Safety control system

Abstract

The invention discloses a safety control system which comprises a first control system, a second control system and a switch assembly. A first interface of the first control system is connected with the working system and is used for receiving a safety abnormal signal transmitted by the working system and sending a first control signal based on the safety abnormal signal; the second control system is connected with the working system and is used for receiving the safety abnormal signal and sending out a first control signal based on the safety abnormal signal; the switch assembly is used for controlling the working state of the second control system, and the working state of the second control system comprises the second control system starting state and the second control system stopping state. By arranging the first control system and the second control system to jointly respond to the safety abnormal signal of the working system, the response efficiency of the safety abnormal signal of the working system is improved, the practicability and safety of the safety control system are improved, and the use experience of a user on the safety control system is improved.

Description

Technical Field

[0001] The present application relates to the field of system control technology, and in particular to a safety control system. Background Art

[0002] Industrial robots are currently widely used, but their safety control systems are still underdeveloped. Typically, these systems employ a low-cost intermediate relay plus a safety relay, or a combination of a safety controller, emergency stop button, safety door lock, hand pressure switch, mode switch, confirmation button, and reset button. While both solutions offer advantages in safety and reliability, they also have significant disadvantages. They only function as emergency stops, and if operators habitually use the emergency stop button as a pause button, this can significantly damage the robot and shorten its service life.

[0003] A third solution has emerged, which uses dual MCUs (Microcontroller Units) plus three-way relay redundancy. The advantage is good flexibility, flexible configuration of stop modes, and monitoring of alarm status. The disadvantage is that the MCU is easily interfered with, the embedded software is prone to errors, and there is only one relay and three-way redundancy, so the safety and reliability are not high, and it does not meet functional safety standards, making it difficult to pass relevant safety certifications. Summary of the Invention

[0004] In order to solve the above technical problems, the present application provides a safety control system, comprising:

[0005] a first control system, wherein a first interface of the first control system is connected to the working system, and is configured to receive a safety abnormality signal transmitted by the working system, and to issue a first control signal based on the safety abnormality signal;

[0006] a second control system connected to the working system, configured to receive the safety abnormality signal and issue the first control signal based on the safety abnormality signal;

[0007] a switch assembly connected to the second control system and configured to control a working state of the second control system, wherein the working state of the second control system includes the second control system being turned on and the second control system being turned off;

[0008] The first control system or the second control system receives a safety abnormality signal from the working system, and generates the first control signal based on the safety abnormality signal, wherein the first control signal is used to control the state of the working system.

[0009] Wherein, the first control system further includes a processing module, a first execution module and a second interface, the first execution module being connected to the processing module and the first interface respectively, the first execution module being configured to transmit the received safety abnormality signal to the processing module, and the processing module being configured to send a feedback signal to the first execution module based on the safety abnormality signal;

[0010] The first execution module is further connected to the working system through the second interface, and is configured to send the first control signal to the working system based on the feedback signal.

[0011] In which, the first control system also includes a second execution module, which is connected to the first execution module. The first execution module is also used to send a second control signal to the second execution module based on the feedback signal to shut down the execution function of the second execution module through the second control signal.

[0012] Among them, the second execution module is also connected to the working system through the first interface and the second interface respectively. The second execution module is used to receive the safety abnormality signal through the first interface, and when it has an execution function, output the first control signal to the working system through the second interface.

[0013] The working system includes a robot system and an equipment system, the robot system is used to participate in the working operation in the equipment system, the first execution module is connected to the robot system and the equipment system respectively, and the first control signal includes an emergency stop signal, a delayed stop signal and an external emergency stop signal;

[0014] The first execution module is used to send the emergency stop signal or the delayed stop signal to the robot system to control the shutdown of the robot system; or send an external emergency stop signal to the equipment system to control the shutdown of the equipment system.

[0015] Wherein, the second control system includes a safety controller and a safety relay, the enable terminal of the safety controller is connected to the switch component, and the switch component controls the working state of the safety controller through the enable terminal;

[0016] Among them, the first receiving end, the second receiving end, the third receiving end and the fourth receiving end of the safety controller are connected to the working system, and the working system includes a robot system and an equipment system. The first output end of the safety controller is connected to the robot system through the safety relay, and the second output end of the safety controller is connected to the equipment system. The safety controller is used to send the first control signal to the safety relay and the equipment system when the first receiving end, the second receiving end, the third receiving end or the fourth receiving end receives the safety abnormality signal. The first control signal is used to control the connection status of the safety relay and the working status of the equipment system.

