Security device comprising tamper-resistant means and method of manufacturing same

Abstract

A safety device (1) configured to be mounted on an industrial machine or facility (100) to prevent machine startup when the machine (100) is in a state in which there is a potential risk to an operator, the safety device comprising: mounting means (13) for mechanically and / or electrically and / or electronically connecting the safety device (1) to the machine (10) by creating an original mounting state; and a tamper-proof device (20) associated with the mounting device (13) and comprising a corresponding identification element (21).

Description

[0001] Cross-citation to related applications

[0002] This application claims the benefit of Italian Patent Application No. 102024000002740, filed on February 9, 2024, the entire contents of which are incorporated herein by reference. Technical Field

[0003] The present invention relates, for example but without limiting its generality, to a safety device for an industrial machine or installation, the safety device being provided with anti-tampering means and being suitable for preventing hazardous operation of the machine or installation, and also to a method for producing the safety device. Background Art

[0004] As is known to all, industrial machines or facilities (hereinafter referred to as machines) that may present dangerous conditions during operation are generally equipped with safety devices to prevent operators from being exposed to the dangerous conditions.

[0005] Such hazardous conditions arise, for example, when operating parts of industrial machines are subject to motion, pressure, and / or high temperatures.

[0006] An example of a safety device is a safety switch mounted to a machine access guard that inhibits operation of the machine upon detecting a hazardous condition (such as when the guard is positioned so that an operator can enter the machine). Typically, safety switches can directly inhibit operation of the machine, or they can be connected to a machine control unit to signal a hazardous condition. In the latter case, the machine control unit inhibits operation of the machine upon signaling a hazardous condition.

[0007] Typically, in order for safety devices to function correctly (i.e., ensure operator safety), they must be installed in the machine or facility according to precise installation diagrams, such as those defined by workplace safety regulations in force in the area where the machine is operated.

[0008] Furthermore, it is crucial to maintain the safety equipment in its original installed condition throughout the operational life of the machine or facility.

[0009] To ensure this, security devices need to include tamper-resistant elements to prevent tampering with the security devices and modifying their original installed state.

[0010] An example of an anti-tamper element is a cap that is applied to a screw that secures the security device to the machine or the housing of the machine. These caps prevent an operator from removing the security device or a portion thereof from its original installation location.

[0011] For example, in the case of a safety switch having a separate actuator, with the switch secured to a fixed portion of the guard and the actuator secured to a movable portion of the guard, the cap prevents an operator from easily removing the actuator from the movable portion of the guard and independently moving it proximate the safety switch, or vice versa, while holding the guard open.

[0012] Another example of a tamper-proof element is a protective cover that can be fitted to a connector of a security device, designed to prevent the device from being disconnected from the cable connecting it to the machine or machine control unit. In this case, to disconnect the cable, the protective cover must be visibly and irreversibly damaged. Consequently, in this case, restoring the original connection state is impossible without revealing the previous tampering.

[0013] Of course, an operator can always remove the actuator from the moving part of the guard, but to do so, the tamper-evident element (i.e., the cap) must be damaged, thereby revealing the tampering. Once disassembly is achieved by damaging the tamper-evident element, it is impossible to secure the security device in its original position without revealing the previous tampering. In fact, the tampering is revealed by the damage or loss of the previously damaged tamper-evident element, thus changing the original installation state of the security device.

[0014] This protects the machine manufacturer or anyone responsible for the correct installation of the machine, since in the event of an accident any tampering with the safety device will be revealed by the absence of the tamper-proof element.

[0015] The applicant notes that security devices are typically supplied to manufacturers of industrial machines or equipment with a sufficient number of tamper-resistant elements for a single installation. Furthermore, to avoid the risk of tampering being concealed, such tamper-resistant elements are typically not commercially available. Indeed, if they were readily available, any tampering could easily be concealed by applying new tamper-resistant elements discovered on the market.

