Method and system for controlling the access of an object or a person in a hazardous area

Abstract

The present invention relates to a method and system for controlling the access of an object or a person in a hazardous area inside a monitored zone, monitored by a RTLS. The method comprises: a) providing an access database (7) with access rights of tags (12) in the hazardous area (2), the access database being readable by a RTLS controller (10a); b) defining, by the RTLS, at least a geofenced zone (14; 16) delimiting an access path to and from the hazardous area (2); c) detecting, by the RTLS, when the position of a tag is inside the geofenced zone (14, 16); d) if a tag is detected in the geofenced zone, comparing, by the RTLS controller, a unique identification information (ID) identifying each tag with the access database; e) if the tag has an access right, changing at least a safety function of the hazardous area (2).

Description

"Method and system for controlling the access of an object or a person in a hazardous area" DESCRIPTION Field of the invention

[0001] The present invention relates to a method and a system for controlling the access of an object or a person in a hazardous area, for example in which a machine is installed, wherein the hazardous area is at least partially inside a zone monitored by a real-time location system, “RTLS”. Background art

[0002] Safety methods and systems for localizing an object or a person in a monitored zone and optionally trigger the muting function of the safety system to allow an authorized object or person to enter in a hazardous area, for example a hazard zone around a machine, are already known.

[0003] These methods and systems typically require that two independent conditions are satisfied in order to change the safety functions of the monitored zone.

[0004] For example, in US121232102A1 the position of an object or person is determined by a real-time location system and by a spatially resolving sensor. The positions returned by both the RTLS and the sensor are then compared by a evaluation unit and, if the two positionsmatch, the evaluation unit enables the muting of the sensor.

[0005] In other examples, the determination is performed on an unique identification information (ID) of the object or person. In this case, the unique identification information is detected independently by the RTLS and by an external ID identification sensor, for example a barcode reader.

[0006] Other solutions adopt a combination of the two methods above.

[0007] In any case, all the known methods and systems make use of external sensors. Summary of the invention

[0008] An object of the present invention is to provide a method and system for controlling the access of an object or a person in a hazardous area, which do not require the use of external sensors in addition to the real-time location system, thereby reducing the installation time, the production, installation and maintenance costs of the system, while improving at the same time its reliability.

[0009] The object is achieved with a method according to claim 1 and with a system according to claim 14. The dependent claims describe preferred embodiments of the invention.

[0010] According to claim 1, in a general embodiment, the method for controlling the access of an object or a person in a hazardous area is based on a RTLS, “Real-Time Location System”, wherein the object or the person is provided with one or more tags readable by the RTLS. The method comprises the steps of: a) providing an access database with access rights of each tag in the hazardous area, the access database being readable by a RTLS controller; b) defining, by the RTLS, at least a geofenced zone delimiting an access path to and from the hazardous area; c) detecting, by the RTLS, when the position of a tag is inside the geofenced zone; d) if a tag is detected in the geofenced zone, comparing, by the RTLS controller, a unique identification information identifying each tag with the access database; e) if the tag has an access right, changing at least a safety function of the hazardous area.

[0011] In one embodiment, the geofenced zone comprises at least an external portion, outside the hazardous area, and at least an internal portion, inside the hazardous area. If a tag with an access right is detected in the external portion, at least a safety function of the hazardous area is changed from an initial state to allowthe tag to access the hazardous area. When said tag is detected in the internal portion, the at least safety function is changed back to its initial state.

[0012] In one embodiment, the access to the hazardous area is controlled by a safety device, for example a safety light curtain. In this case, step e) of changing safety function(s) of the safety area comprises enabling, by the RTLS, a muting sequence of the safety device.

[0013] In one embodiment, the geofenced zone comprises: - a first external portion, outside the hazardous area; - a second portion, beginning outside the hazardous area upstream the safety device along an entry direction of the object or person from the outside to the inside of the hazardous area, and - a third internal portion, inside the hazardous area and downstream the safety device along the entry direction.

[0014] In this case, if a tag with an access right is detected in the first external portion, a first muting signal triggering a muting sequence is sent to the safety device. When the tag is detected to enter the second portion upstream the safety device, a second muting signal of the muting sequence is sent to the safetydevice, the second muting signal switching on the muting of the safety device.

[0015] When the tag is detected to enter the third portion, the second muting signal changes its state, or a third muting signal of the muting sequence is sent to the safety device, thereby switching off the muting of the safety device.

[0016] In one embodiment, the geofenced zone further comprises a fourth internal portion, downstream the third internal portion inside the hazardous area. In this case, when the tag is detected to enter the fourth internal portion, the first muting signal changes its state, or a fourth muting signal is sent to the safety device, thereby ending the muting sequence.

[0017] In one embodiment, when the tag is detected inside the hazardous area and the muting sequence has ended, the method provides that: - when the tag is detected in the fourth internal portion, the first signal is sent to the safety device; - when the tag is detected to enter the third internal portion, the second signal is sent to the safety device; - when the tag is detected inside the second portion, downstream the safety device in an exit direction of the person or object from the inside to the outside of the hazardous area, the second muting signal changes itsstate or a third muting signal is sent to the safety device, thereby switching off the muting of the safety device; - when the tag is detected to enter the first external portion, the first muting signal changes its state, or a fourth muting signal is sent to the safety device, thereby ending the muting sequence.

[0018] On one embodiment, when a tag is detected outside the hazardous area, the geofenced zone is set by the RTLS as an entry geofenced zone, in which the second portion ends inside the hazardous area, downstream the safety device.

[0019] Furthermore, when the tag is detected inside the hazardous area and the muting sequence has ended, the geofenced zone is set by the RTLS as an exit geofenced zone. In this case, the length of the second portion is changed by the RTLS so that the second portion is completely downstream the safety device in the exit direction. The length of the third portion is changed by the RTLS so that the third portion ends downstream the safety device in the exit direction.

[0020] In one embodiment, wherein the object accessing the hazardous area is a mobile device provided with a first tag placed on a front part of the mobile device and with a second tag placed on a rear part of the mobiledevice, the method provides that: - the muting signals associated with the first and second portions of the geofenced zone are controlled only according to the position of the first tag, while the second tag is not considered; - the muting signals associated with the third and fourth portions of the geofenced zone are controlled only according to the position of the second tag, while the first tag is not considered.

