Abstract:
The present invention involves a methodology for the interconnection of safety control modules used for the safeguarding of personnel around points and areas of hazardous machine operation. The system includes one or more safety control modules connected together so that the safety control modules communicate with each other using actively diverse safety control signals. The safety control modules are also connected to the machine safety control circuit so that the safety control modules can stop machine operation when one or more safety control modules are activated. The use of actively diverse safety control signals provides a control reliable system.

Description:
TECHNICAL FIELD  
         [0001]    This invention relates to the field of machine operation control. More specifically, this invention relates to a methodology for implementing a control reliable safety system for machine operation.  
         BACKGROUND OF THE INVENTION  
         [0002]    Safety control modules are used for the safeguarding of personnel around points and areas of hazardous machine operation. Examples of hazardous machines include punch presses, press brakes, automation work cells (including robot cells), molding presses, and the like. Often times the machine and/or cell application requires multiple safety controls to guard and control the machine safely. Multiple light curtains, E-Stop switches, gate switches, safety mats etc. are used with the machine safety control circuit to provide safe and efficient machine operation. Typically, many of the safety controls are functionally connected in series to form safety control signals to various parts of the machine control circuit. Interconnection of these safety controls often introduces wiring faults that can lead to the loss of the safety control signals.  
           [0003]    “Control Reliability” is a method of ensuring the integrity of performance of control systems, including guards and safeguarding devices that interface with the control system. In order to be control reliable, an interconnection methodology cannot allow the loss of any safety control signal when any single fault of any part of the machine safety control system occurs, including the wiring. Furthermore, the interconnection methodology cannot allow the loss of any safety control signal due to single faults that are undetected and combined with additional faults. In the past, unique solutions have been developed for each specific functional safety control. Solutions for multiple safety light curtains were different compared to multiple E-Stop switches, gate switches, safety mats, etc. Often times, these different methods produced different levels of safety integrity (i.e. not all methods were control reliable). The inconsistency of wiring solutions also has resulted in confusion, poor field reliability, excessive circuit wiring, special dedicated control components and high system costs. An approach is needed that provides a consistent, control reliable, simplified, low system cost solution using standard safety control modules.  
           [0004]    Currently, safety control modules are designed and sold individually and without knowledge of the machine safety control circuit. This limits the safety control module engineers in their ability to provide products that form a control reliable machine safety control system when connected together. Simply using control reliable safety control modules is not enough. The machine safety control system must be interconnected in a control reliable manner so that wiring faults of the system result in control reliable machine operation. Machine safety control systems are developed and modified by different people at different times over the life of the machine. The manufacturer may develop an initial machine safety control system that is modified by the installer of the machine at the customer site. Over the life of the machine the setup of the machine changes to accommodate various production assignments. Machines may be sold, recommissioned or rebuilt to perform other production tasks. This presents many opportunities for the machine safety control system to be modified.  
           [0005]    Because each safety control module has been independently designed (often times by different manufacturers) without taking into account the overall control reliability of the machine safety control circuit, there is a lack of overall system designs including a hybrid of safetycontrol modules. For example, safety light curtains have addressed connecting multiple safety light curtains by the following methods:  
           [0006]    independent safety light curtain systems with isolated output contacts connected to the machine control circuit. Monitoring and detecting wiring faults is very difficult to achieve due to signals that are not unique.  
           [0007]    special safety control modules that operate more than one safety light curtain sensor pair. These systems are limited in how many sensor pairs can be connected (see, e.g., the Banner Multi-Screen System Dual Safety Light Screen System control box MUSC-1).  
           [0008]    special systems that break up the sensors into pieces that are connected by special cables that allow the control unit to treat the pieces as one sensor pair, as described in U.S. Pat. No. 5,198,661. Response time for these systems is increased because all of the sensor pairs are in series and treated as one sensor. Ordering and stocking of the special sensors (first segment, middle segment, end segment), and the special interconnecting cables are cumbersome and undesirable. The individual segments cannot be used alone. They must be pieced together to make a working system. The diagnostics are combined so it is more difficult to determine which segment or cable is faulty and in need of replacement.  
