Safety system and material testing system including a safety system

Abstract

An example material testing system includes: an actuator configured to control an operator-accessible component of the material testing system; an actuator disabling circuit configured to disable the actuator; and one or more processors configured to: control the actuator based on a material testing process; monitor multiple inputs associated with operation of the material testing system; determine a state of the material testing system from multiple predetermined states based on the multiple inputs and the material testing process, the predetermined states including one or more unrestricted states and one or more restricted states; and control the actuator disabling circuit based on the determined state.

Description

[0001] Related Applications

[0002] This international application claims priority to U.S. Provisional Patent Application Serial No. 62 / 773,895, filed on November 30, 2018, entitled “SAFETY SYSTEMS AND MATERIAL TESTING SYSTEMS INCLUDING SAFETY SYSTEMS,” and U.S. Patent Application Serial No. 16 / 697,873, filed on November 27, 2019, entitled “SAFETY SYSTEMS AND MATERIAL TESTING SYSTEMS INCLUDING SAFETY SYSTEMS.” The entire contents of U.S. Provisional Patent Application Serial No. 62 / 773,895 and U.S. Patent Application Serial No. 16 / 697,873 are incorporated herein by reference. Background Art

[0003] The present disclosure relates generally to materials testing, and more particularly to safety systems and materials testing systems including safety systems.

[0004] Universal testing machines are used to perform mechanical tests on materials or components, such as compression strength tests or tensile strength tests. Summary of the invention

[0005] A safety system and a material testing system including a safety system are disclosed, substantially as illustrated by and described in conjunction with at least one of the Figures, and as more fully set forth in the claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] These and other features, aspects and advantages of the present disclosure will be better understood when the following detailed description is read with reference to the accompanying drawings, in which like reference numerals refer to like parts throughout, and in which:

[0007] Figure 1 is an example test apparatus for performing mechanical property testing according to aspects of the present disclosure.

[0008] Figure 2 yes Figure 1 A block diagram of an example implementation of a test device.

[0009] Figure 3 yes Figure 2 A block diagram of an example implementation of a security system.

[0010] The drawings are not necessarily drawn to scale. Where appropriate, similar or identical reference numerals are used to refer to similar or identical components. DETAILED DESCRIPTION

[0011] Traditional material testing systems use mitigation techniques such as configuration switches, guarding, limited force control, motion limitation and / or protection to improve operator safety. However, traditional material testing systems often do not always comply with international standards. Traditional mitigation techniques require the operator to put the system into an appropriate operating mode, such as safe interaction or test. Many traditional safety techniques can be implemented using off-the-shelf safety components such as programmable logic controllers (PLCs) and / or relays. PLCs and relays typically add significant cost to the material testing system.

[0012] The disclosed example material testing system has a safety system that complies with international standards embedded or integrated within the material testing system. Because the safety system is integrated into the material testing system, the disclosed example material testing system provides safety improvements at a much lower cost than can be achieved using off-the-shelf parts because the safety system is integrated into the existing electronics, semiconductors and / or circuit boards of the material testing system. Integration further improves reliability, thereby reducing or eliminating external wiring between purchased safety components.

[0013] As described in more detail below, the disclosed example safety system for a material testing system includes machine status indicators that visually display the status of the testing machine from the perspective of operating limits. The disclosed example safety system for a material testing system provides a high reliability and monitored activation mechanism at the machine control point, which can include internal fault checking and / or power supply diagnostics within the material testing system. In some examples, the pneumatic clamps are provided with two-stage clamping pressure control and monitoring. The disclosed example material testing system is compatible with interlock protection systems with redundant or different contacts. Such protection systems comply with ISO safety standards by using redundant, diverse and / or dynamic real-time monitoring. The disclosed example material testing system includes redundant beam travel limit monitoring. The disclosed example material testing system shutdown circuit system complies with international safety standards including ISO 13849-1.

[0014] Additionally, conventional off-the-shelf safety relay components used with PLCs use an additional firmware layer within the PLC to stop the motion of moving parts during an emergency stop event. The disclosed example safety system for a material testing system is configured to enable hardware (e.g., an emergency stop button) to directly shut down the power amplifier driver of the actuator(s), regardless of whether the embedded firmware within the safety processor is running.

[0015] The disclosed example materials testing system complies with the European Machinery Directive and follows the rules set forth in the ISO 13849-1 standard, which relates to "Safety Related Parts of Control Systems." The following functions, determined through system risk analysis, have been integrated into the materials testing system. The safety system provides a disabled drive state for removing energy from the drive beam, a disabled drive state for removing energy from the clamping system, and a limited drive state for operator settings. In the limited drive state, the example safety system monitors the beam speed to maintain the beam speed below an upper speed limit, monitors intentional manual movement of the beam (jogging), monitors for reduced clamping pressure when closing, and / or monitors for intentional clamp closing.

[0016] As used herein, "beam" refers to a component of a materials testing system that applies directional (axial) and / or rotational forces to a specimen. A materials testing system may have one or more beams, and the beam(s) may be located in any suitable position and / or orientation in the materials testing system.

[0017] The disabling of circuit system, actuator, and / or other hardware can be accomplished via hardware, software (including firmware), or a combination of hardware and software, and can include physical disconnection, power failure, and / or software control, which limits the implementation of commands to actuate circuit system, actuator, and / or other hardware. Similarly, the enabling of circuit system, actuator, and / or other hardware can be accomplished via hardware, software (including firmware), or a combination of hardware and software using the same mechanism as disabling. Firmware can include stored instructions, such as security level embedded software (SRESW) and / or security level application software (SRASW).

[0018] The disclosed example material testing system further includes an unrestricted drive state that enables removal of checks in the restricted drive state. In some examples, the unrestricted drive state can be entered through a dual activation mechanism in which material testing functions are performed and the operator does not interact with the system.

[0019] The disclosed example materials testing system includes indicators on each machine for indicating different states, such as a disabled state, a setup state (e.g., restricted drive mode), a warning state (e.g., unrestricted drive mode), and a test state (e.g., unrestricted drive mode), to clearly indicate to an operator when interaction is possible and when a hazard exists.

