Abstract:
An apparatus allows workers to assert and release control over the energization of a system. The apparatus does not require the workers to carry any additional paraphernalia, and is not be easily defeated by other workers. Users asserting and releasing control present tokens uniquely identifying each user to a reader, and the apparatus prevents transition of the system to an undesired state until an appropriate number of users are currently asserting control. For example, a dangerous manufacturing robot can be prevented from energizing until all the users that have asserted control when entering the robot&#39;s controlled space have subsequently released control when leaving the robot&#39;s controlled space.

Description:
PRIORITY CLAIM  
       [0001]    This application claims priority to application Ser. No. 08/761,098 “Apparatus for Controlling System State Based on Unique Identifiers”, filed Dec. 15/1996, incorporated herein by reference. 
     
    
     CONTROL OF EQUIPMENT USING CREDENTIALS  
       [0002] This invention was made with Government support under Contract DE-AC04-94AL85000 awarded by the U.S. Department of Energy. The Government has certain rights in the invention. 
     
    
     
       BACKGROUND OF THE INVENTION  
         [0003]    This invention relates to the field of machine safeguarding devices, and more specifically to the field of lockout devices for allowing multiple users to control energization of systems.  
           [0004]    There are many tasks where a person or persons must enter the dangerous workspace of a robot or other system. Examples of such tasks include machine maintenance, product quality inspection, process monitoring, and management inspection. Often, the operation of the system can be hazardous to humans, either by physical contact with dangerous parts (e.g., cutting tools, lifts and presses) or by dangerous environmental conditions (e.g., extreme temperatures, airborne chemicals). For safety, therefore, the system must be prevented from operating while people are within the potentially hazardous space (the controlled space). This is often accomplished with barriers and doors that prevent system operation when opened. To restart the system, the barrier or door must be closed. Additional external resets are sometimes required.  
           [0005]    Unfortunately, if the hazardous space is such that people inside the space are not always visible from the reset location, then people inside can be endangered if someone else resets the system. Administrative means such as safety checklists and visual inspections can help, but do not give those inside the space personal control over the reset of the machine.  
           [0006]    In simple mechanical systems physical locks are often used to provide personal control over a system. Each worker applies and removes his own lock to the reset switch. The system can not be reset until all the locks have been removed. This straightforward approach has drawbacks, however. Physical locks can damage work in progress (e.g., scratch paint on car bodies) and can be bypassed by anyone with a bolt cutter. Management of unique locks and keys for many workers can be problematic. Also, workers without locks, workers whose locks have been forgotten, and workers whose locks are controlling other machines can not assert control over a machine.  
           [0007]    Enabling plugs are also often used. Workers entering the controlled space remove a plug that enables the system to start. The plugs are usually not unique, however, and so systems can be energized while workers are still in danger.  
           [0008]    Advanced electronic systems can limit access to an area to specific individuals. These systems must be very complex, however, to verify identity and limit access to pre-approved individuals. Generally a database must be created and managed. Special cards or keys are required to allow the system to identify authorized users. The expense of such systems makes them unrealistic for use with most machines.  
           [0009]    There is a need, therefore, for an inexpensive apparatus that gives workers inside a controlled space personal control over the transition of a system from one state to another (e.g., from halted to energized). The apparatus should not require the workers to carry any additional paraphernalia, and should not be easily defeated by other workers.  
         SUMMARY OF THE INVENTION  
         [0010]    The present invention provides an apparatus that allows multiple workers to independently control the energization of a system. The apparatus does not require the workers to carry any additional paraphernalia, and is not easily defeated by other workers. Workers assert control over the system by entering an identifier unique to the worker into the apparatus. Workers release control by entering the same identifier into the apparatus. The apparatus remembers the identifiers associated with assertion of control, and can prevent energization of the system until all the workers that asserted control have subsequently released control. The apparatus can also prevent transition of the system to an undesired state until a desired number of users remain with control asserted. For example, a manufacturing robot can be prevented from energizing until all the users that have asserted control on entering the controlled space have subsequently released control on leaving the controlled space. As another example, a lift can be prevented from operating until an appropriate number of users are on it.  
