Electronic security function lock unlocking system

Abstract

An electronic safety function lockout system includes a human machine interface (HMI) device. The HMI device includes a touchscreen display for touch input and one or more cameras for capturing gesture input data and operator facial image data. An operator uses a first touchscreen input or a first gesture input to initiate a lockout operation with respect to a piece of equipment to perform a lockout operation that disconnects the industrial equipment from power. The operator uses a second touchscreen input or a second gesture input to initiate an unlock operation or status with respect to the piece of equipment. The HMI optionally requires a voice confirmation from the operator of the requested lockout or unlock operation. The HMI can compare the captured image of the operator's face to a database of authorized facial images to determine whether the operator is authorized to initiate the lockout operation and initiate the lockout operation only if the operator is authorized. A power switch unit is set to turn power on to the industrial equipment only if the number of active lockout statuses is equal to zero.

Description

Technical Field

[0001] This invention relates to the field of electronic security function technology, and more specifically to electronic security function locking and unlocking systems and methods for selectively locking and unlocking industrial systems. Background Technology

[0002] During the maintenance of industrial equipment, maintenance personnel often need to work on the machines. If these machines are not completely shut down during maintenance, or if they are accidentally restarted, it can pose a danger. Therefore, the use of a Lockout Tag (LOTO) procedure is known to ensure that power is removed from such equipment for maintenance and to prevent accidental premature reconnection of power to the equipment. A lockout device provides a means of definitively disconnecting power to the associated equipment. Such a lockout device can be locked in the disconnected position using one or more locks (e.g., American Koco locks), one or more padlocks (one padlock for each maintenance personnel near the machine), etc. A printed warning label is also affixed to and displayed on the equipment to provide a “tag” notification, warning of equipment operation. The lockout padlocks and printed tag warning labels comply with safety standards such as OSHA Standard 29 CFR 1910.147 to provide a simple and reliable mechanism to ensure that the machine is not accidentally activated or without the consent of all maintenance personnel working on the equipment.

[0003] In some cases, instead of using physical padlocks and associated tags, a remote low-voltage interlocking system is provided to enable interlocking and tagging operations without the use of physical padlocks and printed tags. Such interlocking systems use a combination of features to meet safety standards such as ANSI Z244.1: redundant wiring, safety-rated controllers, safety monitoring relays, and redundant isolation contactors. The remote interlocking system is an operatively connected power switch unit. Based on operator input to the human-machine interface (HMI), the remote interlocking system operates the power switch unit to disconnect power from the machine being serviced until the operator interacts with the HMI again to control the remote interlocking system to reconnect power to the machine being serviced.

[0004] A need has been identified for a new and improved remote low-pressure interlocking system that provides enhancements beyond those associated with known systems to offer improved security, reliability, protection, auditing capabilities, and operator convenience. Summary of the Invention

[0005] According to one aspect of the invention, an electronic security function lock-unlocking system includes a human-machine interface (HMI) device comprising a processor and a touchscreen display controlled by the processor and configured to display a plurality of display elements relating to an associated controlled system. The HMI also includes at least one camera device for capturing at least one of: (i) operator gesture input relating to the associated controlled system; and (ii) operator image data. The HMI device is configured to display a graphical user interface (GUI) comprising a plurality of display elements on the display. The GUI includes a lock-unlocking control area comprising: (i) a user-selectable button display element; and (ii) an operator image display element. When an operator of the HMI initiates a lock operation by at least one of: (i) a first input gesture captured by the at least one camera device; or (ii) a first touch input on the touchscreen display of the user-selectable button display element in the lock-unlocking control area of ​​the GUI.

[0006] According to another aspect of the invention, a method for selectively locking and unlocking an industrial system includes: receiving a first input from a locking operator to a human-machine interface device, the first input indicating a locking operation request for the associated industrial system. The method further includes capturing a lock operator's facial image, including a facial image of the locking operator. The lock operator's facial image is associated with the locking operation request. A deactivation of the locking status of the associated industrial system is initiated for the associated industrial system. Attached Figure Description

[0007] Figure 1 An example of an electronic security function lock-and-unlock system provided according to an embodiment of the present invention is shown.

[0008] Figure 2 An example of an electronic security function lock-and-unlock system provided according to another embodiment of the present invention is shown.

[0009] Figure 3 A human-machine interface (HMI) device provided according to an embodiment of the present disclosure is shown.

[0010] Figure 4 and Figure 3 Similarly, an operator interacting with the HMI device via biometric data is also shown.

