor is malfunctioning. In response, the controller can then transfer the facility to a safe state. Specifically, the safety controller can be configured to provide an output signal for safety output only when the processing unit 18 continuously issues signals indicating the operability of the imaging unit 12. In this way, safety functions according to relevant safety standards can be implemented using a standard camera.

[0060] Figure 2 An example of monitoring a defined work area using a device, as an exemplary embodiment of the invention, is shown. This work area may, for example, be a secure area of ​​a technical facility (not shown) where operation of the facility could pose a danger to personnel or objects. In such a scenario, safety functions could include shutting down the technical facility if intrusion into the work area is detected.

[0061] According to an exemplary embodiment, intrusion is detected by imaging unit 12. Once the controller detects a deviation between the image captured by imaging unit 12 and a defined reference image, controller 14 can transfer the facility to a safe state.

[0062] like Figure 2 As indicated, imaging unit 12 can capture the hazardous area as a two-dimensional image. The image from imaging unit 12 can then be compared pixel-by-pixel with a reference image. If a predetermined number of pixels deviate from the reference image, it can be determined that the situation in the work area has changed, for example, personnel have entered the work area. This change in state can be a trigger event that activates safety functions.

[0063] It goes without saying that this relatively simple comparison is only one way to evaluate the image data of imaging unit 12. Depending on the type and scope of the image data, more complex evaluations can be conceived to record and monitor defined states within the working area. In another example, imaging unit 12 can monitor three-dimensional space (indicated here by dashed lines) by recording and evaluating image data containing three-dimensional information.

[0064] Test unit 16 can be configured to verify the operability of imaging unit 12 independently of the type of condition monitoring.

[0065] According to an exemplary embodiment, the working area 24 is divided into multiple individual segments 26. To verify operability, the processing unit 18 instructs the projection unit 20 to project a pattern 28 onto a specific segment 26 in the working area 24. In this example, the pattern 28 is a dot pattern, which is projected, for example, into segment 26'.

[0066] While processing unit 18 instructs projection unit 20 to project the pattern, processing unit 18 receives and evaluates image data from imaging unit 12. Using appropriate image processing, processing unit 18 can extract pattern 28 from the image captured by imaging unit 12 and determine in which segment 26 of working area 24 pattern 28 is detected. If the segment 26 determined by processing unit 18 matches the segment to which projection unit 20 has been instructed to project pattern 28, it can be assumed that imaging unit 12 is operating correctly. If the position does not match or the pattern cannot be extracted from the image data, it can be concluded that there is a fault in imaging unit 12 or in the coupling between imaging unit 12 and controller 14.

[0067] Both the instruction to project the pattern into which segment 26 and the evaluation of whether the detected pattern is in that segment can be performed by the safety controller 14. In other words, the processing unit 18 can be fully integrated into the safety controller. Therefore, the imaging unit 12, processing unit 18, or projection unit 20 itself need not be fail-safe devices, as long as the instructions and evaluations are performed by fail-safe devices.

[0068] If one of these non-safe components fails to operate reliably, an error will be generated no later than the next processing cycle, whereby the safety controller instructs projection unit 20 to project the pattern into another segment because the projected pattern does not match the expectation. For example, if, despite being instructed to project pattern 28 into another segment 26, projection unit 20 continues to display the pattern in the current segment 26, the pattern detected by imaging unit 12 will not match the safety controller's expectation. Therefore, the safety controller will execute a safety response and reach a safe state. In this way, low-cost, fail-safe standard components can be used for both imaging unit 12 and projection unit 20 of test unit 16, particularly test unit 16, thereby allowing for cost-effective implementation of the system.

[0069] The projection of pattern 28 into working area 24 can be systematic or random, where different sets of errors can be detected through systematic projection rather than random projection. Therefore, it is conceivable to systematically project pattern 28 into working area 24 at a first interval and randomly project it into working area 24 at a second interval. Thus, a large number of possible errors can be reliably detected, and, where applicable, their causes can be clearly identified.

[0070] It goes without saying that the work area 24 is not limited to the two-dimensional work area shown here. It is also conceivable to cover a three-dimensional work space, where the defining characteristic of the projected pattern is a three-dimensional feature. For example, the three-dimensional feature could be three-dimensional spatial coordinates. Therefore, even complex work areas / spaces can be reliably and fault-safely monitored through standard components that interact with the safety controller.