           [0011]    Advantages and novel features will become apparent to those skilled in the art upon examination of the following description or may be learned by practice of the invention. The objects and advantages of the invention may be realized and attained by means of the instrumentalities and combinations particularly pointed out in the appended claims. 
       
    
    
     DESCRIPTION OF THE FIGURES  
       [0012]    The accompanying drawings, which are incorporated into and form part of the specification, illustrate embodiments of the invention and, together with the description, serve to explain the principles of the invention.  
         [0013]    [0013]FIG. 1 is an illustration of a lockout apparatus according to the present invention.  
         [0014]    [0014]FIG. 2 is an illustration of a lockout apparatus according to the present invention.  
         [0015]    [0015]FIG. 3 a  is flow diagram of control of one embodiment of the present invention.  
         [0016]    [0016]FIG. 3 b  is a diagram of identifier storage used by the control of FIG. 3 a.    
         [0017]    [0017]FIG. 4 is a schematic diagram of an example implementation of a system according to the present invention.  
         [0018]    [0018]FIG. 5 is a flow diagram corresponding to computer software suitable for use in an example implementation of a system according to the present invention.  
     
    
     DETAILED DESCRIPTION OF THE INVENTION  
       [0019]    The present invention provides an apparatus for preventing the transition of a system from one state to another based on the assertion and release of control by multiple users.  
         [0020]    [0020]FIG. 1 is an illustration of a lockout apparatus according to the present invention. In the figure, a robot  101  and end effector  102  can be dangerous to workers within a controlled space S. A worker  110  has a token  111  that is uniquely associated with the worker  110 . Examples of suitable tokens include barcodes and magnetic strips on employee identification badges, credit cards, and biometric information. When the worker  110  enters or exits the controlled space S, the worker  110  presents the token  111  to the reader  120 . The reader  120  reads the token  111 . A controller  130  monitors the tokens read entering and exiting, and does not allow power  140  to the robot  101  if there are any tokens that were read entering the controlled space S that have not been subsequently been read exiting the controlled space S. Each token read exiting the controlled space S can only release control for that token; one worker&#39;s control can not be released by another worker&#39;s token. Each worker can thereby retain personal control over the energization of the robot through personal control of the token.  
         [0021]    [0021]FIG. 2 shows a lockout system according to the present invention. A reader  201  is mounted near the entry  203  of a controlled space  204 . The controlled space can be a dangerous machine (not shown) such as a robot or a dangerous environment such as an oven. Those skilled in the art will appreciate many such controlled spaces common in modern industrial processes. The reader  201  must be able to read tokens presented by users asserting and releasing control over the controlled space  204 . The tokens can be uniquely associated with a user, or can be re-used by many users, for example by having a container of tokens near the reader itself. The reader  201  must be able to distinguish each token from every other token, however. The tokens can be magnetic strips on employee identification badges, credit cards, or other similar devices. Suitable magnetic strip readers such as those used in commercial transactions include credit card scanners and automated teller machines. The tokens can also be read optically, as for example with barcodes placed on employee identification badges or on tools uniquely assigned to each employee. Suitable optical scanners such as are used in commercial transactions include grocery code barcode readers and library barcode checkout systems. The reader 201 could also read other information unique to each employee such as biometric information or passwords. Those skilled in the art will appreciate other employee-specific information that could be appropriate tokens.  
         [0022]    The reader  201  can also monitor non-human users. As an example, a unique token could be entered for each parts cart entering and exiting an oven. The reader  201  could track the number of parts carts in the oven and not allow the oven to heat until all the carts were removed. The reader  201  can distinguish between entering and exiting users by, for example, direction sensors, a switch or button near the reader  201 , separate entry and exit readers, and distinct scanning procedures for entry and exit. The reader  201  can also allow for a supervisory reset by allowing a special token, password, key, or other operation to reset the system so that lost tokens do not permanently lockout the system.  
