Real-time control using isolation controller

Abstract

The present disclosure relates to systems, software, and computer-implemented methods for controlling a machine. The system may include a sensor configured to measure an operational characteristic of the machine; and a safety controller in communication with the sensor. The security controller may include a dedicated border processor and communicate with a control processor through the border processor that isolates operation of the control processor from the security controller. The safety controller may be configured to: receive measurement data from the sensor; performing signal conditioning on the measurement data to generate conditioned samples; analyzing the conditioned sample to determine whether to take a safety action; and sending the conditioned sample to the boundary processor for transmission to the control processor. The control processor may be configured to perform operations including: receiving the conditioned sample; and controlling one or more operations of the machine based on the conditioned sample.

Description

[0001] Claiming priority This application claims priority to U.S. Patent Application No. 18 / 223,776, filed July 19, 2023, the entire contents of which are incorporated herein by reference. Technical Field

[0002] This disclosure generally relates to the real-time control of machinery. Background Technology

[0003] Turbines and other machinery are widely used in a variety of industrial and commercial applications to generate electrical or mechanical power. These machines often operate under harsh conditions or circumstances where reliability is critical. Therefore, safety control systems are frequently implemented to enable emergency response in abnormal situations. Summary of the Invention

[0004] This disclosure relates to systems, software, and computer-implemented methods for controlling machinery. The system may include: a sensor configured to measure operational characteristics of the machine; and a safety controller communicating with the sensor. The safety controller may include a dedicated boundary processor and communicate with a control processor via the boundary processor, the boundary processor isolating the operation of the control processor from the safety controller. The safety controller may be configured to: receive measurement data from the sensor; perform signal conditioning on the measurement data to generate conditioned samples; analyze the conditioned samples to determine whether to take a safety action; and send the conditioned samples to the boundary processor for transmission to the control processor. The control processor may be configured to perform operations including: receiving the conditioned samples; and controlling one or more operations of the machine based on the conditioned samples.

[0005] The implementation may optionally include one or more of the following features.

[0006] In some instances, the sensor is triggered by a timer to perform measurements periodically.

[0007] In some instances, the control processor is configured to wait until the next trigger of the timer before controlling one or more operations of the machine.

[0008] In some instances, the timer triggers a measurement every 5ms.

[0009] In some instances, analyzing the conditioned sample includes confirming that the measurement was performed within 10% of the total period of the periodic measurement.

[0010] In some instances, the machine is a turbine generator.

[0011] In some instances, the control processor controls the speed of the machine.

[0012] In some instances, the measurement data includes information related to machine temperature, pressure, acceleration rate, and speed.

[0013] In some instances, the safety action is an emergency stop.

[0014] In some instances, the boundary processor isolates the control processor from the security controller and uses a proprietary protocol to send the conditioned sample to the control processor. In some implementations, the proprietary protocol is the Ethernet protocol.

[0015] Similar operations and processes can be performed in different systems including at least one processor and a memory communicatively coupled to the at least one processor, wherein the memory stores instructions that, when executed, cause the at least one processor to perform operations. Furthermore, a non-transitory computer-readable medium storing instructions that, when executed, cause the at least one processor to perform operations is also contemplated. Additionally, similar operations can be associated with or provided as computer-implemented software embodied on a tangible, non-transitory medium that processes and transforms corresponding data; some or all of these aspects can be computer-implemented methods, or further included in a corresponding system or other device for performing the functions described herein. These and other aspects of this disclosure, as well as details of the embodiments, are set forth in the following description and drawings. Other features, objects, and advantages of this disclosure will become apparent from the description and drawings and from the claims. Attached Figure Description

[0016] Figure 1 A block diagram illustrating a simplified system architecture that allows a real-time controller to read signals from a safety controller is shown.

[0017] Figure 2 An exemplary timeline of machine control and safe operation is depicted.

[0018] Figure 3 This is a flowchart illustrating an exemplary process for controlling a machine.