[0020] The disclosed example material testing system includes one or more stop functions that are configured to override the initiation and / or continuation of movement of a component, such as a crossbar or a clamp. In addition, the one or more stop functions can be configured redundantly via hardware so that they effectively disable the material testing system even when the software portion of the safety system is disabled. Examples of such stop functions that can be included in the disclosed system include interlocked guards and / or emergency stop switches.

[0021] Some disclosed example material testing systems include selecting and implementing a single control point for activating a material testing frame and / or a clamping system. Some example systems provide power failure monitoring and / or protection to ensure that the system ceases unrestricted operation and places the material testing system in a disabled drive state when power is reestablished. In some examples, in response to a power failure, any pneumatic specimen clamping is automatically powered off.

[0022] The disclosed example safety systems and material testing systems include increased internal diagnostics and reporting to an operator of critical errors within the system, such as equipment failures, or conflicts between redundant inputs, outputs, and / or processes. The disclosed example material testing systems enable faster specimen removal and / or insertion relative to conventional material testing systems because the safety setup mode of the testing machine allows the operator to move within the test space without disabling the material testing system or requiring a protective door. The disclosed example systems further enhance operator safety when setting up and configuring the system within the test space due, at least in part, to the use of setup states that restrict movement of the crossbar and / or limited movement and / or force that can be applied by the fixture.

[0023] The disclosed material testing system and safety system can be specifically configured for use in the disclosed example configurations to achieve the identified risk mitigation. The disclosed material testing system significantly improves the efficiency and specificity of material testing compared to purchasing generic, off-the-shelf, discrete safety components.

[0024] The disclosed example material testing system includes: an actuator configured to control an operator-accessible component of the material testing system; an actuator disabling circuit configured to disable the actuator; and one or more processors configured to: control the actuator based on a material testing process; monitor multiple inputs associated with operation of the material testing system; determine a state of the material testing system from multiple predetermined states based on the multiple inputs and the material testing process, the predetermined states including one or more unrestricted states and one or more restricted states; and control the actuator disabling circuit based on the determined state.

[0025] In some example material testing systems, the one or more processors include a safety processor having a plurality of processing cores configured to: execute redundant code to monitor a plurality of inputs and determine a state of the material testing system; and compare outputs of the redundant code, wherein at least one of controlling an actuator disable switch or controlling a state output indicator is based on the comparison of the outputs. In some examples, the plurality of inputs include a guard input configured to indicate whether an operator is within a predetermined volume around the material testing system, and the one or more processors are configured to set the state of the material testing system in response to determining that the operator is within the predetermined volume.

[0026] Some example material testing systems further include at least one of a mechanically interlocked guard door or a light curtain configured to output a guard input. In some examples, the one or more processors are configured to limit a speed of the actuator in response to the guard input.

[0027] In some examples, the operator-accessible component includes an automatic clamp or a manual clamp configured to clamp a material under test, wherein the actuator is configured to actuate the automatic clamp or the manual clamp; and the operator-accessible component further includes: a crossbar configured to move the automatic clamp or the manual clamp to position the automatic clamp or the manual clamp, or to apply a force to the material under test held by the automatic clamp or the manual clamp; and a second actuator configured to actuate the crossbar, wherein the one or more processors are configured to limit at least one of the actuator or the second actuator based on a state of the material handling system. Some example material testing systems further include a plurality of speed sensors configured to monitor a speed of the crossbar, and the one or more processors are configured to: limit a speed of the crossbar; compare speeds detected by the speed sensors; and when the compared speeds have a difference greater than a threshold, at least one of: a) setting a state of the material testing system; or b) disabling operation of the material testing system.

[0028] In some examples, one or more processors are configured to: limit the pressure that can be applied by the automatic fixture to less than a threshold force when the material testing system is in any of one or more restricted states; and enable the actuator to exceed the threshold force that can be applied by the automatic fixture when the material testing system is in one or more of the unrestricted states.

[0029] In some examples, the plurality of inputs includes an emergency stop input coupled to at least one of the one or more processors or the actuator disabling circuit, wherein the one or more processors or the at least one of the emergency stop inputs are configured to control the actuator disabling circuit to disconnect the actuator from an energy source of the actuator. In some examples, the one or more processors are configured to control the actuator disabling circuitry to continue to disconnect the actuator from the energy source after the emergency stop input is released until the one or more processors recognize a user interaction for reconnecting the actuator to the energy source.

[0030] Some example material testing systems further include an actuator braking circuit configured to decelerate the actuator prior to disconnecting the actuator from the energy source in response to a signal for disconnecting the actuator from the energy source. In some examples, the one or more processors are configured to: determine whether the actuator is decelerating at at least a threshold deceleration rate; and disconnect the actuator in response to determining that the actuator is not decelerating at at least the threshold deceleration rate.

[0031] Some example material testing systems further include a power supply monitor circuit configured to monitor a power supply to the material testing system, wherein the one or more processors are configured to, in response to a signal from the power supply monitor circuit indicating that the power supply is out of tolerance, do at least one of: set a state of the material testing system; or disable operation of the material testing system.

[0032] In some examples, the state output indicator includes at least one of: a plurality of lights corresponding to one or more unrestricted states and one or more restricted states; or a display configured to display information about the material testing system. In some examples, the one or more processors are configured to: monitor the state output indicator; and in response to detecting that the state output indicator is not outputting a state corresponding to the determined state, at least one of: set a state of the material testing system; or disable operation of the material testing system.

[0033] In some examples, the one or more unrestricted states include: a warning state, in which the one or more processors reduce the restriction on the actuator and do not control the actuator to perform a test; and a test state, in which the one or more processors reduce the restriction on the actuator and control the actuator to perform a test. In some examples, the one or more restricted states include: a set state, in which the one or more processors restrict the actuator and control the actuator in response to an operator input; and a disabled state, in which the one or more processors restrict the actuator and do not control the actuator in response to an operator input.

