Self-recovery type laser safety system equipped with an automatic diagnosis system

Abstract

A diagnostic system for a high-power laser system that detects and responds to malfunctions in the interlock of a laser safety system. When a fault is detected in any of the interlock circuits, the operating conditions of the laser are restricted or even shut down. To distinguish between typical transient faults caused by ambient conditions and persistent faults caused by a failed component or circuit that require external intervention for repair, the system uses a database of possible fault classifications to determine the likely type of fault. If the fault is likely to be transient, the laser is maintained in a reduced-power state until one or more temporary interlocks are applied as a backup for the failed interlock. The system can be repeatedly tested at full-power output for fault correction. Once recovered from a fault, the backup interlock can be disabled and the system returned to full operation.

Description

Technical Field

[0001] The present disclosure relates to technologies in the field of safety systems in laser systems, and more particularly to technologies related to the functional guarantee of such safety systems.

Background Art

[0002] High-power laser systems need to be protected by a number of safety interlocks so that they can be accessed by general users who have not received special training related to laser safety. Each interlock is configured to give a warning or execute a corrective measure when a situation occurs where a system user, bystander, or animal or inanimate object can access or come into contact with a high-power, and thus dangerous, laser beam. Such a plurality of interlocks constitutes part of a safety system also known as automatic emission control, and a typical laser system may have several interlocks that each detect a specific safety threat that can occur. Without these interlocks, there is a possibility that a user may access a dangerous laser beam or the beam may be emitted into the space around the laser system. An interlock can be understood as a circuit including a sensor, a logic element, and an output system. Its function is to ensure that the conditions under which the laser system operates are safe. Therefore, they give a warning or a corrective measure against external threats. Some such safety systems are described in a number of patent documents including, for example, Patent Document 1 for "optical wireless power supply system", Patent Document 2 for "optical wireless power supply system", Patent Document 3 for "flexible management system for optical wireless power supply", Patent Document 4 for "fail-safe optical wireless power supply", and Patent Document 5 for "laser power transmission system in an environment involving gas heating or cooking" (all of which are assigned to the present applicant).

[0003] Laser safety systems should, in some cases, be redundant. That is, there should be at least two interlocks that protect against the same safety threat, and even if one interlock fails to operate, there should always be at least one backup interlock that protects the user or the environment from the threats posed by a safety system failure. Some prior art systems incorporate such redundancy provisions. However, even with built-in redundancy, there can be situations where false operation of an interlock or a combination of such false operations occurs, rendering the safety system inadequate or inoperable.

[0004] The disclosure of each publication referred to in this section and other sections of this specification is hereby incorporated by reference in its entirety.

Prior Art Documents

Patent Documents

[0005]

Patent Document 1

Patent Document 2

Patent Document 3

Patent Document 4

Patent Document 5

Summary of the Invention

[0006] The present disclosure seeks to provide a novel system and method that overcome at least some of the drawbacks of prior art systems and methods. In particular, the present disclosure provides a monitoring or diagnostic system that monitors the function of the safety interlock itself. This ensures the detection of situations in which the interlock malfunctions, or combinations of such interlock malfunctions occur. Such malfunctions can render the safety system inadequate or even inoperable. Such a fault detection mechanism or diagnostic system is known from the relevant part of ISO 13849, which is intended to provide guidance in the design and evaluation of machine control systems, and in the event of such a fault in the safety system, it is necessary to issue a warning and take positive safety measures to control the operation of the laser system. Additionally, the diagnostic system needs to be able to execute and monitor a method for safely returning the laser system to normal operation if the diagnostic system determines that the interlock fault is due to a transient fault. This fault may heal naturally by returning the state of the laser system or the ambient environmental conditions to normal levels.

[0007] The present disclosure thus describes a new exemplary system for a diagnostic system that detects and responds to malfunctions in various interlock sensors, components, or circuitry of a laser safety system. In the event of a failure in one of these interlock circuits, the diagnostic system can instruct a change in the operating state of the laser or a shutdown to prevent the user from being exposed to a potentially dangerous laser beam. Thus, in situations where the reliability of the laser safety system can be compromised due to one or more interlock failures that would have otherwise caused the safety system to take the necessary safety actions if it were functioning properly, the diagnostic system performs the functions that the laser safety system itself should undertake, or in some cases similar functions. In this way, while an interlock system typically performs these measures to protect the user or the environment only in the event of a danger, the diagnostic system performs these measures in response not to a danger but to a malfunction of a sensor or component or circuitry, as if there were no detected interlock failure, the safety system would have done. Thus, the diagnostic system is not essentially a safety system, but rather can be said to be a system that checks whether all the interlocks that make up the safety system itself are operable and normal. The diagnostic system generally does this by monitoring sensors used for inputs to various interlocks, circuit outputs and measurements, and sensors indicating good normal operation of the logic elements of the safety system. When the monitor indicates that a value is outside the acceptable range or that there is no output at all, the diagnostic system indicates a system failure and operates to ensure the continued safety of the laser system. One way the diagnostic system achieves this is to ensure that the laser system switches to a safe state with a limited output intended to prevent the transmission of a potentially harmful beam, and optionally and additionally, to ensure that the laser system is prevented from switching to its normal high-power state.A circuit, software, or control element that achieves such a result is also called a safety interlock because it provides an input to the laser system that ensures the safety of its user.

[0008] Malfunctions of the interlock system can be divided into two general types. Some of such malfunctions can be caused by failures of physical components. Examples of such component failures can include burnout, short circuit, wire breakage of electronic components such as sensors or transistors, damage to reflectors or windows, etc. Such failures are typically permanent until at least repaired, and generally, the laser system should be made not to operate continuously until the component problem is solved by means external to the system. That is, for example, a broken or cracked mirror remains in that state until an engineer repairs or replaces it. Alternatively, in the situations where they exist, an automatic repair system performs some operation such as automatic self-cleaning of the optical surface, and the problem remains until the surface degradation is repaired.