[0011] Figure 5 and Figure 3 Similarly, it also shows an operator interacting with the HMI device via gestures.

[0012] Figure 6 yes Figures 3 to 5 A schematic diagram of an HMI device.

[0013] Figure 7 This is a flowchart illustrating a lock / unlock method with optional authorization checks and optional voice confirmation according to an embodiment of the present disclosure;

[0014] Figure 8 This is a flowchart illustrating a security counter system and method according to an embodiment of the present invention. Detailed Implementation

[0015] Figure 1 An example of an electronic security function locking / unlocking system S1 provided according to an embodiment of the present invention is shown. System S1 is operatively connected to and controls an associated controlled system S2, which includes industrial equipment E1. Industrial equipment E1 includes and is / is connected to a power switching unit PSU. The power switching unit PSU includes one or more mechanical and / or solid-state switches that control the power supply to industrial equipment E1. Industrial equipment E1 may include electrical and / or electromechanical systems, such as electrical switching devices and / or electric motors or other electromechanical actuators or any other electrical and / or mechanical equipment. The power switching unit PSU is selectively controlled to supply power to industrial equipment E1 or to disconnect industrial equipment E1 from power.

[0016] The locking / unlocking system S1 includes at least one human-machine interface (HMI) device H, through which an operator provides input to the locking / unlocking system S1 and the controlled system S2. One or more HMI devices H1, H2 typically also provide output to the operator, such as visual and / or auditory output relating to the status and / or other operational parameters of the locking / unlocking system S1 and / or the controlled system S2. As shown herein, the locking / unlocking system includes a first HMI device H hardwired to the locking / unlocking system S1, and also includes a second HMI device H wirelessly operably connected to the locking / unlocking system S1 via a suitable wireless connection (e.g., Bluetooth or WiFi connection), but the second HMI device H is otherwise identical to the hardwired HMI device H.

[0017] The locking / unlocking system S1 may include a data switch D (e.g., an Ethernet switch), with an HMI device H and other components (e.g., a power switch unit and industrial equipment E1) operably connected to the data switch D. The locking / unlocking system S1 may also include the following devices that provide inputs of data and / or control commands to the controlled system S2 and / or receive output data or signals from the controlled system S2: a controller C (e.g., a programmable logic controller (PLC)), one or more distributed I / O devices I, and / or one or more motor drive devices M.

[0018] One or more HMI devices H are operably connected to the power switching unit PSU of the controlled system S2 via a data switch D or otherwise (e.g., direct wired or wireless connection), enabling an operator to use the HMI devices H to operate the power switching unit PSU to turn the power connection of the industrial equipment E1 on or off. Figure 1 As shown, the HMI device H is located near the controlled system S2 or otherwise locally within the controlled system S2. Alternative locations, such as... Figure 2 As shown, each HMI device H or any of the HMI devices can be located remotely from the controlled system S2 and communicate with the power switching unit PSU of the controlled system S2 via a wired or wireless data network (e.g., the security network SN shown).

[0019] HMI device H may include conventional computer system input / output devices, such as a keyboard, keypad, one or more mechanical switches, a visual display such as a touchscreen display for combined input and output, indicator lights, etc. HMI device H may also include a processor and memory, and can perform general computing operations based on one or more stored programs. Figure 3 As shown, each of the illustrated HMI devices H includes a housing 12 that supports a touchscreen display or "touchscreen" 14 for outputting visual information to an operator and for receiving touchscreen input from the operator. In one example, the touchscreen 14 is a resistive and / or capacitive touchscreen display that senses the contact of the operator's finger. The touchscreen 14 may be a security touchscreen that includes both capacitive and resistive sensing inputs to provide redundant input to the lock / unlock system S1. The touchscreen 14 outputs to the operator user OP( Figure 4The HMI device S1 may provide one or more visual icons or other graphic elements 14i that provide visual output information, and the user may physically touch one or more of these graphic elements 14i with a finger or other body part to provide input data to the HMI and lock / unlock system S1. Each HMI device S1 may also include an emergency stop (Estop) switch 16 (or "button") that allows the operator to stop or at least slow down the controlled machine E1 in an emergency or other situation. When activated, the Estop switch 16 may cause the system S1 to cut off power to the controlled device E1. The HMI device S1 may include one or more visual output indicators (e.g., LED lights 18 shown) and may also include a speaker 20 for providing audible output indicators to the user. The HMI device S1 may also include at least one microphone input device 22 (e.g., a MEMS microphone) for receiving sound data from the operator or other sound data from the surrounding environment.

