Security system and method of using the same

Abstract

The present application relates to a security system (1) and a method for using the security system, wherein the security system (1) is used for locating at least one position-variable object (2), comprises at least one control and evaluation unit (3), at least one radio positioning system (4), the radio positioning system having at least three arranged radio stations (5), at least one radio transponder (6) being arranged on the object (2), position data of the radio transponder and position data of the object (2) being determinable by means of the radio positioning system (4), the position data being transmittable from the radio stations (5) of the radio positioning system (4) to the control and evaluation unit (3), the control and evaluation unit (3) being designed to periodically detect the position data of the radio transponder, a first checking unit (7) being provided, the first checking unit (7) being connected to the control and evaluation unit (3), the control and evaluation unit (3) being checked by the first checking unit (7).

Description

[0001] The present invention relates to a security system and to a method of using a security system.

[0002] In industrial safety technology, it is currently practiced to control hazards locally at the hazard point by detecting the approach or presence of a person and stopping or slowing down the machine or the travel movement in a safety-oriented manner.

[0003] The prior art describes only partial security concepts.

[0004] The object of the present invention is to provide an improved safety system.

[0005] This object is achieved by a safety system for locating at least one position-variable object, the safety system comprising at least one control and evaluation unit, at least one radio positioning system, wherein the radio positioning system comprises at least three arranged radio stations, wherein at least one radio transponder is arranged on the object, wherein position data of the radio transponder and position data of the object can be determined by means of the radio positioning system, wherein the position data can be transmitted from the radio stations of the radio positioning system to the control and evaluation unit, wherein the control and evaluation unit is designed to periodically detect the position data of the radio transponder, wherein a first checking unit is provided, wherein the first checking unit is connected to the control and evaluation unit, wherein the control and evaluation unit is checked by the first checking unit.

[0006] The object is also achieved by a method using a security system for locating at least one position-variable object, the security system having at least one control and evaluation unit, at least one radio positioning system, wherein the radio positioning system has at least three arranged radio stations, wherein at least one radio transponder is arranged on the object, wherein position data of the radio transponder and position data of the object can be determined by means of the radio positioning system, wherein the position data can be transmitted from the radio stations of the radio positioning system to the control and evaluation unit, wherein the control and evaluation unit is designed to periodically detect the position data of the radio transponder, wherein a first testing unit is provided, wherein the first testing unit is connected to the control and evaluation unit, wherein the control and evaluation unit is tested by the first testing unit.

[0007] According to the present invention, an architecture for implementing a security system, in particular a secure RTLS system, is provided. The security system is capable of determining verified position data of objects (such as people and / or mobile machines) in an operating environment and providing a credibility measure for these position data. The checked position data can be used to influence situations or objects using transponders, thereby avoiding danger.

[0008] The safety system comprises at least a radio station, a control and evaluation unit, a radio transponder and a first checking unit.

[0009] The radio station is used for radio-based communication and flight time measurement with the positionally variable radio transponder and for forwarding the communication and flight time measurement values ​​to a control and evaluation unit or an RTLS server.

[0010] The control and evaluation unit or the central RTLS server receives the measured signal flight time and determines therefrom the position value of the existing transponder.

[0011] The transponder is located by measuring the time of flight of radio signals, which are periodically exchanged between the transponder and a number of fixed radio stations. This triangulation method is very effective if the signals are transmitted with sufficient signal strength and along a straight or direct propagation path.

[0012] According to the invention, the signals of the radio transponders are received by a plurality of fixed radio stations or anchor stations, and the basis for positioning is created by means of time-of-flight measurements, such as "time of arrival (TOA)" or "time difference of arrival (TDOA)". The position of the radio transponder is then calculated or estimated on a control and evaluation unit, for example on a central RTLS server (Real-Time-Location-System-Server), which is connected to all radio stations or anchor stations via a wireless or wired data connection. This positioning mode is called RTLS mode (Real-Time-Location-System-Mode).

[0013] A first checking unit or a secure RTLS watchdog controller monitors the control and evaluation unit. The first checking unit, for example, checks the plausibility of the determined position data, sends a switching signal for the secure state of the respective transponder, or, for example, initiates a checking unit reset signal to the transponder, depending on the situation.

[0014] The first test unit and the control and evaluation unit thus form at least one single-channel system or optionally a two-channel system, which is tested according to ISO 13849. The first test unit provides necessary diagnostic mechanisms, such as are required by relevant safety standards.

[0015] The first verification unit, or RTLS watchdog controller, monitors and diagnoses the safety system and the control and evaluation unit and performs the safety functions of the safety system. For example, the first verification unit uses the control and evaluation unit as a communication relay. Specifically, the first verification unit monitors correct communication between, for example, radio transponders, radio stations, and the control and evaluation unit, verifies the temporal behavior of all components, and performs consistency checks on the measured data. If necessary, the first verification unit also uses function blocks implemented in the control and evaluation unit or the RTLS server for this purpose.