           [0009]    mechanically configured sensors such as hinged or fixed special (T or L) shaped units.  
           [0010]    E-stop switch controls and gate switch controls have utilized series connections of the switches with or without safety monitoring control modules. Because of the direct series arrangement, this leads to masking (undetected) wire and/or switch faults when more than one switch is open at the same time.  
           [0011]    The above scenarios illustrate that the control reliability of the machine safety control system is difficult to design into the system and maintain. Also, having safety control modules designed without a concerted effort toward system integration only makes the problem worse. Failure analysis of the machine safety control circuit is not always conducted correctly to account for failures such as wiring faults between safety control modules.  
         SUMMARY OF THE INVENTION  
         [0012]    In accordance with the present invention, the above and other problems are solved by providing a methodology for implementing the interconnection of safety control modules in a control reliable manner. The methodology includes one or more safety control modules connected together so that the safety control modules communicate with each other using actively diverse safety control signals. The safety control modules are also connected to the machine safety control circuit so that the safety control modules can stop machine operation when one or more safety control modules are activated. The use of actively diverse safety control signals provides a control reliable system.  
           [0013]    These and various other features as well as advantages, which characterize the present invention, will be apparent from a reading of the following detailed description and a review of the associated drawings. 
       
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0014]    [0014]FIG. 1 shows a generic safety control module connected to a machine at the machine safety control circuit.  
         [0015]    [0015]FIG. 2 illustrates different types of safety control devices and modules.  
         [0016]    [0016]FIG. 3 shows two safety control modules connected in a control reliable manner as described in this present invention.  
         [0017]    [0017]FIG. 4 shows multiple safety light curtain module connected in a control reliable manner as described in a first embodiment of the present invention.  
         [0018]    [0018]FIG. 5 illustrates multiple generic safety control modules connected in a control reliable manner as described in a second embodiment of the present invention.  
         [0019]    [0019]FIG. 6 illustrates multiple safety light curtain modules and generic safety control modules connected in a control reliable manner as described in a third embodiment of the present invention.  
         [0020]    [0020]FIG. 7 illustrates the operational flow of a single safety control module.  
         [0021]    [0021]FIG. 8 illustrates the operational flow of two or more safety control modules. 
     
    
     DETAILED DESCRIPTION OF THE INVENTION  
       [0022]    The invention may be described in the general context of different modules. These modules may be implemented in hardware circuitry or executed by one or more computers or other devices. Modules may include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. Typically the functionality of the modules may be combined or distributed in desired various embodiments.  
         [0023]    [0023]FIG. 1 illustrates one possible embodiment of a safety control system  101  used to provide perimeter safety to a user of a machine  130  according to the present invention. The safety control system  101  includes a safety control module  102  and one or more safety control sensors  110  and  120  in order to detect an unsafe operation condition for the machine  130 . When such an unsafe condition is detected, the safety control system  101  takes appropriate steps, such as disabling the operation of the machine  130 , to reduce any risk of injury to the user of the machine  130 .  
         [0024]    Machine  130  includes a machine safety control module  135 . Safety control module  102  is connected to the machine safety control module  135  of machine  130  by connection  125 . This connection  125  allows the safety control module  102  to communicate with the machine  130  through the safety control module  135 . The safety control sensors  110  and  120  are adapted to interact with the machine operating environment and provide an indication of the machine operating environment to the safety control module  102  when predefined conditions in the machine operating environment are present.  
         [0025]    [0025]FIG. 2 shows embodiments of several different types of safety control devices and modules that may be used in a safety control system such as  101 . The different safety control modules include safety light curtain module  205 , electronic control switch device  210 , mechanical safety switch device  220 , and safety mat module  230 . In addition, generic dual contact safety device/control module  240  is shown with contacts  242  and  244 , as well as generic single contact safety control device/module  250  with single contact  252 . A single contact module such as  250  is easily bypassed by a single wiring short across contact  252  and is therefore not control reliable. Dual contact versions provide a second channel to supply a safety control signal in the event of a single short of one of the output contacts  242  or  244 . This works as long as the machine safety control module detects the shorted channel and does not allow the machine to continue to operate until the short is repaired. Otherwise, continued machine operation can lead to a second short across the other output contact. With both output contacts  242  and  244  bypassed, the safety control signals of the safety control module are muted and the machine will not stop.  