[0017] Among them, the first control signal includes an emergency stop signal and an external emergency stop signal, the status end of the safety controller is grounded, and the first output end is used to send the emergency stop signal to the safety relay when the first receiving end, the second receiving end or the third receiving end receives the safety abnormality signal, and the emergency stop signal is used to control the safety relay to disconnect immediately; the second output end is used to output the external emergency stop signal to the equipment system, and the external emergency stop signal is used to control the equipment system to shut down.

[0018] Among them, the first control signal includes a delayed stop signal and an external emergency stop signal, the status end of the safety controller is connected to the power supply, and the first output end is used to send the delayed stop signal to the safety relay when the first receiving end, the second receiving end or the third receiving end receives the safety abnormality signal, and the delayed stop signal is used to control the safety relay to disconnect; the second output end is used to output the external emergency stop signal to the equipment system, and the external emergency stop signal is used to control the equipment system to shut down.

[0019] Among them, the status end of the safety controller is grounded or connected to the power supply, and the output end is used to send the first control signal to the safety relay and the equipment system when the fourth receiving end receives the safety abnormality signal. The first control signal is used to control the safety relay to disconnect and control the equipment system to shut down.

[0020] Among them, the safety control system also includes a reset switch, which is connected to the reset end of the safety controller. The reset switch is used to send a trigger signal to the reset end, and the safety controller is also used to perform a reset operation after the reset end receives the trigger signal.

[0021] Beneficial effects of the present application: Different from the prior art, the safety control system of the present application includes a first control system, a second control system and a switch component. The first interface of the first control system is connected to the working system, and is used to receive the safety abnormality signal transmitted by the working system, and send a first control signal based on the safety abnormality signal; the second control system is connected to the working system, and is used to receive the safety abnormality signal, and send a first control signal based on the safety abnormality signal; the switch component is used to control the working state of the second control system, and the working state of the second control system includes the second control system being turned on and the second control system being turned off. The first control system or the second control system receives the safety abnormality signal from the working system, and generates a first control signal based on the safety abnormality signal, and the first control signal is used to control the state of the working system. By setting the first control system and the second control system to jointly respond to the safety abnormality signal of the working system, multiple redundant designs improve the efficiency of responding to the safety abnormality signal of the working system, while improving the practicality and safety of the safety control system and improving the user experience of the safety control system. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0023] in:

[0024] Figure 1 This is a structural diagram of an embodiment of the safety control system of the present application;

[0025] Figure 2 This is a structural diagram of an embodiment of the first control system of the present application;

[0026] Figure 3 This is a schematic structural diagram of an embodiment of a second control system of the present application;

[0027] Figure 4 It is a structural diagram of another embodiment of the safety control system of the present application.

[0028] Figure numbers: safety control system 1; first control system 11; processing module 111; first execution module 112; first interface 113; second interface 114; second execution module 115; second control system 12; safety controller 121; safety relay 122; coil 1221; main contact 1222; auxiliary contact 1223; switch assembly 13; reset switch 14. DETAILED DESCRIPTION

[0029] The following describes the embodiments of the present application in detail with reference to the accompanying drawings.

[0030] In the following description, for the purpose of explanation rather than limitation, specific details such as specific system structures, interfaces, and technologies are provided to facilitate a thorough understanding of the present application.

[0031] References to "embodiments" in this application mean that a particular feature, structure, or characteristic described in connection with the embodiment may be included in at least one embodiment of the application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute an independent or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0032] The term "and / or" in this application is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent three situations: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the objects associated before and after are in an "or" relationship. In addition, "many" in this article means two or more than two. In addition, the term "at least one" in this article means any combination of at least two of any one or more of a plurality of, for example, including at least one of A, B, and C, can mean including any one or more elements selected from the set consisting of A, B, and C. In addition, the terms "first", "second", and "third" in this application are used for descriptive purposes only, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated.

[0033] Traditional industrial robot safety control systems often utilize safety programmable logic controllers (PLCs) or safety relays. In the event of an emergency or a manual emergency stop, a STOP0 (emergency stop) button is activated, immediately shutting off all power to the robot. This provides reliable safety, but emergency stops can cause additional damage and wear and tear on the robot, making them inappropriate for normal program shutdowns. In everyday use, users often mistake the emergency stop button for a pause button, which inevitably increases wear and tear on the robot and shortens its service life. Furthermore, these systems lack state feedback monitoring, making it difficult to identify the cause of an emergency stop, hindering incident resolution.

