Method and system for enabling safety-critical functions of a machine - Patents.com

Abstract

The invention relates to a method for activating a safety-critical function of a machine (1), wherein a monitoring system (2) monitors a safety-critical area of ​​the machine (1), the monitoring system (2) comprises at least one monitoring sensor (3), the safety-critical function is deactivated if the monitoring system (2) detects a first risk in a signal (4) from the monitoring sensor (3), the first signal (4) from the monitoring sensor (3) is combined with a first identifier at a first time point (t1, t4) to generate a first message (6), the first message (6) is sent by the monitoring system (2) to an activation unit (7), a second message (8) comprising the activation signal and the first identifier is received by the monitoring system (2) at a second time point (t5, t8), the second message (8) is checked by the monitoring system (2), and if the check on the second message (8) is successful the safety-critical function is enabled by the monitoring system (2).

Description

[Technical field]

[0001] The present invention relates to a method for enabling safety-critical functions of a machine.

[0002] The invention further relates to a system for enabling safety-critical functions of a machine.

[0003] It is known to monitor spatial areas using sensors and to stop a machine if the sensors detect a risk in the respective area, which can be for example a person or an object that is not expected in this area.

[0004] Typically, the machine is stopped or otherwise put into a safe state as soon as one of the sensors detects a risk. Any computing unit for evaluating the sensor signal, if it may be present, is considered here as part of the sensor. Activation of a stopped machine is typically only possible by visual inspection of the monitoring area. Therefore, activation requires that a person is in the immediate vicinity of the monitoring area.

[0005] A control device is known from DE 102016226133 (A1) which can be switched from an alarm state to a normal state by means of a transmitter by means of an optical signal.

[0006] It is an object of the invention to provide a system as mentioned at the beginning and a method as mentioned at the beginning which simplify machine validation.

[0007] This object is achieved by a method according to claim 1 and a system according to claim 8.

[0008] According to the invention, there is provided a method for disabling a safety-critical function of a machine, the method comprising: a monitoring system monitoring a safety-critical area of ​​the machine, the monitoring system comprising at least one monitoring sensor, the safety-critical function being interrupted when the monitoring system detects a first risk in a signal of the monitoring sensor, the first signal of the monitoring sensor being combined with a first identifier at a first time point to form a first message, the first message being transmitted by the monitoring system to an enabling unit, A method is provided in which at a second time, a second message having an enablement signal and the first identifier is received by the monitoring system, the second message is verified by the monitoring system, and if verification of the second message is successful, the safety-critical function is enabled by the monitoring system.

[0009] Possible sensors for monitoring the area are, for example, light barriers, contact sensors on the door, ultrasonic sensors, radar sensors or cameras. The sensors can monitor the borders of the area and / or the area itself.

[0010] The signal from the camera or another imaging sensor, i.e. the image, or preferably the image stream, is preferably used to transmit the first message. This is particularly advantageous when a person assesses the situation at the validation unit.

[0011] The identifier allows the monitoring system to assign the second message to the first message, which is advantageous when transmitting multiple messages with the signals of the monitoring sensors over a network where the temporal order of the messages is not guaranteed, for example the Internet.

[0012] The verification of the second message is considered successful if it does not fail for at least one reason. Possible reasons for verification failure are listed below.

[0013] Preferably, at a third time point, a second signal of the monitoring sensor is combined with a second identifier to form a third message, the third time point being after the first time point, and the second identifier being different from the first identifier, such that the identifier allows the temporal ordering of the signals to be determined.

[0014] The second signal is the same signal as the first signal, except that the second signal is generated by the monitoring sensor at a later time, preferably an image or a sequence of images taken at a later time, and thus the third message can be treated as the first message by the validation unit.

[0015] It is understood that further messages can be transmitted together with the respective current signals of the monitoring sensors. This means that the situation that has changed after the function has been interrupted can also be evaluated in the validation unit. The further messages each receive their own identifier. The messages are preferably transmitted cyclically. This is particularly advantageous if each message contains one or more images from the image stream of the camera.

[0016] The identifier is preferably a timestamp, which makes it particularly easy to determine the chronological order of the messages.

[0017] Particularly preferably, the first identifier is a cryptographically signed timestamp, and verification of the validation signal fails if verification of the first cryptographically signed timestamp from the second message fails. Cryptographically signed timestamps are known, for example, from the RFC3161 standard or the ANSI ASC X9.95 standard. Further information can also be found at https: / / en.wikipedia.org / wiki / Trusted_timestamping.

[0018] A cryptographically signed timestamp is advantageous since an activation signal with an arbitrary timestamp would lead to a verification failure, so that a failure of the activation unit does not result in an erroneous activation of a safety-critical function.