[0020] Each HMI device H also includes at least one camera device for facial recognition and gesture recognition, as described in detail below. As shown in the example illustrated, the HMI device H includes first and second redundant 3D time-of-flight (ToF) camera devices CM1, CM2 (e.g., laser ranging 3D camera devices shown), which enable 3D facial recognition and gesture recognition of the HMI operator. Figure 4 As shown, redundant camera devices CM1 and CM2 of the HMI device H are configured to capture 3D images of the operator OP's face FC. The first camera device CM1 and the second camera device CM2 independently generate corresponding first and second 3D facial images, and another component of the HMI device H or system S1 compares the first and second 3D facial images to confirm they match, i.e., confirming that both the first and second 3D facial images represent the same person. Microphone 22 senses any voice data originating from the operator OP, indicating the reason for the operation.

[0021] In a non-limiting example, the touchscreen display 14 is configured to display as shown in the image. Figure 3 and Figure 4 The diagram shows a lock / unlock graphical user interface (GUI) 114. The GUI 114 includes multiple lock / unlock control areas 114a, each including a user-selectable graphical element 14i, which includes a lock / unlock display element 115a, a user face image display element 115b, and a warning display element 115c. The GUI 114 may also include one or more configurable function display elements 115d, each configured to perform a selection function indicated by an adjacent label display element 115e.

[0022] Each lock / unlock display element 115a includes a user-selectable button display element. In one embodiment, each lock / unlock display element 115a switches or alternates between displaying a lock message (e.g., "Locked") when the corresponding lock / unlock control area 114a is ready to accept lock input from the operator and displaying an unlock message (e.g., "Unlocked") when the lock / unlock control area 114a is ready to accept unlock input from the operator. When the operator OP has interacted with the HMI device H to initiate a lock process (power interruption process) of the HMI device H relative to the controlled industrial equipment EI, as described herein, the lock / unlock control area 114a of the GUI 114 is in a locked mode. Alternatively, when the lock / unlock control area 114a of the GUI 114 is not in a locked mode, i.e., before the operator OP has interacted with the lock / unlock control area 114a or otherwise with the HMI device H to initiate a lock process (power interruption process) of the HMI device H relative to the controlled industrial equipment EI, the lock / unlock control area 114a of the GUI 114 is in an unlocked mode.

[0023] Furthermore, when the lock / unlock control area 114a of the GUI 114 is in lock mode, its corresponding facial image display element 115b displays the facial image of the operator who initiated the lock mode, captured by either of the camera devices CM1 or CM2 (i.e., the facial image display element 115b displays the "locked operator's facial image"), allowing the same operator, another operator, or other viewer on the display 14 to know the identity of the specific operator who initiated the lock mode associated with that particular lock / unlock control area 114a. Alternatively, the name of the operator represented by the facial image displayed by the facial image display element 115b can be displayed based on facial recognition data that associates the facial images captured by the camera devices CM1 or CM2 with the operator's name, or other data stored in the HMI device H. When the lock / unlock control area 114a is not in lock mode, the facial image display area 115b does not display a facial image (but may display a generic icon or other generic image representing a face).

[0024] Additionally, when the lock / unlock control area 114a of the GUI 114 is in locked mode, its warning display element 115c displays a warning message indicating that the operator (as depicted by the facial image display element 115b) has placed the controlled device EI in a locked (power-off) state and that the device EI should not be operated. Alternatively, when the lock / unlock control area 114a of the GUI 114 is in unlocked mode, the warning display element 115c can be used to provide the operator (OP) with visual instructions and / or other instructions on how to initiate a locked state.

[0025] Similarly, such as Figure 5 As shown, redundant camera devices CM1 and CM2 of the HMI device H are configured to capture gesture data representing at least a first gesture G1 and a second gesture G2 provided by the hand N of the operator OP. The first camera device CM1 and the second camera device CM2 independently capture corresponding first and second gesture images, and another component of the HMI device H or system S1 compares the first captured gesture image with the second captured gesture image to confirm they match, i.e., confirming that both the first and second gesture images represent the same gesture to provide redundancy. If the first and second gesture images captured by the first camera device CM1 and the second camera device CM2 do not match, the first and second gesture images are ignored. Figure 5 In one example shown, camera devices CM1 and CM2 are configured to capture at least: (i) a first pose G1 (e.g., the shape of a lowercase letter "L") indicating an input "lock" command to HMI device H and system S1; and (ii) a second pose G2 (e.g., the shape of a lowercase letter "U") indicating an input "unlock" command to HMI device H and system S1. As described above, the first and second redundant pose images, captured separately by the first camera device CM1 and the second camera device CM2, are compared with each other in the HMI or elsewhere in system S1 to ensure they match, thereby ensuring that the pose input provided to HMI device H is correctly interpreted.