[0021] In this case, the shapes of the first, second, third and fourth portions of the geofenced zones may not change, regardless the fact the mobile device is entering or exiting the hazardous area.

[0022] In one embodiment, a manual restart button is operatively connected to the safety device and located outside the hazardous area. In this case, the geofenced zone may comprise: - a first external portion, outside the hazardous area; - a second portion, beginning outside the hazardous area upstream the safety device along an entry direction of the object or person from the outside to the inside of the hazardous area.

[0023] If a person provided with a tag with an access right is detected in the first external portion, a firstmuting signal triggering a muting sequence is sent to the safety device.

[0024] When the tag is detected to enter the second portion upstream the safety device, a second muting signal of the muting sequence is sent to the safety device, the second signal switching on the muting of the safety device.

[0025] The muting of the safety device is switched off only if the tag is detected in the second portion downstream the safety device in an exit direction of the person from the inside to the outside the hazardous zone and the manual restart button is pressed.

[0026] In one embodiment, the method further comprises the step of providing a tag type database with different types of tag, the tag type database being readable by the evaluation unit of the RTLS.

[0027] In this case, step d) further comprises, if a tag is detected in the geofenced zone, the RTLS compares the unique identification information identifying each tag with the tag type database. Furthermore, in step e), if the tag has an access right and if the tag is of a certain type, the RTLS changes at least a parameter of the hazardous area.

[0028] More specifically, when a machine operates in the hazardous area, the step of changing, by the RTLS, atleast a parameter of the hazardous area comprises changing a working parameter of the machine.

[0029] The present invention is also related to a system for controlling the access of an object or a person in a hazardous area, comprising: - a real-time location system, “RTLS”, comprising a RTLS controller and a plurality of radio stations, each radio station being operatively connected to the controller; - one or more tags suitable for being attached to the object or person, each tag being configured to exchange data with the plurality of radio stations and being uniquely identified by a unique identification information; - at least one safety device suitable for controlling the access to the hazardous area and operatively connected to the RTLS controller.

[0030] The position data of the person or object can be determined by means of the RTLS.

[0031] The RTLS is configured to implement the method described above. Brief description of the drawings

[0032] Further features and advantages of the method and system according to the invention will be apparent from the description given below of preferred embodimentsthereof, made by way of a non-limiting examples with reference to the appended drawings, wherein: - Figure 1 schematically shows a system for controlling the access of an object or a person in a safety area of a machine, according to one embodiment of the invention; - Figure 2 is an example of an access database; - Figure 3 is an example of a tag type database; - Figures 4 and 4a schematically show a hazardous area with an entry geofenced zone and an exit geofenced zone, respectively; - Figure 5 is a flow-chart of the method for controlling the access of an object or a person in hazardous area, according to one embodiment of the invention; - Figures 6-8 are flowcharts related to parts of the method implemented in respective different positions of a tag of an operator with respect the hazardous area, where the tag has no access rights; - Figure 9 is a time diagram of the signals involved in the method of figures 6-8; - Figures 10-21 are flowcharts related to parts of the method implemented in respective different positions of a tag of an object with respect the hazardous area, where the tag has access rights;- Figure 22 is a time diagram of the signals involved in entry phase of the method of figures 10-21; - Figure 23 is a time diagram of the signals involved in exit phase of the method of figures 10-21; - Figure 24-28 are flowcharts related to parts of the method implemented in respective different positions of a tag of a person with respect the hazardous area, where the tag has access rights; - Figure 29 is a time diagram of the signals involved in the method of figures 24-28; - Figure 30 is another example of an access database; - Figure 31 is an example of an object provided with a front tag and a rear tag; - Figures 32 and 32a are examples of an access database and of a tag type database for the object of Figure 31; and - Figures 33 and 33a are examples of a hazardous area with a geofenced zone, when the object with two tags of Figure 31 is inside and outside the hazardous area, respectively. Detailed description of embodiments of the invention

[0033] In the drawings, reference number 1 globally denotes a monitored zone. This monitored zone 1 is monitored by a real-time location system 10 (in the following, “RTLS”).

[0034] The RTLS 10 comprises a RTLS controller 10a and a plurality of radio stations 10b, also called “anchors”. Each radio station 10b is operatively connected to the controller 10a.

[0035] The RTLS 10 is configured to control the position of objects 5 or persons 6, moving within the monitored zone 1. To this end, one or more tags 12 are attached to each object 5 or person 6. Each tag 12 is configured to exchange data with the plurality of radio stations 10b.

[0036] In one embodiment, each tag 12 is a RFID tag.

[0037] However, the term “tag” includes any wireless device readable by the RTLS through the radio stations 10b. For example, a tag may be also implemented with Beacon, GPS, Wi-Fi, Ultra-wide Band technologies.

[0038] Each tag 12 has a processor.

[0039] Each tag 12 is also uniquely identified by a unique identification information (ID).

[0040] A hazardous area 2 is defined at least partially inside the monitored zone 1.

[0041] A machine 3, for example a robot, is installed in or close to the hazardous area 2.

[0042] The hazardous area 2 may be defined at least partially around, or close to, the machine 3.

[0043] The machine 3 is operatively connected to theRTLS controller 10a. More specifically, as it will be described further on, the RTLS controller 10a is configured to control some operating functions of the machine 3.

[0044] In one embodiment, the access to the hazardous area 2 is controlled by at least one safety device 4, for example a safety light curtain, a laser scanner, a safety radar, or more in general any ESPE designed to guarantee safe operations of the machine.

[0045] The safety device 4 may be operatively connected to the controller 10a of the RTLS 10. More specifically, as it will be described further on, the RTLS controller 10a is configured to control some safety functions of safety device 4.

[0046] The RTLS 10 is configured to implement a method for controlling the access of an object 5 or a person 6, provided with at least a tag 12, in the hazardous area 2, as described herein below according to some embodiments of the invention.

