OPTOELECTRONIC SAFETY DEVICE

Description

[0001] The invention relates to an optoelectronic security device for monitoring a monitoring area, comprising a light transmitter, a light receiver and an evaluation unit for evaluating the received signals and outputting a security signal depending thereon.

[0002] The main problem addressed by the present invention concerns the functional safety of optoelectronic safety devices. Sensors used in safety engineering, such as safety laser scanners, must operate with exceptional reliability and therefore meet stringent safety requirements, for example, the IEC 61508 or EN 62061 standard for safety-related systems and the EN 61496 standard for non-contact protective devices. These standards define architectural specifications that must be applied to various Safety Integrity Levels (SILs).

[0003] The required safety standards can be achieved through a range of measures, such as reliable electronic evaluation using redundant, diverse electronics, functional monitoring, and / or specific monitoring of contamination of optical components, and / or the provision of individual test targets with defined reflectances that must be detected at the corresponding scan angles. A single fault can be identified in a well-organized system through periodic self-tests. For example, if a reference target installed in the housing of an optoelectronic safety device is not detected or is detected incorrectly, it can be concluded that the sensor unit of this device is no longer functioning correctly. Within a specific timeframe, a safety-critical condition can therefore be detected and the device shut down safely.

[0004] More complex components of the optoelectronic safety device cannot always be tested quickly enough within the system. This primarily affects signal processing at the processor level. Here, it is common practice to perform the processing in two channels and compare the results. If one processor detects a discrepancy with the result in the other processor, this triggers a safety-related shutdown. Each processor has a redundant shutdown channel available.

[0005] The complete self-testing of such a system often requires more computing power than the actual safety function. A fully dual-channel processor unit with redundant processing units and separate memory increases the device's size, cost, and heat dissipation. In particular, coupling a single-channel sensor front end to a dual-channel processor back end can be problematic. Dedicated lockstep dual-core processors optimized for safety applications exist. These processors eliminate common-cause failures on a single chip. However, these chips are not available in high-performance classes. Furthermore, they currently lack the integration of programmable logic (FPGA) or sufficient flexibility in interfaces or add-on modules (e.g., ADCs).

[0006] Since security measures always involve a lot of extra effort and costs, the aim is to make the security measures as simple and efficient as possible, yet still effective and sufficient.

[0007] From EP 0 605 496 B1 a safety light curtain is known in which a system processor is checked via a watchdog controller to ensure safe operation.

[0008] From DE 102015101023 A1, a safety switching device is known in which a first signal processing channel is arranged on a first semiconductor substrate and a second signal processing channel is arranged on a second semiconductor substrate, wherein the two semiconductor substrates are monolithically assembled into a stack and thus into a single electronic component. This is a novel component, which is designed as a dedicated safety component specifically for safety applications and, although it forms only a single component in its composition, the individual layers of the stack are separate semiconductor substrates for the signal processing channels, which must be strictly separated therein.

[0009] WO 20128 / 125438 A2 discloses a non-secure LIDAR scanner which features so-called "adaptive scanning", in which objects can be scanned with different spatial resolutions depending on the angular range.

[0010] Processor monitoring using a watchdog processor is known from Majzik Istvan et al "Multiprocessor Checking Using Watchdog Processors FAUmachine View project Modula-2 View project", December 31, 2002 (2002-12-31), pages 1-16, XP55932111 and from US 2007 / 0294601 A1.

[0011] Based on this state of the art, the object of the invention is to provide an optoelectronic safety device with which the aforementioned disadvantages can be avoided, in particular reducing the effort and costs for the safety measures without losing the level of safety.

[0012] This problem is solved by a device having the features of claim 1.

[0013] An optoelectronic safety device according to the invention comprises a light transmitter for emitting transmitted light beams into a monitoring area, a light receiver for generating received signals from received light beams originating from reflections of the transmitted light beams off at least one object in the monitoring area, and an evaluation unit for evaluating the received signals and outputting a safety signal depending on the received signals. The evaluation unit includes a processing unit with at least two CPUs, wherein the processing unit is not a dedicated safety component and is designed as a standard multi-core processor on a single semiconductor substrate. This standard multi-core processor does not, in itself, meet any safety standard and is commercially available.The evaluation is performed redundantly on both CPUs of the computing unit, and the evaluation unit has a watchdog controller that monitors the function of the computing unit, whereby the watchdog controller can cause the evaluation unit to output the safety signal independently of the computing unit.