[0016] The first verification unit or RTLS watchdog controller uses the verified position data of the RTLS system, along with information about the hazardous location, details of the operating environment, etc., provided in advance, for example, through configuration, to assess the local risk. In the simplest case, this is achieved by determining the distance between a person and the hazardous location and initiating risk reduction measures if the distance falls below a safety limit. Risk reduction is based, for example, on the fact that the verification unit sends a safe shutdown or switching signal to a transponder, which forwards it to the connected machine or, if the transponder is on a person, a warning signal or action instruction to the person.

[0017] For example, a plurality of transponders are provided, for example on all machines and persons whose positions can be changed, and optionally also on stationary machines.

[0018] Radio transponders can have additional tasks and therefore differ from conventional radio transponders or tags. In addition to supporting the positioning function of RTLS systems, the following functions are added, for example:

[0019] Radio-based self-position determination, for example, reverse radio positioning based on flash signals from different radio stations.

[0020] Alternatively, a time-of-flight measurement of the radio station signal can be performed by the transponder and the difference in time of flight can be fed back to the first checking unit or the RTLS watchdog controller, after which the calculated transponder position can optionally be checked for plausibility.

[0021] Furthermore, for example, position information, status information and diagnostic information are transmitted to the control and evaluation unit and the first test unit.

[0022] For example, in order to be able to perform these functions, the radio transponder has a two-way communication with the first testing unit.

[0023] The present invention has the advantage that it allows for the implementation of higher-level safety functions based on secure, checked position data.

[0024] In a development of the invention, position data can be transmitted from the radio transponder to the control and evaluation unit.

[0025] At the same time, position information can also be determined on each transponder. In this case, the security system operates similarly to a GPS navigation system. Each transponder receives signals from a radio station or anchor station, which are transmitted at a fixed time interval. Here, too, the transponder's position can be estimated using various time-of-flight measurements and knowledge of the radio station or anchor position. The transponder calculates its position itself and, if necessary, transmits it to the RTLS server via radio signals or other wireless data connections.

[0026] Position determination in GPS mode is independent of position determination in RTLS mode in various respects:

[0027] For example, the calculation is not performed in the control and evaluation unit, but locally on the radio transponder.

[0028] The basis for the position calculation is the measured flight time of the signal of a stationary radio station. In contrast, in RTLS mode, the signal of the radio transponder is used for the flight time calculation.

[0029] Based on the determined signal quality and the associated radio station positions, the radio transponder decides which subset of the available radio station signals to use for position calculation. Thus, a subset of the available transmitted signals is used. Conversely, in RTLS mode, a subset of the signals received at each radio station is used.

[0030] This independence in position determination can now be used to verify positioning. If both modes are operated in parallel, i.e., position data is determined in RTLS mode and GPS mode, a diverse and redundant comparison can be performed for verification purposes. This presupposes that both types of position information are combined in the control and evaluation unit.

[0031] Radio transponders attached to people, vehicles and / or machines reveal their position in space by radio positioning and carry out two-way communication with stationary radio stations.

[0032] For example, two-way communication is possible between a radio transponder and a radio station.

[0033] Communication between the radio station and the radio transponder does not require additional radio technology such as W-LAN or Bluetooth.

[0034] The first checking unit checks the plausibility of the determined position data and, if an erroneous or implausible measured value is detected, sends a signal to switch the relevant transponder into a safe state.

[0035] According to the RTLS system, the position data of the radio transponder and the position data of the object can be measured by means of a radio positioning system, and the RTLS system uses radio positioning to measure the position of all radio transponders in a fixed time grid (in einem festenzeitlichen Raster). The working mode of the RTLS system is to carry out two-way communication between the radio transponder and the radio station. The reason for doing so is that the radio transponder can additionally measure its position by itself and transmit the positioning result to the control and evaluation unit by means of a radio return channel (such as a UWB return channel). Thus, the position information of the two independent measurements can be used for comparison in the control and evaluation unit or the RTLS server. That is to say, the first is the position information measured by the radio station, and the second is the position information measured by the radio transponder. Alternatively, the radio transponder can measure the time of flight of the signal transmitted by the radio station, and only the measured time of flight can be fed back to the control and evaluation unit for credibility check. This is sufficient for the credibility of the check position determination. In addition, two-way communication can be used to forward diagnostic information or other status information measured locally on the transponder to the watchdog controller.

[0036] In a further development of the present invention, the radio transponder has a second checking unit. The second checking unit also performs a monitoring function. For example, the second checking unit can also be referred to as a radio transponder watchdog.