[0047] The method provides that the RTLS controller 10a can read an access database 7 (Figure 2) which specifies access rights of each tag 12 in the hazardous area 2.

[0048] In addition, the method may provide that the RTLS controller 10a can read a tag type database 8(Figure 3) which specifies different types of tag 12, for example operator or vehicles tags).

[0049] In one embodiment, the RTLS 10 is configured to define: - an entry geofenced zone 14 around the safety device 4 (externally and internally) to be used during the entrance phase of the tags 12 into the hazardous area 2 (Figure 4); - an exit geofenced zone 16 around the safety device 4 (externally and internally) to be used during the exit phase of the tags 12 from the hazardous area 2 (Figure 4a).

[0050] In other words, the geofenced zones 14, 16 define an access path to and from the hazardous area 2.

[0051] With reference to the flowchart 100 of figure 5, in one embodiment, the method for controlling the access of a person 6 (an operator) or an object 5 (for example a mobile device or vehicle) to the hazardous area 2 starts with an acquisition, by the RTLS 10, of the position of all the tags 12 (step 102).

[0052] The RTLS 10 then may check the status of the safety device 4 and of an optional presence sensor inside the hazardous area 2 (step 104).

[0053] If an unexpected situation occurs, the system enters a safety state (step 106).

[0054] If no unexpected situation occurs, the RTLS sets the entry geofenced zone 14 or the exit geofenced zone 16, depending on the current conditions (step 108).

[0055] The RTLS then checks whether there is any tag 12 in the geofenced zone 14; 16 (step 110).

[0056] If there are no tags in the geofenced zone 14; 16, the method ends.

[0057] If at least a tag 12 is detected in the geofenced zone 14; 16, the RTLS checks tag ID and compares it with the access database 7 (step 112) and with tag type database 8 (step 114).

[0058] If, from the comparison, the tag 12 results to be allowed to access the hazardous area 2, a muting sequence of the safety device 4 is enabled (step 116).

[0059] If the tag 12 is not allowed to access the hazardous area 2, the muting sequence of the safety device 4 is not enabled (step 118).

[0060] As it will be described further on, in one embodiment the muting sequence is based on a transmission, by the RTLS controller - or, in an alternative embodiment, by the tag processor - to the safety device 4, of a sequence of two signals: a first muting signal (A) triggering the muting sequence and a second muting signal (B), which (if the first muting signal (A) is active) causes the muting of the safetydevice 4.

[0061] Figure 2 is an example of the access database 7, in the form of a table. In the table: - tag ID 1 is not allowed to have access to the hazardous area 2 and therefore the muting of the safety device 4 is not enabled; - tag ID 2 is allowed to have access to the hazardous area 2 and therefore the muting of the safety device 4 is enabled; - tag ID 3 is allowed to have access to the hazardous area 2 and therefore the muting of the safety device 4 is enabled.

[0062] In addition, access database 7 may specify if and how the status of the machine 3 has to be modified if the tag enters the hazardous area 2.

[0063] In the example, if tag ID 1 enters the hazardous area 2, the machine must be stopped. If tag ID 2 enters the hazardous area 2, the machine can go on running at normal operating speed. If tag 3 enters the hazardous area 2, the machine is controlled so as to run at a reduced operating speed.

[0064] Figure 3 is an example of the tag type database 8, in the form of a table. In the example: - tag ID 1 is associated to an operator; - tag ID 2 is associated to a vehicle;- tag ID 3 is associated to an operator.

[0065] Figure 4 is an example of an entry geofenced zone 14. In the example, the entry geofenced zone 14 comprises: - a first external portion A, outside the hazardous area 2; - a second portion B, beginning outside the hazardous area 2 upstream the safety device 4 along an entry direction of the object or person from the outside to the inside of the hazardous area 2 and ending inside the hazardous area, downstream the safety device; - a third internal portion C, inside the hazardous area 2 and downstream the safety device 4 along the entry direction; - a fourth internal portion D, downstream the third internal portion C, inside the hazardous area 2.

[0066] Figure 4a shows an exit geofenced zone 16. The exit geofenced zone 16 has the same portions A-D of the entry geofenced zone 14. However, the length of the second portion B is changed by the RTLS so that the second portion is completely downstream the safety device 4 in the exit direction, and the length of the third portion C is changed by the RTLS 10 so that the third portion C ends downstream the safety device in the exit direction.

[0067] As it will be apparent from the following description of some embodiments of the method of the invention, the different shape of the geofenced zones, depending on whether the object is entering in or exiting from the hazardous area 2, guarantees that the muting sequence for muting the safety system 4 begins and ends properly in terms of position of the tag with respect the safety device 4 to be muted and unmuted.

[0068] Figure 6 is a flowchart 200 of the method according to the present disclosure, when tag ID1 (not allowed to enter the hazardous area 2) tries to access the hazardous area 2 and is in the first portion A of the entry geofenced zone 14 (Figure 6a).

[0069] In step 202, the RTLS acquires position of all tags and detects a tag 12 in the first portion (A) of the entry geofenced zone 14.

[0070] In step 204, the RTLS 10 checks the status of the safety device 4 and optionally of the presence sensor inside the hazardous area 2: tag 12 results outside the hazardous area 2 and does not intercept the safety device 4.

[0071] If no unexpected situation occurs, in step 206 RTLS 10 sets the geofenced zone as the entry geofenced zone 14.

[0072] In step 208, the RTLS 10 checks the ID of tag12 and compares the detected ID1 with tag type database 8: tag ID1 is an operator tag 12.

[0073] In step 210, the RTLS checks the ID of tag 12 and compares the detected ID1 with access database 7: tag ID1 has no access rights.

[0074] Therefore, the first muting signal A is not sent (that is, the muting sequence does not start) (step 212).

[0075] Figure 7 is a flowchart 300 of the method according to the present disclosure, when tag ID1 (not allowed to enter the hazardous area 2) tries to access the hazardous area 2 and is in the second portion B of the entry geofenced zone 14 (Figure 7a).

[0076] In step 302, the RTLS acquires position of all tags and detects a tag 12 in the second portion B of the entry geofenced zone 14, but upstream the safety device 4.