[0034] In some examples, the actuator includes at least one of a motor, a pneumatic actuator, a hydraulic actuator, a piezoelectric actuator, a relay, or a switch. In some examples, the one or more processors include: a control processor configured to perform control of the actuator; and one or more safety processors configured to perform monitoring of a plurality of inputs, determination of a state of the material testing system, and control of an actuator disabling circuit.

[0035] Figure 1 1 is an example material testing system 100 for performing mechanical property testing. The example material testing system 100 may be, for example, a general purpose testing system capable of performing static mechanical testing. The material testing system 100 may perform, for example, a compression strength test, a tensile strength test, a shear strength test, a bending strength test, a flexural strength test, a tear strength test, a peel strength test (e.g., adhesive strength), a torsion strength test, and / or any other compression and / or tension test. Additionally or alternatively, the material testing system 100 may perform dynamic testing.

[0036] The example material testing system 100 includes a test fixture 102 and a computing device 104 communicatively coupled to the test fixture 102. The test fixture 102 applies a load to a material under test 106 and measures a mechanical property of the test, such as a displacement of the material under test 106 and / or a force applied to the material under test 106. Although the example test fixture 102 is shown as a dual-column fixture, other fixtures, such as a single-column test fixture, may also be used.

[0037] The example computing device 104 may be used to configure the test fixture 102, control the test fixture 102, and / or receive measurement data (e.g., transducer measurements such as force and displacement) and / or test results (e.g., peak force, fracture displacement, etc.) from the test fixture 102 for processing, display, reporting, and / or any other desired purpose.

[0038] Figure 2 yes Figure 1 1 is a block diagram of an example implementation of a materials testing system 100 . Figure 2 The example material testing system 100 includes a test fixture 102 and a computing device 104. The example computing device 104 may be a general purpose computer, a laptop computer, a tablet computer, a mobile device, a server, an all-in-one computer, and / or any other type of computing device.

[0039] Figure 2The example computing device 104 includes a processor 202. The example processor 202 can be any general-purpose central processing unit (CPU) from any manufacturer. In some other examples, the processor 202 can include one or more special-purpose processing units, such as a RISC processor with an ARM core, a graphics processing unit, a digital signal processor, and / or a system on a chip (SoC). The processor 202 executes machine-readable instructions 204, which can be stored locally in a random access memory 206 (or other volatile memory), in a read-only memory 208 (or other non-volatile memory such as FLASH memory), and / or in a mass storage device 210 at the processor (e.g., in an included cache or SoC). The example mass storage device 210 can be a hard disk drive, a solid-state storage drive, a hybrid drive, a RAID array, and / or any other mass data storage device.

[0040] The bus 212 supports communications between the processor 202 , the RAM 206 , the ROM 208 , the mass storage device 210 , the network interface 214 , and / or the input / output interface 216 .

[0041] An example network interface 214 includes hardware, firmware, and / or software to connect computing device 201 to a communication network 218, such as the Internet. For example, network interface 214 may include wireless and / or wired communication hardware compliant with IEEE 202.X for sending and / or receiving communications.

[0042] Figure 2 The example I / O interface 216 includes hardware, firmware, and / or software for connecting one or more input / output devices 220 to the processor 202 to provide input to and / or output from the processor 202. For example, the I / O interface 216 may include a graphics processing unit for interfacing with a display device, a universal serial bus port for interfacing with one or more USB compatible devices, FireWire, a field bus, and / or any other type of interface. The example material testing system 100 includes a display device 224 (e.g., an LCD screen) coupled to the I / O interface 216. Other example I / O device(s) 220 may include: a keyboard, a keypad, a mouse, a trackball, a pointing device, a microphone, an audio speaker, a display device, an optical media drive, a multi-touch screen, a gesture recognition interface, a magnetic media drive, and / or any other type of input and / or output device.

[0043] The example computing device 104 may access the non-transitory machine-readable medium 222 via the I / O interface 216 and / or the I / O device(s) 220 . Figure 2Examples of machine-readable media 222 include: optical disks (e.g., compact disks (CDs), digital versatile / video disks (DVDs), Blu-ray disks, etc.), magnetic media (e.g., floppy disks), portable storage media (e.g., portable flash drives, secure digital (SD) cards, etc.), and / or any other type of removable and / or installed machine-readable media.

[0044] Figure 1 The example material testing system 100 further includes a test fixture 102 coupled to a computing device 104. Figure 2 In some examples, test fixture 102 is coupled to a computing device via I / O interface 216, such as via a USB port, a Thunderbolt port, a FireWire (IEEE 1394) port, and / or any other type of serial or parallel data port. In some other examples, test fixture 102 is coupled to network interface 214 and / or I / O interface 216 directly or via network 218 via a wired or wireless connection (e.g., Ethernet, Wi-Fi, etc.).

[0045] Figure 2 The test fixture 102 of the embodiment includes a frame 228, a load cell 230, a displacement transducer 232, a cross member loader 234, a material clamp 236, a control processor 238, and a safety system 240. The frame 228 provides rigid structural support for the other components of the test fixture 102 that perform the test. The load cell 230 measures the force applied by the cross member loader 234 to the material being tested via the clamp 236. The cross member loader 234 applies force to the material being tested, and the material clamp 236 (also referred to as a clamp) grasps or otherwise couples the material being tested to the cross member loader 234. The example cross member loader 234 includes a motor 242 (or other actuator) and a cross beam 244. The cross beam 244 couples the material clamp 236 to the frame 228, and the motor 242 moves the cross beam relative to the frame to position the material clamp 236 and / or apply force to the material being tested. Example actuators that may be used to provide force and / or motion to components of the materials testing system 100 include motors, pneumatic actuators, hydraulic actuators, piezoelectric actuators, relays, and / or switches.

[0046] Example fixtures 236 include platens, jaws, or other types of clamping devices, depending on the mechanical properties being tested and / or the material being tested. The fixtures 236 can be manually configured, controlled by manual input, and / or automatically controlled by a control processor 238. The crossbar 244 and the fixtures 236 are operator accessible components.