[0037] According to this development, the radio transponder has a second checking unit which must be reset periodically by a signal from the first checking unit. If the signal fails, the second checking unit triggers a safety signal.

[0038] It can also be provided that the first checking unit generates an emergency stop signal if the second checking unit no longer sends a periodic signal.

[0039] In a development of the invention, the first testing unit and / or the second testing unit each have a timer.

[0040] The timer can be an integral component of the second test unit or the transponder, which timer must be reset periodically by the first test unit. In addition to sending the reset signal, the first test unit also determines, for example, the operating time of the timer depending on the current danger situation and the diagnostic state.

[0041] In the second test unit of the radio transponder, a timer is stopped, which can be reset by a reset signal from the first test unit. For example, the timer of the second test unit of the radio transponder can depend on the distance of the relevant radio transponder to the nearest person or hazardous location, wherein a longer time is set for a greater distance and a shorter time is set for a smaller distance.

[0042] Alternatively or additionally, the timer can also be set based on the plausibility of the position data or based on higher-level process information. For example, if the robot acting as a hazardous location is not activated, the timer can be extended.

[0043] Only if the position data are deemed valid after checking and no error state is detected does the first checking unit reset the timer.

[0044] The first checking unit determines the times of various timers according to the minimum time before the danger occurs.

[0045] In a development of the invention, the timers of the second checking units each have a separate time value.

[0046] For example, the timer of the second checking unit can be set individually and differently for each radio transponder, depending on the situation.

[0047] An integrated timer with individually adjustable time values ​​or timer values ​​also allows for a fail-safe implementation and avoids problems with secure radio communication. Thus, no complex communication mechanisms are required to ensure radio communication.

[0048] Under normal circumstances (if there is no danger), the timer of the second test unit of the transponder is periodically reset or reset by the first test unit via a reset signal. The timer of the transponder can be set individually for each transponder and differently depending on the situation.

[0049] For example, if the distance between a person and the autonomous vehicle is already determined to be large and it is known that these people would need several seconds to get dangerously close to the vehicle, the timer can be set accordingly long. Conversely, if the person is already close to a dangerous location or is assumed to be close to a dangerous location based on low-reliability position data, a short value can be set.

[0050] In a development of the invention, the position data can be transmitted from the radio transponder to the first checking unit.

[0051] The position data of the radio transponder are thus transmitted independently to the control and evaluation unit and the first verification unit. The position data are thus available in the control and evaluation unit and the first verification unit and can be cross-checked, with the first verification unit verifying the position data of the control and evaluation unit and vice versa. This results in a dual-channel system and independent, redundant transmission of the position values ​​of the radio transponder.

[0052] In a development of the invention, the radio transponder has a safe switching output and / or a safe interface or a safe interface.

[0053] The transponder outputs a safe output signal via a switching output or a safety interface, in particular to a vehicle or machine. For example, a vehicle can then be braked, decelerated, or even stopped. For example, a machine can then be decelerated or also stopped.

[0054] Safety-related signals are output to the vehicle or machine via safe switching outputs or safety interfaces.

[0055] In particular, radio transponders with safe switching outputs allow direct operation of the machine and bypass the need to initiate risk reduction measures via a higher-level machine control system.

[0056] Instead of switching on a safe switching output or outputting a switching signal at a safety interface, it can also be provided that the transponder takes or initiates another safety measure. For example, the robot arm of a mobile robot is moved into a safe position. This is therefore a measure of stop category 1 or 2, depending on the corresponding standard. According to stop category 0, the machine is "hard" stopped, wherein, for example, a safe switching output switches on a relay, interrupting the power supply to certain parts of the machine, such as the motor of a press. Stop category 1 means entering a "safe" state in a controlled manner, for example by quickly braking a circular saw blade, slowly stopping the movement and only then switching off the power. In the case of stop category 2, the power supply is always maintained to maintain a safe state. For example, the current to the electromagnet on a crane is switched on so that a part suspended from the electromagnet and being transported by the crane does not fall.

[0057] For example, for stop categories 1 and / or 2, the radio transponder preferably has a safety interface. This safety interface can be, for example, a bus-based output, or, for example, one of N outputs (1-aus-N Ausgang), or, for example, a radio-based interface (e.g., Bluetooth, Bluetooth Low Energy, W-LAN, etc.) for communication with the control system of the machine or mobile vehicle in which the radio transponder is located.

[0058] In a development of the invention, the safe switching output and / or the safe interface or the safe interface is activated when a set time of the timer has expired and has not been reset.

[0059] For example, after the timer of the second checking unit has expired, a corresponding state is output at the safe switching output of the transponder, ie a switching output low signal or an OSSD low signal.