[0034] In order to solve the drawbacks of the above methods, a dual-channel MCU and software programming method is used to implement the industrial robot safety control system. This method is based on MCU programming embedded software and cooperates with the robot teach pendant. Although the emergency stop mode (STOP0 (emergency stop) / STOP1 (quick stop) / STOP2 (general stop)) can be flexibly configured, and various alarms can be displayed in real time on the teach pendant page to facilitate accurate accident handling, the defects of MCU being easily interfered with and embedded software being easily run away are very prominent. Compared with safety PLCs and safety relays, the safety and reliability are not high.

[0035] Based on the above technical issues, please refer to Figure 1 , Figure 1 This is a structural diagram of an embodiment of the safety control system of the present application. The present application provides a safety control system 1 that integrates a first control system 11 and a second control system 12. Based on the two control systems, a four-way redundant safety control system for the industrial robot is formed to improve the safety and reliability of the operation control of the industrial robot.

[0036] Among them, such as Figure 1 As shown, the safety control system 1 provided in the embodiment of the present application includes a first control system 11 , a second control system 12 and a switch assembly 13 .

[0037] The first interface of the first control system 11 is connected to the working system, and is used to receive the safety abnormality signal transmitted by the working system, and to send a first control signal based on the safety abnormality signal; the second control system 12 is connected to the working system, and is used to receive the safety abnormality signal transmitted by the working system, and to send a first control signal based on the safety abnormality signal; the switch component 13 is connected to the second control system 12, and is used to control the working state of the second control system 12, and the working state of the second control system 12 includes the second control system 12 being turned on and the second control system 12 being turned off.

[0038] The first control system 11 or the second control system 12 receives a safety abnormality signal from the working system, and generates a first control signal based on the safety abnormality signal, where the first control signal is used to control the state of the working system.

[0039] Specifically, the switch assembly 13 may be a single-pole double-throw DIP switch. In one embodiment, Figure 1 As described above, one end of the switch component 13 can be connected to the first control system 11, and the other end of the switch component 13 can be connected to the second control system 12, so that when the switch component 13 is closed, the first control system 11 can supply power to the second control system 12 to turn on the second control system 12, or, when the switch component 13 is disconnected, the second control system 12 has no input power and the second control system 12 is turned off.

[0040] It is understandable that since the second control system 12 is connected to the working system, when the switch component 13 is disconnected and the second control system 12 is shut down, the working system still sends a safety abnormality signal to the second control system 12, but the second control system cannot respond to it.

[0041] Among them, the safety abnormality signal of the working system can be a teach pendant shield enable, teach pendant emergency stop, control cabinet emergency stop, external emergency stop, fault emergency stop, safety fence, safety confirmation and other signals. The first control system 11 can pre-classify the levels of the above signals, and then after receiving the corresponding safety abnormality signal, it can send a corresponding first control signal to the working system.

[0042] For example, the first control system 11 defines a fault emergency stop as the first emergency stop level (corresponding to STOP0), a teach pendant emergency stop and a control cabinet emergency stop as the second emergency stop level (corresponding to STOP1), and an external emergency stop as the third emergency stop level (corresponding to STOP2). After the first control system 11 receives a safety abnormality signal including a fault emergency stop, the first control system 11 can send a first control signal including STOP0 to the working system to control the emergency shutdown of the robot in the working system. When the first control system 11 receives a safety abnormality signal including an emergency stop of the control cabinet, the first control system can send a first control signal including STOP1 to the working system to control the robot in the working system to stop (delayed shutdown) after completing the current braking process. After the first control system 11 receives a safety abnormality signal including an external emergency stop, the first control system 11 can send a first control signal including STOP2 to the working system, and the robot in the working system can continue to run or generally pause the robot, and the remaining equipment in the working system except the robot can also be paused.

[0043] In other embodiments, the first control system 11 may also have other plans for the classification of emergency stop levels for different signals, which can be set based on user needs, and this application does not impose any restrictions on this.

[0044] By sending the corresponding first control signal based on the safety abnormality signal by the first control system 11, it is possible to respond to different safety abnormality signals of the working system, thereby improving the practicality, safety and reliability of the safety control system 1.

[0045] Furthermore, when the switch component 13 controls the working state of the second control system 12 to be that the second control system 12 is turned on, the second control system 12 can also send a first control signal based on the safety abnormality signal to control the working system, and perform safety control together with the first control system 11, flexibly combining the first control system 11 and the second control system 12 to improve the safety and reliability of the safety control system 1.

[0046] Optionally, see Figure 1 The first control system 11 includes a processing module 111 , a first execution module 112 , a first interface 113 and a second interface 114 .

[0047] The first execution module 112 is connected to the processing module 111 and the first interface 113, respectively. The first execution module 112 is configured to transmit the received safety anomaly signal to the processing module 111. The processing module 111 is configured to send a feedback signal based on the safety anomaly signal to the first execution module 112. The first execution module 112 is also connected to the working system via the second interface 114 and is configured to send a first control signal to the working system based on the feedback signal.

