Abstract:
A safety interlock switch with coded interlocking to provide tamper resistance, the coded interlocking having two differently coded technologies  8,10; 16,18 . In a preferred embodiment one technology is mechanical in the form of a coded-cam system operated by a coded-tongue  8 , the other is electronic comprising a non-contact coded RFID sensor  16,18 , and wherein the switch is only enabled when the two different codes have been correctly applied.

Description:
The present invention relates to safety switches and in particular safety interlock switches with an actuator operated cam mechanism. 
     BACKGROUND OF THE INVENTION 
     Actuator operated interlock switches require a tongue shaped actuator to be removed and inserted from a main switch housing. The switch is used to enable a power supply to machinery. The switch is generally mounted between a machine guard and a frame for the guard, with the tongue mounted to one of the guard and frame, and the main switch housing attached to the other of the guard and frame. The switch is designed such that the power supply cannot be enabled until the guard is closed and the tongue is thereby inserted in the main switch housing. In a switch with machine guard locking, the tongue cannot be removed from the switch housing and the guard opened until the machine has come to a stop or is in a safe condition for access thereto. In addition to the mechanical aspects of the switch, the switch additionally has several normally closed and normally opened safety contacts, the normally closed contacts enabling power when the guard is closed. 
     This type of switch has the disadvantage that personnel may override or bypass the safeguard provided by this switch by removing the tongue and inserting a foreign object into the switch to permanently bias it to its normal position where the contacts are closed and power is supplied. This is done to gain easier access to the machine, enabling the guard to be opened without the inconvenience of waiting for the machine to power down. 
     SUMMARY OF THE INVENTION 
     An anti-tamper feature has been developed to try and prevent personnel bypassing the safety function of this type of switch. To this end the internal mechanical moving components of the switch actuated by the tongue have a specifically shaped orifice which can be accessed only by a dedicated tongue having a complementary shape. However, this type of structure is still prone to mechanical failure, in that the internal mechanism can be broken by force and the safety contacts remain closed. It is also difficult to detect this type of failure, since the switch appears to operate normally, however, the power is not disabled. 
     It is an object of the present invention to provide an improved safety switch which overcomes or alleviates the above described disadvantages. 
     In accordance with the present invention, there is provided a safety interlock switch which has coded interlocking to provide tamper resistance, wherein the interlocking includes two differently coded technologies. 
     In a preferred embodiment, the switch comprises safety means which checks that the two different codes have been correctly applied before enabling a safety output of the switch which provides machine control. 
     The safety means may check the codes in a specific predetermined sequences, the specific sequence may include determining at least one of predetermined positions and condition of the interlock. 
     The safety means may check for a fault condition in the switch and prevent activation of the safety output if a fault condition in the switch is detected. 
     One of the coded technologies may be mechanical and in preferred embodiment use a coded cam system operated by a coded tongue. 
     The other of the coded technologies may be electronic and may include a non-contact coded RFID sensor. A coded RFID actuator of the sensor may be mounted on the coded tongue or may be adapted to be mountable separately thereto. 
     The safety means may comprise a plurality of contacts which open and close in said predetermined sequences upon activation and deactivation of the switch by the actuators or actuators of the switch. 
     In accordance with a second aspect of the present invention, there is provided a method of operating a safety interlock switch which includes a coded rotary cam system operated by a coded tongue, the switch being of the positively operated type in which the switch must be positively operated by the cam system in order to switch off the power to attendant machinery, the switch further comprising a second interlock in the form of a non-contact RFID sensor, the method comprising the steps of firstly inserting the coded tongue to rotate the cam, secondly checking the code of RFID sensor when the tongue is part inserted to ensure that the code is correct and enabling power only when both interlocks are correctly coded. 
     The method may further include the steps of performing a system check to ensure that there are no faults in the locking system before allowing the power to be enabled. 
     The switch may further include a safety circuit with a plurality of contacts, the method further including only enabling power when all contacts are correctly closed in a specific sequence, the sequence may include at least one of checking the codes and position of actuators. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       By way of example, only a specific embodiment of the invention will now be described with reference to the accompanying drawings, in which:— 
         FIG. 1  is a schematic view of a tongue operated safety switch constructed in accordance with a first embodiment of the present invention; 
         FIG. 2  is a schematic view of the safety circuit used to shown sequence of actuator movement of the safety switch  FIG. 1 . 
         FIG. 3  is a schematic view showing a second embodiment of tongue operated safety switch in situ on a guard and its frame with a separately mounted RFID coded sensor. 
     