[0019] Figure 4 This is a schematic diagram of an exemplary computer system.

[0020] Similar reference numerals and names in the various figures indicate similar elements. Detailed Implementation

[0021] This disclosure describes systems and methods for achieving real-time control of machines without requiring redundant sensing and signal conditioning. Many critical machines requiring high reliability and safety utilize redundant control and safety systems. A control system can read one or more parameters related to the machine's operation and send control signals to adjust the monitored operation. In contrast, a safety system typically monitors multiple parameters and, upon detecting that a parameter exceeds a predetermined safety threshold, can send a safety command or shutdown command to quickly place the machine under safe conditions.

[0022] For example, if the machine is a turbine generator, the safety system can monitor the internal turbine temperature, rotor speed, voltage, and frequency, and issue a shutdown command to trip or close the turbine's supply valves if any of the monitored parameters exceeds a safety threshold (e.g., overspeed, overvoltage, underfrequency, overtemperature, etc.). The control system could be, for example, a speed control system that monitors the rotor speed and makes periodic throttling adjustments to the different valves supplying fuel (or high-pressure / energy fluid) to the turbine. In some implementations, each of the control and safety systems includes its own sensors(s), signal conditioning circuitry, logic, and communication pathways. However, because these systems often monitor similar or identical parameters (e.g., rotor speed), it may be advantageous to use the same sensors(s) and signal conditioning circuitry(s) for both the safety and control systems, thereby reducing overall system complexity and cost.

[0023] Furthermore, security systems are often externally certified by third-party agents. Therefore, changing components or modifying the design of a security system can be prohibitively expensive or time-consuming. This disclosure describes a system and process for using sensors and signal conditioning circuitry already certified within a security system by adding a security boundary, which utilizes a separate processor and unidirectional communication from the security system to the control system. The disclosed system and process enable the control system to use signals from the signal conditioner of the security system.

[0024] Figure 1 This is a block diagram illustrating a simplified system architecture 100 for allowing real-time controller 102 to read signals from safety controller 104. Safety controller 104 is part of a certified safety system 106, which includes one or more sensors 108, a signal conditioner 110, safety controller 104, a safety boundary 114, and one or more safety actuators 116. In addition to certified safety system 106, system 100 also includes controller 102, machine actuator 124, machine 112, and rate group controller 120. The various components in system 100 communicate using communication link 126.

[0025] The certified safety system 106 may be hardware and software devices certified by an external authority and designed to be highly reliable and to quickly place machine 112 to a safe condition if a hazardous situation is detected. The certified safety system 106 may include one or more sensors 108 that can measure physical parameters associated with the machine, such as rotational speed, generated voltage, frequency, phase angle, temperature associated with different stages of the machine, pressure at the machine's inlet and outlet, fuel flow, outlet flow, oil or lubricant flow, pressure or temperature, and other parameters. In some implementations, sensors 108 measure additional parameters external to machine 112, such as ambient temperature, noise, pressure, or mains voltage (among other things). In some implementations, sensors 108 are redundant, with two or more of each sensor present, so that a failure of any single component will not result in erroneous measurements by machine 112.

[0026] Generally, sensor 108 transmits a signal to signal conditioner 110, which processes the data received from sensor 108 for downstream analysis (e.g., security analysis or control input development). Signal conditioner 110 includes the logic and processing necessary to convert the raw data generated by sensor 108 into a usable signal. Signal conditioner 110 may include, for example, filtering circuitry such as passive or active low-pass, high-pass, or band-pass filters. Signal conditioner 110 may further include averaging circuitry, quantization circuitry (e.g., sample-and-hold system), anomaly or glitches filtering, scaling and / or offset conversion, linearization, temperature compensation, and other processes. In some implementations, signal conditioner 110 processes / conditions the signal from sensor 108 in real-time, instantaneously, or near instantaneously. For example, the total time between sensor 108 detecting an event, signal conditioner 110 conditioning the event, and the event reaching security controller 104 may be less than 1 ms, or may be otherwise designed to have no intentional delay in its propagation. In some implementations, signal conditioner 110 is composed of one or more analog circuits. In some implementations, signal conditioner 110 is a digital signal conditioner with a dedicated processor and clock. In some implementations, signal conditioner 110 is a combination of analog and digital circuits. Signal conditioner 110 can be analog circuitry, such as a resistance temperature detector (RTD) circuit including one or more calibrated components.