[0077] In step 304, the RTLS 10 checks the status of the safety device 4 and optionally of the presence sensor inside the hazardous area 2: tag 12 results outside the hazardous area 2 and does not intercept the safety device 4.

[0078] If no unexpected situation occurs, in step 306 RTLS 10 sets the geofenced zone as the entry geofenced zone 14.

[0079] In step 308, the RTLS 10 checks the ID of tag 12 and compares the detected ID1 with tag type database 8: tag ID1 is an operator tag 12.

[0080] In step 310, the RTLS checks the ID of tag 12 and compares the detected ID1 with access database 7: tag ID1 has no access rights.

[0081] Therefore, second muting signal B is not sent (that is, the muting sequence does not start) (step 312).

[0082] Figure 8 is a flowchart 400 of the method according to the present disclosure, when tag ID1 (not allowed to enter the hazardous area 2) tries to access the hazardous area 2 and has intercepted the safety device 4 (Figure 8a).

[0083] In step 402, the RTLS acquires position of all tags and detects a tag 12 in the third or fourth portion (C, D) of the entry geofenced zone 14.

[0084] In step 404, the RTLS 10 checks the status of the safety device 4 and optionally of the presence sensor inside the hazardous area 2: the safety device 4 has been intercepted.

[0085] An unexpected situation has occurred, and, in step 406, a safety state is activated (for example machine 3 stops).

[0086] In this case, a manual restart (for example triggered by the pressure of a restart button 11) isneeded to restore the operating state of the safety device 4 (step 408).

[0087] Figure 9 is a time diagram of the signals involved in the method for controlling the access of the person 6 provided with tag ID1 (no access rights) in the hazardous area 2, in correspondence with the passage of the person across portions of the entry geofenced zone 14.

[0088] In particular, the following signals are reported: - for the muting sequence, first muting signal A and second muting signal B, both inactive (logical level “0”); - the resulting muting signal “MUTING”, not active; - EMERGENCY signal, which is activated when the tag intercepts the safety device 4 and is switched off by the pressure of a manual restart button 11; - the safety device status signal (“SCL’ status”), which is normally active, is switched off when the tag ID1 intercepts the safety device and is activated again by the pressure of the restart button 11; - a presence sensor status signals, which is normally OFF and switches ON when tag ID1 enters the hazardous area 2; - the machine status signal, which is in a state offull speed until the tag ID1 intercepts safety device 4, when the machine is stopped; the machine restarts when the restart button 11 is pressed.

[0089] Figure 10 is a flowchart 500 of the method according to the present disclosure, when tag ID2 (a vehicle 5 allowed to enter the hazardous area 2) tries to access the hazardous area 2 and is in the first portion A of the entry geofenced zone 14 (Figure 10a).

[0090] In step 502, the RTLS acquires position of all tags and detects a tag 12 in the first portion A of the entry geofenced zone 14.

[0091] In step 504, the RTLS 10 checks the status of the safety device 4 and optionally of the presence sensor inside the hazardous area 2: tag 12 results outside the hazardous area 2 and does not intercept the safety device 4.

[0092] If no unexpected situation occurs, in step 506 RTLS 10 sets the geofenced zone as the entry geofenced zone 14.

[0093] In step 508, the RTLS 10 checks the ID of tag 12 and compares the detected ID2 with tag type database 8: tag ID2 is a vehicle tag 12.

[0094] In step 510, the RTLS checks the ID of tag 12 and compares the detected ID2 with access database 7: tag ID2 has access rights.

[0095] Therefore, first muting signal MUT A is sent (that is, the muting sequence starts) (step 512).

[0096] Figure 11 is a flowchart 600 of the method according to the present disclosure, when tag ID2 is in the second portion B of the entry geofenced zone 14, but still upstream the safety device 4 (Figure 11a).

[0097] In step 602, the RTLS acquires position of all tags and detects a tag 12 in the second portion (B) of the entry geofenced zone 14, but external to the hazardous area 2 (Figure 11a).

[0098] In step 604, the RTLS 10 checks the status of the safety device 4 and optionally of the presence sensor inside the hazardous area 2: tag 12 results outside the hazardous area 2 and does not intercept the safety device 4.

