Method and device for reliably switching an operating mode of an industrial controller for machine tools or production machines

A method and a device for securely switching between operating modes of an industrial controller for machine tools or production machines are described. Before the operating mode is switched, the operator is identified by identification means that transmit to an operator's console of the controller a redundant binary enable signal after a successful identification. The operator is allowed to switch between operating modes by using the keys of the operator's console implemented in safe technology as long as the enable signal is received and is error-free. With the method and the device, the operating modes of an industrial controller for machine tools or production machines can be easily, reliably and cost-effectively switched.

CROSS-REFERENCES TO RELATED APPLICATIONS

This application claims the priority of German Patent Application, Serial No. 103 15 526.0, filed Apr. 4, 2003, pursuant to 35 U.S.C. 119(a)–(d), the disclosure of which is incorporated herein by reference.

BACKGROUND OF THE INVENTION

The present invention relates to a method and a device for reliably switching an operating mode of an industrial controller for a machine tool or production machines. In the following description, the term “production machine” is used in a generic sense and includes robots which generally follow the concepts outlined here.

Machine tools and production machines require certain safety procedures for their operation to protect people from dangerous movements of workpieces and machine elements. In particular, the safety procedures are intended to prevent unintended movements of workpieces or machine elements that could endanger an operator.

Each machine has several operating modes, for example automatic production, setup mode and manual mode. The settings for the various protective measures, such as the maximum permitted travel path or the maximum permitted travel speed, are defined when the desired operating mode is selected. Only qualified personnel especially trained for operating the machine should be allowed to select or switch the operating mode. In general, modern industrial controllers for machine tools or production machines have key authentication switches with redundantly implemented, galvanically separated contacts for safely selecting and/or switching the operating mode. For operating the controller, the various contacts are each connected individually to a control panel, whereby the controller properly evaluates and processes the switch position of the key authentication switch. Read errors, wiring defects and switch malfunctions are identified by comparing the two read-in switch position values.

FIG. 1shows a conventional operator's console1of an industrial controller for machine tools or production machines. The operator's console1includes essentially two rotary switches2aand2b,and a standard keypad3awith nine standard keys, whereby for sake of clarity only one standard key4ais labeled, and another standard key pad3bthat also includes nine keys, whereby also only one key4bis labeled for sake of clarity. The operator's console also includes a terminal strip5with eight individual contacts.

FIG. 2shows a three-step key authentication switch6. The three-step key authentication switch6has eight contacts, wherein only one contact9is labeled for sake of clarity. A mechanical coupling8is provided to ensure that the upper four contacts are switched synchronously with the lower four contacts when the key7is turned, as depicted inFIG. 2. The eight contacts of the three-step key authentication switch6are electrically connected separately with a corresponding single contact of a terminal strip5, as shown inFIG. 1. A total of eight electrically conducting connections between the operator's console1and the three-step key authentication switch6are required in order to switch between the two different operating modes. A single operating mode is associated with each step of the key authentication switch6.

Only one qualified operator has the key7and can select the desired operating mode by turning the key7. Two corresponding redundant contacts and one operating mode are associated with each switch position. The contacts are connected via two electrically conducting, galvanically separated connections to an operator's console with failsafe inputs. The signals from the contacts are evaluated and processed in the operator's console and/or the controller. A device of this type and a corresponding method for securely switching between operating modes of an industrial controller for machine tools or production machines, however, has several disadvantages. These are in particular:High cost of the three-step or multi-step redundant key authentication switch.Large installation size of the three-step or multi-step redundant key authentication switch.For each operating mode two contacts and/or two terminals are required on both the operator's console and the key authentication switch, hence requiring a large number of contacts (this does not include the two contacts for the power supply).Complicated wiring because of the need to provide per operating mode two electric connections between operator's console and key authentication switch (this does not include the two connections for the power supply).The switch position of the key authentication switch is oftentimes difficult to mark, since the switch is typically installed externally.The number of the operating modes is limited by the maximum number of possible steps of the key authentication switch.

It would therefore be desirable and advantageous to provide an a simple, safe and cost-effective device and method for safety switching between operating modes of an industrial controller for machine tools or production machines.

SUMMARY OF THE INVENTION

According to one aspect of the present invention, a method for securely switching between operating modes of an industrial controller for machine tools or production machines includes the steps of identifying an operator before switching between the operating modes and transmitting to an operator's console of the controller a redundant binary enable signal if the operator is successfully identified. If the operator's console receives the enable signal and determines that the enable signal is error-free, the operator is allowed to switch between the operating modes by using at least one key of the operator's console. The key is implemented in safe technology.

According to another aspect of the present invention, a device for securely switching between operating modes of an industrial controller for machine tools or production machines includes identification means for identifying an operator before switching between the operating modes and an operator's console of the controller that receives from the identification means a redundant binary enable signal if the operator is successfully identified. At least one key is located on the operator's console and implemented in safe technology. The key or keys enable the operator to switch between the operating modes if the operator's console receives from the identification means the enable signal and determines that the enable signal is error-free.

According to another advantageous feature of the present invention, the identification means can be externally connected to the operator's console. In this way, the number of identification means that can be connected to the operator's console is not limited.

According to yet another advantageous feature of the present invention, the identification means can include a key authentication switch, which are commonly used as identification means. Suitably, the key authentication switch can be a two-step key authentication switch, which can be quite cost-effective.

According to another feature of the present invention, the key identification switch can be a switch with a key that automatically returns to its rest position and interrupts the enable signal when the key is released. This forces the operator to use one hand to prevent the key from returning to its initial position when selecting a new operating mode, while selecting the new operating mode using the other hand. The operating mode can thereby be securely switched.