[0026] Figure 6This is a schematic diagram of the HMI device H and its operational connection to the power switching unit PSU via a security network SN. A first Time-of-Flight (ToF) 3D camera device CM1 and a second Time-of-Flight (ToF) 3D camera device CM2 are operably connected to and controlled by a first camera device controller CC1 and a second camera device controller CC2, respectively. Camera device controllers CC1 and CC2 are each operably connected to an HMI processor P (e.g., a microprocessor or other processor), which may include a programmable general-purpose processor and / or an application-specific integrated circuit (ASIC) or another electronic processor. Therefore, the first camera device CM1 and the second camera device CM2 provide facial recognition data and pose data to the HMI processor P. Processor P implements a first face recognition and gesture recognition module or process FGR1 and a second face recognition and gesture recognition module or process FFGR2. The first face recognition and gesture recognition module or process FGR1 and the second face recognition and gesture recognition module or process FFGR2 independently process image data received from the first camera device CM1 and the second camera device CM2 to provide redundant face recognition and gesture recognition outputs. These redundant face recognition and gesture recognition outputs must be consistent with or correspond to each other; otherwise, they will be ignored. Processor P also implements a speech recognition and sound output module VSR, which receives and processes sound input data from microphone 22 (e.g., ...). Figure 4 The processor P also implements a touchscreen input / output module TS, which receives and processes touchscreen input from the touchscreen 14 and generates graphic elements 14i displayed on the touchscreen 14. The HMI also includes a memory Q, such as volatile and / or non-volatile random access memory (RAM) or other computer storage devices operatively connected to the HMI processor P. When the operator OP interacts with the HMI device, the HMI device H is able to: (i) receive facial recognition data representing the appearance and three-dimensional structure of the operator's face FC via the first 3D camera device CM1 and the second 3D camera device CM2; (ii) receive gesture data representing gestures performed by the operator OP via the first 3D camera device CM1 and the second 3D camera device CM2; and (iii) receive voice data VC representing the operator OP's voice via the microphone 22.

[0027] The HMI device H (and more specifically, its HMI processor P) is operatively connected to the power switch unit (PSU) of the controlled system S2 via a wired or wireless network connection (e.g., a hardwired secure network SN as shown). The power switch unit PSU itself includes a power switch controller PSC operatively connected to the HMI processor P via the network SN. For example, the power switch controller PSC may include a microprocessor or other processor, such as a programmable general-purpose processor and / or an application-specific integrated circuit (ASIC). The power switch controller PSC is operatively connected to at least one, and preferably first and second redundant power switches PS1, PS2, and controls at least one, and preferably first and second redundant power switches PS1, PS2, which, when turned off, each interrupt the connection to industrial equipment E1 (…). Figure 1 Power conduction.

[0028] Continue to refer to Figure 6 The power switch unit (PSU) also includes a feedback module (FB) that monitors the actual state (open / non-conducting or closed / conducting) of one or more power switches (PS1, PS2) and outputs at least one switch feedback signal indicating the actual state of one or more power switches (PS1, PS2) to the power switch controller (PSC) and the HMI processor (P). In one example, the feedback module (FB) outputs corresponding first and second switch feedback signals for the first power switch (PS1) and the second power switch (PS2). In another example, the feedback module (FB) outputs a single switch feedback signal indicating the overall conduction state (conducting or non-conducting) of the power switch unit (PSU). As described in more detail below, before further locking or unlocking operations and before indicating the completion of locking or unlocking operations, the power switch controller (PSC) and the HMI processor (P) use the switch feedback signals received from the feedback module (FB) to verify that the power switches (PS1, PS2) and / or the power switch unit (PSU) are actually in the state set by the HMI processor (P).