[0099] If no unexpected situation occurs, in step 606 RTLS 10 sets the geofenced zone as the entry geofenced zone 14. [000100] In step 608, the RTLS 10 checks the ID of tag 12 and compares the detected ID2 with tag type database 8: tag ID2 is a vehicle tag 12. [000101] In step 610, the RTLS checks the ID of tag 12 and compares the detected ID2 with access database 7: tag ID2 has access rights. [000102] Therefore, second muting signal B is sent tothe safety device 4 (that is, the muting sequence proceeds) (step 612). [000103] When the safety device 4 receives second muting signal B, muting is active (step 614). [000104] RTLS 10 then checks the impact on machine 3 associated with the type of tag: machine 3 runs at normal operating speed (step 616). [000105] Figure 12 is a flowchart 700 of the method according to the present disclosure, when tag ID2 is in the second portion B of the entry geofenced zone 14, downstream the safety device 4 (Figure 12a). [000106] In step 702, the RTLS acquires position of all tags and detects a tag 12 in the second portion (B) of the entry geofenced zone 14, internal to the hazardous area 2. [000107] In step 704, the RTLS 10 checks the status of the safety device 4 and optionally of the presence sensor inside the hazardous area 2: the safety device is muted and tag 12 is inside the hazardous area 2. [000108] If no unexpected situation occurs, muting of the safety device 4 remains active (step 706) and RTLS 10 checks the impact on machine 3 associated with the type of tag: machine 3 runs at normal operating speed (step 708). [000109] Figure 13 is a flowchart 800 of the methodaccording to the present disclosure, when tag ID2 is in the third portion (C) of the entry geofenced zone 14 (Figure 13a). [000110] In step 802, the RTLS acquires position of all tags and detects a tag 12 in the third portion (C) of the entry geofenced zone 14, internal to the hazardous area 2 (Figure 13a). [000111] In step 804, the RTLS 10 checks the status of the safety device 4 and optionally of the presence sensor inside the hazardous area 2: the safety device is muted and tag 12 is inside the hazardous area 2. [000112] If no unexpected situation occurs, second muting signal MUT B is sent to the safety device (muting sequence proceeds) (step 806). [000113] When the safety device 4 receives the second muting signal B, muting decays (safety device 4 is re- activated) (step 808). [000114] Figure 14 is a flowchart 900 of the method according to the present disclosure, when tag ID2 is in the fourth portion (D) of the entry geofenced zone 14 (Figure 14a). [000115] In step 902, the RTLS acquires position of all tags and detects a tag 12 in the fourth portion (D) of the entry geofenced zone 14, internal to the hazardous area 2 (Figure 14a).[000116] In step 904, the RTLS 10 checks the status of the safety device 4 and optionally of the presence sensor inside the hazardous area 2: the safety device is active and tag 12 is inside the hazardous area 2. [000117] If no unexpected situation occurs, first muting signal MUT A is sent to the safety device (muting sequence ends) (step 906). [000118] Figure 15 is a flowchart 1000 of the method according to the present disclosure, when tag ID2 is in an operating zone 3’ of the machine 3, that is, downstream the entry geofenced zone 14 and inside hazardous area 2 (Figure 15a). [000119] In step 1002, the RTLS acquires position of all tags and detects a tag 12 in the operating zone 3’ (Figure ()). [000120] In step 1004, the RTLS 10 checks the status of the safety device 4 and optionally of the presence sensor inside the hazardous area 2: the safety device is active and tag 12 is inside the hazardous area 2. [000121] If no unexpected situation occurs, RTLS 10 switches entry geofenced zone 14 to exit geofenced zone 16 (step 1006) (figure 15b). [000122] Figure 16 is a flowchart 1100 of the method according to the present disclosure, when tag ID2 is in the fourth portion (D) of the exit geofenced zone 16(Figure 16a). [000123] In step 1102, the RTLS acquires position of all tags and detects a tag 12 in the fourth portion (D) of exit geofenced zone 16 (Figure 16a). [000124] In step 1104, the RTLS 10 checks the status of the safety device 4 and optionally of the presence sensor inside the hazardous area 2: the safety device is active and tag 12 is inside the hazardous area 2. [000125] If no unexpected situation occurs, RTLS 10 keeps the exit geofenced zone 16 active (step 1106). [000126] RTLS 10 sends first muting signal A to the safety device 4, starting the muting sequence (step 1108). [000127] Figure 17 is a flowchart 1200 of the method according to the present disclosure, when tag ID2 is in the third portion (C) of the exit geofenced zone 16, but still inside the hazardous area 2 (that is, upstream the safety device 4 in the exit direction) (Figure 17a). [000128] In step 1202, the RTLS acquires position of all tags and detects a tag 12 in the third portion (C) of exit geofenced zone 16 and inside the hazardous area 2 (Figure 17a). [000129] In step 1204, the RTLS 10 checks the status of the safety device 4 and optionally of the presence sensor inside the hazardous area 2: the safety device is activeand tag 12 is inside the hazardous area 2. [000130] If no unexpected situation occurs, RTLS 10 sends second muting signal B to the safety device 4 (step 1206). [000131] When the safety device 4 receives second muting signal MUT B, muting is active (step 1208). [000132] Figure 18 is a flowchart 1300 of the method according to the present disclosure, when tag ID2 is in the third portion (C) of the exit geofenced zone 16, but outside the hazardous area 2 (that is, downstream the safety device 4 in the exit direction) (Figure 18a). [000133] In step 1302, the RTLS acquires position of all tags and detects a tag 12 in the third portion (C) of exit geofenced zone 16 and outside the hazardous area 2 (Figure 18a). [000134] In step 1304, the RTLS 10 checks the status of the safety device 4 and optionally of the presence sensor inside the hazardous area 2: the safety device 4 is muted and tag 12 is outside the hazardous area 2 (presence sensor is OFF). [000135] If no unexpected situation occurs, RTLS 10 keeps sending second muting signal MUT B to the safety device 4 (step 1306). [000136] Muting of safety device is still active (step 1308).