[0060] In addition to the actively transmitted switching signal, the first test unit periodically sets a timer for each transponder, for example based on the current situation and diagnostic status. Even without an actively transmitted switching signal from the first test unit, the timer switches the switching output of the transponder to a safe state after expiration. This ensures that no danger can occur even if the communication link is interrupted.

[0061] For example, the transponder reads the timestamps contained in the transponder information and compares them with its own timer. If the deviation exceeds a preset value, the transponder switches its safety-related switching output or outputs a signal at a safety interface. The minimum and maximum deviations between the timestamps and the timer can be adjusted dynamically during operation, for example, depending on the position of the transponder.

[0062] In a development of the invention, the first checking unit and / or the second checking unit are each designed to check the number and / or type of data telegrams of the radio transponder.

[0063] According to a further development, the transponder itself does not measure time, but rather the number and / or type of data telegrams or data packets. For example, the transponder checks the total number of data telegrams of a certain type that arrive at the transponder within a predetermined time. For example, if more and / or fewer data telegrams / data packets than the tolerance allow within a certain time window, the transponder detects that data transmission is being disrupted. The transponder can then take safety measures, for example, by switching on its safety switching output in the simplest case.

[0064] For example, the tolerance limits depend on the position of the wireless transponder in space or, for example, on the correlation with a locally defined area of ​​the workshop. That is, the minimum deviation and the maximum deviation are dynamically adjusted during operation, for example, depending on the position.

[0065] In a further development of the invention, the radio transponder has an output interface for warnings or instructions. In particular, the radio transponder is arranged on a person.

[0066] The output interface can be designed to output, for example, visual or auditory warnings or instructions to a person. For example, a display element or display is provided for visual warnings. Auditory warnings are implemented by signal sounds or, for example, by voice output.

[0067] This can be, in particular, a safety-related warning to people.

[0068] In a development of the invention, the radio transponders have an identification, wherein the radio transponders are respectively assigned to an object, whereby the control and evaluation unit is designed to distinguish between the objects.

[0069] For example, the first object is a mobile object and the second object is a mobile object, wherein the radio transponder has an identification, wherein the radio transponder is correspondingly assigned to the mobile object, whereby the control and evaluation unit is designed to distinguish between the mobile objects, wherein the control and evaluation unit is designed to assign a risk factor to each mobile object at least depending on the position of the mobile object relative to at least one other mobile object.

[0070] For example, the mobile object, or movable machine, or mobile machine may be an unguided vehicle, an unmanned vehicle or autonomous vehicle, an autonomous guided vehicle (AGV), an automated mobile robot (AMR), an industrial mobile robot (IMR), or a robot with a movable robot arm. Therefore, the mobile machine has a drive and can move in different directions.

[0071] Furthermore, for example, the first object is a person and the second object is a mobile object, wherein the radio transponder has an identification, wherein the radio transponder is respectively assigned to at least one person and wherein the radio transponder is respectively assigned to at least one mobile object, whereby the control and evaluation unit is designed to distinguish between persons and mobile objects, wherein the control and evaluation unit is designed to assign a risk factor to each person at least depending on the position of the person relative to the at least one mobile object.

[0072] In a development of the invention, the radio transponder is designed to transmit a safe control signal to the control and evaluation unit in order to initiate the risk reduction measures.

[0073] Thus, risk reduction measures can be triggered at the control and evaluation unit based on the transponder and the object. For example, risk reduction measures can be initiated based on the movement of the object and the movement of the transponder, i.e., for example, the machine can be stopped due to the movement of the transponder in the dangerous direction of movement of the machine.

[0074] In a development of the invention, the control and evaluation unit is designed to transmit a safe control signal to the radio transponder in order to initiate the risk reduction measure.

[0075] Thus, based on the risk detected in the safety system, risk reduction measures can be triggered in a transponder or in a plurality of transponders. For example, risk reduction measures can be initiated based on the movement of an object and the movement of a transponder, i.e., for example, multiple vehicles can be slowed down or even stopped due to the movement of a person's transponder in the direction of the vehicles.

[0076] In a development of the invention, the radiolocation system is an ultra-wideband radiolocation system, in which frequencies in the range of 3.1 GHz to 10.6 GHz are used, with the transmission energy per radio station being at most 0.5 mW.

[0077] The absolute bandwidth in an ultra-wideband radiolocation system is at least 500 MHz, or the relative bandwidth is at least 20% of the center frequency.

[0078] The effective range of such a radio positioning system is, for example, 0 m to 50 m. Here, radio pulses of short duration are used for positioning.

[0079] Therefore, radiolocation systems only emit low-energy radio waves. This makes them very flexible and interference-free. BRIEF DESCRIPTION OF THE DRAWINGS

[0080] The following will describe other advantages and features of the present invention based on embodiments with reference to the accompanying drawings. In the accompanying drawings:

[0081] Figures 1 to 3 The safety systems are shown separately;

[0082] Figures 4 and 5 Parts of the safety system are shown separately.