[0029] As shown in the following reference Figure 7 As described, utilizing Figures 1 to 6The disclosed system allows the HMI H to open or close at least one power switch PS1, or a first power switch PS1 and a second power switch PS2 (if provided) connected in parallel with each other, based on at least two of the following: (i) facial recognition data of the operator OP received from the 3D camera devices CM1, CM2; (ii) posture data of the operator OP received from the 3D camera devices CM1, CM2; (iii) voice data VC of the operator OP received from the microphone 22; and (iv) touchscreen data input by the operator OP via interaction with the touchscreen display 14. In one embodiment, the HMI H controls the power switch unit PSU solely based on: (i) facial recognition data of the operator OP; (ii) posture data and / or touchscreen input data from the operator OP. In another embodiment, the HMI H controls the power switch unit PSU based on: (i) facial recognition data of the operator OP; (ii) posture data and / or touchscreen input data from the operator OP; and (iii) voice data VC of the operator OP. In the example shown, systems S1 and S2 may be described as being in a “locked” or inactive state when either a single power switch PS1 or either the first power switch PS1 or the second power switch PS2 (if both are provided) is in an open (non-conducting) state. Conversely, systems S1 and S2 may be described as being in an “unlocked” or operational state when either a single power switch PS1 or either the first power switch PS1 or the second power switch PS2 (if both are provided) is in a closed (conducting) state. It should be noted that when the emergency stop switch / button 16 is pressed or otherwise actuated, it also causes the power switching unit PSU to enter its non-conducting state, thereby disconnecting one or more power switches PSI, PS2 and interrupting power conduction to device E1.

[0030] like Figure 6As shown, the power switching unit (PSU) also includes a memory (PM) used by the power switching controller (PSC) to store and track all lockout conditions initiated by an HMI H (if system S1 includes only a single HMI H) or by each of multiple HMI devices H (if system S1 includes multiple HMI devices H). The memory (PM) includes volatile memory and / or non-volatile memory (e.g., random access memory (RAM), non-volatile RAM), and / or non-volatile storage devices (e.g., disk drives and / or solid-state storage devices). The power switching controller (PSC) communicates with each HMI device H included as part of system S1 and updates all active lockout conditions, such that each lockout condition can be displayed and removed / cleared from any HMI device H in system S1, without needing to remove / clear each lockout condition from the same HMI device used to initiate the lockout condition. The memory PM is also used to continuously store and track the number of currently active latching conditions for system S1 to ensure that the power switching unit PSU is never set to its "ON" or conducting state unless the number of currently active latching conditions is equal to zero, as shown below. Figure 8 As described. Furthermore, the memory PM can be used to store timestamp data including time and date data, as well as logs of other data associated with each locking condition (e.g., the name and image of the operator initiating the locking condition). Similarly, the memory PM can be used to store logs of timestamp data including time and date data, as well as logs of other data associated with removing each locking condition (“unlocking” operation) (e.g., the name and image of the operator initiating the “unlocking” operation). Additionally or alternatively, each HMI device H can locally store a log of all locking and unlocking operations initiated on such device H, the log including timestamp data and operator data including operator name data, operator image data, etc.

[0031] Figure 7 This is a flowchart illustrating an industrial equipment locking / unlocking method M1 provided according to an embodiment of the present invention. The disclosed method M1 is executed by an HMI processor P, unless otherwise stated. Method M1 optionally includes the following steps: M1a – displaying a saver or blank screen on the touchscreen 14; M1b – determining whether the HMI device H has received a wake-up touch or wake-up sound (e.g., operator voice) on the touchscreen 14 instructing the operator OP to perform a locking or unlocking operation; M1c – if step M1b satisfies a "yes" output, waking up the HMI display 14 and displaying... Figure 3 and Figure 4 The lock / unlock graphical user interface (UI) shown (if no wake-up sound or touch is detected in step M1b, control returns from step M1b to step M1a).

[0032] In step M1d, the method includes determining whether the operator OP performs either of the following: (i) displaying a first gesture (e.g., a lowercase letter "L") to indicate input of a "lock" command (sub-step M1da); or (ii) providing first touch input by selecting the "lock" display element 115a of the GUI 114 (sub-step M1db). If either sub-step of step M1d satisfies a "yes" output, the method may proceed to an optional step M1e, which requires voice confirmation or affirmation from the operator OP of the lock command detected in step M1d. If optional step M1e is performed, the lock command detected in step M1d is ignored unless the voice confirmation step M1e satisfies a "yes" output based on one or more spoken words (voice) detected via microphone 22 by the operator OP (e.g., the operator can say the word "yes" etc. in response to an audio or visual cue from the HMI device H). The operator who initiates the lock operation may be referred to as the "lock operator".