         [0026]    The various embodiments of safety control devices/modules  205 - 250  may be implemented using a combination of hardware circuitry as well as software routines. The safety control devices/modules  205 - 250  are used within a safety control system  101  as illustrated in FIG. 1. A safety control system such as  101  can comprise of one or more of the safety control devices/modules shown in FIG. 2. Each of the safety control modules within a safety Control system can be connected to allow communication between each safety control module and the machine  130  shown in FIG. 1. Each safety control module can monitor the working environment and communicate with the machine when certain conditions in the working environment are present.  
         [0027]    [0027]FIG. 3 shows the interconnection and signaling of two safety control modules  310  and  350  according to a sample embodiment of the present invention such that control reliability is maintained throughout system  300 . The first safety control module  310  comprises input connection modules  315  and  316 , output connection modules  311 ,  312  and  314 ,  317 , and a plurality of terminal connection modules  313  that would be connected to one or more safety control sensors or devices. Output connection modules  311  and  312  of safety control module  310  are electrically connected to input connection modules  351  and  352  of the second safety control module  350 . Other output connection modules  314 ,  317  as well as other input connection modules  315 ,  316  of the first safety control module  310  may be connected to other safety control devices or modules not shown in FIG. 3.  
         [0028]    Actively diverse safety control signals  320  and  325  are communicated between outputs  311  and  312  to input connection modules  351  and  352  of safety control module  350 . Actively diverse safety control signals are defined as signals that are generated in such a way as to differentiate them from other signals. Actively diverse safety control signals  320  and  325  may be generated by changing the state of these signals in a pre-defined way that differentiates the safety control signals from steady state signals (power or ground), other I/O signals, and extraneous electrical noise.  
         [0029]    Pulsing the outputs creates an active signal. A pulse algorithm determines the signal definition. The safety control signal of a safety control module must be diverse in that each signal must have a unique definition. A unique definition of an actively diverse safety control signal may be accomplished by changing the one or more characteristics of the signal pulsing, including number of pulses, pulse width, time between pulses or a combination of all of these things, by changing the phase of the pulsing signals, by changing the circuit potential of the signals, or by a combination of any or all of these methods. Safety control modules must have input connection modules such as  351  and  352  that detect these pre-defined actively diverse safety control signals  320  and  325  and differentiate them from both other signals known signals and extraneous electrical noise present within a system.  
         [0030]    Use of actively diverse safety control signals allows multiple safety control modules to be interconnected at an I/O module level as opposed to interconnecting them at the sensor/actuator level. By using a safety control signal output structure consisting of two or more actively diverse safety control signals and an input structure consisting of two or more actively diverse safety control signals, safety control modules may be connected together in a way that provides various safety functions, such as intrusion detection, guard removal, personnel detection, etc., in a control reliable way. Using this methodology, wiring faults such as an open or short to supply or other signal lines may be detected by the safety control modules that permits the machine to be shut down safely until the faults are repaired The preferred embodiment of this invention includes two redundant actively diverse signals that provide a control reliable system. However, other configurations such as a single channel, non-redundant, active signal may be used without departing from the spirit of the invention.  
         [0031]    [0031]FIG. 4 illustrates a machine  480  connected to a single safety control module incorporated within a safety control system  450  according to a first embodiment of the present invention. Safety control module  410  is provided as a safety light curtain module with safety light sensor  440 . Output signals  431 ,  432  generated by the safety control sensor  430  are connected to input connections  420 ,  421  of safety control module  410 . Output connections  422 ,  423  of the safety control module  410  are connected to input connections  451 ,  452  of the safety control system  450 . Output signals  453 ,  454  generated by the safety control system  450  are connected to input connections  460 ,  461  of the machine safety control module of machine  480 . Communication among safety control sensors  430 ,  440 ,  450 , safety control module  410  and machine safety control module input  460 ,  461  is conducted using actively diverse safety control signals, thereby assuring control reliability.  