[0047] The example control processor 238 communicates with the computing device 104 to, for example, receive test parameters from the computing device 104 and / or report measurements and / or other results to the computing device 104. For example, the control processor 238 may include one or more communication or I / O interfaces to enable communication with the computing device 104. The control processor 238 may control the cross-member loader 234 to increase or decrease the applied force, control the clamping device(s) 236 to grasp or release the material being tested, and / or receive measurements from the displacement transducer 232, the load cell 230, and / or other transducers.

[0048] The example safety system 240 provides an additional layer of monitoring and control for the test fixture 102. The safety system 240 monitors operator input and the status of the test fixture 102. Figure 2 In the example of FIG. 2 , the safety system 240 restricts the user's operation of the test fixture 102 so that the user can control the test fixture 102 only when the machine is in an appropriate state. In response to detecting one or more conditions, the safety system 240 will automatically cause the test fixture 102 to enter a restricted state (e.g., a restricted setup state, disabling all power and motion that could present a hazardous condition, etc.).

[0049] As discussed in more detail below, the safety system 240 selectively adds, removes, increases, and / or decreases restrictions on the operation of the material testing system based on monitoring input signals from the material testing system 100, input signals from the safety system 240, and / or control signals from the control processor 238. The safety system 240 controls the operation of the material testing system 100 by determining the state in which the material testing system 100 is to be operated at any given time from a plurality of predetermined states. Example predetermined states include one or more restricted states in which one or more operations of the material testing system 100 are restricted (e.g., disabled, limited, etc.), and one or more unrestricted states in which restrictions of a restricted state are reduced and / or removed. Figure 2 In some examples, the safety processor 240 is attached to and / or interrupts the control processor 238's control of the cross member loader 234 and / or the clamping device(s) 236. In some other examples, the safety system 240 may directly control the cross member loader 234 and / or the clamping device(s) 236 while enforcing any applicable restrictions on the actuators.

[0050] Example restricted states include a set state and a disabled state. In the set state, the safety system 240 limits one or more actuators (e.g., the motor 242 and / or (multiple) clamp actuators 246) and controls (or allows control of) these actuators in response to operator input. Example limitations on the motor 242 and / or the beam 244 may include an upper speed limit and / or an upper or lower position limit of the beam 244 relative to the test fixture 102. Example limitations on the (multiple) clamp actuators 246 may include an upper pressure limit and / or an upper clamping force limit. In the disabled state, the safety system 240 limits the actuators and the control processor 238 does not control the actuators in response to operator input (e.g., does not attempt to control the motor 242 and / or (multiple) clamp actuators 246, or is prevented from controlling the motor 242 and / or (multiple) clamp actuators 246 by powering off).

[0051] Example unrestricted states include a warning state and a test state. In the example warning state, the safety system 240 reduces restrictions on the actuators (e.g., the motor 242 and / or the (multiple) clamp actuators 246) and does not control the actuator motor 242 and / or the (multiple) clamp actuators 246. In the warning state, the control processor 238 can control the (multiple) actuators to perform actions, such as high-speed jogging of the beam 244 and / or increasing the clamping force of the pneumatic clamps 248, for which the operator should not be physically close to the beam 244 and / or the pneumatic clamps 248. In the example test state, the safety system 240 reduces restrictions on the actuators while the control processor 238 controls the (multiple) actuators to perform testing (e.g., according to a material testing process or procedure executed by the control processor 238).

[0052] Figure 2 The example material testing system 100 can further include one or more control panels 250 including a plurality of status indicators 252 and one or more mode switches 254. The mode switches 254 can include buttons, switches, and / or other input devices located on an operator control panel. For example, the mode switches 254 can include a button that controls the motor 242 to jog (e.g., position) the crossbar 244 at a particular location on the frame 228, a switch (e.g., a foot switch) that controls the clamp actuator 246 to close or open the pneumatic clamp 248, a mode control button that is pressed in conjunction with another button to enable the safety system 240 to allow operation in an unrestricted state, and / or any other input device that can cause operation in an unrestricted state.

[0053] The status indicators 252 correspond to a set of predetermined states (e.g., the disabled, setup, warning, and test states described above) to which the safety system 240 can set the material testing system 100. As described in more detail below, the safety system 240 controls the status indicators 252 to provide an indication of the current state of the material testing system 100 as determined by the safety system 240. The status indicators 252 may include lights, displays, audio, mechanical systems, and / or any other indication that an operator can discern.

[0054] Figure 3 yes Figure 2 A block diagram of an example implementation of a security system 240 is shown. Figure 3 As shown, security system 240 includes a security processor 302 .

[0055] The example safety processor 302 includes a plurality of redundant processing cores 304a, 304b. The processing cores 304a, 304b execute redundant instructions 306a, 306b and receive redundant inputs such that the processing cores 304a, 304b should produce substantially identical outputs during normal operation of the test fixture 102. The safety processor 302 (e.g., via the redundant cores 304a, 304b) monitors the plurality of inputs and determines a state of the material testing system 100 based on the inputs. The safety processor 302 may compare the outputs of the redundant instructions 306a, 306b and control the state of the material testing system 100 based on the comparison of the outputs.

[0056] The example security processor 302 and / or redundant processing cores 304a, 304b may be a general purpose central processing unit (CPU) from any manufacturer. In some other examples, the security processor 302 and / or redundant processing cores 304a, 304b may include one or more dedicated processing units, such as a RISC processor with an ARM core, a graphics processing unit, a digital signal processor, and / or a system on a chip (SoC). The security processor 302 and / or redundant processing cores 304a, 304b execute machine-readable instructions (such as redundant instructions 306a, 306b), which may be stored locally in a storage device (such as a random access memory, a read-only memory, and / or a mass storage device) at the processor (e.g., in an included cache or SoC).