[0016] In this context, manufacturers of industrial machines or facilities that have already installed safety equipment cannot change the location of the equipment without damaging the anti-tampering mechanism.

[0017] Therefore, if the safety device is not installed accurately, the machine manufacturer cannot reposition it without damaging the tamper-evident mechanism.

[0018] This is dangerous because it could lead to machine manufacturers releasing machines onto the market without anti-tampering devices.

[0019] It is therefore an object of the present invention to provide a security device with an anti-tampering device, the installation state of which can be changed without compromising the effectiveness of the anti-tampering device.

[0020] It is therefore an object of the present invention to provide a security device with an anti-tampering device which is cost-effective and of simple construction.

[0021] Another object of the present invention is to develop a production method for a security device that can change its installation state without compromising the effectiveness of the anti-tampering means. Summary of the Invention

[0022] In accordance with the above-mentioned objectives, the present invention provides a safety device configured to be installed on an industrial machine or facility and adapted to prevent the machine from starting when the machine is in a state that is potentially dangerous to an operator, wherein the safety device comprises: a sensor device configured to at least detect a dangerous state; a switching device configured to transmit a safety signal encoding the state detected by the sensor device; a mounting device configured to mechanically and / or electrically connect the safety device to the machine in its original mounted state; an anti-tamper device associated with the mounting device and configured to prevent modification of the safety device in its original mounted state; wherein each anti-tamper device comprises a corresponding identification element configured to distinguish the corresponding anti-tamper device from other anti-tamper devices. The present invention is preferably, but not necessarily, limited to the forms defined in the dependent claims.

[0023] The claims describe preferred forms of embodiment of the invention and form an integral part of the present description. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In the following, for a better understanding of the invention, certain forms of implementation of the invention will be described by way of non-limiting examples and with reference to the accompanying drawings, in which:

[0025] - Figure 1 is a schematic diagram of a machine protected by a housing associated with a safety device according to the present invention;

[0026] - Figure 2 is a schematic diagram of a safety device according to the present invention connected to a machine control unit;

[0027] - Figure 3 and Figure 4 are isometric views of a security device provided with an anti-tampering device according to an embodiment of the present invention in an exploded state and an installed state, respectively;

[0028] - Figure 5 and Figure 6 yes Figure 4 Magnified image of;

[0029] - Figure 7 and Figure 8 are isometric views of a security device provided with an anti-tampering device according to an embodiment of the present invention in an exploded state and an installed state, respectively;

[0030] - Figure 9 and Figure 10 yes Figure 8 Magnified image of . DETAILED DESCRIPTION

[0031] refer to Figure 1 In the example shown in FIG, numeral 1 denotes a safety device for an industrial machine or facility (hereinafter simply referred to as a machine 100 ) according to the present invention, which is configured to prevent a dangerous operation of the machine 100 when an operator faces a dangerous state.

[0032] In this specification and claims, a dangerous state refers to a state in which an operator may come into contact with a dangerous component of the machine 100 when the machine 100 is started. Figure 1 In a case where a machine 100 is surrounded by a protective barrier 102 provided with an entrance 103 protected by a movable guard 104, a hazardous situation arises when the movable guard 104 enables an operator to pass through the entrance 103 and approach the machine 100. In fact, in this case, if the machine 100 is started with the movable guard 104 enabling the operator to pass through the entrance 103 and approach the machine 100, the operator may come into contact with hazardous elements of the machine 100 (such as moving, pressurized, hot or other parts).

[0033] refer to Figure 1 and Figure 2 The safety device 1 may include: a safety switch 10 configured to be fixed to a protective barrier 102 near an entrance 103 ; and an actuator 14 configured to be fixed to a movable guard 104 .

[0034] The safety device 1 further comprises a sensor device 11 configured to detect at least a dangerous state, and a switching device 12 configured to safely transmit a safety signal S related to the state detected by the sensor device 11 .

[0035] The sensor device 11 depends on the type of safety device 1 , ie the dangerous state to be detected.