         [0023]    [0023]FIG. 3 a  shows a flow diagram of control for a reader suitable for use with the present invention. State  301  signifies that no users have asserted control over the system. Tokens indicating users releasing control cause the controller to remain in state  301 . If a token indicates a user asserting control, then the entering user identification is added to the record of users asserting control  302 . The controller is then in state  303 , signifying that at least one user has asserted control and not subsequently released control. Tokens indicating additional users asserting control will cause those user identifications to be added to the record if not already present. Tokens indicating users releasing control will cause the user identification of the releasing user to be removed from the record  304 . If the record is empty  305  then the controller will return to state  301 , signifying that no users remain in control of the system. If the record is not empty  305 , then users are still in control of the system and so the controller returns to state  303 . FIG. 3 b  shows an example record  310  indicating that two users, user A  311  and user B  312 , have asserted control. Two other locations  313 ,  314  in the record  310  are empty, indicating that they do not contain user identification for users having asserted control. Those skilled in the art will appreciate other ways of maintaining the record, including lists and tables, for example.  
         [0024]    The token reading apparatus can also provide feedback to ease human operability. An auditory, visual, or other feedback signal can be provided to indicate a successfully read token. The feedback can be different for token reads asserting control and token reads releasing control. The number of users asserting control can be communicated by a numeric display or other means, so that users can determine how many users have asserted but not yet released control. Some applications might also allow system state transition or energization when a specified number or pattern of users have asserted, then released, control. For example, a robot might be energized when all but one user has released control, where the remaining user is a “teacher” for the robot&#39;s programmed operation.  
         [0025]    For some machine safeguarding applications the lockout apparatus would have to be “control reliable” as defined in ANSI B11.19. Typically, redundancy and cross-checking are used to ensure that no single component failure can prevent the safe operation of the system. This could be achieved in the present invention in various ways. For example, two independent token readers and control processors could be used. The system transition from one state to another (e.g., energized to not energized) could be prevented unless both readers and control processors agreed that the transition was allowable.  
       EXAMPLE IMPLEMENTATION  
       [0026]    The system described herein as an example implementation uses a badge reader to act as an electronic lock with an infinite number of keys. The system can be used as a safeguarding interlock to prevent the operation of hazardous machines inside a workcell, for example. In this context, to “lock” the cell means to lockout (prevent) hazardous operations in the cell, thereby allowing personnel entry.  
         [0027]    System Diagram  
         [0028]    [0028]FIG. 4 is a schematic representation of hardware associated with the example system. A logic unit  401  implements a control method as desribed below. For example, a contemporary laptop or notebook computer can serve as a logic unit. Single board computers and special purpose circuit boards or integrated circuits can also serve as logic units. A badge reader  402  communicates with the logic unit  401 . For example, a magnetic card reader such as those marketed by United Barcode Industries under the name MAGSCAN can read magnetic stripes on badges and cards and communicate the information to the logic unit using a USB (Universal Serial Bus) interface currently in widespread use. A switch  403  also communicates with the logic unit  401 , allowing specification of whether a particular card read is associated with entry or exit of the workcell. A standard toggle or pushbutton switch can be used. Memory  408  is accessible by the logic unit, providing space for storage of data for cards that have been recorded as entering the workcell. Memory  408  can also provide storage for computer software controlling the logic unit, and can be integrated with the logic unit (as, for example, with memory in a contemporary laptop computer). A power source  407  supplies the system with needed power. The logic unit  401  controls a lock control output  406  based on the control method described below. The lock control output  406  can be specific to the particular equipment being controlled; for example, a relay control can control power supply to electrically-energized equipment. Display lights  404  (for example, LEDs indicating entry, exit, and lock status) and display counter  405  (for example, a digital LED or LCD display) can also be connected with the logic unit  401 , allowing information about the status of the system and the number of cards currently locking the equipment to be communicated. The switch  403 , lights  404 , and counter  405  can be connected, for example, using a parallel data port in a contemporary laptop computer.  