[0057] The redundant processing cores 304a, 304b and redundant instructions 306a, 306b allow the security system 240 to process redundant and / or different inputs and outputs, thereby providing a highly reliable and predictable system. Figure 3, but these inputs and / or outputs may be replicated to support redundant processing cores 304a, 304b and redundant instructions 306a, 306b. The redundant instructions 306a, 306b (e.g., embedded software, operating systems, and generated code) executed by the safety processor 302 conform to processes outlined in international standards, including, but not limited to, ISO 13849-1 (which relates to "safety-related parts of control systems"). Although the example safety processor 302 includes multiple redundant processing cores, in other examples, the safety processor 302 may include a single processing core or multiple non-redundant processing cores.

[0058] Figure 3 The safety system 240 further includes an actuator disabling circuit 308 that selectively disables a power amplifier 310 from providing energy to the motor 242 of the beam 244. Additionally or alternatively, the actuator disabling circuit 308 (or another actuator disabling circuit) can disable the (multiple) clamp actuators 246 from providing energy to the (multiple) pneumatic clamps 248. The power amplifier 310 receives input power and outputs power to the motor 242 to control the movement of the beam 244. The example actuator disabling circuit 308 and the power amplifier 310 can be implemented using a safety rated safe torque off (STO) high reliability servo power amplifier. The control processor 238 can control the movement of the motor 242 and the beam 244 via a motor control signal 312 to the power amplifier 310.

[0059] In response to the STO signal 314 from the safety processor 302, the actuator disabling circuit 308 disables the connected actuator (e.g., the motor 242). For example, the actuator disabling circuit 308 can disconnect all energy to the motor 242 (and / or other moving parts in the material testing system 100) for less than a certain defined time period. The example actuator disabling circuit 308 can provide the safety processor 302 with an STO feedback signal 315 that indicates whether the actuator disabling circuit 308 is currently disabling the actuator. The safety processor 302 can compare the STO signal 314 with the STO feedback signal 315 to detect a fault.

[0060] In the example material testing system 100, as specified by international standards, after activating the STO signal 314, the travel of the moving beam 244 and any internal components is stopped. Most of the subsystems of the safety system 240 disclosed herein activate the actuator disabling circuit 308 to safely stop the machine. In addition, the power amplifier 310 may include a motor braking circuit 316 to decelerate the motor 242 before applying the STO signal 314. The motor braking circuit 316 allows the motor 242 to stop in a more controlled manner by eliminating the continued movement due to mechanical inertia after the drive power is turned off. The use of pre-disabling braking reduces or minimizes the movement of the beam 244 after the motor 242 is powered off. Therefore, the example actuator disabling circuit 308 and the motor braking circuit 316 provide a Class 1 stop defined in the IEC 60204-1 standard, which is the "Electrical Safety Standard for Machinery".

[0061] The example safety processor 302 monitors the motor 242 and / or the motor brake circuit 316 when pre-disabling braking occurs to confirm that the motor 242 is braking. If the safety processor 302 determines that the motor 242 is not decelerating during braking, the safety processor 302 performs brake fault mitigation to stop braking and immediately de-energize the motor 242. By implementing brake fault mitigation with a two-stage disabling sequence, the safety processor 302 can shorten the stopping distance in the event that braking is ineffective. Although the shortest stopping distance occurs when the pre-disabling brake is effective, a two-stage sequence involving an ineffective pre-disabling brake may have a longer stopping distance than a single-stage sequence (e.g., disconnection only) when the pre-disabling brake is not fully effective. A second advantage of brake fault mitigation is that the mitigation enables greater flexibility in implementing the two-stage disabling sequence because a wider range of components and systems can be used to perform high performance braking using a brake fault mitigation process that can capture faults in the braking system.

[0062] The example safety system 240 further includes an emergency stop device 318 (e.g., a button, switch, etc.) that provides an emergency stop input signal 320 to the safety processor 302. The emergency stop device 318 can be a manually operated emergency stop button, which is a supplemental safety function. The emergency stop device 318 includes two channel redundancy for signaling. The emergency stop device 318 can include an emergency stop switch 322, an emergency stop detection circuit 324, and an actuator disabling circuit 326. The emergency stop device 318 can be independently controlled using hardware and embedded software of the safety processor 302. For example, in response to detecting the emergency stop input signal 320 from the emergency stop detector 324, the safety processor 302 sets the state of the material testing system 100 to a disabled state and provides an emergency stop output signal 321 to the emergency stop device 318 (e.g., to the emergency stop switch 322).

[0063] In response to the emergency stop output signal 321, the emergency stop switch 322 controls the actuator disabling circuit 326 to control the actuator disabling circuit 314 and / or the motor braking circuit 314 to stop the motor 242. The example actuator disabling circuit 326 can have a first connection to the motor braking circuit 314 and a second redundant connection to the actuator disabling circuit 308. When the actuator disabling circuit 326 is triggered, the actuator disabling circuit 326 activates the motor braking circuit 314, delays for a period of time to allow braking to occur, and then activates the actuator disabling circuit 308 to de-energize the applicable actuator.

[0064] In addition to or as an alternative to control via the safety processor 302, the emergency stop switch 322 can directly actuate the actuator disabling circuit 308 within the power amplifier 310, such as by a physical interruption of the STO signal 314 between the safety processor 302 and the actuator disabling circuit 308. The safety processor 302 monitors the emergency stop detection circuit 324 and acts as a redundant monitor for the hardware. The safety processor 302 outputs the STO signal 314 to control the actuator disabling circuit 308 to continue to disable the motor 242, so that when the emergency stop switch 322 is released, the material testing system 100 will remain disabled (e.g., in a restricted state) and user interaction is required to re-enable operation of the motor 242.