[0009] Other malfunctions are caused by transient events such as environmental conditions including, for example, temperature, dust, humidity, radiation, electronic or acoustic noise and vibration, and other influences. These events cause temporary reading impairments or temporarily prevent the operation of the detection system, logic system, or switch, and thus temporarily prevent the interlock system from functioning properly. These malfunctions are often related to external influences on the system. Examples of such external influences include loss of sensitivity of parameter measurement sensors, lasers or their power supplies, photovoltaic cells, sensors due to sunlight, interference of electronic noise, gamma particles emitted from the sun, influence of transient external magnetic fields on circuits and components, vibrational movement of mirrors due to external mechanical shocks (but without permanent damage or movement), or external influences similar to these.

[0010] For a diagnostic system, it is generally difficult to determine whether a fault event is transient or persistent. Therefore, a component can be affected by external conditions until it reaches a physical state that deviates from its operating specifications, such as being exposed to a temperature that is too high or too low. Such an event is characterized as a transient event because once the temporary state has passed, the component will return to normal operation and perform its circuit function.

[0011] The diagnostic system is configured to monitor the operating state of the interlock and respond when it detects an interlock problem that is considered severe enough for the interlock to fail to provide a warning signal. The default response is typically to put the laser system in a safe state by reducing the laser output or turning it off completely, and to prevent the laser system from transitioning to a state where it can be involved in a danger even when in a safe state. Once in a safe state, it becomes necessary to determine whether the detected problem is a transient fault, even if the transient fault has passed. Since the laser output may be required to detect whether the transient problem has ended, the question is how to return the laser system to safe operation in a situation where the diagnostic system has revealed the presence of at least one faulty interlock that may or may not be functioning to give a danger warning. There may be safety issues associated with attempting to operate the laser system again. If the interlock does not function correctly, there is no assurance that the laser system will operate safely, so there may be no way to guarantee that the transient problem has passed without turning on the laser power.

[0012] To overcome this problem, the diagnostic system described herein uses a novel configuration adapted such that the procedure uses a second independent system check and control procedure to operate as a backup interlock. This can result in a temporary interlock that only functions to confirm that the laser system is in a safe state and can resume operation, even though the initial primary interlock that warned of a malfunction in the laser system does not give permission to resume operation of the laser system. Once it becomes clear that the main interlock is operating properly, the backup interlock procedure can be abandoned and reliance can be placed again on the main interlock to perform its function, since the fault condition has subsided or been repaired.

[0013] That is, interlocks can be classified into two groups. Primary interlocks typically analyze the operating characteristics of the system and give warning indications and prompt action if there are system malfunctions that would allow the transmission of harmful beams to the user or the surrounding environment. Such interlocks are generally referred to as complex interlocks because of their sophisticated operating modes, and include interlocks such as power accounting systems that check the difference between the transmitted beam power and the received beam power and calculate whether there has been an intrusion into the beam. Other interlocks, such as those based on measurement of specific operating parameters of the laser power supply, such as the laser current drawn, or those based on monitoring of the beam level reflected from the receiver, are also generally direct interlocks having the function of directly monitoring the correct operation of the system and the function of intervening in the event of a dangerous situation.

[0014] Other types of interlocks are used to ensure that, if a system failure is detected, and if one or more of the main interlocks can become inoperative even under system failure, the laser does not operate in a manner that could produce dangerous radiation. That is, such interlocks are temporary interlocks that are implemented as long as the main interlocks are inoperative due to system failure. Therefore, these interlocks may be referred to as backup interlocks or simple interlocks. This is because these functions are generally not as complex as the main interlocks.

[0015] There are a number of procedures that can be used as a simple and temporary interlock. Of these procedures, two are particularly easy to apply. This is because they only require controlling the irradiation power of the laser beam, without the need to operate other parameters or system components. The first simple interlock is for the diagnostic system to impose a limit on the laser to a level below the acceptable or accessible exposure limit (AEL) of the operable power. As a result, even if the original faulty part of the main interlock system remains inoperable, no dangerous situation will occur. The second temporary interlock can be implemented by limiting the time the laser can irradiate the beam to a period less than the permitted cumulative exposure limit time. Of course, these two temporary interlocks can be used in combination. One or both of these temporary interlocks, or one or more alternative temporary backup interlocks, can be applied until the diagnostic system receives confirmation that the event that caused the main interlock to malfunction has been resolved. If such a situation is achieved, the operation of the laser system can return completely to its original level. Other alternative temporary backup interlocks can use a number of functions such as rapidly scanning the laser beam on a patterned array so that, even if the laser is radiating at high power, it does not expose the area of the intruder for a long enough time to result in an overexposure situation. Another backup interlock is the activation of a beam-blocking function that absorbs the beam. Still another backup interlock is to attenuate or spread the laser beam power to be less than the permitted power limit. Finally, the beam control function can be used to direct the beam to an empty area where it is known that human access is not possible.

[0016] These simple interlocks or backup interlocks are used to ensure that the laser can operate reliably in the event of a fault, but in a controlled low-output state, or in a configuration where neither the user nor the environment is exposed to laser power for longer than the time allowed for the aforementioned laser beam power. Under such circumstances, as described below, the fault can be investigated and repaired or can return to a normal state on its own.