[0019] The second message is preferably provided with a second cryptographic signature from the validation unit, and verification of the second message fails if verification of the second cryptographic signature fails. The second signature can be created, for example, using a private key of the validation unit, and a public key associated with the private key is stored in the monitoring system for verifying the second signature. The cryptographic signature can be used to ensure that the second message originates from the validation unit and not from an unknown unit.

[0020] Preferably, the verification of the second message fails if the monitoring system detects a second risk between the first and second time points. Similar to the first risk, the second risk is detected from the signal of the monitoring sensor or another monitoring sensor. The safety-critical function is only enabled if the message with the enabling signal has an identifier indicating a time point after the last detected risk. Verification of an enabling signal with another identifier will result in a verification failure.

[0021] In a preferred embodiment, the first message is additionally sent to a second activation unit, and a second message from the second activation unit having the activation signal and the first identifier is handled by the monitoring system in the same way as the second message from the first activation unit. Sending the first message to the second activation unit allows the function to be activated by two activation units. This is advantageous in case of failure of an activation unit or when the operator is unable to operate the manually operated activation unit.

[0022] A second aspect of the invention relates to a system for disabling a safety-critical function of a machine, in particular a machine tool, comprising the machine, a monitoring system and an enabling unit, the monitoring system having at least one monitoring sensor for monitoring a safety-critical area of ​​the machine, the monitoring system and the enabling unit being communicatively connected, the monitoring system comprising a computing unit, the computing unit being provided and designed to evaluate a first signal of the monitoring sensor and to shut down the safety-critical function of the machine if the computing unit detects a first risk in the first signal of the monitoring sensor, the monitoring system being provided and designed to combine the first signal of the monitoring sensor with a first identifier and to send the first signal in a first message to the enabling unit, the monitoring system being provided and designed to receive a second message from the enabling unit comprising the enabling signal and the first identifier, the monitoring system being provided and designed to validate the second message and to enable the safety-critical function of the machine if validation of the second message is successful.

[0023] The computing unit may comprise a processor, an FPGA, an ASIC, a controller, or another computing device. The computing unit may be part of a machine or may be an independent unit.

[0024] The system is preferably provided and designed to carry out preferred embodiments of the method according to the invention.

[0025] The monitoring sensor is preferably a camera, whose signal can be particularly easily verified by a person.

[0026] The further monitoring sensor is particularly preferably a light barrier, a contact sensor, an ultrasonic sensor, a radar sensor or a lidar sensor. The additional sensors increase safety since more potential risks can be detected.

[0027] Preferably, the timestamp is a cryptographically signed timestamp and a monitoring system is provided and designed to verify the timestamp received in the second message and to fail verification of the second message if verification fails.

[0028] Preferably, a monitoring system is provided and designed to compare a second time point of receiving the second message with a first time point defined by a first identifier from the second message, and to fail verification of the second message if the difference between the first and second time points is greater than a predefined limit value.

[0029] Preferably, a monitoring system is provided and designed to fail verification of the second message if the monitoring system detects a second risk in a second signal of the monitoring sensor between the first and second time points.

[0030] Preferably, the second message is provided with a cryptographic signature of the validation unit, and a monitoring system is provided and designed to verify the cryptographic signature of the second message and to fail the verification of the second message if verification of the cryptographic signature fails.

[0031] The following description of preferred embodiments, taken in conjunction with the drawings, serves to explain the invention in more detail. [Brief description of the drawings]

[0032] [Figure 1] A schematic diagram of a monitoring system is shown. [Diagram 2]4 shows a general sequence of communication between the monitoring system and the validation unit. [Diagram 3] 2 shows a time sequence of the method according to the invention; DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0033] In all exemplary embodiments, elements that are the same or have equivalent functions are given the same reference numerals. The exemplary embodiments are described with a single activation unit. If multiple activation units are used, the first message of the monitoring system is sent to all activation units respectively, and the second message of the activation unit is handled by the monitoring system in the same way.

[0034] A schematic diagram of a monitoring system 2 is shown in Fig. 1. The area around a machine 1, in this case a laser cutting machine, is monitored by a monitoring sensor 3, in this case a camera. The monitoring sensor 2 transmits a signal 4, in this case a sequence of images, to a computing unit 5. If the computing unit 5 detects a risk in the signal 4, it shuts down safety-critical functions of the machine 1 so that no damage occurs. Preferably, the entire machine 1 is stopped or put into a safe state.