[0048] Specifically, the processing module 111 can be an ARM (Advanced RISC Machines, advanced reduced instruction set processor) module, the first execution module 112 can be an FPGA (Field-Programmable Gate Array, field programmable gate array) module, the first interface 113 and the second interface 114 are safety IO interfaces. After the first execution module 112 receives the safety abnormality signal transmitted by the working system through the first interface 113, the safety abnormality signal can be transmitted to the processing module 111, and the processing module 111 sends a feedback signal to the first execution module 112 based on the safety abnormality signal. Among them, the processing module 111 can pre-store the emergency stop levels corresponding to the different safety abnormality signals described above, and then after receiving the safety abnormality signal, send a feedback signal to the first execution module 111 based on the specific content of the safety abnormality signal. After receiving the feedback signal, the first execution module 112 sends a first control signal to the working system based on the feedback signal to control the working system to perform the corresponding operation. Improve the precision and accuracy of the control of the working system, and improve the safety and reliability of the safety control system 1.

[0049] Optionally, see Figure 2 , Figure 2 1 is a schematic diagram of the structure of an embodiment of the first control system of the present application. The first control system 11 also includes a second execution module 115, which is connected to the first execution module 112. The first execution module 112 is further configured to send a second control signal to the second execution module 115 based on the feedback signal, thereby disabling the execution function of the second execution module 115 via the second control signal.

[0050] Among them, the second execution module 115 can be an FPGA module identical to the first execution module 112, and the second execution module 115 can serve as a backup execution module of the first execution module 112. Furthermore, when the first execution module 112 is in normal condition and can operate normally, after receiving the feedback signal, the first execution module 112 will not only send the first control signal to the working system through the second interface 114, but will also send the second control signal to the second execution module 115 based on the feedback signal. The second control signal can be a shielding signal to shield the second execution module 115 and turn off the execution function of the second execution module 115, so as to avoid the second execution module 115 participating in the control operation when the first execution module 112 operates normally, and the working system simultaneously receives the first control signals sent by the first execution module 112 and the second execution module 115, thereby complicating the safety control of the working system by the first control system 11.

[0051] Optionally, the second execution module 115 is also connected to the working system through the first interface 113 and the second interface 114 respectively. The second execution module 115 is used to connect to the working system through the first interface 113, receive the safety abnormality signal transmitted by the working system, and output the first control signal to the working system through the second interface 114 when it has the execution function.

[0052] Specifically, if the second execution module 115 has an execution function, that is, if the second execution module 115 does not receive the second control signal transmitted by the first execution module 112, it may be that the first execution module 112 is in an abnormal state and is unable to send the first control signal and the second control signal after receiving the feedback signal, or the processing module 111 is in an abnormal state and is unable to send a feedback signal to the first execution module 112 based on the safety abnormality signal. If the first execution module 112 does not receive the feedback signal, it is unable to send the first control signal and the second control signal. When the second execution module 115 has an execution function, it can be determined that the first execution module 112 and / or the processing module 111 are in an abnormal state, and the second execution module 115 can replace the first execution module 112 to perform the control operation.

[0053] Among them, since the processing module 111 is unable to obtain the safety abnormality signal and identify the emergency stop level corresponding to the safety abnormality signal at this time, in order to avoid the second execution module 115 responding to a lower control signal level when the emergency stop level is higher (for example, an accident occurs in which the working system fails and stops suddenly, which should be the first emergency stop level, emergency shutdown, but the second execution module 115 controls the working system to perform a delayed shutdown), the second execution module 115 directly outputs the first control signal to the working system after receiving the safety abnormality signal to control the working system to shut down urgently.

[0054] By setting the second execution module 115 as a backup execution module of the first execution module 112, when the first execution module 112 and / or the processing module 111 are in an abnormal state, the second execution module 115 is allowed to issue a first control signal based on the safety abnormality signal, thereby improving the practicality and reliability of the first control system 11.

[0055] It is understandable that if Figure 2 As shown, since the first interface is connected to the first execution module 112 and the second execution module 115 respectively, that is, the first execution module 112 and the second execution module 115 can receive the safety abnormality signal at the same time, at this time, the second execution module 115 has not yet received the second control signal, that is, the second execution module 115 still has the execution function. If the second execution module 115 directly sends the first control signal to the working system at this time, the second execution module 115 will participate in the control operation when the first execution module 112 and the processing module 111 are in normal status, which will complicate the control process of the first control system 11.