[0017] If the diagnostic system does not receive confirmation that the system has returned to correct operation, the laser is prevented from emitting at a higher output level. This is a procedure used for permanent, or more precisely non-transient, faults such as a damaged component, a short-circuited or open-circuited electronic function, a damaged mirror, etc., and it will not correct itself until the problem causing the fault is repaired. Generally, once this is done by the maintenance personnel, a confirmation signal indicating that the fault has passed should be generated by the maintenance personnel, and based on this confirmation signal, the laser system can be restarted.

[0018] For example, the diagnostic system must operate even when multiple interlocks are in operation, such as when there is at least one additional interlock providing a safety function in addition to the interlock currently being tested.

[0019] Such a safety diagnostic system is an essential element associated with the safety system of any high-power laser system. Without such a diagnostic system, even seemingly trivial events, such as digit shifts in computer routines due to power noise spikes, can cause the laser system to stop operating. In a laser wireless charging system, in situations where battery charging or replacement is unnecessary and the system is expected or capable of operating for long periods without further attention after setup, the need for a safety system that can self-recover from transient events becomes important. The safety diagnostic system of the present disclosure aims to realize a highly reliable safety system for such a laser power wireless transmission system.

[0020] In a general situation where the user blocks the beam, the interlock system should respond to put the system in a safe state. Such operations are well described in several prior art documents and patents, as well as in industry-imposed safety standards such as 21 CFR 1040.10 in the United States and IEC 60825-1 in many other countries.

[0021] As described above, the safety system should be provided with two or more interlocks to provide backup protection in case one interlock fails and cannot issue a warning of system failure. The backup interlocks may operate based on different physical characteristics of the laser system to provide various coverage in case of circuit or component failures. Additionally, a backup interlock that operates similarly to the first interlock may also be provided.

[0022] Since the safety system has redundancy in this way, the system can maintain safety even if a failure occurs in one interlock. However, if two interlocks fail, the system is likely to become unsafe. Although the probability that two interlocks fail simultaneously is extremely low, if one of the interlocks has a permanent failure and remains in a failed state for a long time without being monitored by a diagnostic system such as the system's regular tests, the system will be protected for a significant additional time, but that protection will be only by the remaining one interlock. The probability that the second interlock also fails over a long period of time increases further here. This is because the second interlock has been operating all the time until a defect is found in the first interlock. This diagnostic system limits the maximum time that the system can remain operational while an interlock can be in a failed state by using the time criteria of the fault detection procedure or by a counting procedure that counts the frequency at which the fault detection procedure is executed (the procedure is scheduled to operate at a predetermined interval).

[0023] Therefore, a self-diagnosis function of the system that periodically or constantly monitors whether the interlock is operating properly is required. According to one embodiment of the diagnostic system of the present application, this can be done by comparing the output result of one interlock with the output result of another interlock, or by comparing the input signal to one interlock with the input signal to another interlock. During normal operation, the responses of both should be the same in the sense that both point out the same danger at the same timing. However, since the responses are different even if one interlock fails, a danger warning should be issued and appropriate measures should be taken.

[0024] The above-described subsystem that performs self-diagnosis tests on various aspects of the safety system interlock is referred to as a diagnostic system in the present disclosure.

[0025] If a malfunction of the safety system is detected by the diagnostic system, the diagnostic system must put the laser system into a safe state in accordance with a functional safety standard such as ISO 13849. This is generally done by terminating the laser beam and emitting a warning signal to the user.

[0026] In particular, such a diagnostic system should be able to recover from a safe state and return to normal operation when it is determined that the fault is transient. In the case of such a transient fault, the diagnostic system should use at least a second interlock to ensure that it operates under safe procedures when restarting the laser system. When operating again, the diagnostic system can determine whether the transient fault has passed and the primary interlock is operable again. As a result, the laser system can be restarted or increased in power without having to wait for an external signal, as in the case of a permanent fault corrected by maintenance measures. Here, this restart procedure is performed so as not to pose a danger to the user or the environment.

[0027] Since transient faults can be caused by noise, as a result of comparing the output from a sensor with the output of other sensors, or a fixed value or a calculated value, the comparison criteria can temporarily deviate from the tolerance boundaries that define the correct function. This causes a transient diagnostic event and transfers the system to the safe mode. Similarly, such a situation can also occur when the output of the sensor appears to deviate from the set limits that define the correct operation. These limits are determined in advance or derived from calculations made from the operating parameters of the laser system.

[0028] For other transient situations due to external influences on the system, such as components exposed to out-of-specification temperatures, or signals from sensors whose measured values can change temporarily under the influence of light, magnetic fields, electric fields, or electromagnetic waves, transient diagnostic coverage events should be assumed.

[0029] Other classifications of such transient events can be found in software errors. Software anomalies, such as race conditions between different software threads or random changes in bits, can cause temporary problems, for example, in reading data from memory cells. Similarly, a watchdog warning signal indicating that the CPU is malfunctioning can be treated as a transient fault. This transient fault is corrected in the next periodic watchdog check of the system. This is often done by reloading the relevant data from storage and re-measuring the input, or by restarting.

[0030] Transient faults can also result from mechanical shocks to components. That is, for example, mechanical vibrations can temporarily "flex" an optical component out of its position without causing permanent damage. Once the external mechanical vibration has passed, the optical component generally returns to its correct position and the transient fault ends.

[0031] Other examples relate to environmental or weather conditions. This is because changes in air pressure, humidity, or dust content, etc., can modify the optical path within the system.

[0032] When it is possible to test the interlock without operating the laser, the system should typically do so. For example, if the interlock does not function or is likely not to function because the temperature of a component is too high, the current temperature of the component causing the interlock failure or potential failure can be determined without turning the laser on. In such cases, the diagnostic system prevents the laser from being turned on until the temperature returns within normal limits.