[0035] The computing unit 5 combines the signal 4 with the first identifier to form a first message 6. The computing unit 5 transmits the first message 6 to the activation unit 7. In this case, the activation unit 7 is a smartphone. The activation unit 7 verifies whether a risk is recognizable in the signal 4 or whether the risk is not present or is no longer present. In this embodiment, an operator 71 of the activation unit verifies the signal 4. If the risk is not recognizable in the signal 4, whether due to a false detection by the computing unit 5 or because the risk was of a temporary nature, the activation unit 7 generates a second message 8 with the activation signal and the first identifier and transmits the second message 8 to the computing unit of the monitoring system 2. The computing unit 5 verifies the second message 8. If the verification is successful, the computing unit 5 activates the safety-critical function of the machine 1. If the verification of the second message 8 fails, the function remains blocked.

[0036] The computing unit 5 preferably periodically generates in each case a further message 6 with the current signal 4 and an individual identifier of the monitoring sensor 3. This enables the validation unit 7 to verify whether the risk has disappeared at a later point in time and then to send a validation signal with the identifier of the message 6 in which the risk is no longer detectable.

[0037] Fig. 2 shows a schematic sequence of communication between the monitoring system and the enabling unit. In a first step 101, the monitoring system 2 detects a first risk. In a second step 102, the monitoring system 2 shuts down a safety-critical function of the machine 1. In a third step 103, the monitoring system 2 generates a signed timestamp as an identifier. In a fourth step 104, the monitoring system generates a first message 6, which includes both the signal 4 and the identifier. In a fifth step 105, the monitoring system 2 sends the first message 6 to the enabling unit 7 at a first time point. These steps are typically performed in rapid succession by a computing unit, so that the time point defined by the timestamp is identified with the first time point.

[0038] In a sixth step 106, the validation unit 7 receives the first message 6. In a seventh step 107, the validation unit 7 verifies whether a risk can be detected in the signal 4. If a risk in the signal 4 is detected by the validation unit 7 in the seventh step, the method ends. If the validation unit 7 does not detect any risk in the signal 4, the validation unit 7 creates a second message 8 in an eighth step 108. In this regard, the second message 8 comprises the validation signal and an identifier of the first message 6 in which no risk was detected. The second message 8 is signed by the validation unit 7 in a ninth step 109. In a tenth step 110, the validation unit 7 transmits the signed second message 8 to the monitoring system 2.

[0039] In an eleventh step 111, the monitoring system 2 receives a second message 8 at a second time. In a twelfth step 112, the monitoring system 2 verifies the second message 8. During this verification, the monitoring system 2 verifies the signature of the second message 8. If the signature is not from the validation unit 7, the verification fails and the method ends. If the first identifier is a signed timestamp, the monitoring system verifies whether the signature of the timestamp is valid. If the signature of the timestamp is invalid, the verification fails and the method ends. The monitoring system 2 verifies whether a second risk is detected in the signal 4 of the monitoring sensor 2 between the first and second time points determined by the first identifier. These steps are typically performed in rapid succession by the computing unit, so that the second time point is equated with the time of verification. If a second risk is detected, the verification fails and the method ends. If the verification does not fail, the verification is successful and the monitoring system enables the safety-critical functions of the machine 1 in a thirteenth step 113 .

[0040] 3 shows the time sequence of the method according to the invention. At time t1, the monitoring system 2 detects a first risk in the signal 4 of the monitoring sensor 3, shuts down a safety-critical function of the machine and sends a first message 6 with the signal of time t1 and a first identifier to the activation unit 7. At time t2, the activation unit 7 receives the first message 6. After verifying the signal and determining that there is no risk, the activation unit 7 sends a second message 8 with the activation signal to the monitoring system 2 at time t3.

[0041] At a time t4 after time t1, the monitoring system detects a second risk in the signal of the monitoring sensor and sends a third message with the signal 4 of time t4 and the second identifier to the activation unit 7. The safety-critical function was already interrupted at time t1. Time t4 is here after time t3, but could be before time t3 or before time t2.

[0042] At a time t5 after time t4, the monitoring system 2 receives a second message 8. Since a second risk was detected at time t4 between time t1 and time t5, the verification of the second message 8 fails, and therefore the safety-critical function remains interrupted.

[0043] At time t6, the activation unit 7 receives the third message 6. After verifying the signal and determining that there is no risk, the activation unit 7 sends a fourth message 8 with the activation signal to the monitoring system 2 at time t7. At time t8, the monitoring system 2 receives the fourth message 8. After successful verification of the fourth message, the monitoring system activates the safety-critical functions of the machine.