[0036] For example, reference Figures 3 to 6 The sensor device 11 includes a proximity sensor associated with the safety switch 10 for detecting whether an actuator (not shown) is near the safety switch 10 .

[0037] In this case, the sensor device 11 detects a dangerous state when the actuator is not in the vicinity of the safety switch 10 (ie when the movable guard 104 is opened).

[0038] Alternatively or additionally, reference Figures 7 to 10 The safety switch 10 may include a locking mechanism for locking an actuator (not shown) from contact with the safety switch 10. The locking mechanism may have a locked position in which the locking mechanism locks the actuator from contact with the safety switch 10 and an unlocked position in which the locking mechanism enables the actuator to move away from the safety switch 10.

[0039] In this case, the sensor device 11 may include a position sensor for detecting the locking mechanism position and detecting the dangerous state when the locking mechanism is in the unlocked position, ie when the movable guard 104 is opened or can be opened.

[0040] It is readily understood by those skilled in the art that the sensor device 11 may also be completely different from those described herein, depending on the dangerous state to be detected, without departing from the scope of the present invention.

[0041] The switching device 12 is configured to transmit the safety signal S to the control device 105 ( Figure 2 ), which enables or disables the operation of the machine 100 based on the safety signal S.

[0042] By way of example, if the safety signal S indicates that the sensor device 11 detects a dangerous state, the control device 105 prohibits the operation of the machine 100. Conversely, if the safety signal S indicates that the sensor device 11 does not detect a dangerous state, the control device 105 allows the operation of the machine 100.

[0043] In a preferred embodiment, the safety device 1 further comprises an electronic control unit (not shown) connected to the sensor device 11 and configured to drive the switching device 12 depending on the state detected by the sensor device 11 .

[0044] For example, the switching device 12 is configured to switch from the active state to the inactive state when the sensor device 11 detects a dangerous state, or vice versa. For example, the switching device 12 is configured to switch from the active state to the inactive state when the sensor device 11 detects a dangerous state.

[0045] Alternatively or additionally, switching device 12 may be driven by an electronic control unit to generate a digital signal for switching from an active state to an inactive state, and vice versa, i.e., a bit sequence encoding a telegram according to a communication protocol. The communication protocol may be a known type such as IO-Link, Profinet, EtherCAT, EtherNet / IP, IO-Link Saftey, Profisafe, CIP Saftey, Saftey over EtherCAT (FSoE), or any other similar communication protocol. In this case, some bits of the telegram encode information related to the state detected by sensor device 11.

[0046] Preferably, the telegram also comprises a verification bit (CRC, watchdog, sequence number related to a previously transmitted telegram) configured to guarantee the integrity of the telegram itself and generated from other bits of the telegram and / or from a previously transmitted telegram.

[0047] In a preferred embodiment, the switching means 12 comprise a pair of safe electronic outputs of the OSSD (Output Signal Switching Device) type driven by an electronic control unit.

[0048] Merely by way of example, an OSSD safety output transmits a signal in an activated state and assumes a logical state of "1" or "ON", and does not transmit a signal in an inactivated state and assumes a logical state of "0" or "OFF".

[0049] The safety device 1 further comprises a mounting device 13 configured to be able to mount the safety device 1 on the machine 100 or on a structure connected thereto (eg the protective barrier 102 ) and to generate an initial mounting state.

[0050] The original installation state refers to a state in which the safety device 1 is correctly installed mechanically and electrically on the machine 100 to ensure a correct safety level for the operator according to the applicable standards.

[0051] It should be noted that here and hereinafter, “electrical ground” also refers to “electronic ground”.

[0052] The mounting arrangement 13 comprises components for mechanically connecting the safety device 1 to the machine 100 or a related structure, such as the protective barrier 102 .

[0053] The means for mechanical connection may comprise holes or slots formed directly in the safety device 1 , and corresponding fastening elements, such as screws, bolts or the like.