[0065] The example material testing system 100 (e.g., the test fixture 102) is compatible with an interlocked guard system having redundant or distinct contacts. The example safety system 240 may include one or more guards 328 and guard interlocks 330 configured to provide a physical and / or virtual barrier to operator access to the material testing system 100 when operating in an unrestricted state. For example, the guards 328 may include physical barriers that are opened and closed to control access to the volume around the pneumatic clamps 248 and / or the crossbar 244 (and / or other moving parts). Example physical barriers include guard doors that may use redundant safety switches to monitor whether the door guarding the protected volume is open or closed. Each door switch has mechanically connected normally open and normally closed contacts that can be dynamically pulsed (e.g., by the guard interlock 330) and / or otherwise received as input. Pulsing allows for plausibility diagnostic checks of the guard door switches in real time.

[0066] Additionally or alternatively, the guards 328 may include virtual guards that monitor for intrusion into the volume surrounding the pneumatic gripper 248 and / or the crossbar 244. Example virtual guards may include light curtains, proximity sensors, and / or pressure pads. Although the virtual guards do not physically prevent access, the virtual guards output guard signals to the guard interlocks 330, which output interlock signals 332 to the safety processor 302 and / or the actuator disabling circuit 308 (e.g., similar to the emergency stop switch 322 discussed above).

[0067] Interlock 330 may trigger actuator disabling circuit 308 to de-energize motor 242. In some examples, when guard interlock 330 is no longer triggered, safety processor 302 controls re-enabling of power amplifier 310 in a manner similar to emergency stop switch 322 discussed above.

[0068] Additionally or alternatively, the example safety system 240 may default to a restricted “setup” state when an operator enters the protected volume of the material testing system 100. The set up state implements limits on speed, pressure, or other activity, rather than disabling or de-energizing actuators of the system 100.

[0069] The example safety system 240 includes a plurality of status indicators 252 and mode switches 254. The example safety processor 302 monitors the mode switches 254 by, for example, dynamically pulsing the mode switches 254 to generate or obtain mode switch input signals 338 (e.g., one or more mode switch inputs of each mode switch 254). In some examples, the mode switches 254 are high reliability switches. The safety processor 302 can test the mode switches 254 for short circuits or other fault conditions periodically, non-periodically, in response to an event (e.g., at startup of a materials testing machine), on a predetermined schedule, and / or at any other time.

[0070] The example safety processor 302 controls the status indicators 252 to indicate the status of the material testing system 100 to the operator. For example, the safety processor 302 can output an indicator signal 342 to the status indicator 252. If the status indicator 252 is a light, the output indicator signal 342 can, for example, control each light to be on, off, blinking, and / or any other output of the light. In some examples, the safety processor 302 determines the status of the indicator through the indicator feedback signal 340. The example indicator feedback signal 340 can indicate to the safety processor 302 whether each status indicator 252 is on, off, shorted, open, and / or any other state or condition of the status indicator 252. If the processor determines that one or more of the status indicators 252 are not in the correct state as commanded, the safety processor 302 controls the material testing system to a restricted state, provides a notification to the operator (e.g., via the control panel 250 or other notification).

[0071] The safety system 240 includes a power supply monitor 344 to monitor the power supplies (e.g., DC and AC power supplies) that provide power to the components of the material testing system 100. The power supply monitor 344 provides one or more power supply status signals 346 to the safety processor 302 and / or a watchdog circuit 362 (described below) to indicate whether the monitored power supplies are within respective voltage and / or current ranges. If the power supply monitor 344 determines that one or more of the power supplies are out of tolerance, the safety processor 302 and / or the watchdog circuit 362 may disable the material testing system 100 and alert an operator.

[0072] The example safety system 240 further includes one or more speed sensors 348. The example speed sensor(s) 348 may be integrated, redundant, and / or different speed monitoring sensors. The speed sensor(s) 348 provide the safety processor 302 with speed signals 350 representing the speed of the crossbar. The safety processor 302 monitors the speed signals 350 to ensure that the crossbar 244 does not exceed the upper speed limit (e.g., the crossbar travel limit(s) 352) determined by the current operating mode of the machine. For example, the value of the upper speed limit may depend on whether the material testing system 100 is in a restricted state or an unrestricted state. In some examples, two speed sensors operating according to different principles may be used in the material testing system 100 to prevent the sensors 348 from suffering from common cause failures. The safety processor 302 reads and compares the speed signals 350 of each speed sensor 348 to verify whether the speed signals 350 are consistent. If one speed sensor 348 indicates a different speed than another speed sensor 350, the safety processor 302 disables the material testing system 100 (e.g., via the actuator disabling circuit 308).

[0073] Example beam travel limit(s) 352 may include travel limits that specify position limits of the beam 244. When the beam travel limit(s) 352 are reached, the safety processor 302 stops the movement of the beam 244. In some examples, the beam travel limit(s) 352 are multi-level limits, where the number of limits triggered indicates how far the beam travel limit(s) 352 have been exceeded. In some examples, a first level limit is processed by the safety processor 302 to stop the operation of the applicable actuator (or all actuators), such as the motor 242. As the beam 244 continues to move beyond the first level limit and reaches a second level limit (e.g., further out of an acceptable range than the first level limit), the beam travel limit 352 may trigger a direct connection (e.g., a hardware connection) to the actuator disabling circuit 308 and / or the motor brake circuit 316, and / or the actuator disabling circuit 326 to trigger a two-phase disable of the motor 242.

[0074] In some examples, where the material testing system 100 includes automated grips (e.g., pneumatic grips, hydraulic grips, electric grips, electromechanical grips, electromagnetic grips, etc.), the safety system 240 includes a grip controller 354 that controls the grip actuators according to a multi-pressure gripping scheme. The multi-pressure gripping scheme reduces (e.g., minimizes, eliminates) the risk of injury to an operator when mounting a material specimen in the pneumatic grips 248 into the material testing system 100.