[0033] If the voice confirmation step M1e is satisfied (or omitted), the method then includes step M1f, which uses at least one of the camera devices CM1 and CM2 to capture an image of the operator OP's face FC. The method optionally includes an optional face matching authorization step M1fa, which determines whether the face image captured in step M1f matches the face of a known operator OP authorized to initiate a lockout (power interruption) process against industrial equipment E1. Step M1fa compares the face image data captured in step M1f with a database of stored image data, which includes multiple authorized face images associated with and representing authorized operator faces. If optional step M1fa is performed, the lockout command detected in step M1d is ignored unless step M1fa is satisfied and an "yes" output indicating a match between the operator's face and a face in the authorized face database is provided. If optional step M1fa is performed and an authorized face match is determined (or if optional authorized face match step M1fa is omitted, the method proceeds to step M1g, in which, in addition to any pre-existing active "locked" conditions associated with the PSU, the HMI device H adds a new active "locked" or "locked" condition to the power switching unit PSU, increasing the lockout number by 1). Figure 8As shown, as determined by step S1, if the number of active “locked” states associated with the PSU (sometimes referred to as the “lockout number”) is greater than or equal to 1 (lockout number ≥ 1), the HMI commands the PSU to set its power switch PS1 or all power switches PS1, PS2 to an open (non-conductive or “off”) state to interrupt power to the associated device E1, thereby rendering device E1 inoperable and safe for maintenance and other activities, as indicated in box S2. Then, as part of method M1, step M1h is performed to display the captured operator’s facial image in the facial image display element 115b of GUI 114 and change the state of the lock / unlock display element from “locked” to “unlocked” or a similar state. The method then proceeds to step M1i, which updates GUI 114 to display another lock / unlock control area 114a (if that lock / unlock control area has not yet been displayed).

[0034] Returning to step M1d, if the operator OP does not perform any of the following: (i) displaying a first gesture (e.g., the lowercase letter "L") to indicate input of a "lock" command; or (ii) selecting one of the "lock" display elements 115a of GUI 114, then the method is controlled to proceed to step M1j to determine whether the operator OP performs any of the following: (i) displaying a second gesture (e.g., the letter "U") to indicate input of a "unlock" command (as determined via sub-step M1ja); or (ii) selecting one of the "unlock" display elements 115a of touchscreen GUI 114 (as determined via sub-step M1jb). If step M1j returns an "No" output from both substeps M1ja and M1jb, control returns to step M1d if activity is detected by the HMI's touchscreen 14, camera devices CM1, CM2, and / or microphone 22; otherwise, processing ends after, for example, a 5-second inactivity delay, as indicated by step M1x.

[0035] If step M1j satisfies the "Yes" output from either sub-step M1ja or M1jb, the method proceeds to optional steps M1k and M1m. Optional step M1k uses at least one of the camera devices CM1 and CM2 to capture an image of the operator's face FC. Step M1m compares the image captured in step M1k with an image previously captured in the preceding step M1f for the currently active "locked" state of the HMI device H to determine if the images match (indicating that the same person initiated the current active "locked" state). If the comparison in step M1m does not satisfy the condition (image mismatch), the "Unlock" input from step M1j is ignored because the "locked" state must be terminated by the same person who initiated it. If step M1m satisfies "yes" (for face matching in an active "locked" state), then in step M1n, GUI 114 is updated to highlight the matching face image display area 115b of the relevant face to be highlighted or otherwise emphasized (brightened, flashed, etc.), and optional step M1o can be performed to request voice confirmation or affirmation from the operator OP for the unlock command detected in step M1j. If optional voice confirmation step M1o is performed, the unlock command identified in step M1j is ignored unless voice confirmation step M1o satisfies "yes" output based on operator voice data (e.g., the word "yes") detected by microphone 22 in response to an audio or visual cue from HMI device H. If voice confirmation step M1o is satisfied (or omitted), the method then includes step M1p, which removes the associated active "locked" state for PSU from HMI device H, reducing the lock count by 1. Then, step M1q is executed to update the GUI display 114, to reset or delete the associated lock unlock control area 114a associated with the removed "lock" status, and control returns to step M1d. The operator who initiates the unlock operation to remove the lock status can be referred to as the "unlock operator".