[0044] It can be seen that the third message is equivalent to the first message and the fourth message is equivalent to the second message. Therefore, the third and fourth messages are treated by the monitoring system and validation unit in the same way as the first and second messages. Similarly, time t4 is equivalent to time t1 and time t8 is equivalent to time t5. [Explanation of symbols]

[0045] 1 machine 2. Monitoring System 3 Monitoring Sensors 4 signals 5 Computing Units 6. First Message 7 Enabling Units 71 Operator 8. Second Message Time t1~t8

Claims

1. A method for releasing a safety-critical function of a machine (1), comprising the steps of: A monitoring system (2) monitors a safety-critical area of ​​the machine (1); The monitoring system (2) comprises at least one monitoring sensor (3), when the monitoring system (2) detects a first risk in the signal (4) of the monitoring sensor (3), the safety-critical function is interrupted; a first signal (4) of the monitoring sensor (3) is combined with a first identifier at a first time (t1) to form a first message (6); said first message (6) being transmitted by said monitoring system (2) to a validation unit (7); At a second time point (t5), a second message (8) comprising an activation signal and the first identifier is received by the monitoring system (2), the second message (8) is verified by the monitoring system (2); If the verification of the second message (8) is successful, the safety-critical function is enabled by the monitoring system (2).

2. 2. The method according to claim 1, characterized in that at a third time point (t4), a second signal of the monitoring sensor (3) is combined with a second identifier to form a third message, the third time point (t4) being after the first time point (1), the second identifier being different from the first identifier, and by means of the identifier the temporal order of the signals can be determined.

3. The method according to any one of claims 1 to 2, characterized in that the first identifier is a timestamp.

4. 4. The method according to claim 1, wherein the first identifier is a cryptographically signed timestamp, and the verification of the second message (8) fails if verification of the first cryptographically signed timestamp from the second message (8) fails.

5. 5. The method according to claim 1, wherein the second message (8) is provided with a second cryptographic signature from the validation unit (7), and the verification of the second message (8) fails if verification of the second cryptographic signature fails.

6. 6. The method according to claim 1, characterized in that the verification of the second message (8) fails if a second risk is detected (t4) by the monitoring system (2) between the first time point (t1) and the second time point (t5).

7. 7. The method according to claim 1, characterized in that the first message (6) is additionally transmitted to a second activation unit (7), and a second message (8) from the second activation unit (7) comprising an activation signal and the first identifier is handled by the monitoring system (2) in the same way as the second message from the first activation unit (7).

8. A system for releasing safety-critical functions of a machine (1), in particular a machine tool, comprising: The system comprises a machine (1), a monitoring system (2), and a validation unit (7), the monitoring system (2) comprises at least one monitoring sensor (3) for monitoring a safety-critical area of ​​the machine (1); the monitoring system (2) and the validation unit (7) are communicatively connected; The monitoring system (2) comprises a computing unit (5), the computing unit (5) is provided and designed to evaluate a first signal (4) of the monitoring sensor (3) and to interrupt the safety-critical function of the machine (1) if the computing unit (5) detects a first risk in the first signal (4) of the monitoring sensor (3), the monitoring system (2) is provided and designed to combine the first signal (4) of the monitoring sensor (3) with a first identifier and to transmit the first signal (4) in a first message (6) to the validation unit (7), the monitoring system (2) is provided and designed to receive an activation signal and a second message (8) comprising the first identifier from the activation unit (7), The system, wherein the monitoring system (2) is provided and designed to verify the second message (8) and to enable the safety-critical functionality of the machine (1) if the verification of the second message (8) is successful.

9. 9. The system according to claim 8, characterized in that the monitoring sensor (3) is a camera.

10. 10. The system according to claim 8 or 9, characterized in that the further monitoring sensor (3) is a light barrier, a contact sensor, an ultrasonic sensor, a radar sensor or a lidar sensor.

11. The system according to any one of claims 8 to 10, characterized in that the first identifier is a time stamp.

12. 12. The system according to claim 11, characterized in that the timestamp is a cryptographically signed timestamp and the monitoring system (2) is provided and designed to verify the timestamp received in the second message (8) and to fail the verification of the second message (8) if the verification fails.

13. A system according to any one of claims 8 to 12, characterized in that the monitoring system (2) is provided and designed to compare a second time point (t5) of receiving the second message (8) with a first time point (t1) defined by the first identifier from the second message (8) and to fail the verification of the second message (8) if the difference between the first time point (t1) and the second time point (t5) is greater than a predefined limit value.

14. A system according to any one of claims 8 to 13, characterized in that the monitoring system (2) is provided and designed to fail the verification of the second message (8) if the monitoring system (2) detects (t4) a second risk in a second signal of the monitoring sensor between a first time point (t1) and a second time point (t5).

15. The system according to any one of claims 8 to 13, characterized in that the second message (8) is provided with a cryptographic signature of the validation unit, and the monitoring system (2) is provided and designed to verify the cryptographic signature of the second message (8) and to fail the verification of the second message (8) if the verification of the cryptographic signature fails.

Images