[000137] Figure 19 is a flowchart 1400 of the method according to the present disclosure, when tag ID2 is in the second portion (B) of the exit geofenced zone 16, outside the hazardous area 2 (that is, downstream the safety device 4 in the exit direction) (Figure 19a). [000138] In step 1402, the RTLS acquires position of all tags and detects a tag 12 in the second portion (B) of exit geofenced zone 16 and outside the hazardous area 2 (Figure 19a). [000139] In step 1404, the RTLS 10 checks the status of the safety device 4 and optionally of the presence sensor inside the hazardous area 2: the safety device 4 is muted and tag 12 is outside the hazardous area 2 (presence sensor is OFF). [000140] If no unexpected situation occurs, RTLS 10 keeps sending second muting signal B to the safety device 4 (muting sequence proceeds, step 1406). [000141] Then muting decays (safety device is re- activated) (step 1408). [000142] Figure 20 is a flowchart 1500 of the method according to the present disclosure, when tag ID2 is in the first portion (A) of the exit geofenced zone 16, outside the hazardous area 2 (that is, downstream the safety device 4 in the exit direction) (Figure 20a). [000143] In step 1502, the RTLS acquires position of alltags and detects a tag 12 in the first portion (B) of exit geofenced zone 16 and outside the hazardous area 2 (Figure 20a). [000144] In step 1504, the RTLS 10 checks the status of the safety device 4 and optionally of the presence sensor inside the hazardous area 2: the safety device 4 is active and tag 12 is outside the hazardous area 2 (presence sensor is OFF). [000145] If no unexpected situation occurs, RTLS 10 sends first muting signal MUT A to the safety device 4, ending the muting sequence (step 1506). [000146] Figure 21 is a flowchart 1600 of the method according to the present disclosure, when tag ID2 is outside the exit geofenced zone 16 and the hazardous area 2 (Figure 21a). [000147] In step 1602, the RTLS acquires position of all tags and detects a tag 12 outside the exit geofenced zone 16 (Figure 21a). [000148] In step 1604, the RTLS 10 checks the status of the safety device 4 and optionally of the presence sensor inside the hazardous area 2: the safety device is active and tag 12 is outside the hazardous area 2 (presence sensor is OFF). [000149] If no unexpected situation occurs, RTLS 10 switches exit geofenced zone 16 to entry geofenced zone14 (step 1606) (figure 21b). [000150] Figure 22 represents a time diagram of all the signals involved in the muting sequence during the entry phase for tag ID2 (object with access rights). [000151] As for the muting signal MUTING, it should be noted that since tag ID2 is allowed to enter the hazardous area 2, the safety device 4 is muted upon RTLS instruction and the vehicle can enter the hazardous area 2 without stopping the machine 3. [000152] After the vehicle 5 has passed the safety device 4, when the tag ID2 is detected in the third portion (C), the muting decays and the safety device 4 protects again the access. [000153] Figure 23 represents a time diagram of all the signals involved in the muting sequence during the exit phase for tag ID2. [000154] Since tag ID2 is allowed to enter the hazardous area 2, the safety device 4 is muted upon RTLS instruction and the vehicle 5 can exit the hazardous area 2 without stopping the machine 3. [000155] After the vehicle 5 has passed the safety device 4, when the tag ID2 is detected in the second portion (B) of the exit geofenced zone 16, the muting decays and the safety device 4 protects again the access. [000156] Figure 24 is a flowchart 1700 of the methodaccording to the present disclosure, when tag ID3 (an operator allowed to enter the hazardous area 2) tries to access the hazardous area 2 and is in the first portion (A) of the entry geofenced zone 14 (Figure 24a). [000157] In step 1702, the RTLS acquires position of all tags and detects a tag 12 in the first portion (A) of the entry geofenced zone 14 (Figure 24a). [000158] In step 1704, the RTLS 10 checks the status of the safety device 4 and optionally of the presence sensor inside the hazardous area 2: tag 12 results outside the hazardous area 2 and does not intercept the safety device 4. [000159] If no unexpected situation occurs, in step 1706 RTLS 10 sets the geofenced zone as the entry geofenced zone 14. [000160] In step 1708, the RTLS 10 checks the ID of tag 12 and compares the detected ID3 with tag type database 8: tag ID3 is a operator tag 12. [000161] In step 1710, the RTLS checks the ID of tag 12 and compares the detected ID3 with access database 7: tag ID3 has access rights. [000162] Therefore, first muting signal A is sent to the safety device 4 (that is, the muting sequence starts) (step 1712). [000163] Figure 25 is a flowchart 1800 of the methodaccording to the present disclosure, when tag ID3 is in the second portion (B) of the entry geofenced zone 14, but still upstream the safety device 4 (Figure 25a). [000164] In step 1802, the RTLS acquires position of all tags and detects a tag 12 in the second portion (B) of the entry geofenced zone 14, but external to the hazardous area 2 (Figure 25a). [000165] In step 1804, the RTLS 10 checks the status of the safety device 4 and optionally of the presence sensor inside the hazardous area 2: tag 12 results outside the hazardous area 2 and does not intercept the safety device 4. [000166] If no unexpected situation occurs, in step 1806 RTLS 10 sets the geofenced zone as the entry geofenced zone 14. [000167] In step 1808, the RTLS 10 checks the ID of tag 12 and compares the detected ID3 with tag type database 8: tag ID3 is an operator tag 12. [000168] In step 1810, the RTLS checks the ID of tag 12 and compares the detected ID3 with access database 7: tag ID3 has access rights. [000169] Therefore, second muting signal MUT B is sent to the safety device 4 (that is, the muting sequence proceeds) (step 1812). [000170] When the safety device 4 receives second mutingsignal MUT B, muting is active (step 1814). [000171] The RTLS then checks the impact on machine 3 associated with the type of tag: machine 3 runs at reduced operating speed (step 1816). [000172] Figure 26 is a flowchart 1900 of the method according to the present disclosure, when tag ID3 is in the second portion (B) of the entry geofenced zone 14, but downstream the safety device 4 (Figure 26a). [000173] In step 1902, the RTLS acquires position of all tags and detects a tag 12 in the second portion (B) of the entry geofenced zone 14, internal to the hazardous area 2 (Figure 26a). [000174] In step 1904, the RTLS 10 checks the status of the safety device 4 and optionally of the presence sensor inside the hazardous area 2: the safety device is muted and tag 12 is inside the hazardous area 2. [000175] If no unexpected situation occurs, entry geofenced zone 14 remains active (step 1906). [000176] Muting of the safety device 4 remains active (until manual restart button 11 is pressed) (step 1908). [000177] Machine 3 runs at reduced operating speed (step 1910). [000178] Figure 27 is a flowchart 2000 of the method according to the present disclosure, when tag ID3 is in the second portion (B) of the entry geofenced zone 14,but upstream the safety device 4, that is, outside the hazardous area 2 (Figure 27a). [000179] In step 2002, the RTLS acquires position of all tags and detects a tag 12 in the second portion (B) of the entry geofenced zone 14, outside the hazardous area 2 (Figure 27a). [000180] In step 2004, the RTLS 10 checks the status of the safety device 4 and optionally of the presence sensor inside the hazardous area 2: the safety device is muted and tag 12 is outside the hazardous area 2 (presence sensor is OFF). [000181] If no unexpected situation occurs, the operator 5 presses the manual restart button (step 2006). [000182] Muting decays and the safety device 4 is active again (step 2008). [000183] Machine 3 runs at normal operating speed (step 2010). [000184] Figure 28 is a flowchart 2100 of the method according to the present disclosure, when tag ID3 is in the second portion (B) of the entry geofenced zone 14, upstream the safety device 4, that is, outside the hazardous area 2 and another operator 6’, without tag or