[0083] In the following figures, identical parts are provided with the same reference numerals.

[0084] Figure 1A safety system 1 for locating at least one positionally variable object 2 is shown, the safety system comprising at least one control and evaluation unit 3, at least one radio positioning system 4, wherein the radio positioning system 4 comprises at least three arranged radio stations 5, wherein at least one radio transponder 6 is arranged on the object 2, wherein position data of the radio transponder 6 and also position data of the object 2 can be determined by means of the radio positioning system 4, wherein the position data can be transmitted from the radio stations 5 of the radio positioning system 4 to the control and evaluation unit 3, and / or the position data can be transmitted from the radio transponder 6 to the control and evaluation unit 3, wherein the control and evaluation unit 3 is designed to periodically detect the position data of the radio transponder 6, wherein a first checking unit 7 is provided, wherein the first checking unit 7 is connected to the control and evaluation unit 3, wherein the control and evaluation unit 3 is checked by the first checking unit 7.

[0085] according to Figure 2 The safety system 1 can determine verified position data of objects 2 (e.g., persons 11 and mobile machines 12) in an operating environment and provide a plausibility measure for these position data. The verified position data can be used to influence the situation or objects 2 using transponders 6 to avoid danger.

[0086] according to Figure 1 The security system 1 comprises at least a radio station 5 , a control and evaluation unit 3 , a radio transponder 6 and a first checking unit 7 .

[0087] The radio station 5 serves for radio-based communication and flight time measurements with a positionally variable radio transponder 6 and for forwarding the communication and flight time measurement values ​​to the control and evaluation unit 3 or to an RTLS server.

[0088] The control and evaluation unit 3 or the central RTLS server receives the measured signal flight time and determines therefrom a position value of the existing radio transponder 6 .

[0089] The transponder 6 is located by measuring the time of flight of radio signals which are exchanged cyclically between the transponder 6 and a plurality of fixed radio stations 5 .

[0090] according to Figure 1The signals of the radio transponder 2 are received by a plurality of stationary radio stations 5 or anchor stations, and the basis for positioning is created by means of time-of-flight measurements, such as "time of arrival (TOA)" or "time difference of arrival (TDOA)". The position of the radio transponder 6 is then calculated or estimated on a control and evaluation unit 3, for example on a central RTLS server (Real-Time-Location-System-Server), which is connected to all radio stations 5 or anchor stations via a wireless or wired data connection. This positioning mode is referred to as RTLS mode (Real-Time-Location-System-Mode).

[0091] At the same time, however, position information can also be determined on each radio transponder 6. In this case, the security system 1 operates similarly to a GPS navigation system. Each radio transponder 6 receives signals from a radio station 5 or anchor station, which are transmitted at a fixed time interval relative to one another. Here, too, the position of the radio transponder 6 can be estimated using various time-of-flight measurements and knowledge of the radio station or anchor positions. The radio transponder 6 calculates its position itself and, if necessary, transmits it to the control and evaluation unit 3 or the RTLS server via radio signals or another wireless data connection.

[0092] This independence in position determination can now be used to verify positioning. If both modes are operated in parallel, i.e., position data is determined in RTLS mode and GPS mode, a diverse and redundant comparison can be performed for verification purposes. This presupposes that both types of position information are combined in the control and evaluation unit 3.

[0093] A first checking unit 7 or a secure RTLS watchdog controller monitors the control and evaluation unit 3 , wherein the first checking unit 7 , for example, checks the plausibility of the determined position data, sends a switching signal for a safe state of the respective radio transponder 6 or, for example, initiates a checking unit reset signal to the radio transponder 6 as appropriate.

[0094] The first checking unit 7 and the control and evaluation unit 3 therefore form a two-channel system.

[0095] according to Figure 2 or Figure 3 The radio transponders 6 attached to persons 11 , vehicles 12 and / or machines 13 reveal their position in space by radio positioning and carry out bidirectional communication with a stationary radio station 5 .

[0096] For example, bidirectional communication is possible between the radio transponder 6 and the radio station 5 .

[0097] The communication between the radio station 5 and the radio transponder 6 does not require any additional radio technology, such as W-LAN or Bluetooth.

[0098] The first checking unit 7 checks the plausibility of the determined position data and, if an erroneous or implausible measured value is detected, sends a signal to switch the relevant transponder 6 into a safe state.

[0099] According to the RTLS system, the position data of the radio transponders 6 and the position data of the objects 2 can be determined by means of a radio positioning system 4, which uses radio positioning to determine the positions of all radio transponders 6 in a fixed time grid. The RTLS system operates by bidirectional communication between the radio transponders 6 and the radio stations 5.