[0027] Safety controller 104 can receive or sample conditioned signals and determine whether a safety action is required. In some implementations, safety controller 104 is directed by rate group controller 120, which synchronizes components of system 100 and provides timing signals to them. In some implementations, rate group controller 120 generates timing signals that are read by various components in system 100, such as controller 102 and safety controller 104. In some implementations, rate group controller 120 transmits command signals directly to components such as safety controller 104 and controller 102. Safety controller 104 can monitor conditioned signals representing one or more operating parameters of machine 112, which may be a mechanical device such as a turbine generator, diesel engine, electric motor, or other equipment. If safety controller 104 detects that a parameter is outside a predetermined threshold or has been outside a threshold for a predetermined period of time (e.g., the most recent three samples), safety controller 104 can signal one or more safety actuators 116 to take a safety action.

[0028] Safety actuator 116 can generate signals or commands to close valves, disconnect circuit breakers, or otherwise mitigate potential damage caused by parameters exceeding thresholds. For example, under overspeed conditions, safety actuator 116 can shut down electromagnetically operated fuel valves, cut off fuel flow to machine 112, and deactivate the machine. In another example of fire detection, safety actuator 116 can trigger a fire suppression system, opening valves and releasing extinguishing agent near the machine while stopping fuel flow to machine 112. In yet another example, in the event of an overcurrent condition, safety controller 104 and safety actuator 116 can disconnect circuit breakers, thereby protecting machine 112 and downstream components from hazardous electrical currents.

[0029] Security boundary 114 is a dedicated system within the security controller 104 of the certified security system 106. Security boundary 114 may include a dedicated processor that receives conditioned signals from signal conditioner 110 and transmits them to controller 102 via communication link 126. In some implementations, the boundary processor of security boundary 114 operates in parallel with the processor of security controller 104 and is electrically isolated from the rest of security controller 104. The boundary processor serves as a unidirectional access channel for pushing data from signal conditioner 110 to controller 102.

[0030] Communication link 126 may be a physical (e.g., wired) connection with a dedicated unidirectional communication protocol from security boundary 114 to controller 102. In some implementations, communication link 126 uses a CAN bus-type communication system, including the use of proprietary communication protocols such as ISO 11898-2 or SAE J1939. In some implementations, communication link 126 uses an Ethernet communication protocol.

[0031] Controller 102 receives conditioned signals from safety boundary 114. In some implementations, safety boundary 114 is configured to add almost no delay, allowing signals to propagate from sensor(s)(s)108 to controller 102 in real-time or near real-time (e.g., less than 1 ms or less than 0.5 ms) via certified safety system 106. Controller 102 also receives synchronization and / or timing signals from rate group controller 120. Using the same rate group controller 120 for both safety controller 104 and controller 102 enables controller 102 to perform real-time or high-speed control based on the sensed signals from certified safety system 106. Generally, controller 102 receives data belonging to operating parameters of machine 112 and generates command signals to operate machine 112. For example, controller 102 may receive a speed signal, compare the speed signal with a desired speed or set speed, and generate command signals to be sent to machine actuator 124 to cause machine 112 to achieve the desired speed. Controller 102 may include one or more classic controllers, such as proportional-integral or proportional-integral-derivative (PID) type controllers. In some implementations, controller 102 includes one or more modern controllers, such as fuzzy logic controllers, state-space controllers, linear quadratic regulators, or linear quadratic Gaussian controllers.