[0071] Figure 3 A flowchart illustrates a method for performing security functions according to an exemplary embodiment of the present invention.

[0072] The method is generally indicated by reference numeral 100 in the accompanying drawings. The first step 101 includes providing an imaging unit, a controller, and a test unit having a projection unit and a processing unit.

[0073] In the second step 102, the projection unit projects a pattern with defined characteristics onto the working area.

[0074] Then (step 103), the processing unit evaluates the image data acquired by the imaging unit, detects the projected pattern 28, and extracts its specific characteristics.

[0075] Finally, in step 104, the processing unit compares the specific characteristics of the detected projection pattern with the defined characteristics, and if the specific characteristics of the detected pattern do not match the defined characteristics or if no pattern is detected at all, a safety-related reaction is triggered.

[0076] It goes without saying, such as Figure 3 As shown, this method only outlines the basic steps required to perform the relevant processes, namely verifying the operability of the imaging sensor. Additionally, it is conceivable to perform other steps to ensure the overall execution of safety functions. It is also evident that the steps of projection, detection, and comparison are performed continuously or repeatedly at defined intervals to ensure safety functions during the operation of the system to be monitored. Furthermore, it is conceivable to perform additional calibration steps once or periodically to align the imaging unit 12 and the test unit 16.

[0077] In general, the invention is not limited to the examples of implementations presented herein, but is defined by the appended claims.

Claims

1. A test unit (16) for verifying the operability of an imaging unit (12), said test unit (16) comprising: Processing unit (18); and Projection unit (20), The projection unit (20) is configured to project a pattern (28) with defined characteristics into the working area (24). The processing unit (18) is configured to evaluate the image data acquired by the imaging unit (12), detect the pattern projected in the image data, extract specific characteristics of the detected projection pattern, and compare the specific characteristics of the detected projection pattern with defined characteristics. The pattern (28) is a dynamic pattern, wherein the defined characteristic changes continuously over time, and wherein the defined characteristic changes systematically at least at a first time interval and randomly at least at a second time interval.

2. The test unit (16) according to claim 1, wherein, The processing unit (18) is configured to forward specific characteristics of the detected projection pattern to the controller (14).

3. The test unit according to claim 1, wherein, The defined characteristics include location information, and the projection unit (20) is configured to project the pattern (28) into the working area (24) according to the location information.

4. The test unit according to claim 1, wherein, The working area (24) is a three-dimensional working space, and the pattern (28) has three-dimensional features that can be detected by the imaging unit (12) as defining characteristics.

5. The test unit according to claim 4, wherein, The three-dimensional features change continuously over time.

6. The test unit according to claim 1, wherein, The pattern (28) is a dot pattern.

7. The test unit according to claim 6, wherein, The projection unit (20) is a laser projector.

8. The test unit according to claim 1, wherein, The imaging unit (12) is a non-safe camera unit that cannot ensure automatic fault safety detection.

9. A system (10) for performing security functions, the system (10) comprising: An imaging unit (12) is used to acquire events that trigger the safety function within a defined working area (24). Controller (14), which is used to perform safety-related responses based on triggering events, and The test unit (16) according to claim 1.

10. The system according to claim 9, wherein, The controller (14) is configured to additionally perform the safety-related response based on a comparison of the specific characteristic with the defined characteristic.

11. The system according to claim 9, wherein, The controller (14) is configured to set the defined characteristics of the pattern (28).

12. A method (100) for performing security functions, the method (100) comprising: - Provides an imaging unit (12) for detecting events that trigger the safety function within a defined working area (24); - Provides a controller (14) for performing safety-related responses based on trigger events; and - A test unit (16) including a processing unit (18) and a projection unit (20) is provided to verify the operability of the imaging unit (12). The projection unit (20) projects a pattern (28) with defined characteristics into the working area (24). The processing unit (18) evaluates the image data acquired by the imaging unit (12), detects the projected pattern, extracts specific characteristics of the detected projected pattern, and compares the specific characteristics of the detected projected pattern with defined characteristics. Wherein, the pattern (28) is a dynamic pattern, wherein the defined characteristics change continuously over time, and The defined characteristics vary systematically at least with a first time interval and randomly at least with a second time interval.

Images