without access rights, has sneaked in the hazardous area 2 while the safety device 4 was muted (Figure 28a). [000185] In step 2102, the RTLS acquires position of alltags and detects a tag 12 in the second portion (B) of the entry geofenced zone 14, outside the hazardous area 2. [000186] In step 2104, the RTLS 10 checks the status of the safety device 4 and of the presence sensor inside the hazardous area 2: the safety device 4 is muted and presence sensor is ON. [000187] Since an unexpected situation occurs, a safe state is activated (for example machine 3 is stopped) (step 2106) and manual restart is needed (step 2108). [000188] Figure 29 represents a time diagram of all the signals involved in the muting sequence for tag ID3. [000189] Since tag ID3 is allowed to enter the hazardous area 2, the safety device 4 is muted upon RTLS instruction and the operator can enter the hazardous area 2, but the machine speed is reduced. [000190] After that the operator 6 has completed his task and exists the hazardous area 2, restart button 11 is pressed, causing the muting to decay, and the machine 3 restores the full speed operation mode. [000191] In some embodiments, for tags allowed to enter the hazardous area 2 (tag ID2 and tag ID3 in the example), the safety of the system can further be increased by introducing a timer that disables the muting function after a pre-defined time window has elapsed.[000192] Furthermore, the logic of the access control could be complicated at will by introducing more constrains on the number of tags present in the hazardous area 2, since their IDs is known. An example is given in the access table of figure 30. [000193] In one embodiment, an object 5’, for example a mobile device, is provided with a first tag 12a placed on a front part of the object and with a second tag 12b placed on a rear part of the object (Figure 31). [000194] Figures 32, 32a show the access table and the tag type table, in which tag ID2, for example, is split in front tag ID2F and rear tag ID2R. [000195] In this embodiment, there is no distinction between the entry geofenced zone and the exit geofenced zone. In other words, the first, second, third and fourth portions (A-D) do not change when the object 5’ enters in or exits from the hazardous area 2. [000196] More specifically, first and second portions A, B are defined on the external side of the safety device 4, while third and fourth portions C, D are defined on the internal side of the safety device 4, that is, inside the hazardous area 2 (Figures 33, 33a). [000197] When the mobile device 5’ moves in the entry direction into the hazardous area 2, the muting signals of the muting sequence, which are sent to enable themuting, are transmitted only according to the position of front tag 12a with respect the first and second portions A, B, while the position of rear tag 12b is not considered. Once the mobile device 5’ has passed the safety device 4, the muting signals associated to third and fourth portions C, D to disable the muting, are provided only by the position of rear tag 12b, while the position of front tag 12a is not considered. [000198] In the same way, when the mobile device 5’ moves in the exit direction, the muting signals associated to fourth and third portions D and C, to enable the muting, are provided only by the position of rear tag 12b, while the position of front tag 12a is not considered. Once the mobile device 5’ has passed the safety device 4, the muting signals associated to portions B and A, to disable the muting, are provided only by the position of front tag 12a, while the position of rear tag 12b is not considered. [000199] In other words, regardless the fact the mobile device 5’ is entering or exiting the hazardous area 2, the muting signals associated to first and second portions A and B depend only by front tag 12a, while rear tag 12b is not considered; the muting signals associated to third and fourth portions C and D depend only by rear tag 12b, while front tag 12a is not considered.[000200] Thanks to this arrangement of two tags on the mobile device 5’, it is not necessary to re-shape the geofenced zone according to the direction of the object towards or from the hazardous area 2. [000201] Apart the role of the two tags and the shape of the geofenced zone, which does not change, the method for controlling the access according to the various embodiments described above is the same. [000202] From the description above, it is clear that the method and system according to the invention achieve the intended object and have the following advantages. [000203] The proposed method and system do not need muting sensors or muting actuators, unlike traditional muting solutions, that need two pairs of sensors to allow entry / exit muting. [000204] The muting signals are triggered by the IDs and positions of the tags; in traditional muting solutions the muting signals are provided by the ON / OFF signals of photocells. [000205] In the proposed method and system, the portions A, B, C, D of the geofenced zone can be updated at each product change, or production cycle change, since the geofenced zone is simply software defined and is not a physical area. Hence, the geofenced zone can be smartly adapted to the size of the goods passing through, ortheir velocity. In traditional solutions this is not possible, since different objects would need a physical reconfiguration / displacement of the muting actuators. [000206] Unlike the proposed method and system, in traditional solution it is not possible to distinguish the IDs of the operators, or distinguish between operators and goods, hence the muting concept must be very strict and unflexible to be safe, else it could be easily cheated. [000207] In the present method and system, there is no need of external muting sensors or muting actuators, thus saving costs and installation time, reducing risks of unwanted machine stops due to misalignment of the muting sensors, reducing footprint of the system. [000208] A part the optional presence sensor, in principle there is no need of external sensors at all to enable the muting function, since the muting is only based on RTLS. The presence sensor may only be present to make sure that the machine is not restarted if an operator without RTLS tag sneaks inside the hazardous area. [000209] The muting of the safety system is based not only on the positions of the tags, but also on their IDs, that is, some tags may not trigger the muting sequence if their ID has not access rights even if their position iscompatible with the muting sequence requirements. [000210] It is possible in principle to enable different kinds of muting, with different durations, and different effects on the machine (running at full speed, reduced speed, or stops) depending on the ID of the tags. [000211] A person skilled in the art may make modifications and adaptations to the embodiments of the method and system according to the invention, replacing elements with others functionally equivalent so as to satisfy contingent requirements while remaining within the scope of protection of the following claims. [000212] Each of the characteristics described as belonging to a possible embodiment may be realized independently of the other embodiments described.