[0032] The controller 102 sends command signals to the machine actuator 124, which may be one or more valves, switches, or other devices for controlling the operation of the machine 112. For example, when the controller 102 is controlling the machine speed, the controller 102 may send command signals to adjust a throttle valve within the machine actuator 124, which adjusts the fuel flow and thus adjusts the speed of the machine 112.

[0033] Figure 2 An exemplary timeline 200 depicts the control and safe operation of the machine. The illustrated timeline can be derived from the above descriptions regarding... Figure 1 The described rate group timer 120 is used for coordination and / or control. The operation of the safety controller is represented by the top timeline 202, while the operation of the control processor is represented by the bottom timeline 204. Although illustrated as taking a specific portion of the overall rate group cycle 222, the operation of the safety controller and control processor may take longer or shorter portions compared to what is illustrated.

[0034] According to the overall system (e.g., such as Figure 1 For the desired performance of the system 100 described herein, a rate group period 222 is set. Generally, the rate group period 222 represents both the overall cycle time during which the safety controller senses and takes safety actions when necessary, and the overall cycle time during which the control processor receives sensor data and adjusts machine operation as needed. In the illustrated example, the rate group period 222 is set to 5 ms; however, other times are possible, such as 10 ms, 1 ms, 50 ms, or other times.

[0035] At the start of rate group period 222, a subframe timer (MFT) trigger is received, and the safety controller begins signal conditioning 206 on sensor samples (220) collected within 10% of the triggered rate group period 222. For example, in the case of a rate group period of 5 ms, sensor samples are collected within 0.5 ms or 500 µs at the MFT trigger. The signal conditioning is then analyzed by the safety controller (208). During this analysis, the conditioned signal is sent to the control processor, which begins to calculate the control signal (214).

[0036] After analyzing the conditioned sample, the safety controller determines whether a safety action is required (210). If a safety action is required, a safety action command is sent to the actuator associated with the machine being controlled to place the machine under safe conditions. If no safety action is required, the safety controller may remain idle until the next MFT trigger, during which new samples and signal conditioning will be performed.

[0037] Simultaneously, at the beginning of rate group cycle 222, the control processor sends control inputs / outputs (I / O) (212) from the previous window 228. In some implementations, this control I / O may be a throttling command used to manipulate electrically operated valves to adjust the machine speed. The control I / O may be, for example, a throttling command, a cooling command, an excitation or power generation command, and other commands for operating the machine.

[0038] Upon receiving the conditioned signal from the safety controller, the control processor then begins to calculate the next control signal (214). As described above, this calculation can involve both classical and modern control calculations, and in some cases, it may include previous samples from the previous window 228 as well as previously transmitted control I / O signals. Once the control signal has been calculated, the control processor waits for the next MFT trigger and transmits the calculated signal in the next window 226.

[0039] Figure 3This is a flowchart illustrating an exemplary process 300 for controlling a machine. It will be understood that process 300 can be performed, for example, by any suitable system, environment, software, and hardware, or, as appropriate, by a combination of systems, environments, software, and hardware. In some instances, process 300 can be performed by, for example, Figure 1 The system or part thereof described herein shall be executed, and process 300 in Figure 2 As well as other components or functions described in other parts of this specification, they are further described. In other instances, process 300 may be performed by multiple connected components or systems. Any suitable system(s), architecture(s), or application(s) may be used to perform the illustrated operations.

[0040] In 302, the safety controller receives measurement data from one or more sensors. The sensors detect parameters associated with the machine being controlled, such as rotational speed, internal temperature, ambient temperature, noise, inlet pressure, outlet pressure, internal pressure, fuel flow, outlet flow, vibration or acceleration, voltage, frequency, or other parameters. In some implementations, the sensors measure parameters continuously or nearly continuously, and the safety controller periodically polls the sensors to receive samples in the form of measurement data. The measurement data can be analog signals (e.g., voltage and current) or digital signals (e.g., serial data, fiber optic, etc.) from the sensors.