[0054] exist Figures 3 to 10In the example of FIG, the component for mechanical connection includes at least one fixing hole 15 formed on the safety switch 10, and a corresponding fixing element 16, such as a screw. Preferably, the component for mechanical connection also includes at least one fixing hole formed on the actuator 14, and a corresponding fixing element.

[0055] Alternatively or additionally, the mounting device 13 comprises means for electronically connecting the safety device 1 to a control device 105 of the machine 100. The means for electronic connection are connected to the switching device 12 and are configured to transmit the safety signal S to the control device 105 of the machine 100.

[0056] exist Figures 3 to 10 In the example of FIG. 1 , the means for electronic connection comprise at least a first connector 17 suitable for being connected to a control device 105 of the machine 100 .

[0057] The first connector 17 is male or female and is adapted to be connected to a second connector 18 which in turn is directly or indirectly connected to the control device 105 .

[0058] The security device 1 further comprises anti-tamper or anti-tamper means 20 associated with the mounting means 13 and configured to prevent access to the mounting means 13 after the security device 1 has reached the original mounted state.

[0059] Specifically, the tamper-proof device 20 is configured to prevent an operator from modifying the original installation state of the security device 1. Preferably, the tamper-proof device 20 is configured to prevent an operator from making reversible and unnoticeable modifications to the original installation state of the security device 1. In other words, in order to modify the original installation state, the operator must damage the tamper-proof device 20, thereby revealing the tampering.

[0060] In fact, in order to reach the mounting device 13 and change the original mounted state of the security device 1 , the anti-tampering device 20 is arranged such that it must be damaged by the operator.

[0061] refer to Figures 3 to 10 In the example of FIG. 2 , the tamper-proof device 20 comprises a covering element configured to prevent access to the mechanical connection device from the outside.

[0062] By way of example, refer to Figures 3 to 5 and Figures 7 to 9The covering element includes a plurality of sealing plugs 25, which are inserted into each fixing hole 15 with an interference fit and positioned above the corresponding fixing element 16. Thus, the sealing plugs 25 prevent an operator from reaching the fixing element 16 and thereby changing the original installation state. Furthermore, since the sealing plugs 25 are inserted into the fixing holes 15 with an interference fit, in order to remove the sealing plugs from the corresponding fixing holes 15 so that they can act on the fixing element 16, the sealing plugs must be damaged.

[0063] Alternatively or additionally, the tamper-proof device 20 further comprises a protective member of the electronic connection device configured to prevent access to the electronic connection device from the outside.

[0064] For example, reference Figure 3 、 Figure 4 、 Figure 6 as well as Figure 7 、 Figure 8 、 Figure 10 The protective component of the electronic connection device includes at least two housings 27, which are adapted to define a storage space between them and are adapted to accommodate at least a portion of the first connector 17 and the second connector 18 connected to each other. The two housings 27 are further configured to be mechanically connected to each other by means of a shape-fitting element 28 arranged within the storage space. In this way, the two housings 27 prevent an operator from reaching the first connector 17 and the second connector 18 and thereby changing the original installation state. In addition, since the shape-fitting element 28 is arranged within the storage space defined by the housings 27, in order to disconnect the first connector 17 from the second connector 18, the shape-fitting element must be damaged.

[0065] According to one aspect of the present invention, each of the tamper-resistant devices 20 is associated with a corresponding identification element 21, which is configured to distinguish the corresponding tamper-resistant device from other tamper-resistant devices. Figures 3 to 10 Each of the tamper-proof devices 20 includes a corresponding identification element 21, which is configured to distinguish the corresponding tamper-proof device 20 from other undamaged tamper-proof devices 20 when it is intact.

[0066] Preferably, each tamper-resistant device 20 comprises a respective unique identification element 21 configured to distinguish the respective tamper-resistant device 20 from the other tamper-resistant devices 20. Even more preferably, the unique identification element 21 is configured to distinguish the respective tamper-resistant device 20 from all other tamper-resistant devices 20.