[0056] Therefore, in one embodiment, after receiving the safety anomaly signal, the second execution module 115 may wait for a period of time (settable by the user). If the second control signal is not received within this period, the execution function of the second execution module 115 is disabled. The second execution module 115 then sends the first control signal to the working system, reserving time for the first execution module 112 and the processing module 111 to respond. This improves the orderly operation of the first control system 11 and enhances the practicality and reliability of the safety control system 1.

[0057] In practical applications, the working system includes a robot system and an equipment system. The robot system includes the robot described above, and the equipment system can be other equipment other than the robot system, such as a conveyor system. The robot system is configured to operate within the equipment system. The first execution module 112 is connected to the robot system and the equipment system, respectively. The first control signal includes an emergency stop signal, a delayed stop signal, and an external emergency stop signal. This is a stop triggered by the servo and executed by the servo drive. During the braking process, the brake immediately engages, and the controller and servo drive are unable to monitor the execution process, resulting in an uncontrolled braking process. Depending on the load size and posture in the robot system, the braking time is affected by factors such as the servo drive and motor brake time. When a serious servo error or failure occurs, an emergency stop is triggered, quickly shutting down the robot system. A delayed stop is a stop triggered by the control system or servo drive and monitored by the servo drive. During the braking process, an external safety or alarm signal triggers a rapid shutdown. The servo system completes the braking process at the maximum acceleration provided by the control system. After the robot stops, the brake engages quickly. Pressing any emergency stop button falls into this category, controlling the robot system to shut down after the current braking process completes. External emergency stop is aimed at the equipment system, that is, the shutdown control of the non-robot system. When a non-robot system accident occurs, the external emergency stop will be responded to to shut down the equipment system.

[0058] Specifically, after the first execution module 112 sends a safety abnormality signal to the processing module 111, the processing module 111 will identify the safety abnormality signal, determine the emergency stop level and the accident object, and then send the judgment result to the first execution module 112 through a feedback signal. The first execution module 112 is used to send an emergency stop signal or a delayed stop signal to the robot system to control the robot system to shut down immediately or shut down after completing the braking process; or send an external emergency stop signal to the equipment system to control the equipment system to shut down.

[0059] In one embodiment, the first control system 11 may be specifically connected to a relay in the robot system, and the first control signal sent by the first control system 11 may control the relay to be disconnected, thereby shutting down the robot system.

[0060] In summary, the first control system 11 provided in the embodiment of the present application implements safety control of the working system based on dual FPGAs, thereby improving the safety and reliability of the safety control system 1.

[0061] Optionally, see Figure 3 , Figure 3The second control system 12 includes a safety controller 121 and a safety relay 122. The enable terminal of the safety controller 121 is connected to the switch component 13. The switch component 13 controls the working state of the safety controller 121 through the enable terminal. Figure 3 When the switch assembly 13 is connected to the I13 and I14 terminals, the enable terminal of the safety controller 121 is energized, and the safety controller 121 is turned on. When the switch assembly 13 is disconnected, the enable terminal of the safety controller 121 is not energized, and the safety controller 121 is turned off.

[0062] The first receiving end, the second receiving end, the third receiving end and the fourth receiving end of the safety controller 121 are connected to the working system, wherein the first receiving end is Figure 3 The I3 and I4 terminals are used to receive the emergency stop signal of the teaching pendant transmitted by the working system; the second receiving terminal is Figure 3 The I5 and I6 terminals are used to receive the emergency stop signal of the control cabinet transmitted by the working system; the third receiving terminal is Figure 3 The I7 and I8 terminals are used to receive the external emergency stop signal transmitted by the working system; the fourth receiving terminal is Figure 3 The I9 and I10 terminals are used to receive fault emergency stop signals transmitted by the working system.

[0063] The working system includes a robot system and an equipment system. The first output terminal ( Figure 3 The 14th and 24th terminals in the figure are connected to the robot system through the safety relay 122. The second output terminal of the safety controller 121 ( Figure 3 The safety controller 121 is connected to the device system (terminals 34 and 44). Upon receiving a safety abnormality signal at the first, second, third, or fourth receiving terminals, the safety controller 121 sends a first control signal to the safety relay 122 and the device system. The first control signal is used to control the connection status of the safety relay 122 and the operating status of the device system. This enables the second control system 12 to safely control the operating system, improving the practicality and reliability of the second control system 12.