[0041] In section 304, the measurement data is conditioned. Signal conditioning may include using one or more filters, such as bandpass filters, high-pass filters, and / or low-pass filters. Additional signal conditioning may include signal scaling or amplification, denoising, offsetting (e.g., voltage biasing), averaging, linearization, temperature compensation, or other signal conditioning.

[0042] At 306, the conditioned signal is analyzed to determine whether a safety action is necessary. In some implementations, this analysis identifies whether any of the measured parameters are outside a predetermined threshold. For example, the speed parameter may have overspeed and underspeed thresholds; if the measured speed is above the overspeed threshold or below the underspeed threshold, a safety action is required and process 300 continues to 308. If no safety action is required (e.g., all measured data are within acceptable limits), process 300 may return to 302, where more measurement data is received. In some implementations, for example, in response to a rate group controller (e.g., Figure 1 The external synchronization signal provided by the rate group controller 120 is used to cycle through 302 periodically in process 300.

[0043] In 308, if a safety action is required, the safety controller takes the associated safety action. Safety actions may include, but are not limited to, signals or commands used to close valves, disconnect circuit breakers, activate fire suppression systems, energize alarms, close doors or safety barriers, shut down systems, or perform other mitigation actions.

[0044] The conditioned signal is further passed to the boundary processor, which receives the conditioned sample at 310 and sends it to the control processor. The boundary processor can be a standalone integrated circuit that establishes a dedicated unidirectional communication path from the security controller (which is typically part of a third-party certified system) to the operation controller. In some implementations, the boundary processor acts as a repeater, broadcasting the conditioned signal. In some implementations, the boundary processor performs additional operations, such as adding metadata or timing information to the conditioned sample.

[0045] In 312, the operation controller receives conditioned samples from the boundary processor. In some implementations, the boundary processor sends samples to the operation controller in response to polling or requests from the operation controller. In some implementations, the boundary processor simply broadcasts or "pushes" conditioned samples to the operation controller's buffer.

[0046] In section 314, the operating controller determines the control signals or inputs / outputs to be sent to the machine actuators. This could be a speed signal, a throttling command, an excitation command, or other signals to adjust the machine's operation to achieve desired operating parameters.

[0047] At 316, the machine is controlled by the operating controller via the control I / O generated at 314. This control loop can include both classical and modern controllers, such as proportional-integral or proportional-integral-derivative (PID) type controllers, fuzzy logic controllers, state-space controllers, linear quadratic regulators, or linear quadratic Gaussian controllers.

[0048] Figure 4 This is a schematic diagram of an exemplary computer system 400 (e.g., a data processing apparatus). According to one implementation, system 400 can be used for operations described in association with process 300.

[0049] System 400 includes a processor 410, memory 420, storage device 430, and input / output device 440. Each of the components 410, 420, 430, and 440 is interconnected using a system bus 450. Processor 410 is capable of processing instructions for execution within system 400. In one implementation, processor 410 is a single-threaded processor. In another implementation, processor 410 is a multi-threaded processor. Processor 410 is capable of processing instructions stored in memory 420 or storage device 430 to display graphical information of a user interface on input / output device 440.

[0050] Memory 420 (e.g., non-temporary memory) stores information within system 400. In one implementation, memory 420 is a computer-readable medium. In one implementation, memory 420 is a volatile memory cell. In another implementation, memory 420 is a non-volatile memory cell.

[0051] Storage device 430 (e.g., non-transitory storage) provides mass storage for system 400. In one implementation, storage device 430 is a computer-readable medium. In various implementations, storage device 430 may be a floppy disk device, hard disk device, optical disk device, or magnetic tape device.

[0052] Input / output device 440 provides input / output operations for system 400. In one implementation, input / output device 440 includes a keyboard and / or a pointing device. In another implementation, input / output device 440 includes a display unit for displaying a graphical user interface.