[0067] In this case, unique refers to an identification element 21 consisting of attributes that can generate more than 1000 different combinations. For example, an alphanumeric code consisting of 3 characters can generate at least 32000 different combinations.

[0068] Alternatively, the tamper-resistant devices 20 of the security device 1 include respective identification elements 21 configured to distinguish them from other tamper-resistant devices not associated with the security device 1. In this case, the tamper-resistant devices 20 of the security device 1 may include respective identical identification elements 21 for two or more tamper-resistant devices of the same security device 1.

[0069] In particular, each of these tamper-resistant devices 20 comprises its own unique identification element 21 .

[0070] Advantageously, the identification element 21 enables the manufacturer of the machine 100 to know and record exactly the specific anti-tampering means 20 that the security device 1 comprises in its originally installed state.

[0071] In this way, by comparing the identification element 21 of the tamper-proof device 20 installed on the security device 1 with the identification element 21 of the tamper-proof device 20 recorded when the original installation state of the security device 1 was created, any possible tampering, i.e. any unauthorized modification to the original installation state, can be easily detected.

[0072] In other words, the identification element 21 makes it possible to distinguish between an original installation state and a subsequent installation state of the safety device 1 .

[0073] This increases the security of the security device 1 and of the machine 100 in which it is installed, since the anti-tampering device 20 according to the invention can always detect any unauthorized and potentially dangerous modifications to the original installation state of the security device 1 .

[0074] In fact, any modification to the original installed state entails destroying the original anti-tampering means 20 that the security device 1 comprises in its original installed state and replacing it with a new anti-tampering means 20 .

[0075] A further advantage is that the manufacturer of the machine 100 can change the installation state of the security device 1 , with each change the identification element 21 of the new tamper-proof device 20 installed in the new original installation state being registered.

[0076] In other words, on the one hand, the present invention is always able to detect whether the original installation state of the safety device 1 has been changed without authorization, and on the other hand, the present invention enables the manufacturer of the machine 100 to change the original installation state over time while maintaining the ability to detect any unauthorized and potentially dangerous changes to the last original installation state.

[0077] The identification element 21 may be of any type suitable for unique identification, for example it may be an optical, magnetic, electromagnetic element.

[0078] For example, reference Figures 3 to 6 , the identification element 21 may include an alphanumeric code formed or printed on a surface of each tamper-evident device 20. Preferably, the alphanumeric code is formed on an outer surface of each tamper-evident device 20.

[0079] In reference Figure 7 、 Figure 8 and Figure 10 In other possible embodiments, the identification element 21 may include a graphic matrix code formed on the surface of each tamper-resistant device 20. The graphic matrix code may be one-dimensional (e.g., a barcode) or two-dimensional (e.g., a QR code).

[0080] Again, preferably, a graphic matrix code is formed on the outer surface of each tamper-evident device 20 .

[0081] In reference Figures 7 to 9 In other embodiments, the identification element may include a resonant circuit that can be powered by an external antenna and transmits a unique identification code to the antenna. For example, the resonant circuit may be of NFC (near field communication) or RFID (radio frequency identification) type.

[0082] The invention also relates to a method for producing a security device 1 provided with the tamper-evident means 20 described herein.

[0083] In particular, the method of the invention provides for at least one identification step in which each tamper-evident device 20 is associated with a unique identification element 21 configured to distinguish the respective tamper-evident device 20 from the other tamper-evident devices 20 .