[0075] When the safety processor 302 controls the material testing system 100 in the setup state, the safety processor 302 provides a pressure signal 356 to the clamp controller 354. The clamp controller 354 controls the upper limit of the pressure that can be applied via the clamp 248 by controlling the clamp actuator(s) 246. The pressure signal 356 (which may be proportional to the specimen gripping force) is limited to allow sufficient pressure to grip the specimen via the clamp 248, but not enough pressure to cause serious injury to the operator. Conversely, when the safety processor 302 controls the material testing system 100 in the warning state or the test state, the safety processor 202 provides the pressure signal 356 to enable the clamp controller 354 to use a higher pressure to grip the specimen during testing. The example clamp controller 354 can monitor the main system pressure (e.g., via the pressure sensor(s) 358) and / or the pressure(s) in the pneumatic clamp(s) 248 (e.g., upper and lower clamps). The clamp controller 354 feeds the pressure signal 360 to the safety processor 302 to verify that the commanded pressure is being implemented.

[0076] In some examples, the clamp controller 354 is controlled by operator input using a foot pedal switch. For example, the foot pedal switch may include separate switches to apply pressure and release pressure through the pneumatic clamp(s) 248. The switches may be mechanically linked switches that may be dynamically pulsed to check rationality between the switches and / or monitor for potential faults in the switches (e.g., electrical faults).

[0077] When power to the material testing system 100 is disabled, the safety processor 302 further controls the gripper controller 354 to de-energize the gripper actuator(s) 246. For example, the safety processor 302 may control the gripper actuator(s) 246 (e.g., via one or more valves, relays, etc.) to achieve pressurization when powered, but typically depressurization for pneumatic actuators, such that the pneumatic gripper(s) 248 are prevented from applying a clamping force when the material testing system 100 is not powered.

[0078] The example safety system 240 further includes a watchdog circuit 362. The watchdog circuit 362 communicates with the safety processor 302 periodically, aperiodically, in response to one or more events or triggers, and / or at any other time to verify the operation of the safety processor 302. For example, the safety processor 302 may transmit a heartbeat signal or a response to a challenge from the watchdog circuit 362 to indicate to the watchdog circuit 362 that the safety system 240 is operating properly. If the watchdog circuit 362 does not receive an expected signal from the safety processor 302, the watchdog circuit 362 disables the material testing system 100 and notifies the operator.

[0079] The example safety processor 302, the example emergency stop 322, the example guard interlock 330, the example crossbar travel limit(s) 352, and / or the example watchdog circuit 362 are coupled (e.g., via a hardware connection) to the actuator disabling circuit 326. When any of the safety processor 302, the emergency stop 322, the guard interlock 330, the crossbar travel limit(s) 352, and / or the watchdog circuit 362 determine that a respective condition is met to disable the material testing system 100 (e.g., activation of the emergency stop switch 322, tripping of the guard 328, exceeding the crossbar travel limit 352, and / or triggering of the watchdog circuit 362), the actuator disabling circuit 326 is used to activate the motor braking circuit 316 and the actuator disabling circuit 308. The safety processor 302 can determine that the state of the material testing system 100 is a disabled state.

[0080] Although the example control processor 238 and the safety processor 302 are shown as separate processors, in other examples, the control processor 238 and the safety processor 302 may be combined into a single processor or a processor group that is not divided into control functions and safety functions. In addition, the control processor 238, the safety processor 302 and / or the combined processor may include non-processing circuit systems (such as analog and / or digital circuit systems) to perform one or more dedicated functions.

[0081] The present method and system can be implemented with hardware, software, and / or a combination of hardware and software. The present method and / or system can be implemented in a centralized manner in at least one computing system, or in a distributed manner with different elements spread over several interconnected computing systems. Any type of computing system or other device suitable for executing the method described herein is suitable. A typical combination of hardware and software may include a general computing system with a program or other code, which controls the computing system when loaded and executed so that the computing system executes the method described herein. Another typical implementation may include a dedicated integrated circuit or chip. Some implementations may include a non-transient machine-readable (e.g., computer-readable) medium (e.g., a flash drive, an optical disk, a magnetic storage disk, etc.), which stores one or more lines of code executable by a machine, so that the machine executes a process as described herein. As used herein, the term "non-transient machine-readable medium" is defined as including all types of machine-readable storage media and excluding propagation signals.

[0082] As used herein, the terms "circuit" and "circuitry" refer to physical electronic components (i.e., hardware) and any software and / or firmware ("code") that can configure hardware, be executed by hardware, and / or otherwise be associated with hardware. As used herein, for example, a specific processor and memory may constitute a first "circuit" when executing a first line or more lines of code, and may constitute a second "circuit" when executing a second line or more lines of code. As used herein, "and / or" refers to any one or more of the multiple items connected by "and / or" in a list. For example, "x and / or y" refers to any element in a three-element set {(x), (y), (x, y)}. In other words, "x and / or y" refers to "one or both of x and y". As another example, "x, y, and / or z" refers to any element in a seven-element set {(x), (y), (z), (x, y), (x, z), (y, z), (x, y, z)}. In other words, "x, y, and / or z" refers to "one or more of x, y, and z". As used herein, the term "exemplary" means serving as a non-limiting example, instance, or illustration. As used herein, the terms "eg" and "for example" introduce a list of one or more non-limiting examples, instances, or illustrations. As used herein, a circuit system is "operable" to perform a function when the circuit system includes the necessary hardware and code (if necessary) to perform the function, regardless of whether the performance of the function is disabled or not enabled (e.g., by a user-configurable setting, a factory adjustment, etc.).

[0083] Although the present method and / or system has been described with reference to certain embodiments, it will be understood by those skilled in the art that various changes may be made and equivalents may be substituted without departing from the scope of the present method and / or system. For example, the frames and / or components of the disclosed examples may be combined, divided, rearranged and / or otherwise modified. Additionally, many modifications may be made to adapt specific circumstances or materials to the teachings of the present disclosure without departing from the scope of the present disclosure. Therefore, the present method and / or system is not limited to the specific embodiments disclosed. Alternatively, the present method and / or system will include all embodiments that fall within the scope of the appended claims, both literally and according to the doctrine of equivalents.