[0014] Commonly available standard multi-core processors are inexpensive integrated circuits that combine all the components needed to control and evaluate a complex optoelectronic safety device. The standard multi-core processor itself is not a dedicated safety component. In principle, several, especially two, identical processors could be used for evaluation to perform dual-channel signal analysis and thus at least increase functional safety. However, both processors share certain parts of the system, so even a single error can lead to a safety-critical system failure.The challenge of this invention, namely the use of a standard multi-core processor for an optical safety device, lies in identifying and diagnosing potential common-cause errors affecting both processors, as well as errors in the shared components of the standard multi-core processor, at runtime. According to the invention, this is achieved via a watchdog controller that can independently switch the safety output, independent of the standard multi-core processor. By monitoring the standard multi-core processor and independently switching the safety output, functional safety can be ensured by means of the watchdog controller. Such a watchdog controller has far fewer requirements than a second processor channel that would otherwise be necessary. Consequently, costs and energy consumption remain extremely low.Costs can be saved and waste heat can be reduced.

[0015] Further integration, and thus cost savings and heat reduction, can be achieved if the computing unit is designed as part of a SoC (System-on-Chip).

[0016] The watchdog controller can easily be placed externally to the SoC.

[0017] Advantageously, the watchdog controller forms a second logical shutdown channel with one of the CPUs of the processing unit. The watchdog controller thus has two functions: firstly, to monitor the operation of the processing unit, and secondly, to form a quasi-diverse shutdown channel together with one of the CPUs.

[0018] In a further development of the invention, the watchdog controller performs various tests to check the CPUs, whereby these tests a clock frequency comparison, an activity test, the generation of tasks for a CPU and the control of corresponding task results, or the monitoring of voltages may include.

[0019] In a further development of the invention, the watchdog controller communicates alternately with one CPU of the processing unit via a serial interface. In this way, for example, the two evaluation channels mentioned above can be created.

[0020] In a further development of the invention, it is also possible for the processor to contain additional processing cores, for example to increase computing power. This could be useful when using the invention in 3D cameras.

[0021] To increase security, a monitoring device may be provided that causes the standard multi-core processor to continuously perform self-tests on individual functions.

[0022] The invention is particularly advantageous in the use of safety laser scanners, FMCW radar, FMCW lidar, 3D-ToF security cameras, or safety sensors based on sensor data fusion. These devices are electronically very complex with sophisticated data processing and therefore require significant computing power, making it advantageous to keep the effort required to achieve functional safety as simple as possible.

[0023] The invention will now be explained in detail using an exemplary embodiment and with reference to the drawing. The drawing shows: Fig. 1 a schematic representation of an optoelectronic device according to the invention in use; Fig. 2 a block diagram of essential components of the optoelectronic safety device according to the invention.

[0024] In Fig. 1Figure 12 shows a safety laser scanner 12 as an embodiment of an optoelectronic safety device 10 according to the invention. This scanner operates according to the known light-trigger principle, in which a light transmitter 14 emits light beams 16 in the form of light pulses. The light beams 16 are emitted via a rotating deflection unit 18 by means of a mirror 20.

[0025] When an object 24 is within the field of view of the safety laser scanner 12, the transmitted light beams 16 are reflected by this object 24. The reflections of the transmitted light beams 16 are received as received light beams 26 via the same path through the deflection unit 18 and a receiving optic 28 to a light receiver 30, where they are converted into received signals.

[0026] The received signals are fed to an evaluation unit 32 for evaluation and output of a safety signal at an output 34, depending on the received signals. In the evaluation unit 32, which also controls the light transmitter 14, the pulse transit time of the transmitted light pulses is recorded, and from this the distance of the safety laser scanner 12 to the object 24 is determined. Additionally, the rotational position of the deflection unit 18 at the time of light emission is recorded via an encoder 19, so that the location of the object 24 is known from the knowledge of the deflection angle and the distance to the object 24. In this way, it can be checked whether the object 24 is located in a specific monitoring area 22. Thus, the monitoring area 22 is monitored to determine whether or not objects 24 are located within it.Depending on whether an object 24 is located in the monitoring area 22, the safety signal can be output at output 34.

[0027] The core of this invention is the design of the evaluation unit 32 and the method of evaluation, so that a safe function of the evaluation unit 32 in the sense of functional safety according to relevant safety standards can be ensured in a simple manner.