[0053] The described features can be implemented in digital electronic circuit systems or in computer hardware, firmware, software, or combinations thereof. The apparatus can be implemented in a computer program product tangibly embodied in an information carrier, for example, in a machine-readable storage device for execution by a programmable processor; and the method steps can be executed by a programmable processor that executes instructions of a program to perform the described implementation of the function by manipulating input data and generating output. The described features can be advantageously implemented in one or more computer programs executable on a programmable system comprising: at least one programmable processor coupled to receive data and instructions from and transmit data and instructions to a data storage system; at least one input device; and at least one output device. A computer program is a set of instructions that can be used directly or indirectly in a computer to perform an activity or cause a result. Computer programs can be written in any form of programming language (including compiled or interpreted languages) and can be deployed in any form, including as a standalone program or as a module, component, subroutine, or other unit suitable for a computing environment.

[0054] Suitable processors for executing instructions include, by way of example, both general-purpose and special-purpose microprocessors, as well as a single processor or one of several processors in any kind of computer. Generally, the processor receives instructions and data from read-only memory or random access memory, or both. Essential components of a computer are the processor for executing instructions and one or more memories for storing instructions and data. Generally, a computer will also include one or more mass storage devices for storing data files, or be operatively coupled to communicate with said one or more mass storage devices; such devices include disks, such as internal hard disks and removable disks; magneto-optical disks; and optical disks. Suitable storage devices for tangibly embodying computer program instructions and data include all forms of non-volatile memory, including, by way of example, semiconductor memory devices such as EPROM, EEPROM, and flash memory devices; disks such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks. The processor and memory may be supplemented by or incorporated into an ASIC (Application-Specific Integrated Circuit).

[0055] To provide interaction with the user, the features can be implemented on a computer having a display device (such as a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user, as well as a keyboard and pointing device (such as a mouse or trackball) through which the user can provide input to the computer.

[0056] The features can be implemented in a computer system that includes back-end components (such as data servers), middleware components (such as application servers or internet servers), or front-end components (such as client computers with graphical user interfaces or internet browsers), or any combination thereof. The components of the system can be connected via digital data communication (such as communication networks) of any form or medium. Examples of communication networks include, for example, LANs, WANs, and computers and networks that form the Internet.

[0057] Computer systems may include clients and servers. Clients and servers are generally geographically separated and typically interact via a network (such as the network described). The client-server relationship is established by computer programs that run on respective computers and have a client-server relationship with each other.

[0058] An embodiment may optionally include one or more of the following features.

[0059] In some embodiments, the sensor is triggered by a timer to perform measurements periodically.

[0060] In some embodiments, the control processor is configured to wait until the next trigger of the timer before controlling one or more operations of the machine.

[0061] In some embodiments, the timer triggers a measurement every 5ms.

[0062] In some embodiments, analyzing the conditioned sample includes confirming that the measurement was performed within 10% of the total period of the periodic measurement.

[0063] In some embodiments, the machine is a turbine generator.

[0064] In some embodiments, the control processor controls the speed of the machine.

[0065] In some embodiments, the measurement data includes information related to machine temperature, pressure, acceleration, and speed.

[0066] In some embodiments, the safety action is an emergency stop.

[0067] In some embodiments, the boundary processor isolates the control processor from the security controller and sends the conditioned sample to the control processor using a proprietary protocol. In some implementations, the proprietary protocol is an Ethernet protocol.

[0068] While several implementations have been described in detail above, other modifications are possible. For example, this concept is not limited to aircraft engine control or industrial turbine control; it will be applicable to any suitable frequency signal obtained from a variable magnetoresistive sensor. Furthermore, the logical flow depicted in the accompanying drawings does not require a specific order or sequence of steps to achieve the desired result. Additionally, other steps may be provided from the described flow, or steps may be eliminated from the described flow, and other components may be added to or removed from the described system. Therefore, other implementations are within the scope of the following claims.