[0033] However, in many cases, it is impossible to test the interlock of a wireless power system using a laser without operating the laser. This diagnostic system includes procedures for safely handling such transient fault situations. This is done by using a temporary safety system to enable the laser to be safely turned on until the main interlock resumes normal operation, limiting the laser output or laser time, or limiting other laser parameters in such situations. Such a temporary safety system is typically implemented by the diagnostic system described in this disclosure.

[0034] Summarizing the differences between the conventionally existing interlock protection method and the interlock protection method of the present invention, the laser system is induced to a safer state according to the level of interlock applied to the system.

[0035] That is, if the laser is intentionally turned off and remains off, the system is inherently safe, and this can be referred to as state 1.

[0036] When the laser is turned on and in a low-power safe state, maintained at that low power by a dual power-limiting circuit, the system is fail-safe in the sense that one of the power-limiting circuits fails and the other takes over protection, and this can be referred to as state 2.

[0037] When the laser is turned on in a high-power safe state and safety is maintained by at least two interlocks that prevent the user from being exposed to dangerous levels, this is a typical safe state shown in the high-level safety interlock system described above and can be referred to as state 3.

[0038] Finally, the diagnostic system of the present disclosure describes a system that can safely test by the current diagnostic system whether an interlock that has failed among a plurality of interlocks of the system providing protection in state 3 has become operable again, even if the test only makes sense by operating the laser at full power. This is achieved by applying temporary additional interlocks to ensure that at least two interlocks are operable and the system with a high-power failure can be safely tested. This situation can be referred to as state 4.

[0039] That is, according to an exemplary embodiment of the device described in the present disclosure, a method for diagnostic monitoring of a laser system is provided that includes a certain number of basic interlocks that enable a safety system to ensure safe transmission of laser power. The method includes (i) Monitoring data from sensors that provide information about the operation of the basic interlocks, and for abnormal outputs outside the normal predicted output range, indicating that such abnormal outputs indicate a failure in the basic interlock associated with the sensor showing the abnormal output; (ii) In the event that a failure is detected in at least one basic interlock, putting the laser system in a safe state by restricting the laser power level transmitted or turning off the laser; (iii) Determining from a predetermined list of fault classifications whether at least one interlock failure has the characteristics of a permanent failure that requires external intervention to repair or the characteristics of a transient failure that is predicted to subside over time; and including (a) If it is determined that the interlock failure has the characteristics of a permanent failure, the safe state of the laser system is maintained; (b) If it is determined that the interlock failure has the characteristics of a transient failure, at least one backup interlock is temporarily applied so that the laser can operate safely until the failure in at least one basic interlock disappears, and the at least one temporarily applied backup interlock is disabled.

[0040] In such a method, the determination of whether the failure in at least one basic interlock has disappeared may be made a predetermined number of consecutive times until the failure disappears. Further, at least one backup interlock may include either maintaining the transmitted laser power at a limited level or limiting the time during which the transmitted laser power is radiated.

[0041] Additionally, in the method described above, if the failure in the basic interlock does not disappear even after a predetermined number of the consecutive predetermined number of times has elapsed, the failure in the basic interlock may be concluded to be a permanent failure rather than a transient failure. In that case, the method needs to warn of the need for external intervention and wait for the reception of an external instruction indicating that the failure has been corrected, and if received, enable the laser system to return from a safe state to normal operation.

[0042] The above method may further provide a step of preventing the laser system from entering a high-power state in the event that at least one basic interlock failure is detected. Such a basic interlock may be adapted to detect a failure in at least one of an electronic circuit, a sensor, a control system logic circuit, an electronic component, and an optical component.

[0043] Furthermore, according to still other implementations of the method of the present application, the diagnostic monitoring of the laser system includes a step of monitoring all of the basic interlocks of the laser system before determining that the failure in the basic interlock has disappeared and the laser system can operate in a high-power state.

[0044] In addition, in any of these methods, at least one temporarily applied backup interlock also (i) scanning the laser beam so that it does not point in any direction for a time that could exceed the safe exposure time for the beam's power level, (ii) blocking or diffusing the laser beam, (iii) attenuating the laser beam, (iv) directing the laser beam in a direction known to be safe may include any of these.

[0045] Any of the temporarily applied backup interlocks should be adapted to provide redundant safety so that the laser system can operate without limitation of the transmitted laser power level in the event that a fault is detected in at least one basic interlock.

[0046] According to yet other implementations of the methods of the present disclosure, a method is further provided for ensuring recovery from a transient fault in a primary interlock of a laser transmitter safety system. The method includes switching the laser transmitter to a safe state with a limited output power, applying at least one backup interlock to (i) ensure that the laser transmitter is in a state with a limited power output, (ii) limit the transmission time of the laser to a safe level with respect to the transmitted power output, (iii) scan the laser beam so that it does not collide with any position for a length exceeding a predetermined time, (iv) block the propagation of the laser beam, (v) attenuate the laser beam, (vi) direct the laser beam in a safe direction and applying it to perform at least one of these steps, Subsequent to the implementation of at least one of steps (i) to (vi), increase the laser output, check the correct functioning of at least the main interlock having a transient fault, and allow the normal full operation of the laser system if at least the main interlock having a transient fault shows the correct functioning, but if at least the main interlock having a transient fault does not show the correct functioning, return the laser system to a safe state with restricted output, wait for a predetermined time, increase the laser output and repeat at least one of steps (i) to (vi), and check the correct functioning of at least the main interlock having a transient fault, including.

[0047] In this method, the step of checking the correct functioning of at least the main interlock having a transient fault may include checking that the interlock sensor is operating normally and indicating that the transient fault of the interlock has been resolved, checking the logic circuit that monitors the operation of the interlock and ensuring correct operation, and checking the correct functioning of the control system for putting the laser system into a safe state. may include.