[0100] The first verification unit 7 or RTLS watchdog controller is used to monitor and diagnose the safety system 1 and the control and evaluation unit 3 and to perform the safety functions of the safety system 1. The first verification unit 7 uses the control and evaluation unit 3 as a communication relay. Specifically, the first verification unit 7 monitors correct communication between, for example, the radio transponder 6, the radio station 5, and the control and evaluation unit 3, verifies the time behavior of all components, and performs consistency checks on the measured data. If necessary, the first verification unit 7 also uses function blocks implemented in the control and evaluation unit 3 or the RTLS server for this purpose.

[0101] The first verification unit 7 or the RTLS watchdog controller uses the checked position data of the RTLS system, as well as information provided in advance, for example, by configuration, about the hazardous location, details of the operating environment, etc., to assess the local risk. In the simplest case, this is achieved by determining the distance between the person 11 and the hazardous location and initiating risk reduction measures if the distance falls below a safety limit.

[0102] For example, according to Figure 4 The risk reduction is based on the fact that the test unit 7 sends a safe shut-off signal or switching signal to the radio transponders 6, which forward the safe shut-off signal or switching signal, for example, to the connected machine 13 or in accordance with Figure 5 In the case of a radio transponder 6, a warning signal is forwarded to the person 2 or an action instruction is forwarded to the person 2.

[0103] For example, according to Figure 2 and Figure 3 , a plurality of radio transponders 6 are provided, for example on all machines 12 and persons 11 that can be moved in different positions, and if necessary also on stationary machines 13 .

[0104] The radio transponder 6 may have additional tasks and therefore differ from conventional radio transponders or tags. In addition to supporting the positioning function of the RTLS system, the following functions may be added, for example:

[0105] Radio-based determination of the own position, for example based on reverse radio positioning using flash signals of the individual radio stations 5 .

[0106] Alternatively, the time of flight of the radio station signal can be measured by the transponder 6 and the difference in time of flight fed back to the first checking unit 7 or the RTLS watchdog controller, whereby the calculated transponder position can optionally be plausibly checked.

[0107] Furthermore, for example, position information, status information and diagnostic information are transmitted to the control and evaluation unit 3 and the first test unit 7 .

[0108] In order to be able to perform these functions, the radio transponder 6 has a two-way communication with the first testing unit 7 .

[0109] according to Figure 4 , the radio transponder has a second checking unit 8. The second checking unit 8 also performs a monitoring function. For example, the second checking unit 8 can also be called a radio transponder watchdog.

[0110] The radio transponder 6 has a second checking unit 8, which must be reset periodically by a signal from the first checking unit 7. If the signal fails, the second checking unit 8 triggers a safety signal.

[0111] It can also be provided that the first checking unit 7 generates an emergency stop signal if the second checking unit 8 no longer sends a periodic signal.

[0112] according to Figure 4 , the testing units 7 and 8 each have a timer 9 .

[0113] The timer 9 can be an integral component of the second test unit 7 or 8 or the transponder 6 and must be reset periodically by the first test unit 7. In addition to sending the reset signal, the first test unit 7 also determines, for example, the operating time of the timer depending on the current hazard situation and the diagnostic status.

[0114] In the second checking unit 8 of the radio transponder 6, a timer is stopped, which can be reset by a reset signal of the first checking unit 7. The timer 9 of the second checking unit 8 of the radio transponder 6 depends on the time from the relevant radio transponder 6 to the nearest person (according to Figure 5 ) or hazardous locations (according to Figure 4) distance, where, depending on the distance, a longer time is set for a larger distance and a shorter time is set for a smaller distance.

[0115] Only if the position data are deemed valid after checking and no error state is detected does the first checking unit 7 reset the timer 9.

[0116] The first checking unit 7 determines the times of the various timers 9 according to the minimum time before the danger occurs.

[0117] For example, the timers 9 of the second checking unit 8 each have an individual time value.

[0118] For example, the timer 9 of the second checking unit 8 can be set individually and differently for each radio transponder 6 , depending on the circumstances.

[0119] The integrated timer 9 with individually adjustable time values ​​or timer values ​​also allows for a fail-safe implementation and avoids problems with secure radio communication. Thus, no complex communication mechanisms are required to ensure radio communication.

[0120] Under normal circumstances (if there is no danger), the timer 9 of the second test unit 8 of the radio transponder 6 is periodically reset or reset by the first test unit via a reset signal. The timer 9 of the radio transponder 6 can be set individually for each radio transponder 6 and differently depending on the situation.

[0121] For example, if the distance between person 11 and autonomous vehicle 12 is determined to be large and it is known that these people 11 would need several seconds to get dangerously close to vehicle 12, timer 9 can be set accordingly long. Conversely, if person 11 is already close to a dangerous location, or if it is assumed that person 11 is close to a dangerous location based on low-reliability position data, a short value can be set.