         [0029]    Control Method  
         [0030]    [0030]FIG. 5 is a flow diagram of a control method suitable for use in the example system. Beginning at Start  501 , a badge can be scanned  502  to read the data thereon. The badge read can be characterized whether associated with an entry or an exit  503 . If the badge is asscoiated with an entry, then, if the badge data is already in a list of badges entered  504 , the control method does not need to take additional action  506  (assuming that each badge can only enter one lock into the system at a time). If the entering badge data is not in the list  504 , then the entering badge date can be added to the list  507 , and a counter representative of the number of locks applied can be incremented  508 . If an exiting badge is not in the list  505 , then the control method does not need to take additional action  506  (since there was no lock entered by this badge). If an exiting badge is in the list  505 , then the exiting badge data can be removed from the list  509  (removing the lock entered by the badge), and the count of remaining locks can be decremented  510 . Not shown in the flow diagram, but implemented in the source code set forth below, is the ability to recognize a “golden badge” that, when read, will clear all the locks.  
         [0031]    After each badge read, the count of remaining locks can be compared to a value required for unlocking the workcell  511  (zero if the workcell is only safe to operate after all workers have cleared the workcell). If the count is not equal to the unlock value  511 , then the cell remains locked  512  (for example, by preventing electrical power flow through a control relay). Status display indicators can be updated  513  to reflect the status (e.g., locked, number of locks remaining, etc.), and the control method is finished  514  until the next event. If the count is equal to the unlock value  511 , then the workcell can be unlocked (for example, by allowing power through a control relay). Status display indicators can be updated to reflect the unlocked state (including, for example, lights or alarms associated with operation of the workcell), and the control method is finished  517  until the next event.  
         [0032]    The control method of the example system has been implemented in Visual Basic 5.0, from Microsoft, on a conventional laptop computer. The source code for the implementation is set forth below.  
         [0033]    The particular sizes and equipment discussed above are cited merely to illustrate particular embodiments of the invention. It is contemplated that the use of the invention may involve components having different sizes and characteristics. It is intended that the scope of the invention be defined by the claims appended hereto.  
                                                                                                                                                                                                                                                                                       SOURCE CODE OF THE EXAMPLE CONTROL METHOD                   Dim enteredText As Boolean       Dim strGolden As String       Dim openLock As Integer       Dim portAddr As Integer       Dim SwReadOld As Integer       Dim nFlash As Integer       Dim iFlash As Integer       Dim exitFlag As Boolean       Dim lastClick As Date       Sub addEntry( )                Dim itm As Integer           Dim match As Boolean           match = False           &#39; check that entry is unique           For itm = 0 To (lstStored.ListCount − 1)                If lstStored.List(itm) = txtDisplay.Text Then                match = True                End If                Next           If match = False Then                lstStored.Add Item txtDisplay.Text           lblCount = lstStored.ListCount           &#39;lblCount.Visible = True           flashStop                End If            End Sub       Sub checkLock(num)        If lstStored.ListCount = num Then &#39;open lock        shpGo.Visible = True        shpStop.Visible = False        Out portAddr, 2             Else   &#39; close lock             shpStop.Visible = True        shpGo.Visible = False        Out portAddr, 1       End If        &#39;txtDisplay.Text = “”       End Sub       Sub deleteEntry( )        Dim itm As Integer        