Claims

Claims 1. Method for controlling the access of an object (5, 5’) or a person (6) in a hazardous area (2), wherein the hazardous area (2) is at least partially inside or close to a monitored zone (1), monitored by a RTLS (10), “Real- Time Location System”, and wherein the object or the person is provided with one or more tags (12) readable by the RTLS, the method comprising the steps of: a) providing an access database (7) with access rights of each tag (12) in the hazardous area (2), the access database being readable by a RTLS controller (10a); b) defining, by the RTLS, at least a geofenced zone (14; 16) delimiting an access path to and from the hazardous area (2); c) detecting, by the RTLS, when the position of a tag is inside the geofenced zone (14, 16); d) if a tag is detected in the geofenced zone, comparing, by the RTLS controller, a unique identification information (ID) identifying each tag with the access database; e) if the tag has an access right, changing at least a safety function of the hazardous area (2).

2. Method according to claim 1, wherein the geofenced zone (14; 16) comprises at least an external portion, outside the hazardous area (2), and at least an internalportion, inside the hazardous area (2), and wherein: - if a tag with an access right is detected in the external portion, at least a safety function of the hazardous area (2) is changed from an initial state to allow the tag to access the hazardous area; - when said tag is detected in the internal portion, the at least safety function is changed back to its initial state.

3. Method according to claim 1 or 2, wherein the access to the hazardous area (2) is controlled by a safety device (4), and wherein step e) of changing safety function(s) of the safety area (4) comprises enabling, by the RTLS, a muting sequence of the safety device (4).

4. Method according to claim 3, wherein the geofenced zone (14; 16) comprises: - a first external portion (A), outside the hazardous area (2); - a second portion (B), beginning outside the hazardous area (2) upstream the safety device (4) along an entry direction of the object or person from the outside to the inside of the hazardous area (2), and - a third internal portion (C), inside the hazardous area and downstream the safety device (4) along the entry direction, and wherein: - if a tag (12) with an access right is detected in thefirst external portion, a first muting signal (A) triggering a muting sequence is sent to the safety device (4); - when the tag (12) is detected to enter the second portion (B) upstream the safety device, a second muting signal (B) of the muting sequence is sent to the safety device (4), the second musting signal switching on the muting of the safety device (4); - when the tag is detected to enter the third portion (C), the second muting signal (B) changes its state switching off the muting of the safety device (4).

5. Method according to claim 4, wherein the geofenced zone (14; 16) further comprises a fourth internal portion (D), downstream the third internal portion inside the hazardous area, and wherein, when the tag is detected to enter the fourth internal portion, first muting signal (A) changes its state ending the muting sequence.

6. Method according to claim 5, wherein, when the tag is detected inside the hazardous area (2) and the muting sequence has ended, - when the tag is detected in the fourth internal portion (D), the first muting signal (A) is sent to the safety device (4); - when the tag is detected to enter the third internal portion (C), the second muting signal (B) is sent to thesafety device (4); - when the tag is detected inside the second portion (B), downstream the safety device (4) in an exit direction of the person or object from the inside to the outside of the hazardous area, the second muting signal (B) changes its state switching off the muting of the safety device (4); - when the tag is detected to enter the first external portion (A), the first muting signal (A) changes its state, ending the muting sequence.

7. Method according to any of the claims 4-6, wherein, when a tag (12) is detected outside the hazardous area (2), the geofenced zone is set by the RTLS as an entry geofenced zone (14), in which the second portion (B) ends inside the hazardous area, downstream the safety device (4).

8. Method according to claim 7, wherein, when the tag (12) is detected inside the hazardous area (2) and the muting sequence has ended, the geofenced zone is set by the RTLS as an exit geofenced zone (16), wherein: - the length of the second portion (B) is changed by the RTLS so that the second portion is completely downstream the safety device (4) in the exit direction; - the length of the third portion (C) is changed by the RTLS so that the third portion ends downstream the safetydevice (4) in the exit direction.

9. Method according to claim 5, wherein the object (5’) accessing the hazardous area is a mobile device provided with a first tag (12a) placed on a front part of the mobile device and with a second tag (12b) placed on a rear part of the mobile device, and wherein: - the muting signals associated with the first and second portions (A, B) of the geofenced zone are controlled only according to the position of the first tag (12a), while the second tag (12b) is not considered; - the muting signals associated with the third and fourth portions (C, D) of the geofenced zone are controlled only according to the position of the second tag (12b), while the first tag (12a) is not considered.

10. Method according to claim 9, wherein the shapes of the first, second, third and fourth portions (A-D) of the geofenced zones do not change, regardless the fact the mobile device (5’) is entering or exiting the hazardous area (2).

11. Method according to claim 3, wherein a manual restart button (11) operatively connected to the safety device (4) is provided outside the hazardous area (2), wherein the geofenced zone comprises: - a first external portion (A), outside the hazardous area;- a second portion (B), beginning outside the hazardous area upstream the safety device along an entry direction of the object or person from the outside to the inside of the hazardous area, wherein: - if a person (6) provided with a tag with an access right is detected in the first external portion, a first signal triggering a muting sequence is sent to the safety device; - when the tag is detected to enter the second portion (B) upstream the safety device, a second signal of the muting sequence is sent to the safety device, the second signal switching on the muting of the safety device; and wherein the muting of the safety device is switched off only if the tag is detected in the second portion (B) downstream the safety device in an exit direction of the person from the inside to the outside the hazardous zone and the manual restart button (11) is pressed.

12. Method according to any of the previous claims, further comprising the step of: a1) providing a tag type database (8) with different types of tag, the tag type database (8) being readable by the controller (10a) of the RTLS; wherein step d) further comprises, if a tag is detected in the geofenced zone, comparing, by the controller ofthe RTLS, the unique identification information (ID) identifying each tag with the tag type database (8), and wherein in step e), if the tag has an access right and if the tag is of a certain type, changing, by the RTLS, at least a parameter of the hazardous area (2).

13. Method according to claim 12, wherein a machine (3) is installed in or close the hazardous area (2), and wherein the step of changing, by the RTLS, at least a parameter of the hazardous area comprises changing a working parameter of the machine (3).

14. System for controlling the access of an object (5) or a person (6) in a hazardous area (2), comprising: - a real-time location system (10), “RTLS”, comprising a RTLS controller (10a) and a plurality of radio stations (10b), each radio station being operatively connected to the controller (10a); - one or more tags (12; 12a, 12b) suitable for being attached to the object or person, each tag being configured to exchange data with the plurality of radio stations (10b) and being uniquely identified by a unique identification information (ID); - at least one safety device (4) suitable for controlling the access to the hazardous area (2) and operatively connected to the RTLS controller, wherein position data of the person (6) or object (5) canbe determined by means of the RTLS; and wherein the RTLS is configured to implement the method according to any of the claims 1-13.

Images