    
    
     DETAILED DESCRIPTION 
     The safety switch, as illustrated in  FIG. 1 , comprises a switch housing  4  and a cam mechanism  6  operably connected thereto, which cam mechanism  6  is operated by insertion and removal of a mechanical actuator in the form of a tongue  8 . 
     The cam mechanism  6  has two insertion openings  10  for selective insertion of the tongue  8 . The plurality of insertion openings  10  enables the mounting of the combined switch and cam mechanism at a variety of geometric locations. In use for example, the tongue  8  is mounted to a guard door and the combined switch housing  4  and cam mechanism  6  on the guard&#39;s frame, with the tongue  8  located adjacent one of the insertion openings  10  for easy insertion and removal therefrom. Inside the cam mechanism  6  is a rotary cam (not illustrated) which has two engagement grooves and which can align with a respective insertion opening  10  to the cam mechanism  6 . The tongue  8  and engagement grooves are coded to match, in this respect the tongue  8  is specifically shaped to fit into the uniquely shaped engagement groove of the rotary cam of the safety switch; like an effective key. 
     In this particular example, the tongue  8  has a head  12 , which in use is fixed to the guard, and a generally H shaped dependent shaft  12 . A cross-bar  14   a  of the shaft  12  hooks into the engagement groove when the tongue  8  is inserted into the insertion opening. With further insertion of the tongue  8 , the cross-bar  14   a  drives the rotary cam, such that the insertion opening moves away from the insertion opening, thereby locking the tongue  8  therein. In this position the machine may be powered and the guard locked. It is to be understood that the tongue  8  is not limited to this specific shape, other matched profiles are also envisaged. 
     In addition to the mechanical actuator, in the form of the tongue  8 , there is also a RFID (Radio Frequency Identification) non-contact coded sensor  16 ,  18 . The sensor  16 ,  18  comprises a RFID actuator  16 , mounted on the head  12  of the tongue  8  and a RFID antenna mounted on the cam mechanism  6 , and located adjacent an insertion opening  10 . An antenna  18  is mounted adjacent each insertion opening  10 . The actuator  16  and antenna  18  are matched, that is have a unique code and provide a second unique locking mechanism for the safety switch, described further herein under. It is to be understood that the actuator and antenna could be provided the other way round. 
     The switch  4  is of the positively operated type in which the switch must be positively operated by the cam mechanism  6  in order to cut power supplied to attendant equipment (not illustrated). To this end the switch has a plurality of normally closed contacts which enable power to attendant machinery and which are closed when the tongue  8  is inserted and broken and thereby power disabled when the tongue is removed. To this end rotation of the cam by the tongue enables actuation of an internal solenoid mechanism or the like inside the switch housing. By providing a specifically coded tongue as the mechanical actuator, this reduces the possibility of deliberate attempts to overcome the normal operation of the switch&#39;s safety function, by insertion of a non-matched mechanical actuator. 
     In the present invention the anti-tamper safety function provided by the mechanical coded tongue is further enhanced by the provision of a second interlock, and anti-tamper safety function which is provided by the RFID coded sensor  16 ,  18 . In this respect the interlocking coded-function is achieved by using two different coded technologies. One is electronic (using RFID coding either unique or by series) and one mechanical using the coded cam system operated by a coded key (tongue). It is intended that both coded technologies need to operate and concur to achieve a safety output for machine control. This provides a unique diverse interlock and provides redundancy in the coded actuation, whereby both must be satisfied to enable the machine to be started. 
     As best illustrated in  FIG. 2 , the switch is provided with a safety circuit  20  which is in communication with a microprocessor  22 . The safety circuit  20  is provided with three mechanical contacts  20   a ,  20   b ,  20   c . The microprocessor  22  monitors the contacts to ensure that a pre-determined sequence of events is followed and also conducts an intelligence check to detect if the lock has been broken by force and the safety contacts remain closed. 
     The Sequence of events is as follows:
     1) RFID sensing check to check the matched code of the sensors  16 ,  18 ;   2) A logic check of fault signals from the mechanical contacts  20   a ,  20   b ,  20   c ; and   3) To provide a signal to operate relay  1  (described further herein under) and to enable the machine to be powered.   

     Safety contact  20   a  provides a mechanical contact from the locking mechanism (position A of  FIG. 2 ) and is closed when:
     1) Actuator (the tongue is fully inserted); and   2) Locking mechanism thereof is engaged.   

     Safety contact  20   b  (position B of  FIG. 2 ) provides an internal relay  1 , which is closed when:
     1) Actuator is part inserted;   2) RFID code of the sensor is confirmed correct by the microprocessor; and   3) Confirmed by microprocessor  22  that no logic errors exist between contacts  20   a ,  20   b ,  20   c.      

     Safety contact  20   c  (position C of  FIG. 2 ) is a mechanical contact from coded anti-tamper tongue operated cam system, and is closed when:
     1) The actuator is part insert.   

     The operating sequence is as follows:
     1) Insertion of actuator and contact operation: (normal)   

     
       
         
               
               
             
           
               
                   
               
             
             
               
                 Contact 20c 
                 closes FIRST by a set position with actuator 
               
               
                 Contact 20b 
                 Closes SECOND by a set position with actuator and when 
               
               
                   
                 RFID code confirmed correct by microprocessor. 
               