[0036] Figure 8This is a flowchart illustrating a safety counter system and method SC according to an embodiment of the present invention. In the example shown, the power switch unit PSU is initially set to the "on" (conducting) state in step SC1. Optionally, step SC2 evaluates the state of the switch feedback signal provided by the feedback module FB of the power switch unit PSU. If step SC2 determines that the switch feedback signal is inconsistent with the indicated "on" state of the power switch unit PSU, an error / safety state SC2e is initiated within the power switch unit PSU to set the power switch unit PSU to its "off" state and / or otherwise disable the controlled device E1 to prevent unsafe conditions. The HMI display 114 may also be updated as part of the error / safety state SC2e to provide the operator with a visual output of the error, and the error may be recorded in the power switch unit memory PM. If step SC2 determines that the feedback signal is correct (consistent with the indicated "on" state of the power switch unit PSU), the method continues to step SC3 to evaluate whether the number of latches (the number of active "lock" states initiated for the power switch unit PSU) is greater than or equal to 1 (number of latches ≥ 1). If the number of interlocks is ≥1, the power switch unit PSU is set to its "off" (non-conducting) state in step SC4, for example, by disconnecting one or more power switches PS1, PS2. Optionally, step SC5 evaluates the state of the switch feedback signal provided by the feedback module FB of the power switch unit PSU. If step SC5 determines that the switch feedback signal is inconsistent with the indicated "off" state of the power switch unit PSU, an error / safety status SC5e is initiated in the power switch unit PSU to disconnect the emergency switch within the power switch unit PSU or otherwise interrupt power to the power switch unit PSU and / or disable the power switch unit PSU and / or disable the controlled device E1 to prevent unsafe conditions. The HMI display 114 can also be updated as part of the error / safety status SC5e to provide the operator with a visual output of the error, and the error can be recorded in the power switch unit memory PM. Each HMI device H can also optionally output a warning sound via speaker 20 and / or a warning light via indicator light 18. If step SC5 determines that the feedback signal is correct (consistent with the "off" state of the indicated power switch unit PSU), then steps SC3 to SC5 are repeated until step SC3 determines that the number of interlocks is no longer greater than or equal to 1 (i.e., until the number of interlocks is less than 1 (interlock number < 1), for example, when the number of interlocks = 0). Based on the fact that the number of interlocks is no longer greater than or equal to 1, control returns to step SC1, in which, for example by closing switches PS1 and PS2, the power switch unit PSU is once again set to its "on" (conducting) state. Figure 8The safety counter system ensures that if multiple lockout conditions have been initiated against the controlled system S2, the power switch unit PSU will remain in its "off" (non-conducting) state until all such lockout conditions have been removed.

[0037] In another alternative implementation, in an emergency, an operator with sufficient authority can override system S1 and remove all existing interlocking conditions established by all other operators to restore the power switch unit PSU to its "on" state. In another example implementation, two or more operators with sufficient authority are required to override system S1 to remove all existing interlocking conditions from all other operators to restore the power switch unit PSU to its "on" state. In such a case, Figure 7 Step M1m can verify the operator's identity and authority for this emergency operation through the facial matching operation in step M1m, and step M1p can be executed to remove all existing lockouts associated with the power switch unit PSY, so that the power switch unit is changed to its "on" state to activate the controlled device E1.

[0038] Various embodiments have been described in the foregoing description with reference to the accompanying drawings. However, it will be apparent that various modifications and alterations can be made thereto without departing from the broader scope of the invention as set forth in the appended claims, and other embodiments can be implemented. Therefore, the description and drawings are to be considered illustrative rather than restrictive.

Claims

1. An electronic security function locking and unlocking system, comprising: Human-machine interface device, the human-machine interface device comprising: processor; A touchscreen display, controlled by the processor and configured to display a plurality of display elements relating to an associated controlled system; At least one camera device is used to capture at least one of the following: (i) operator gesture input in relation to the associated controlled system; (ii) operator image data; The human-machine interface device is configured to display a graphical user interface including the plurality of display elements on the touch screen display, wherein the graphical user interface includes a lock / unlock control area, the lock / unlock control area including: (i) a user-selectable button display element; and (ii) an operator image display element; The human-machine interface device is configured such that when the first operator initiates the locking operation, the operator image display element of the graphical user interface displays the locking operator image; Wherein, when the locking operator of the human-machine interface device initiates a locking operation by at least one of the following, the at least one camera device captures the locking operator's image: (i) a first input gesture captured by the at least one camera device; (ii) a first touch input to the user-selectable button display element of the lock / unlock control area of ​​the graphical user interface on the touch screen display; When the unlocking operator of the human-machine interface device initiates an unlocking operation by at least one of the following, the at least one camera device captures an image of the unlocking operator: (i) a second input gesture captured by the at least one camera device; (ii) a second touch input on the user-selectable button display element of the lock / unlock control area of ​​the graphical user interface on the touchscreen display; and The human-machine interface device is configured as follows: Compare the unlocking operator image with the locking operator image; and The unlocking operation is initiated only if the unlocking operator image and the locking operator image represent the same person.