[0064] Specifically, such as Figure 3As shown, safety relay 122 includes a coil 1221, a main contact 1222, and an auxiliary contact 1223. One end of coil 1221 is connected to the first output terminal of safety controller 121, and the other end of coil 1221 is connected to a 24V power supply. One end of main contact 1222 is connected to the robot system, and the other end of main contact 1222 is connected to a 220V power supply. Main contact 1222 is in a normally closed state, connecting the 220V power supply to the robot system, powering the robot system and putting the robot system into operation. When the first, second, third, or fourth receiving terminals of safety controller 121 receive a safety anomaly signal, the first output terminal of safety controller 121 outputs an electrical signal to coil 1221, causing coil 1221 to generate a magnetic field that acts on main contact 1222, disconnecting main contact 1222. This disconnects the power supply to the robot system, shutting it down.

[0065] One end of auxiliary contact 1223 is connected to a warning light. Auxiliary contact 1223 is normally open. When coil 1221 acts on main contact 1222, causing it to open, coil 1221 simultaneously acts on auxiliary contact 1223, closing it and illuminating the warning light. This serves to alert the user that the robot system is in the off state, improving the interactivity between the safety control system 1 and the user.

[0066] In one embodiment, Figure 3 The presence of two coils 1221 in the second control system 12 means that the second control system 12 can include two safety relays 122. Furthermore, the main contacts 1222 of the two safety relays 122 can be connected in series between the robot system and the 220V power supply, thereby improving the reliability of the second control system 12 in controlling the robot system. This avoids the situation in which the safety relay 122 is damaged and the robot system cannot be shut down if only one safety relay 122 is provided.

[0067] In one embodiment, the first control signal includes an emergency stop signal and an external emergency stop signal, and the status terminal ( Figure 3 The first output terminal is configured to transmit an emergency stop signal to safety relay 122 upon receiving a safety anomaly signal at the first, second, or third receiving terminals. This emergency stop signal is used to immediately disconnect safety relay 122 (specifically, main contact 1222), thereby disconnecting the circuit connecting the robot system to the 220V power supply and immediately shutting down the robot system. Simultaneously, the second output terminal also transmits an external emergency stop signal to the device system, which is used to shut down the device system.

[0068] In another embodiment, the first control signal includes a delayed stop signal and an external emergency stop signal, and the state terminal of the safety controller 121 is connected to the power supply ( Figure 3 The first output terminal is connected to the PLC circuit in the first receiving terminal, the second receiving terminal or the third receiving terminal, and is used to send a delayed stop signal to the safety relay 122 when a safety abnormality signal is received at the first receiving terminal, the second receiving terminal or the third receiving terminal. The delayed stop signal is used to control the delayed disconnection of the safety relay 122; at the same time, the second output terminal outputs an external emergency stop signal to the equipment system, and the external emergency stop signal is used to control the shutdown of the equipment system.

[0069] In summary, the control of the working system by the safety controller 121 can be adjusted by adjusting the connection of the status terminal of the safety controller 121. When the status terminal of the safety controller 121 is grounded, upon receiving an emergency stop signal from the teach pendant, a control cabinet, or an external emergency stop signal, the safety controller 121 directly controls the shutdown of the robot system and the device system. When the status terminal of the safety controller 121 is connected to a power source, upon receiving an emergency stop signal from the teach pendant, a control cabinet, or an external emergency stop signal, the safety controller 121 delays the shutdown of the robot system and the device system.

[0070] It can be understood that when the first execution module 112 or the safety controller 121 sends a delayed shutdown signal to the working system, the first execution module 112 or the safety controller 121 may delay sending the shutdown signal to the working system, wherein the specific time of the delay of the first execution module 112 or the safety controller 121 can be set in advance by the user, and this application does not limit the specific value of this time.

[0071] Optionally, the I1 and I2 terminals of the safety controller 121 can also be used to receive a teach pendant shield signal. When the safety controller 121 receives the teach pendant shield signal, the safety controller 121 will not respond to the working signal received by the first receiving terminal. In other words, when the teach pendant is shielded, the teach pendant emergency stop signal is invalid.

[0072] In other embodiments, the status end of the safety controller 121 is grounded or connected to a power supply, and the output end is used to send a first control signal to the safety relay 122 and the equipment system when a safety abnormality signal is received at the fourth receiving end. The first control signal is used to control the safety relay to disconnect and control the equipment system to shut down.

[0073] Specifically, as mentioned above, the fourth receiving end is used to receive the fault emergency stop signal of the working system. The fault emergency stop signal is generally the safety abnormality signal with the highest emergency stop level. Therefore, this embodiment proposes that the response of the safety controller 121 to the fault emergency stop signal is not affected by the connection status of the status end of the safety controller 121. When the safety controller 121 receives the fault emergency stop signal through the fourth receiving end, the safety controller 121 immediately sends an emergency stop signal to the safety relay 122 and sends an external emergency stop signal to the equipment system to control the robot system and the equipment system to shut down immediately.