A user or operator can be reliably identified by using as an identification means an identification card or a transponder or a biometric method, in particular a fingerprint or a retina scan.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

Turning now to the drawing, and in particular toFIG. 3, there is shown a schematic illustration of an operator's console31according to the present invention, including two rotary switches2aand2b,a standard key pad3awith nine standard keys, of which only one standard key4ais labeled for sake of clarity. Parts corresponding with those inFIG. 1are denoted by identical reference numerals and not explained again. The description below will center on the differences between the embodiments. In accordance with the present invention, the operator's console31has a key pad12that is implemented in a safe technology, with nine keys implemented in safe technology, of which only one key13is labeled for sake of clarity. In addition, the operator's console31has a terminal strip35with only for individual contacts.

To ensure clarity, it is necessary to establish the definition of the term “safe technology” that will be used throughout this disclosure. As already mentioned, the operator's console31ofFIG. 3, unlike the operator's console1inFIG. 1, has two different key pads3aand12. The key pad3aand the keys4aof the key pad3aare implemented as standard keys, whereas the key pad12and the associated keys13are implemented in the so-called safe technology. The keys13implemented in safe technology are read-in from the operator's console and/or the controller by special methods or procedures in a particularly secure and reliable manner. This can be achieved in different ways, for example, by providing the keys13with redundant contacts, as in the key authentication switch, and/or by reading the values in redundantly. In addition, the two read-in values in the operator's console and in the controller can be compared to thus identify a read error, a wiring defect and/or a switch malfunction. The additional expense for implementing the keys in safe technology as compared to standard technology is insignificant.

FIG. 4shows a functional circuit diagram of a two-step key authentication switch10. This switch essentially corresponds to the three-step key authentication switch6depicted inFIG. 2. Each of the two contacts is switched redundantly and synchronously by a key7via a mechanical coupling8. Unlike the three-step key authentication switch6depicted inFIG. 2, the two-step authentication switch10ofFIG. 4has only four contacts, with only one contact9labeled for sake of clarity.

The four contacts of the two-step key authentication switch10ofFIG. 4are each separately connected via a corresponding connection to respective contacts of the terminal block5of the operator's console1, as depicted inFIG. 3.

If a qualified operator desires to switch the operating mode, then the operator inserts the key7into the two-step key authentication switch10and turns the key. In this way, the upper and lower contact of the two-step key authentication switch10ofFIG. 4are synchronously closed and a binary redundant enable signal, which consists of the two individual enable signals14and15depicted inFIG. 3andFIG. 4, is transmitted to the operator's console1via the respective contacts. As long as the operator's console receives the redundant enable signal and does not detect an error in the enable signal (both of the enable signals14and15must have the same logical value, for example “0” or “1”), then all keys of the key pads12or a subset thereof constructed in safe technology are enabled and can be operated by the qualified operator.

In the depicted embodiments, one operating mode is associated with each enabled key that is configured with the safe technology. As long as the enable signal is applied, the operator can select the desired operating mode by pressing the corresponding key. However, instead of associating a single operating mode with each key as shown in the depicted exemplary embodiment, the same or an even greater number of operating modes than the afore-described nine different enabled operating modes (corresponding to the number of keys) can be defined and/or selected when using a menu that is controlled by the keys or by an even smaller number of keys.

After the operating mode is switched, the qualified operator returns the key7again into the initial position, thereby interrupting the enable signal and blocking the keys of the key pad12.

Unlike conventional methods and devices, the methods and the device of the invention depicted inFIGS. 3 and 4only require four contacts on the operator's console1and on the key authentication switch10, so that a two-step key authentication switch can be used. In addition, in the depicted exemplary embodiment only four wired connections are required between the operator's console1and the two-step key authentication switch10(seeFIGS. 3 and 4), instead of the eight connecting wires required in the conventional embodiment depicted inFIGS. 1 and 2.

This significantly reduces the cost and wiring complexity and improves the reliability.

In the depicted exemplary embodiment, an externally connected key authentication switch is provided as an identification means. However, it will be appreciated by those skilled in the art that the identification means or the key authentication switch can also be an integrated component of the operator's console1. The contacts can then be located inside the housing of the operator's console1and are not visible to the externally located operator.

Instead of using a key authentication switch, the identification means can also be implemented as an identification card, a transponder or a biometric unit, such as a fingerprint or a retina scanner.

If the identification means is connected externally to the operator's console, then the identification means can be easily exchanged at a later time.

It will be understood that a three-step or multi-step key authentication switch can also be used instead of the two-step key authentication switch. The unused contacts of the key authentication switch are then not connected. Such a three-step or multi-step key authentication switch, however, can be expected to be more expensive than a two-step key authentication switch.

If the key authentication switch is implemented so that the key automatically returns to its initial position and the enable signal is interrupted when the key is released, then the user is forced to use both hands when switching between operating modes. The operator has to use one hand to hold the key in the turned position to prevent the key form returning to its initial position, while selecting using the other hand to select the operating mode with the keys13of the keypad12implemented with safe technology. This arrangement reduces the risk that the operating mode is switched unintentionally of by pressing the wrong key or by dropping objects on the keys.

If an identification card or a retina scan of the user's eye is used as identification means, then the enable signal can remain activated for a short time after the identification. This time should be sufficient to switch the operating mode, and giving the user with an unobstructed view of the keys to be pressed.

FIG. 3shows an exemplary operator's console1with optional identification means in the form of a fingerprint scanner11, schematically indicated by dotted lines. Optionally, the indicated fingerprint scanner11and the two-step key authentication switch10can also operate in parallel, so that the operator can use for identification, for example, either the fingerprint scan11or the two-step key authentication switch10or both, which provides additional security.