[0122] according to Figure 4 , the position data can be transmitted from the radio transponder 6 to the first testing unit 7 .

[0123] The position data of the radio transponder 6 are thus transmitted independently to the control and evaluation unit 3 and the first checking unit 7. The position data are thus available in the control and evaluation unit 3 and the first checking unit 7 and can be cross-checked, whereby the first checking unit 7 checks the position data of the control and evaluation unit 3 and, conversely, the control and evaluation unit 3 checks the position data of the first checking unit 7. Thus, there is a two-channel system and an independent, redundant transmission of the position values ​​of the radio transponder 6.

[0124] according to Figure 4 , the radio transponder 6 has a safe switching output 10 or a safe interface.

[0125] The transponder 6 outputs a safe output signal via the switching output 10 or via a safety interface, in particular to a vehicle 12 or machine 13. For example, the vehicle 12 can then be braked, decelerated, or even stopped. For example, the machine 13 can then be decelerated or also stopped.

[0126] Via the safe switching output 10 or the safety interface, safety-related signals are output to the object 2 , in particular the vehicle 12 , or to the machine 13 .

[0127] In particular, the radio transponder 6 with the safe switching output 10 allows direct action on the machine 13 and bypasses the need to initiate risk reduction measures via a higher-level machine control system.

[0128] For example, after the timer 9 of the second testing unit 8 has expired, a corresponding state is output at the safe switching output 10 of the transponder 6 .

[0129] In addition to the actively transmitted switching signal, the first test unit 7 cyclically sets a timer 9 for each transponder 6, for example, based on the current situation and the diagnostic status. Even without an actively transmitted switching signal from the first test unit 7, the timer 9 switches the switching output 10 of the transponder 6 to a safe state after expiration. This ensures that no danger can occur even if the communication connection is interrupted.

[0130] according to Figure 5 The radio transponder 6 has an output interface 14 for warnings or instructions. In particular, the radio transponder 6 is arranged on the person 11.

[0131] The output interface 14 can be designed to output, for example, visual or acoustic warnings or instructions to the person 11. For example, a display element or a display is provided for visual warnings. An acoustic warning is achieved by a signal tone or, for example, by voice output.

[0132] This can be, in particular, a safety-related warning for person 11 .

[0133] For example, the radio transponders 6 have an identification, wherein the radio transponders 6 are respectively assigned to an object, whereby the control and evaluation unit 3 is designed to distinguish between the objects 2 .

[0134] For example, the first object 2 is a mobile object and the second object 2 is a mobile object, wherein the radio transponder 6 has an identification, wherein the radio transponder 6 is correspondingly assigned to the mobile object, whereby the control and evaluation unit 3 is designed to distinguish between the mobile objects, wherein the control and evaluation unit 3 is designed to assign a risk factor to each mobile object at least depending on the position of the mobile object relative to at least one other mobile object.

[0135] For example, the mobile object, or movable machine, or mobile machine 12 may be an unguided vehicle, an unmanned vehicle or autonomous vehicle, an autonomous guided vehicle (AGV), an automated mobile robot (AMR), an industrial mobile robot (IMR), or a robot with a movable robot arm. Therefore, the mobile machine has a drive and can move in various directions.

[0136] Furthermore, for example, the first object is a person 11 and the second object is a mobile object, wherein the radio transponder 6 has an identification, wherein the radio transponder 6 is respectively assigned to at least one person 11, and wherein the radio transponder 6 is respectively assigned to at least one mobile object, whereby the control and evaluation unit 3 is designed to distinguish between persons 11 and mobile objects, wherein the control and evaluation unit 3 is designed to assign a risk factor to each person 11 at least depending on the position of the person 11 relative to the at least one mobile object.

[0137] according to Figure 4 , the radio transponder 6 is designed to transmit a safe control signal to the control and evaluation unit 3 in order to initiate risk reduction measures.

[0138] Thus, risk reduction measures can be triggered at the control and evaluation unit 3 based on the radio transponder 6 and the object 2. For example, a risk reduction measure can be initiated based on the object movement and the movement of the radio transponder 6, i.e., for example, the machine 13 is stopped due to the movement of the radio transponder 6 in the dangerous direction of movement of the machine 13.

[0139] according to Figure 4 , the control and evaluation unit 3 is designed to transmit a safe control signal to the radio transponder 6 in order to initiate risk reduction measures.

[0140] Thus, based on the risk detected in the safety system, risk reduction measures can be triggered in the radio transponder 6 or in a plurality of radio transponders 6. For example, risk reduction measures can be initiated based on the movement of an object and based on the movement of the radio transponders 6, i.e., for example, due to the movement of the radio transponder 6 of the person 11 in the direction of the vehicles 12, a plurality of vehicles 12 can be slowed down or even stopped.