Dim match As Boolean        match = False                &#39; find entry            For itm = (lstStored.ListCount − 1) To 0 Step −1           If lstStored.List(itm) = txtDisplay.Text Then                lstStored.RemoveItem (itm)           flashGo           match = True                End If             Next        lblCount = lstStored.ListCount        &#39;lblCount.Visible = True       End Sub       Public Sub ResetAll( )       lstStored.Clear       Timer1.Enabled = False       Timer2.Enabled = False       iFlash = 0       txtDisplay.Text = “”       lblCount = lstStored.ListCount       &#39;lblCount.Visible = False       checkLock (openLock)       End Sub       Private Sub cmdList_Click( )       If lstStored.Visible = False Then        lstStored.Visible = True        lblList.Visible = True        lblUnlockVal.Visible = True        txtUnlockVal.Visible = True        Label2.Visible = True        Label3.Visible = True        cmdList.Caption = “Hide”       Else        lstStored.Visible = False        lblList.Visible = False        lblUnlockVal.Visible = False        txtUnlockVal.Visible = False        Label2.Visible = False        Label3.Visible = False        cmdList.Caption = “Show”       End If       txtDisplay.SetFocus       End Sub       Private Sub cmdReset_Click( )       ResetAll       txtDisplay.SetFocus       End Sub       Private Sub Form_Load( )       strGolden = “sandia”       openLock = 0       txtUnlockVal.Text = openLock       exitFlag = False       portAddr = &amp;H378       SwReadOld = Inp(portAddr + 1)       nFlash = 12       ResetAll       End Sub       Public Sub Timer1_Timer( )       &#39;flashes stop light       shpStop.Visible = Not shpStop.Visible       Out portAddr, −shpStop.Visible &#39;write 0 or 1       iFlash = iFlash + 1       If iFlash = nFlash Then        Timer1.Enabled = False        iFlash = 0        checkLock (openLock)       End If       End Sub       Private Sub Timer2_Timer( )       &#39;flashes go light       shpGo.Visible = Not shpGo.Visible       Out portAddr,−2 * shpGo.Visible &#39;write 0 or 2       iFlash = iFlash + 1       if iFlash = nFlash Then        Timer2.Enabled = False        iFlash = 0        checkLock (openLock)       End If       End Sub       Private Sub Timer3_Timer( )       Dim ExitSw As Integer       &#39; poll exit switch and save last entry       &#39; check exit switch       ExitSw = Inp(portAddr + 1)       If ExitSw &lt;&gt; SwReadOld Then        SwReadOld = ExitSw        lastClick = Now       End If       End Sub       Private Sub txtDisplay_KeyDown(KeyCode As Integer, Shift As Integer)       &#39; clears “entered token” line after /CR/       If enteredText = True Then        enteredText = False        txtDisplay.Text = “”       End If       &#39; Scan on exit instead of on entry       &#39; F12 is 123       If KeyCode = 123 Then        exitFlag = True       End If       End Sub       Private Sub txtDisplay_KeyUp(KeyCode As Integer, Shift As Integer)       &#39; /CR/ (enter) was pressed.       &#39; determine if ‘EXIT’ button was pushed in the last x seconds       If DateDiff(“s”, lastClick, Now) &lt; 6 Then        exitFlag = True        lastClick = 0 &#39; reset, only let one exit per button click       End If       &#39; Begin processing the string.       If KeyCode = 13 Then                If txtDisplay.Text &lt;&gt; “” Then                enteredText = True           If txtDisplay.Text = strGolden Then                MsgBox “golden key”           ResetAll                Else                If exitFlag = True Then &#39;exit                deleteEntry           exitFlag = False                Else   &#39;enter                addEntry                End If                End If                End If            End If       End Sub       Private Sub txtUnlockVal_Change( )       openLock = Val(txtUnlockVal.Text)       checkLock (openLock)       End Sub       Public Sub flashStop( )       Timer1.Enabled = True       End Sub       Public Sub flashGo( )       Timer2.Enabled = True       End Sub       &#39;Inp and Out declarations for direct port I/O       &#39;in 32-bit Visual Basic 4 and 5 programs.       Public Declare Function Inp Lib “inpout32.dll” —         Alias “Inp32” (ByVal PortAddress As Integer) As Integer       Public Declare Sub Out Lib “inpout32.dll” —         Alias “Out32” (ByVal PortAddress As Integer, ByVal Value As Integer)