         [0032]    If safety control sensors  430  or  440 , detect a stop or alarm condition within the working environment, the sensor would communicate to safety control module  410 . In turn, safety control module  410  would communicate with safety control system  450  and safety control system  450  would communicate with the machine safety control module of machine  480 , stopping the machine or otherwise compensating for the alarm condition.  
         [0033]    [0033]FIG. 5 illustrates a machine connected to a plurality of safety control modules according to a second embodiment of the present invention. Safety control modules  510 ,  520 , and  530  include generic dual contact safety control devices/modules  515 ,  525 , and  535 . Output connections  511 ,  512  of the first safety control module  510  are connected to input connections  523 ,  524  of the second safety control module  520 . Output connections  521 ,  522  of the second safety control module  520  are in turn connected to input connections  533 ,  534  of the third safety control module  530 . This interconnection of safety control modules may be extended to any number of connected modules. Communication between safety control modules  510 ,  520 , and  530  is accomplished using actively diverse safety control signals, thereby assuring control reliability  
         [0034]    If dual contact safety control devices/modules  515 ,  525 , or  535  detect a stop or alarm condition within the working environment, this condition would be communicated to safety control modules  510 ,  520 , or  530  respectively. In turn, safety control modules  510 ,  520 , and  530  would communicate the stop or alarm condition via outputs  531 ,  532 . These outputs can be connected to another safety control module or a machine safety control module of a machine. Eventually the stop or alarm condition will be communicated to the machine safety control module, stopping the machine or otherwise compensating for the alarm condition.  
         [0035]    [0035]FIG. 6 illustrates a third embodiment of the present invention showing system  600  comprising mixed technology safety control sensors. System  600  includes safety control module  610 , safety light curtain module sensors  640 ,  650 , and  660 , and generic safety control devices/modules  620  and  630 . Safety light curtain module sensor  640  has outputs  641 ,  642  connected to contact  622  and  621  of generic safety control device/module  620 . Contacts  621 ,  622  of safety control module  620  are connected to inputs  611 ,  612  of safety control module  610 . Outputs  613 ,  614  of safety control module  610  are connected through contacts  631 ,  632  of generic safety control module  630 , to inputs  663 ,  664  of safety light curtain module system  660 . The outputs  661 ,  662  of safety light curtain module system  660  may be connected to a second safety control module or a machine safety control module not shown. The communications between the separate modules shown in system  600  are accomplished using actively diverse safety control signals, thereby assuring control reliability. Faults of output contracts and wiring of devices/modules  620  and  630  are detected and control reliability is maintained.  
         [0036]    In all three embodiments shown in FIGS. 4, 5, and  6 , the redundant actively diverse I/O methodology results in a common control reliable solution for multiple safety devices of similar or different safety functions.  
         [0037]    [0037]FIG. 7 illustrates the operational flow for a single safety control module according to another embodiment of the present invention. Reception operator  710  receives actively diverse safety control signals from a safety control sensor or another safety control module. Identifier  720  then processes and recognizes the actively diverse safety control signals. Finally, communicator  730  sends the actively diverse safety control signals to thenext module in the chain, which may include another safety control module or the machine safety control module of a machine.  
         [0038]    [0038]FIG. 8 shows the operational flow for a machine safety control system  800  comprising two safety control modules. Reception operator  810  receives actively diverse safety control signals. Identifier  820  then processes and recognizes the actively diverse safety control signals. If the actively diverse safety control signals are not identified, detector  825  communicates to the machine to terminate operation, as shown in  870 . If the actively diverse safety control signals are identified, communicator  830  sends the actively diverse safety control signals to reception operator  840  of the next safety control module. Reception operator  840 , identifier  850 , detector  855 , and communicator  860  of the second safety control module function in a manner identical to the operators of the first safety control module.  
         [0039]    It will be recognized by one skilled in the art that these operations, steps and modules described any of the above embodiments may be implemented in software, in firmware, in special purpose digital logic, and any combination thereof without deviating from the spirit and scope of the present invention as recited within the claims attached hereto. While the invention has been particularly shown and described with reference to preferred embodiments thereof, it will be understood by those skilled in the art that various other changes in the form and details may be made therein without departing form the spirit and scope of the invention.