[0141] For example, the radiolocation system 4 is an ultra-wideband radiolocation system, wherein the frequencies used are in the range of 3.1 GHz to 10.6 GHz, wherein the transmission energy of each radio station is at most 0.5 mW.

[0142] Reference Mark:

[0143] 1. Security System

[0144] 2 objects

[0145] 3Control and evaluation unit

[0146] 4 Radio positioning system

[0147] 5 radio stations

[0148] 6 radio transponders

[0149] 7First inspection unit

[0150] 8 Second inspection unit

[0151] 9 timers

[0152] 10 safe switching outputs

[0153] 11 people

[0154] 12 Mobile machines and vehicles

[0155] 13 machines

[0156] 14 output interfaces.

Claims

1. A safety system (1) for locating at least one positionally variable object (2), comprising at least one control and evaluation unit (3), at least one radiolocation system (4), in, The radio positioning system (4) has at least three radio stations (5) arranged, wherein at least one radio transponder (6) is arranged on the object (2), wherein the position data of the radio transponder and the position data of the object (2) can be determined by means of the radio positioning system (4), wherein the position data can be transmitted from a radio station (5) of the radio positioning system (4) to the control and evaluation unit (3), wherein the control and evaluation unit (3) is designed to periodically detect the position data of the radio transponder (6), A first checking unit (7) is provided, wherein the first checking unit (7) is connected to the control and evaluation unit (3), wherein the control and evaluation unit (3) is checked by the first checking unit (7), and wherein the radio transponders (6) each have a second checking unit (8), wherein the second checking unit (8) is periodically reset by a signal from the first checking unit (7).

2. The safety system (1) according to claim 1, characterized in that The position data can be transmitted from the radio transponder (6) to the control and evaluation unit (3).

3. Safety system (1) according to at least one of the preceding claims, characterized in that The first testing unit (7) and / or the second testing unit (8) each have a timer (9).

4. The safety system (1) according to claim 1, characterized in that The timers (9) of the second checking units (8) each have an individual time value.

5. The safety system (1) according to claim 1 or 2, characterized in that The position data can be transmitted from the radio transponder (6) to the first testing unit (7).

6. The safety system (1) according to claim 3, characterized in that The radio transponders (6) each have a safe switching output (10) and / or a safe interface.

7. The safety system (1) according to claim 6, characterized in that When the set time of the timer has expired and has not been reset, the safe switching output (10) and / or the safe interface is activated.

8. The safety system (1) according to claim 1 or 2, characterized in that The first checking unit (7) and / or the second checking unit (8) are each designed to check the number and / or type of data telegrams of the radio transponder.

9. The safety system (1) according to claim 1 or 2, characterized in that The radio transponder (6) has an output interface (14) for warnings or instructions.

10. The safety system (1) according to claim 1 or 2, characterized in that The radio transponders (6) have an identification, wherein the radio transponders (6) are respectively assigned to the objects (2), whereby the control and evaluation unit (3) is designed to distinguish between the objects (2).

11. The safety system (1) according to claim 1 or 2, characterized in that The radio transponder (6) is designed to transmit a safe control signal to the control and evaluation unit (3) in order to initiate risk reduction measures.

12. The safety system (1) according to claim 1 or 2, characterized in that The control and evaluation unit (3) is designed to transmit a safe control signal to the radio transponder (6) in order to initiate risk reduction measures.

13. The safety system (1) according to claim 1 or 2, characterized in that The radiolocation system (4) is an ultra-wideband radiolocation system, wherein the frequencies used are in the range of 3.1 GHz to 10.6 GHz, wherein the transmission energy of each radio station (5) is at most 0.5 mW.

14. A method for using a safety system (1) for locating at least one positionally variable object (2), the safety system having at least one control and evaluation unit (3), at least one radiolocation system (4), in, The radio positioning system (4) has at least three radio stations (5) arranged, wherein at least one radio transponder (6) is arranged on the object (2), wherein the position data of the radio transponder and the position data of the object (2) can be determined by means of the radio positioning system (4), wherein the position data can be transmitted from a radio station (5) of the radio positioning system (4) to the control and evaluation unit (3), and the position data can be transmitted from the radio transponder (6) to the control and evaluation unit (3), The control and evaluation unit (3) is designed to periodically detect position data of the radio transponder (6). A first checking unit (7) is provided, wherein the first checking unit (7) is connected to the control and evaluation unit (3), wherein the control and evaluation unit (3) is checked by the first checking unit (7), and wherein the radio transponders (6) each have a second checking unit (8), wherein the second checking unit (8) is periodically reset by a signal from the first checking unit (7).

Images