               
                 Contact 20a 
                 Closes THIRD by a set position with actuator and when 
               
               
                   
                 mechanical actuator is locked. 
               
               
                   
               
             
          
         
       
         
         2) Withdrawal of actuator and contact operation: (normal) 
       
    
     
       
         
               
               
             
           
               
                   
               
             
             
               
                 Contact 20a 
                 Opens FIRST by energisation of the switch&#39;s 
               
               
                   
                 solenoid to open its normally closed contacts 
               
               
                   
                 and with release of the locking mechanism. 
               
               
                 Contact 20b and 20c 
                 Both open LATER by set position with actuator 
               
               
                   
                 and when RFID sensing is lost. 
               
               
                   
               
             
          
         
       
         
         3) Withdrawal of actuator and contact operation—(Fault Condition): 
       
    
     
       
         
               
               
             
           
               
                   
               
             
             
               
                 Contact 20a 
                 Stays closed after energisation of the switch solenoid 
               
               
                   
                 due to forced damage or other mechanical fault. 
               
               
                 Contact 20c 
                 Stays closed after withdrawal of actuator due to forced 
               
               
                   
                 damage or other mechanical fault. 
               
               
                 Contact 20b 
                 Opens LATER by set position with actuator and when 
               
               
                   
                 RFID sensing is lost. Microprocessor Logs Fault and 
               
               
                   
                 prevents the machine being started even when the 
               
               
                   
                 actuator is re-inserted. 
               
               
                   
               
             
          
         
       
     
     By this means the microprocessor  22  is adapted to prevent operation of the machine until a predetermined position and sequence check of the contacts is found to be normal. This enables detection of a broken locking. 
     The tongue  8  and sensor  16 ,  18  provide a combined actuator  8 ,  16 ,  18 . As best illustrated in  FIG. 2  when the actuator is inserted into the cam mechanism  6 , the RFID code is checked to ensure it is the correct, or matched code for that switch, at a first pre-determined set position (distance) before the mechanical cam system can operate at a second position and achieve closing of the mechanical contacts and locking of the actuator. 
     This enables the RFID code to be accepted as matching before the final mechanical safety contacts close  20   b  and the machine is able to be started. 
     When the actuator is withdrawn (after energisation of the switch solenoid to release the lock and open the mechanical contacts), the mechanical contacts are opened before the RFID coded check is disengaged. This is via a predetermined set position (distance) set by the design of the actuator  8 ,  16 ,  18  and its position relative to the switch housing  4 ,  6 . This allows for an intelligence check by the internal microprocessor  22  to detect if the lock has been broken by force and the safety contacts remain closed. If the lock has been wrenched (broken) the sequence check of the mechanical contacts  20   a ,  20   b ,  20   c  opening relative to the RFID circuits opening will allow the machine to stop, but will not be able to be restarted even if the actuator  8 ,  16 ,  18  is inserted into the broken lock. 
     In a normal operation condition when the actuator is withdrawn the mechanical cam contact  20   a  opens and the RFID contact  20   b  opens. In an abnormal operating condition when the mechanism has been broken, the actuator is withdrawn, the mechanical contacts  20   a  stay closed, the RFID sensing is stopped and the abnormal condition of the contacts is detected. 
     In the above described first embodiment, the profiled tongue  8  (key) which provides the cam operated mechanical coding and the RFID key (non contact coded key tag) are assembled in the same mounting and with this alignment of the tongue  8  automatically leads to alignment of the RFID coded key  16 ,  18 . The design and choice of components is selected to ensure that the RFID coded key  16 ,  18  is always correctly checked before the coded tongue  8  can reach the desired position to cause final operation of the mechanical interlock and the machine started. Not only does this guard against mechanical failure as described above, but also provides a second layer of anti-tamper protection in that only a specifically matched RFID coded key will actuate the mechanism. 
     Whilst the combined mounting of the two differently coded technologies has been described, it is to be understood that these could also be mounted separately to the guard as best illustrated in  FIG. 3 . Here, the tongue  8  is mounted on a fixing bracket  24  to the guard door  26  for insertion and removal into the cam mechanism  6  of the switch housing  4 . Whilst the non-contact coded RFID actuator  16  is mounted separately thereto on the guard  26 . This additionally provides mechanical redundancy on the moving part of the guard door  26 , in that two independent fixings would have to fail or be by-passed to create a dangerous situation. Furthermore, this enables the non-contact RFID sensor  16 ,  18  to be located in a hard to reach location, further preventing tampering. The sequence of opening and closing of the contacts is monitored as per the first embodiment. 
     It is to be understood that whilst a predetermined set distance has been described for detection of position of actuator and sensor, these could be adapted to be adjusted in situ to account for mounting position. Furthermore, a degree of tolerance may be incorporated to account for minor movement between the positions of guard and frame overtime due to wear and vibration.