[0048] In any of the immediately preceding methods, after switching the laser transmitter to a safe state with restricted output power, the system may be prevented from switching to the normal full power state. Additionally, the step of blocking the propagation of the laser beam may be performed by an opaque object or a diffusive object.

[0049] Furthermore, an increase in the laser output of the laser system after performing at least one of steps (i) to (vi) is allowed because the system is now protected by at least one backup interlock to provide redundancy in the absence of a main interlock indicating a transient fault. In such a situation, the normal full operation of the laser system is allowed when checking the correct functioning of at least the main interlock having a transient fault indicates correct operation. The system is now protected by at least one of the temporary backup interlocks that provide redundancy of the main interlock in the absence of a main interlock indicating a transient fault.

[0050] In addition, in any of these methods, at least one backup interlock can be deactivated if at least the main interlock having a transient fault shows correct functioning. Further, in these methods, the step of checking the correct operation of the logic circuit monitoring the operation of the interlock can be achieved by using a watchdog circuit. Also, the step of checking the logic circuit monitoring the operation of the interlock can be achieved by observing whether the sensor output is within the logical range predicted from the sensor.

[0051] Finally, for clarification, the diagnostic system described in the present disclosure uses various types of secondary interlocks to enable the laser system to operate in order to test whether the fault of the main interlock has been corrected. Throughout the present disclosure, such secondary interlocks may be variously referred to as backup interlocks, temporary interlocks, redundant interlocks, or the like, and it should be understood that all of these nomenclatures refer to the same functional interlock entity.

Brief Description of the Drawings

[0052] The present invention will be more fully understood and appreciated from the following detailed description when used in conjunction with the drawings.

[0053]

Figure 1

Figure 2

DETAILED DESCRIPTION OF THE INVENTION

[0054] Referring now to FIG. 1, an overview of one exemplary method that can be used by a diagnostic system is schematically shown, in which the diagnostic system is to (i) monitor for the presence of a fault in the interlock of a high-power laser system, (ii) control the actions necessary to ensure the safety of the system after detection of such a fault, and (iii) return the laser system to a safe operating state without exposing a user or others in the vicinity of the laser system to danger after detection of signs of such a fault. The normal operating state of the laser system is referred to as the "interlock protection state". That is, for potentially dangerous situations arising from faults or user situations, the normal protection operation uses the interlock to give warnings until the fault is cleared or the user has left the dangerous situation.

[0055] In step 101, it is detected by the diagnostic system, typically by receiving the output from a sensor or sensors, that there is a fault in the interlock of the laser system. This can be the result of statistical calculations, comparison between different values, comparison of boundaries and values that can be the result of calculations of communication with external devices, an output that deviates beyond a limit from a predicted level, whether the predicted level is pre-determined or not, or whether it is the result of a level calculated from other measured values, or whether it has been received from an external source via a communication channel.

[0056] In step 102, if the presence of a non-functional interlock is suspected, it is dangerous to continue the operation of the laser system. Therefore, the laser system is put into a safe output limit state and further prevented from switching to the normal output operation state.

[0057] In step 103, the diagnostic system controller then determines whether an opposing reading is suspected due to potentially transient problems such as excessive noise levels, extreme temperatures, noise in the electronic environment, or other external problems. This determination typically involves comparing whether the parameters of the opposing reading match certain predefined criteria. These criteria are known to potentially indicate transient problems but are not related to failures that could cause common persistent failures in multiple safety-related subsystems. This step is a predictive estimate. This is because all the diagnostic system knows is that an incorrect reading has been obtained, and it is necessary to determine the true cause. The initial determination may be made by considering whether the detected fault matches the faults listed in a database list of predefined problems where the detected faults are often transient problems. If the specific fault detected does not match the faults on the list, it is assumed that the fault is likely to be "persistent" in the sense that it does not indicate a transient problem and will not disappear without intervention.

[0058] In step 104, the diagnostic controller may then maintain the laser system in a safe output limit state or turn off the laser for a predetermined type of fault for which such a measure may be recommended, and a warning signal indicating that external intervention is required may be generated. Optionally, a service call is also initiated so that repair or maintenance work can be performed. During that time, the diagnostic system controller continues to prevent the laser system from switching to normal output or continues to keep the laser in a closed state so that no laser output occurs. This state is maintained until an external signal indicating that the fault has been corrected is received by the diagnostic system controller from service or maintenance staff, or an automated external system such as a cleaning robot or software patch, and the laser system can then return to normal operation in step 104.

[0059] On the other hand, in step 103, if it is shown by the database list or the system's programming routine that the suspected fault is likely to be related to a transient problem, in step 105, the system is maintained in a safe, limited output state for a predetermined time or the laser is kept turned off. This provides additional guidance for determining whether the fault is a fixed fault or a transient fault. After waiting for a predetermined time in step 105, it is observed whether the opposite reading remains at an unacceptable level that may indicate that a permanent fault has occurred in the system, or whether, if the opposite reading changes, it remains at an unacceptable level that may indicate that a temporary problem has occurred due to external influence on components, circuits, measurement devices, or sensors, and thus fluctuating influence.

[0060] After waiting for a predetermined time in step 105, before proceeding to the process of determining whether the transient problem has passed, in step 106, the operating state of the diagnostic system must be checked to ensure that all the necessary parameters of the laser system's interlock are being correctly monitored. That is, for example, by a test that compares the output of a sensor suspected of generating out-of-range readings to a known and valid reference level, it is confirmed whether the suspected sensor and the interlock depending on it have returned to a correct operating state.