Claims

1. A safety device (1) configured to be mounted on an industrial machine or facility (100) and adapted to prevent the machine (100) from starting when the machine (100) is in a state potentially dangerous to an operator, wherein: The safety equipment includes: • a sensor device (11) configured to detect at least said dangerous state; • a switching device (12) configured to transmit a safety signal (S) encoding the state detected by the sensor device (11); • mounting means (13) configured to mechanically and / or electrically connect the safety device (1) to the machine (10) in an originally mounted state of the safety device (1); • anti-tampering means (20), associated with said mounting means (13) and configured to prevent modifications to said original mounted state of said security device (1) on said machine (100); It is characterized in that each of the tamper-proof devices (20) comprises a corresponding identification element (21), and the identification element is configured to distinguish the corresponding tamper-proof device (20) from other tamper-proof devices (20).

2. The safety device (1) according to claim 1, characterized in that The identification element (21) is capable of distinguishing the original installation state from a subsequent installation state of the safety device (1).

3. The safety device (1) according to claim 1, characterized in that The identification element (21) comprises an alphanumeric code.

4. The safety device (1) according to claim 1, characterized in that The identification element (21) comprises a one-dimensional or two-dimensional matrix graphic code.

5. The safety device (1) according to claim 1, characterized in that The identification element (21) comprises a resonant circuit.

6. The safety device (1) according to claim 1, characterized in that Each of the tamper-resistant devices (20) includes a respective unique identification element (21) configured to distinguish the respective tamper-resistant device (20) from all other tamper-resistant devices (20).

7. The safety device (1) according to claim 1, characterized in that The tamper-proof device (20) comprises a corresponding identification element (21) configured to distinguish the identification element from other tamper-proof devices not associated with the security device (1).

8. The safety device (1) according to claim 1, wherein The mounting device (13) comprises a fixing hole (15) designed to accommodate a fixing element (16) for attaching the security device (1) to the machine (10), characterized in that the tamper-proof device (20) comprises a sealing plug (25) for the fixing hole (15), the sealing plug being configured to prevent access to the fixing element (16).

9. The safety device (1) according to claim 1, wherein The mounting device (13) comprises at least a first electrical connector (17) connected to the switching device (12), the first electrical connector being configured to be connected to a second electrical connector (18), the second electrical connector being in turn connected to a control device (105) of the machine (100), characterized in that the tamper-proof device (20) comprises at least one protective element (27) which is applicable to at least one of the first electrical connector (17) and the second electrical connector (18) and is configured to prevent the first electrical connector (17) from being disconnected from the second electrical connector (18).

10. The safety device (1) according to claim 1, characterized in that The safety device comprises a safety switch (10) and an actuator (14) configured to interact with the safety switch (10), wherein the safety switch (10) and the actuator (14) comprise respective mounting devices (13) provided with respective anti-tampering devices (20).

11. The safety device (1) according to claim 10, characterized in that The safety switch (10) comprises the sensor device (11), and wherein the sensor device (11) is configured to detect an interaction of the actuator (14) with the safety switch (10).

12. The safety device (1) according to claim 10, wherein The safety switch (10) is configured to be attached to a protective barrier (102) provided with an entrance (103) to the machine (10), and the actuator (14) is configured to be attached to a movable guard (104) of the entrance (103) to interact with the safety switch (10) when the movable guard (104) is closed.

13. A method for producing a safety device (1) configured to be mounted on an industrial machine or facility (100) and designed to prevent the machine (100) from starting when the machine (100) is in a state potentially dangerous to an operator, wherein: The safety device (1) comprises: • a sensor device (11) configured to detect at least said dangerous state; • a switching device (12) configured to transmit a safety signal (S) encoding the state detected by the sensor device (11); • mounting means (13) configured to mechanically and / or electrically connect the safety device (1) to the machine (10) in an originally mounted state of the safety device (1); • anti-tampering means (20), associated with said mounting means (13) and configured to prevent modifications to said original mounted state of said security device (1) on said industrial machine or facility (100); The method comprises an identification step, in which, when each of the tamper-proof devices (20) is intact, a corresponding unique identification element (21) is assigned to each of the tamper-proof devices, wherein the unique identification element is configured to distinguish the corresponding tamper-proof device (20) from other tamper-proof devices (20).

Images