Claims

1. A material testing system, comprising: a first actuator configured to control an operator-accessible component of the material testing system, wherein the operator-accessible component comprises an automatic clamp or a manual clamp configured to clamp a material under test, wherein the first actuator is configured to actuate the automatic clamp or the manual clamp; a crossbeam configured to move the automatic fixture or the manual fixture to position the automatic fixture or the manual fixture, or to apply a force to the material under test held by the automatic fixture or the manual fixture; a second actuator configured to actuate the crossbar; an actuator disabling circuit configured to disable the second actuator; and One or more processors configured to: controlling the second actuator based on a material testing process; monitoring a plurality of inputs associated with operation of the materials testing system; determining a state of the material testing system from a plurality of predetermined states based on the plurality of inputs and the material testing process, the predetermined states comprising one or more unrestricted states and one or more restricted states, wherein the one or more processors are configured to restrict at least one operation of the material testing system in the one or more restricted states, and wherein the one or more processors are configured to reduce or remove at least one restriction in the one or more restricted states in the one or more unrestricted states; controlling the actuator disabling circuit based on the determined condition; limiting a clamping pressure generated by the first actuator to less than a threshold pressure and limiting a crosshead speed generated by the second actuator to less than a threshold speed when the state of the materials testing system is one of the one or more limited states; When the state of the materials testing system is one of the one or more unrestrained states, the clamping pressure generated by the first actuator is permitted to exceed the threshold pressure, and the crosshead speed generated by the second actuator is permitted to exceed the threshold speed.

2. The material testing system of claim 1, wherein: The one or more processors include a security processor having a plurality of processing cores, the plurality of processing cores being configured to: executing redundant code to monitor the plurality of inputs and determine a status of the materials testing system; as well as Outputs of the redundant codes are compared, wherein at least one of controlling the actuator disabling circuit or controlling a status output indicator is based on the comparison of the outputs.

3. The material testing system according to claim 1, wherein: The plurality of inputs include a guard input configured to indicate whether an operator is within a predetermined volume around the material testing system, and the one or more processors are configured to set a state of the material testing system in response to determining that the operator is within the predetermined volume.

4. The material testing system of claim 3, further comprising at least one of a mechanically interlocked guard door or a light curtain configured to output the guard input.

5. The material testing system of claim 3, wherein: The one or more processors are configured to limit a speed of the second actuator in response to the guard input.

6. The material testing system of claim 1 , further comprising a plurality of velocity sensors configured to monitor a velocity of the crosshead, the one or more processors configured to: comparing the speeds detected by the speed sensor; and When the compared speeds have a difference greater than a threshold, at least one of: a) setting a state of the materials testing system; or b) disabling operation of the materials testing system.

7. The material testing system of claim 1, wherein: The multiple inputs include an emergency stop input coupled to at least one of the one or more processors or the actuator disabling circuit, wherein the one or more processors or at least one of the emergency stop inputs are configured to control the actuator disabling circuit to disconnect the second actuator from an energy source of the second actuator.

8. The material testing system of claim 7, wherein: The one or more processors are configured to control the actuator disabling circuitry to continue to disconnect the second actuator from the energy source after the emergency stop input is released until the one or more processors identify a user interaction for reconnecting the second actuator to the energy source.

9. The material testing system of claim 1, further comprising a power supply monitor circuit configured to monitor a power supply of the material testing system, wherein: The one or more processors are configured to at least one of: set a state of the materials testing system; or disable operation of the materials testing system in response to a signal from the power supply monitor circuit indicating that the power supply is out of tolerance.

10. The material testing system of claim 2, wherein: The status output indicator includes at least one of: a plurality of lights corresponding to the one or more unrestricted states and the one or more restricted states; or a display configured to display information about the material testing system.

11. The material testing system of claim 10, wherein: The one or more processors are configured to: monitoring the status output indicator; and In response to detecting that the status output indicator is not outputting a status corresponding to the determined status, at least one of: setting a status of the materials testing system; or disabling operation of the materials testing system.

12. The material testing system of claim 1, wherein: The one or more unrestricted states include: a warning state, wherein the one or more processors reduce a restriction on the first actuator or the second actuator and do not control the first actuator or the second actuator to perform a test; and A testing state, wherein the one or more processors reduce a restriction on the first actuator or the second actuator and control the first actuator or the second actuator to perform a test.

13. The material testing system of claim 1, wherein: The one or more restricted states include: setting a state in which the one or more processors constrain the first actuator or the second actuator and control the first actuator or the second actuator in response to an operator input; and A disabled state in which the one or more processors limit the first actuator or the second actuator and do not control the first actuator or the second actuator in response to operator input.

14. The material testing system of claim 1, wherein: The first actuator or the second actuator includes at least one of a motor, a pneumatic actuator, a hydraulic actuator, a piezoelectric actuator, a relay, or a switch.

15. The material testing system of claim 1, wherein: The one or more processors include: a control processor configured to perform said control on said first actuator or said second actuator; and One or more safety processors configured to perform said monitoring of said plurality of inputs, said determining of a state of said materials testing system, and said controlling of said actuator disabling circuit.

16. A material testing system comprising: an actuator configured to control an operator-accessible component of the materials testing system; an actuator disabling circuit configured to disable the actuator; One or more processors configured to: controlling the actuator based on a material testing process; monitoring a plurality of inputs associated with operation of the materials testing system; determining a state of the material testing system from a plurality of predetermined states based on the plurality of inputs and the material testing process, the predetermined states comprising one or more unrestricted states and one or more restricted states, wherein the one or more processors are configured to restrict at least one operation of the actuator in the one or more restricted states, and the one or more processors are configured to reduce or remove at least one restriction of the at least one operation of the actuator in the one or more restricted states when in the one or more unrestricted states; and controlling the actuator disabling circuit based on the determined condition; and An actuator braking circuit is configured to, in response to a signal to disconnect the actuator from an energy source, decelerate the actuator prior to the disconnection.

17. The material testing system of claim 16, wherein: The one or more processors are configured to: determining whether the actuator is decelerating at at least a threshold deceleration rate; as well as The actuator is disconnected in response to determining that the actuator is not decelerating at at least the threshold deceleration rate.

Images