[0061] On the other hand, if it is found in step 106 that there is a possibility that the diagnostic system itself is not functioning correctly, it is considered dangerous to continue the procedure for determining when the transient failure of the laser system has passed, and (if it was actually a transient failure), the controller returns the system to step 104 and waits in a safe state or OFF state until it receives confirmation that the failure has been repaired in step 104.

[0062] On the other hand, if in step 106 a confirmation is received that the diagnostic system is in a correct operating state, in step 107, the system counter is started. The counter function is to record the number of times or the number of time increments that have elapsed while such a fault test is being repeatedly executed. This counter may be a counter that determines the number of repeated attempts made to determine whether the fault has been resolved, or, as determined in step 105, it may be a time-limit counter that sequentially increments at fixed time intervals, in which case the "counter" is a timer that measures the elapsed time since the fault test was applied in the previous sequential test cycle.

[0063] In step 106, since the diagnostic system is operable and thus the system is considered to be safely monitored, in step 108, additional backup or redundant interlocks are implemented and the laser output can be increased. This is based on the knowledge that both the primary and backup interlocks are operating properly and are applied while the laser output level is being raised. Thus, a test can be performed as to whether the original fault still exists. These backup or redundant interlocks may be, for example, the operation of the laser with either a reduction in the output level or a limitation in the duration such that exposure to the laser beam is restricted within the allowable safety conditions. Any other interlock that guarantees that the emitted beam is not dangerous, such as rapidly scanning the beam, blocking the beam, operating a beam attenuator or diffuser, or directing the beam in a safe direction, may be applied as a backup interlock to ensure the safe operation of the laser even when its output is increased. By the operation of the laser, the diagnostic system now has the opportunity to determine whether a system fault problem still exists, for example, by determining whether opposing readings still deviate from the limits of their predicted levels.

[0064] In step 108, if it is determined that there are no signs that the problem with the fault has been resolved, in step 109, the laser is either returned to a restricted output state or turned off completely, prevented from switching to the high state, a counter or timer is advanced, indicating that another system test cycle has been executed. To avoid infinite test iterations, there must be a limit to the number of test cycles executed. Therefore, in step 110, the system queries the counter / timer system to check whether the maximum number of cycles has been executed. If not, the method returns to step 105, waits for a predetermined time, and starts the test cycle procedure from step 106 again. If the maximum number of test cycles has been executed, in step 111, the system is queried to determine whether the fault has been eliminated. If not, the fault is considered a permanent fault, the laser is turned off in step 112, and the system waits for technical repair in step 104 as well.

[0065] On the other hand, in step 108, even before the maximum number of repetitions is executed, if the method determines that there are positive signs that the problem has been resolved, the diagnostic system will no longer prevent the laser from operating at its full power. However, if the system's interlock or operating parameters are affected by other parameters unrelated to the fault that has been discovered and corrected in the system, it may still prevent this. In this way, the system is considered to be fully operational again so that the operation of the backup interlock can be completed. In step 113, the full power of the laser system is enabled.

[0066] Referring now to FIG. 2, one exemplary way in which the diagnostic system operates to safely test whether the laser system can fully utilize its capabilities is schematically shown, as the transient fault in the main interlock has passed and the interlock has returned to its normal monitoring function.

[0067] In step 201, the diagnostic system typically receives outputs from one or more sensors and determines that a fault problem has been detected in the main interlock by comparing the output levels to limits, regardless of whether they are pre-determined or calculated.

[0068] In step 202, after fault detection based on the test results in step 201, the system is placed in a safe state, the output level is restricted, or the laser is turned off. The system should have at least one safe state and at least one state where safety is guaranteed by the interlock system but is not safe because not enough interlocks are operating.

[0069] Thereafter, in the safe state, in step 203, the system is prevented from transitioning to the "interlock protection state", i.e., the normally protected operation that uses the main interlock to warn of potentially dangerous situations, until the fault is resolved.

[0070] In step 204, the diagnostic system controller checks whether the problem found is in a database list of predetermined problems that could be transient faults. If the problem is not in the "transient list", it is further assumed to be of a permanent nature and external intervention is required for resolution. The diagnostic system may optionally wait for a predetermined time in step 220 and then raise the laser power to test whether the fault still exists for a shorter time than would be involved in exceeding the beam's allowable exposure limit. If the fault still exists, or if the aforementioned fault confirmation test is not performed, a warning is issued regarding the high likelihood of the permanent nature of the fault, and the laser system continues to be prevented from switching to the high-power state of the "interlock protection state" until an external event such as maintenance or user attention occurs.

[0071] Only if it is identified in step 204 that the fault is potentially transient, the system waits for a predetermined time in a safe performance - limiting state in step 205, or in the OFF state if so input, and then performs at least one of the following operations. All of these operations are operable as backup interlocks to ensure safety while the main interlock is malfunctioning before the laser can be returned to full - power output performance. 206 Limit the laser output power. 207 Limit the duration for which the laser is permitted to irradiate its beam. 208 Always change the alignment direction of the beam unit, such as by performing a scan motion procedure so that the laser does not point in one direction for a time that could exceed the safe exposure time for its output level. 209 Block the beam with an opaque object or diffuse the collimated beam with a diffusive object. 210 Attenuate the beam. 211 Direct the beam towards a known safe beam - absorbing target, a beam block, or a direction in which the beam is known to be non - harmful.

[0072] In step 212, once at least one of the previous steps 206 to 211 has been implemented, the laser can now be turned on at its increased output level. That is, since the system is now protected by at least one of the temporary backup interlocks from step 206 to step 211, an interlock - protected state is now being implemented. Redundancy is provided to the main interlock as long as the faulty main interlock is absent.