[0074] The following is a brief description of the safety control process of safety control system 1:

[0075] 1. By default, the second control system 12 is not enabled, that is, the switch assembly 13 is disconnected, and the first control system 11 controls the working state of the working system.

[0076] First, when the processing module 111 and the first execution module 112 are in normal status, the first execution module 112 receives the safety abnormality signal transmitted by the working system through the first interface 113, and transmits the safety abnormality signal to the processing module 111. The processing module 111 identifies the emergency stop level and accident object corresponding to the safety abnormality signal, and sends the identification result to the first execution module 112 through a feedback signal. After receiving the feedback signal, the first execution module 112 sends a first control signal to the working system, and sends a second control signal to the second execution module 115 to shield the second execution module 115.

[0077] Among them, the first control signal sent by the first execution module 112 includes an emergency stop signal, a delayed stop signal and an external emergency stop signal. The working system can control the robot system and / or the equipment system to shut down based on the obtained signal.

[0078] Then, when the processing module 111 and / or the first execution module 112 is in an abnormal state, the first execution module 112 cannot shield the second execution module 115, and the second execution module 115 has an execution function. After the second execution module 115 receives the safety abnormality signal, the second execution module 115 directly sends an emergency stop signal and an external emergency stop signal to the working system to control the shutdown of the robot system and the equipment system.

[0079] 2. When the user has high requirements for the safety control accuracy of the safety control system 1, the second control system 12 is started, that is, the switch component 13 is connected, and the first control system 11 and the second control system 12 control the working state of the working system.

[0080] As can be seen from the foregoing, the four receiving ends of the safety controller 121 are used to receive four types of emergency stop signals, namely, teach pendant emergency stop signal, control cabinet emergency stop signal, external emergency stop signal and fault emergency stop signal, and the safety abnormality signals transmitted by the working system also include safety fence and safety confirmation signals. Therefore, when the first control system 11 and the second control system 12 jointly perform safety control on the working system, the second control system 12 can respond to the four types of emergency stop signals, while the first control system 11 responds to other signals.

[0081] First, when the safety abnormality signal is a signal such as a safety fence, the first control system 11 controls the working state of the working system.

[0082] Next, when the safety abnormality signal is one of the four emergency stop signals, if the status terminal of the safety controller 121 is grounded, when the safety controller 121 receives any one of the four emergency stop signals, the safety relay 122 is controlled to disconnect, the robot system is shut down, and the control equipment system is shut down at the same time.

[0083] When the status terminal of safety controller 121 is connected to a power source, if it receives any of the emergency stop signals from the teach pendant, the control cabinet, or an external emergency stop, it delays the opening of safety relay 122, allowing the robot system to complete the braking process and then shut down, while also controlling the device system to shut down. If safety controller 121 receives a fault emergency stop signal, it immediately opens safety relay 122, shutting down the robot system and the device system.

[0084] Furthermore, after the safety controller 121 sends the first control signal to the working system, the safety controller 121 needs to be reset, such as Figure 4 As shown, Figure 4 The safety control system 1 further includes a reset switch 14, which is connected to the reset terminal of the safety controller 121 ( Figure 3 The reset switch 14 is connected to the reset end (end), and the safety controller 121 is used to perform a reset operation after receiving the trigger signal at the reset end.

[0085] Specifically, after the user handles the accident of the working system, the user can press the reset switch 14, and then the reset switch 14 sends a trigger signal to the reset end of the safety controller 121. After the reset end of the safety controller 121 receives the trigger signal, the safety controller 121 performs a reset operation to enable the safety controller 121 to perform safety control in the safety control system 1 and respond to the next safety abnormality signal.

[0086] The reset switch 14 can also be connected to the processing module 111. When the safety controller 121 needs to be reset, the processing module 111 can first output a rising edge signal to the reset switch 14 to trigger the reset. The reset switch 14 can also include a reset light. Upon receiving the rising edge signal, the reset light illuminates to alert the user. The user can then press the reset switch 14 to trigger the reset, after which the reset light goes out. After the user presses the reset switch 14, the T3 terminal on the safety controller 121 transmits a triggering electrical signal to the I17 terminal. After the I17 terminal receives the triggering electrical signal, the safety controller 121 performs the reset operation, making it safer and more reliable.

[0087] In summary, this application proposes a safety control system 1 for a working system that can conveniently switch between quad-redundancy and dual-redundancy. By default, only the processing module 111, the first execution module 112, and the second execution module 115 form a dual-redundant first control system 11 for safety control. In situations where higher safety requirements are required, a safety controller 121 and a safety relay 122 with built-in dual-redundancy can be optionally configured to switch to a quad-redundant safety control system 1. This improves the practicality, safety, and reliability of the safety control system 1, and enhances the user experience of the safety control system 1.