Claims

1. A mechanical control system, comprising: Sensors are configured to measure the operating characteristics of a machine; A safety controller, communicating with the sensor, includes a dedicated boundary processor, wherein the safety controller communicates with a control processor via the boundary processor, the boundary processor isolates the operation of the control processor from the safety controller, and wherein the safety controller is configured to perform operations including: Receive measurement data from the sensor; The measurement data is subjected to signal conditioning to generate conditioned samples; Analyze the conditioned sample and determine whether to take safety action; and The conditioned sample is sent to the boundary processor for transmission to the control processor; The control processor is configured to perform operations, including: Receive the conditioned sample; and Based on the conditioned sample, control one or more operations of the machine.

2. The mechanical control system according to any one of claims 1, wherein the sensor is triggered by a timer to perform measurements periodically.

3. The mechanical control system of claim 2, wherein the control processor is configured to wait until the next trigger of the timer before controlling one or more operations of the machine.

4. The mechanical control system according to any one of claims 2 to 3, wherein the timer triggers the measurement every 5ms.

5. The mechanical control system according to any one of claims 2 to 4, wherein analyzing the conditioned sample includes confirming that the measurement is performed within 10% of the total period of the periodic measurement.

6. The mechanical control system according to any one of claims 1 to 5, wherein the operation of the safety controller is configured to occur during a scheduled period, and wherein the conditioned sample is sent to the boundary processor and transmitted to the control processor within the first 10% of the scheduled period.

7. The mechanical control system according to any one of claims 1 to 6, wherein the machine is a turbine generator.

8. The mechanical control system according to any one of claims 1 to 7, wherein the control processor controls the speed of the machine.

9. The mechanical control system according to any one of claims 1 to 8, wherein the measurement data includes information related to machine temperature, pressure, acceleration, and speed.

10. The mechanical control system according to any one of claims 1 to 9, wherein the safety action is an emergency machine stop.

11. The mechanical control system according to any one of claims 1 to 10, wherein the boundary processor isolates the control processor from the safety controller, and wherein the boundary processor sends the conditioned sample to the control processor using a proprietary protocol.

12. A method comprising: The safety controller receives measurement data from sensors configured to measure the operating characteristics of the machine. The safety controller performs signal conditioning on the measurement data to generate conditioned samples; The safety controller analyzes the conditioned sample and determines whether to take safety action. as well as The conditioned sample is sent to a boundary processor for transmission to a control processor, the boundary processor isolating the operation of the control processor from the security controller; The conditioned sample is received by the control processor and from the boundary processor; as well as Based on the conditioned sample, the control processor controls one or more operations of the machine.

13. The method of claim 12, wherein the sensor is triggered by a timer to perform measurements periodically.

14. The method of claim 13, wherein the control processor is configured to wait until the next trigger of the timer before controlling one or more operations of the machine.

15. The method of claim 13 or 14, wherein the timer triggers the measurement every 5 ms.

16. The method according to any one of claims 13 to 15, wherein analyzing the conditioned sample includes confirming that the measurement is performed within 10% of the total period of the periodic measurement.

17. The method of any one of claims 12 to 16, wherein the operation of the security controller is configured to occur during a scheduled period, and wherein the conditioned sample is sent to the boundary processor and transmitted to the control processor within the first 10% of the scheduled period.

18. A mechanical control system, comprising: Sensors are configured to measure the operating characteristics of a machine; A safety controller, communicating with the sensor, includes a dedicated boundary processor, wherein the safety controller communicates with a control processor via the boundary processor, the boundary processor isolates the operation of the control processor from the safety controller, and wherein the safety controller is configured to perform operations including: Receive measurement data from the sensor; The measurement data is subjected to signal conditioning to generate conditioned samples; Analyze the conditioned sample and determine whether to take safety action; and The conditioned sample is sent to the boundary processor for transmission to the control processor, wherein the control processor controls one or more operations of the machine based on the conditioned sample.

19. The mechanical control system of claim 18, wherein the sensor is triggered by a timer to perform measurements periodically.

20. The mechanical control system of claim 19, wherein the control processor is configured to wait until the next trigger of the timer before controlling one or more operations of the machine.

Images