[0073] Once at least one of these safety protections is implemented, the diagnostic system typically performs a series of tests to ensure that each interlock is operable in all aspects of its function. The tests may advantageously include an assessment of the following three aspects of the interlock function.

[0074] (a) For example, sensor functions such as a temperature monitor that is checked by comparing its value with other test results of temperature, (b) logical functions such as determining whether the displayed temperature is outside the range considered for that measurement, which are generally tested by a watchdog, and (c) output functions such as an action to turn off a laser, which can be tested by attempting to turn off the laser to check whether the output function is operable.

[0075] If this process is applied to the method of Figure 2, the following steps will be taken.

[0076] In step 213, a test is performed to ensure that an interlock sensor, which was previously faulty and designed to indicate signs of danger, is operating correctly, typically by measuring the sensor response, such as the temperature monitor output, against a reference response.

[0077] In step 214, a test is performed to determine whether the overall interlock functional component is operating correctly in giving a logically acceptable result, i.e., whether the sensor and the sensor output are operating correctly, and whether a logic circuit or an analog circuit that performs a "logical operation" (the "logic" may be a simple comparison of a value with a threshold) is functioning. Typically, a watchdog on the controller is used to detect whether the output function of the circuit is functioning.

[0078] In step 215, a test is performed to determine whether a switch or control function for putting the system into a safe state is operating correctly. This is known to apply at this stage because the system is already in a safe state. However, situations may also arise where such a test is required in the procedure.

[0079] If all three of the above tests are checked in step 216 and it is determined that the problem has passed or has been automatically corrected, in step 217, the diagnostic system controller gives an instruction so that the laser system can resume normal operation up to full power output. The temporary backup interlock applied from steps (i) through (vi) may be disabled.

[0080] On the other hand, if in step 216 it is determined that any of the tests 213, 214, 215 is unsuccessful and it is determined that the problem of the failure has not subsided, the system is restricted to a low power state in step 218, is prevented from switching to the normal operating state in step 219, and the diagnostic control algorithm returns the system to step 205. Here, the system is instructed to wait in its performance-limited state before restarting the safety process from step 206 to step 216.

[0081] To illustrate the above-described procedure, an exemplary scenario of how the diagnostic system can operate in an exemplary real-world situation uses an exemplary wireless power laser system protected from accidental intrusion by the user using two main interlocks or basic interlocks. The first interlock is an intrusion detection system using an optical sensor such as a camera to detect when a person approaches or enters the beam path. The second interlock is a "power accounting system" that compares the power received by the receiver from the laser with the power radiated from the laser to determine whether the amount of power lost during transmission exceeds a limit value that may indicate an intrusion into the beam.

[0082] The system includes an interlock diagnostic system of the type described in the present disclosure and can monitor many failure situations.

[0083] Here, some typical faults that can be handled by the diagnostic system of the present application will be described. For a camera-based system, if the image is completely black, white, or gray, or has white noise or static interference, it indicates that there is a problem with the camera's interlock.

[0084] If the watchdog of the controller that processes the image is not reset periodically, further problems are suggested.

[0085] There may also be an additional problem that the switching controller or circuit used to turn off the laser is not functioning properly. This can be tested by periodically turning off the laser.

[0086] In the power accounting system, if the power measured by the power output meter of the transmitter does not match the laser power predicted from the power setting of the laser controller, if the watchdog of the system controller is not reset periodically, or if the switch used to turn off the laser does not operate, a diagnostic fault indication is given. When such an indication is received, the system switches to a safe state with limited performance. Usually, there is at least one additional switch for performing this function, so that even if the first switch function is lost, the system protection is not insufficient.

[0087] If one of the switches or its control circuit intended to turn off the laser in the system does not function, this fault is generally not considered a transient problem, and the system does not permanently switch to the normally power-on state with interlock protection until an external event such as a maintenance intervention procedure occurs. In such a situation, the diagnostic system uses other switches to keep the laser off.

[0088] If the watchdog of the controller is not reset regularly, the controller needs to be restarted, which may solve the problem. Such a restart operation should be performed without turning on the laser.

[0089] If the camera shows a defective image (as described above in this specification), it is necessary to retest without turning on the laser.

[0090] As another example of the diagnostic system of the present disclosure, one specific failure that requires a specific action is a failure of the power meter indicated as having a failure. In such a situation, it is preferable for the system to perform the following exemplary procedures. (i) Apply a temporary limit to the laser output. Typically, it is any of an exposure time limit, a power limit, or the application of a scan operation, all of which ensure that the laser does not exceed the safe exposure limit. (ii) Test the power meter with the laser beam clearly on. Since it is necessary to comply with the safe exposure limit, it is necessary to appropriately limit the exposure time of the laser beam and perform the test within a limited time. (iii) If the test does not show that the power meter is operating properly, the system is returned to a safe state, and if the problem with the power meter is a transient failure, the procedures from (i) to (iii) are repeated after a predetermined time when it is predicted that the problem will be cured within the predetermined time. (iv) Only when the power meter is tested as "operable", assuming that everything else is normal, the laser system can resume normal operation.

[0091] As a result of the exemplary embodiments being provided, this disclosure is complete and its scope is fully conveyed to those skilled in the art. To provide a complete understanding of the embodiments of this disclosure, numerous specific details are set forth, such as examples of particular components, devices, and methods. It will be apparent to those skilled in the art that neither the need to use specific details nor the fact that exemplary embodiments may be embodied in many different forms should be construed as limiting the scope of this disclosure. Further, it will be understood by those skilled in the art that the present invention is not limited by what has been particularly shown and described above. Rather, the scope of the present invention includes both combinations and sub - combinations of the various features described above, along with variations and modifications that do not exist in the prior art that would occur to those skilled in the art when reading the above description.