2. The electronic security function locking and unlocking system according to claim 1, wherein, The human-machine interface device is configured such that the lock / unlock control area of ​​the graphical user interface displays a message that notifies the viewer of the touchscreen display that the lock operator shown in the operator image display element has initiated the lock operation.

3. The electronic security function locking and unlocking system according to claim 1, wherein, The human-machine interface device is operatively connected to the power switch unit of the associated controlled system, and when the locking operator initiates the locking operation, the human-machine interface controls the power switch unit to disconnect power from the industrial equipment of the associated controlled system.

4. The electronic security function locking and unlocking system according to claim 1, wherein, The at least one camera device includes a redundant first camera device and a second camera device.

5. The electronic security function locking and unlocking system according to claim 4, wherein, The first camera device and the second camera device are each three-dimensional time-of-flight laser ranging cameras.

6. The electronic security function locking and unlocking system according to claim 1, wherein, The human-machine interface device further includes: A speaker, wherein the human-machine interface device is configured to output an audible request to confirm at least one of the locking and unlocking operations; and A microphone, wherein the human-machine interface device is configured to input an audible response from at least one of the locking operator and the unlocking operator in response to the audible request.

7. A method for selectively locking and unlocking an industrial system, the method comprising: Receive a first lock input request to a first human-machine interface device from a first lock operator, the first lock input request indicating a first lock operation request for the associated industrial system; Capture a first lock operator's facial image, including the facial image of the first lock operator; Associate the facial image of the first locking operator with the first locking input request; Initiate a first lockout state against the associated industrial system, which disables the associated industrial system; Update the visual output display of the first human-machine interface device to display the facial image of the first locking operator associated with the first locking status; A first unlock input request is received from a first unlock operator for the first or second human-machine interface device, the first unlock input request indicating an unlock operation request for the associated industrial system, wherein the first unlock input request is associated with the first locking status; Capture a first unlocking operator's facial image, including the facial image of the first unlocking operator; Associate the facial image of the first unlocking operator with the first unlocking input request; Determine whether the first unlocking operator and the first locking operator are the same person; and The first lock status for the associated industrial system is removed only if the first unlocking operator and the first locking operator are the same person.

8. The method according to claim 7, wherein, The first lock input request includes one of the following: (i) gesture input of the first lock operator captured by the camera device; (ii) Touchscreen input from the first locking operator.

9. The method according to claim 7, further comprising: Before initiating the first locking status, a lock confirmation voice input is received from the first locking operator to confirm the first lock input request.

10. The method according to claim 7, wherein, The step of determining whether the first unlocking operator and the first locking operator are the same person includes comparing the facial image of the first unlocking operator with the facial image of the first locking operator.

11. The method of claim 7, further comprising receiving an unlock confirmation voice input from the first unlock operator confirming the first unlock input request.

12. The method of claim 7, further comprising: Determine whether the first locking operator is authorized; The step of initiating the first locking status is performed only if the first locking operator is authorized.

13. The method according to claim 12, wherein, The steps for determining whether the first locking operator is authorized include: The facial image of the first locking operator is compared with multiple images of authorized locking operators; The first locking operator is determined to be authorized only if the facial image of the locking operator matches one of a plurality of images of the authorized locking operator.

14. The method of claim 7, further comprising: Receive a second lock input request from a second lock operator to the first or second human-machine interface device, the second lock input request indicating a second lock operation request for the associated industrial system; Capture a second locking operator's facial image, including the facial image of the second locking operator; Associate the second locking operator's facial image with the second locking input request; Initiate a second lockout state against the associated industrial system, which disables the associated industrial system.

15. The method of claim 14, further comprising: The third locking operator receives a third locking input request for the first, second, or third human-machine interface device, the third locking input request indicating a third locking operation request for the associated industrial system. Capture a third locking operator's facial image, including the facial image of the third locking operator; Associate the third lock operator's facial image with the third lock input request; Initiate a third lockout state against the associated industrial system, which disables the associated industrial system; After the third locking condition is initiated, an unlock input request is received from the unlocking operator for the first HMI device, the second HMI device, the third HMI device, or the fourth HMI device. The unlock input request indicates an unlock operation request for the associated industrial system, wherein the unlock input request is associated with a selected locking condition among the first locking condition, the second locking condition, or the third locking condition. Capture an image of the unlocking operator's face, including the unlocking operator's facial image; Facial recognition is used to determine whether the unlocking operator is authorized to remove a selected lock status from the first, second, and third lock statuses; and The selected lock status among the first, second, and third lock statuses for the associated industrial system is removed only when the unlocking operator is authorized.

Images