[0028] A basic and highly simplified representation of the structure is shown Fig. 2The evaluation unit 32 is shown there, which receives and evaluates the light signals from the light receiver 30 and controls the light transmitter 14. In addition to an FPGA 40, which sends and receives the analog signals from the light receiver 30 and the light transmitter 14, the evaluation unit 32 comprises a processing unit 42 with at least two CPUs 44 and 46. The processing unit 42 is not a dedicated safety component, i.e., it does not meet any relevant safety standard, and is designed as a standard multi-core processor 42 implemented on a single semiconductor substrate. Such standard multi-core processors are readily available commercially. The standard multi-core processor is preferably implemented as part of a SoC (System-on-Chip). The standard multi-core processor 42 redundantly evaluates the received signals forwarded by the FPGA 40 on the two CPUs 44 and 46, and depending on the evaluation, the safety signal is routed to an I / O unit 48.The I / O unit 48 is connected to output 34, where the safety signal is then provided.

[0029] According to the invention, the evaluation unit 32 additionally includes a watchdog controller 50, which monitors the function of the standard multi-core processor 42. The watchdog controller 50 can cause the evaluation unit 32 to output the safety signal independently of the standard multi-core processor 42. For this purpose, the watchdog controller 50 is connected to the standard multi-core processor 42 on one side and to the I / O unit 48 on the other. The watchdog controller 50 can be physically separate from the standard multi-core processor 42 or be part of a system-on-a-chip (SoC) unit.

[0030] As in Fig. 2As shown, the watchdog controller 50 forms a first logical shutdown channel with one of the CPUs, here CPU 44 of the standard multi-core processor 42. The other, second logical shutdown channel is formed by CPU 46. The watchdog controller 50 thus has two functions: firstly, to monitor the standard multi-core processor 42, and secondly, together with CPU 44, to form a quasi-diverse first shutdown channel for the second shutdown channel. It is also possible for the watchdog controller 50 to form a logical shutdown channel together with CPU 46. Preferably, the watchdog controller 50 forms a shutdown channel alternately with CPU 44 and CPU 46, as shown in Figure 2 The line is shown as a dashed line. Communication between CPUs 44 and 46 on the one hand and the watchdog controller 50 on the other hand takes place via a serial interface.

[0031] The Watchdog Controller 50 performs various tests to check the CPUs 44 and 46, whereby these tests may include a clock frequency comparison, an activity test, the generation of tasks for a CPU 44 or 46 and the checking of corresponding task results or the monitoring of voltages.

[0032] The timers of the standard multi-core processor 42 and the watchdog controller 50 are compared with each other, and deviations of the timers or their oscillations can be detected.

[0033] Furthermore, the Watchdog Controller 50 monitors the communication with the standard multi-core processor 42 with regard to the required timing. This means that the Watchdog Controller 50 checks whether the safety-relevant modules connected to it are still active (alive check) and communicating correctly. Timing errors or other errors lead to a safety-related shutdown.

Claims

1. Optoelectronic safety device with - a light transmitter (14) for emitting transmitting light beams (16) into a monitoring area (22), - a light receiver (30) for generating receiving signals from received light rays (26) originating from reflections of the transmitting light beams (16) on at least one object (24) in the monitoring area (22), - an evaluation unit (32) for evaluating the receiving signals and for issuing a safety signal depending on the receiving signals, - wherein the evaluation unit (32) has one computing unit (42) with at least two CPUs (44, 46), wherein the computing unit (42) is not a dedicated safety component and is designed as a standard multi-core processor on only one semiconductor substrate and the evaluation is carried out redundantly on both CPUs (44 and 46) of the computing unit (42), - and characterized in that the evaluation unit (32) has a watchdog controller (50) which monitors the function of the computing unit (42), wherein the watchdog controller (50) can cause the evaluation unit (32) to output the safety signal independently of the computing unit (42).

2. Safety device according to claim 1, characterized in that the computing unit is designed as part of a SoC (system-on-chip).

3. Safety device according to claim 2, characterized in that the watchdog controller is intended externally to the SoC.

4. Safety device according to any of the preceding claims, characterized in that the watchdog controller forms a second logical shutdown channel with one of the CPUs of the computing unit.

5. Safety device according to any of the preceding claims, characterized in that the watchdog controller performs various tests to check the CPUs.

6. Safety device according to claim 5, characterized in that the tests comprise - a watch comparison, - an activity test, - Generating tasks for a CPU and checking corresponding task results, or - Monitoring voltages.

7. Safety device according to one of the preceding claims, characterized in that the watchdog controller communicates alternately with one CPU of the computing unit via a serial interface.

8. Safety device according to any of the preceding claims, characterized in that the computing unit contains additional CPUs.

9. Safety device according to any of the preceding claims, characterized in that a monitoring device is provided which causes the computing unit to continuously perform self-tests on individual functions.

10. Safety device according to any of the preceding claims, characterized in that it is designed as a safety laser scanner, as an FMCW radar, as an FMCW lidar, as a 3D ToF security camera or as a safety sensor based on sensor data fusion.