Claims

Claim 1 A method for diagnostic monitoring of a laser system, the laser system including a certain number of basic interlocks that enable a safety system to ensure safe transmission of laser power, the method comprising: monitoring data from sensors that provide information about the operation of the basic interlocks, and for abnormal outputs outside a normal predicted output range, indicating that such an abnormal output indicates a fault in the basic interlock associated with the sensor indicating the abnormal output; in the event that a fault is detected in at least one basic interlock, putting the laser system in a safe state by restricting the laser power level transmitted or by turning off the laser; determining from a predetermined list of fault classifications whether the at least one interlock fault (i) is a permanent fault that requires external intervention for correction, or (ii) is a transient fault predicted to recover over time has the characteristics of; and including (a) if it is determined that the interlock fault has the characteristics of a permanent fault, maintaining the safe state of the laser system; (b) if it is determined that the interlock fault has the characteristics of a transient fault, temporarily applying at least one backup interlock so that the laser can operate safely until the fault in the at least one basic interlock disappears, and invalidating the at least one temporarily applied backup interlock. Claim 2 The method according to claim 1, wherein the determination of whether the fault in the at least one basic interlock has disappeared is performed a predetermined number of consecutive times until the fault disappears. Claim 3 The method according to any one of claims 1 and 2, wherein the at least one backup interlock includes either maintaining the transmitted laser power at a restricted level or restricting the time during which the transmitted laser power is emitted. Claim 4 The method according to any one of claims 1 to 3, wherein if the fault in the basic interlock has not disappeared after a predetermined number of consecutive times, it is concluded that the fault in the basic interlock is a permanent fault rather than a transient fault. Claim 5 If it is determined that the fault has the characteristics of a permanent fault, warning of the need for external intervention and waiting for the receipt of an external instruction that the fault has been corrected, and if received, enabling the laser system to return from its safe state to normal operation, the method according to any one of claims 1 to 4.

6. The method according to any one of claims 1 to 5, further comprising the step of preventing the laser system from entering a high-power state in the event of detection of at least one basic interlock fault.

7. The method according to any one of claims 1 to 6, wherein the basic interlock is adapted to detect a fault in at least one of an electronic circuit, a sensor, a control system logic circuit, an electronic component, and an optical component.

8. The method according to any one of claims 1 to 7, wherein the diagnostic monitoring of the laser system includes the step of monitoring all of the basic interlocks of the laser system before determining that the fault in the basic interlock has disappeared and the laser system can operate in a high-power state.

9. The at least one temporarily applied backup interlock further scanning the laser beam so that the laser beam does not point in any direction for a time that can exceed the safe exposure time for the power level of the beam, blocking or diffusing the laser beam, attenuating the laser beam, pointing the laser beam in a direction known to be safe The method according to any one of claims 1 to 8, including any of.

10. The at least one temporarily applied backup interlock is adapted to provide redundant safety such that the laser system can operate without limitation of the transmitted laser power level in the event that a fault is detected in at least one basic interlock, the method according to any one of claims 1 to 9.

11. A method for ensuring recovery from a transient fault in a main interlock of a safety system of a laser transmitter, switching the laser transmitter to a safe state with a limited output power, at least one backup interlock, (i) ensuring that the laser transmitter is in a limited power output state; (ii) restricting the transmission time of the laser to a safe level with respect to the transmitted power output; (iii) scanning the laser beam so that the laser beam does not collide with any position for a length exceeding a predetermined time; (iv) blocking the propagation of the laser beam; (v) attenuating the laser beam; (vi) applying at least one of the steps of directing the laser beam in a safe direction; applying at least one of the steps of performing at least one of the above; following the implementation of at least one of steps (i) to (vi), increasing the laser output and checking the correct functioning of at least the main interlock having the transient fault; (a) allowing full operation of the laser system if at least the main interlock having the transient fault shows a correct function, (b) if at least the main interlock having the transient fault does not show a correct function, returning the laser system to a safe state with limited output, waiting for a predetermined time, increasing the laser output and re-executing at least one of steps (i) to (vi), and repeating the step of checking the correct function of at least the main interlock having the transient fault; A method comprising the above.

12. The step of checking the correct function of at least the main interlock having the transient fault includes: checking that the interlock sensor is operating normally and indicating that the transient fault in the interlock has been eliminated; checking the logic circuit monitoring the operation of the interlock and ensuring correct operation; checking the correct function of the control system for putting the laser system in a safe state; The method according to claim 11, comprising the above.

13. After switching the laser transmitter to a safe state with limited output power, the system is prevented from switching to its normal full power state. The method according to any one of claims 11 and 12.

14. The step of blocking the propagation of the laser beam is performed by an opaque object or a diffusive object, the method according to any one of claims 11 to 13.

15. The increase in the laser output of the laser system after performing at least one of steps (i) to (vi) is allowed because the system is now protected by at least one backup interlock to provide redundancy in the absence of the main interlock indicating a transient fault, the method according to any one of claims 11 to 14.

16. The normal full operation of the laser system is allowed when checking the correct function of at least the main interlock having the transient fault indicates correct operation, and the system is now protected by at least one of the temporary backup interlocks providing redundancy of the main interlock in the absence of the main interlock indicating a transient fault, the method according to claim 15.

17. When at least the main interlock having the transient fault shows a correct function, the at least one backup interlock can be deactivated, the method according to any one of claims 11 to 16.

18. The step of checking the correct operation of the logic circuit monitoring the operation of the interlock is achieved by using a watchdog circuit, the method according to any one of claims 11 to 17.

19. The step of checking the logic circuit monitoring the operation of the interlock is achieved by observing whether the sensor output is within the logical range predicted from the sensor, the method according to any one of claims 11 to 17.

Images