[0088] The above description is only an implementation method of the present application and does not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the description and drawings of this application, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A safety control system, characterized in that: include: a first control system, wherein a first interface of the first control system is connected to the working system, and is configured to receive a safety abnormality signal transmitted by the working system, and to issue a first control signal based on the safety abnormality signal; a second control system connected to the working system, configured to receive the safety abnormality signal and issue the first control signal based on the safety abnormality signal; a switch assembly connected to the second control system and configured to control a working state of the second control system, wherein the working state of the second control system includes the second control system being turned on and the second control system being turned off; The first control system or the second control system receives a safety abnormality signal from the working system, and generates the first control signal based on the safety abnormality signal, wherein the first control signal is used to control the state of the working system.

2. The safety control system according to claim 1, characterized in that: The first control system further includes a processing module, a first execution module and a second interface, the first execution module being connected to the processing module and the first interface respectively, the first execution module being configured to transmit the received safety abnormality signal to the processing module, and the processing module being configured to send a feedback signal to the first execution module based on the safety abnormality signal; The first execution module is further connected to the working system through the second interface, and is configured to send the first control signal to the working system based on the feedback signal.

3. The safety control system according to claim 2, characterized in that: The first control system also includes a second execution module, which is connected to the first execution module. The first execution module is also used to send a second control signal to the second execution module based on the feedback signal to shut down the execution function of the second execution module through the second control signal.

4. The safety control system according to claim 3, characterized in that: The second execution module is also connected to the working system through the first interface and the second interface respectively. The second execution module is used to receive the safety abnormality signal through the first interface and output the first control signal to the working system through the second interface when it has an execution function.

5. The safety control system according to claim 2, characterized in that: The working system includes a robot system and an equipment system, the robot system is used to participate in the working operation in the equipment system, the first execution module is connected to the robot system and the equipment system respectively, and the first control signal includes an emergency stop signal, a delayed stop signal and an external emergency stop signal; The first execution module is used to send the emergency stop signal or the delayed stop signal to the robot system to control the shutdown of the robot system; or send an external emergency stop signal to the equipment system to control the shutdown of the equipment system.

6. The safety control system according to claim 1, characterized in that: The second control system includes a safety controller and a safety relay, the enable terminal of the safety controller is connected to the switch component, and the switch component controls the working state of the safety controller through the enable terminal; Among them, the first receiving end, the second receiving end, the third receiving end and the fourth receiving end of the safety controller are connected to the working system, and the working system includes a robot system and an equipment system. The first output end of the safety controller is connected to the robot system through the safety relay, and the second output end of the safety controller is connected to the equipment system. The safety controller is used to send the first control signal to the safety relay and the equipment system when the first receiving end, the second receiving end, the third receiving end or the fourth receiving end receives the safety abnormality signal. The first control signal is used to control the connection status of the safety relay and the working status of the equipment system.

7. The safety control system according to claim 6, characterized in that: The first control signal includes an emergency stop signal and an external emergency stop signal. The status end of the safety controller is grounded. The first output end is used to send the emergency stop signal to the safety relay when the first receiving end, the second receiving end or the third receiving end receives the safety abnormality signal. The emergency stop signal is used to control the safety relay to disconnect immediately; the second output end is used to output the external emergency stop signal to the equipment system, and the external emergency stop signal is used to control the equipment system to shut down.

8. The safety control system according to claim 6, characterized in that: The first control signal includes a delayed stop signal and an external emergency stop signal. The status end of the safety controller is connected to the power supply. The first output end is used to send the delayed stop signal to the safety relay when the first receiving end, the second receiving end or the third receiving end receives the safety abnormality signal. The delayed stop signal is used to control the delayed disconnection of the safety relay; the second output end outputs the external emergency stop signal to the equipment system, and the external emergency stop signal is used to control the shutdown of the equipment system.

9. The safety control system according to claim 6, characterized in that: The status end of the safety controller is grounded or connected to a power supply, and is used to send the first control signal to the safety controller and the equipment system when the fourth receiving end receives the safety abnormality signal. The first control signal is used to control the safety relay to disconnect and control the equipment system to shut down.

10. The safety control system according to claim 6, characterized in that: The safety control system further includes a reset switch connected to a reset terminal of the safety controller. The reset switch is configured to send a trigger signal to the reset terminal. The safety controller is further configured to perform a reset operation after the reset terminal receives the trigger signal.

Images