Patent Description:
Universal testing machines are used to perform mechanical testing, such as compression strength testing, tension strength testing, or torsional strength testing, on materials or components. <CIT> relates to safety system interfaces and material testing systems including safety system interfaces.

Systems and methods are disclosed for material testing, which include torsional material testing systems, substantially as illustrated by and described in connection with at least one of the figures, as set forth more completely in the claims.

Disclosed are systems and methods for torsional strength testing. In particular, the disclosed torsional material testing system employs a number of safety modes and software architecture to ensure safe operation of the system. For instance, rotary motion is safely disabled when the system operates in an unrestricted or testing mode, which is also indicated to the operator visually, audibly, or by other suitable feedback.

When the system is operating in a restricted mode (e.g., a disabled or setup mode), a virtual interlock prevents powered motion of the rotary drive system. This allows for an operator to engage with the system without unintentional activation of the torsional material testing system. In some examples, the rotary drive system (e.g., rotational motor) allows for manual jogging. For example, the virtual interlock may be activated, thereby preventing powered motion of the rotary drive system, while allowing physical rotation of the material under test.

In some examples, a motor brake is provided to lock rotational movement of the rotary drive system motor. The brake may be implemented manually and/or in response to a trigger, either by hardware and/or software. For instance, the rotary drive system can be locked with the motor brake when the material testing system is configured for axial setup or testing, but without rotational movement or torsional testing.

In some examples, an unrestricted mode (including the testing state) allows for jogging the motor to move either clockwise or counterclockwise, such as by use of a user interface (e.g., remote device, control panel, connected computing platform, etc.). Following a torsional material testing process, the rotary drive system may return to a default or commanded position, either automatically or in response to a user input.

Conventional material testing systems use mitigation techniques, such as configuration switches, guarding, limited force controls, motion limiting, and/or protection, to improve operator safety. However, conventional material testing systems frequently do not always comply with international standards. Conventional mitigation techniques require the operator to place the system in the appropriate mode of operation, such as safe interaction or testing. Many conventional safety techniques can be implemented using off-the-shelf safety components, such as programmable logic controllers (PLCs) and/or relays. PLCs and relays typically add significant cost to the material testing system.

Disclosed example material testing systems embed or integrate a safety system complying with international standards within the material testing system. Because the safety system is integrated into the material testing systems, disclosed example material test systems provide safety improvements at a much lower cost than would be accomplished using off-the-shelf parts because the safety system is integrated into the existing electronics, semiconductors, and/or circuit boards of the material testing systems. Integration further improves reliability, which reduces or eliminates external wiring between purchased safety components.

As described in more detail below, disclosed example safety systems for material testing systems include machine state indicators that visually show the state of the testing machine from an operational restriction perspective. Disclosed example safety systems for material testing systems provide high reliability and monitored activation mechanisms at the machine point of control, which may include internal fault checking and/or power supply diagnostics within the material testing systems.

The disclosed material testing systems are designed for simple, simultaneous axial and torsional testing of devices and/or components, but has the flexibility to be used for purely axial or torsional testing. In some examples, torsional material testing systems control and monitor operational devices, as well as safety systems and associated circuitry. Disclosed example material testing systems are compatible with interlock guarding systems having redundant or diverse contacts. Such guarding systems comply with ISO safety standards by using redundant, diverse, and/or dynamic monitoring in real time. Disclosed example material testing systems include redundant torsional material testing systems monitoring. The material testing system shutdown circuitry of disclosed examples is compliant with international safety standards including ISO <NUM>-<NUM>.

Additionally, conventional off-the-shelf safety relay components used with PLCs use an extra layer of firmware within the PLC to stop the motion of the moving components during an emergency stop event. Disclosed example safety systems for material testing systems are configured to enable the hardware (e.g., an emergency stop button) to directly shutdown a power amplifier drive to the actuator(s), regardless of whether the embedded firmware within the safety processor is running.

Disabling of circuitry, actuators, and/or other hardware may be done via hardware, software (including firmware), or a combination of hardware and software, and may include physical disconnection, de-energization, and/or a software control that restricts commands from being implemented to activate the circuitry, actuators, and/or other hardware. Similarly, enabling of circuitry, actuators, and/or other hardware may be done via hardware, software (including firmware), or a combination of hardware and software, using the same mechanisms used for disabling. Firmware may include stored instructions such as Safety Rated Embedded Software (SRESW) and/or Safety Rated Application Software (SRASW).

Disclosed example material testing systems are compliant with the European Machinery Directive, following the rules set forth in the ISO <NUM>-<NUM> standard, which pertains to the "Safety Related Parts of Control Systems. " The following functions, which are determined by a system risk analysis, are integrated into the material testing system. The safety system provides a disabled drive state to remove energy from the drive crosshead, a disabled drive state to remove energy from the torsional material testing system, and a restricted drive state for operator setup. In the restricted drive state, the example safety systems monitor the crosshead speed to maintain the crosshead speed below an upper speed limit, monitor for intentional manual movement (jogging) of the torsional material testing system, monitor for commands for a torsional material testing system process, and/or monitor for unintentional torsional movement.

The disclosed example material testing systems further include an unrestricted drive state, which enables the removal of checks in the restricted drive state. In some examples, the unrestricted drive state can be entered via a dual activation mechanism, in which material testing functionality is performed and the operator does not interact with the system.

Disclosed example material testing systems include indicators for different states, such as a disabled state, a setup state, a caution state (e.g., restricted drive mode), and a testing state (e.g., unrestricted drive mode) indication on every machine to clearly indicate when the operator may interact and when a hazard is present.

Disclosed example material testing systems include one or more stop functions that are configured to take precedence over the starting and/or continuation of motion of components such as the torsional material testing system. Furthermore, one or more stop functions may be redundantly configured via hardware such that the stop functions are effective to disable the material testing system even when software portions of the safety system are disabled. Examples of such stop functions that may be included in disclosed systems include interlocked guards and/or emergency stop switches.

Some disclosed example material testing systems include selection and enforcement of a single control point for starting the material testing frame and/or torsional material testing system. Some example systems provide power failure monitoring and/or protection to ensure the system stops unrestricted operation and places the material test system into the disabled drive state upon re-establishment of power. In some examples, in response to a power failure, the torsional material testing system is automatically de-energized.

Disclosed example safety systems and material testing systems include increased internal diagnostics and reporting to the operator of critical errors within the system, such as malfunctions of equipment or conflicts between redundant inputs, outputs, and/or processes. Disclosed example material testing systems enable faster specimen removal and/or insertion, relative to conventional material testing systems, due to the safe setup mode of the testing machine that permits operator activity within the test space without disabling of the material testing system or requiring guard doors. Disclosed example systems further improve operator safety when setting up and configuring the system inside the test space, due at least in part to use of the setup state, which restricts motion of the torsional material testing system and/or limited motion and/or force that can be applied to or by the torsional material testing system.

Disclosed material testing systems and safety systems may be specially configured to be utilized in the disclosed example configurations, to achieve identified risk mitigations. Disclosed material testing systems are significantly more efficient and targeted to materials testing than purchasing general purpose, off-the-shelf, discrete safety components.

Disclosed material testing systems and safety systems are configured to return to a restricted state whenever the unrestricted states are not in active use and/or to require intentional action by operators to transition from restricted states to the unrestricted states. Example material testing systems and safety systems provide active warning notifications at the time the unrestricted states are activated. Example active warning notifications include defined as notifications that appear and/or disappear at locations the operator is likely to be observing (e.g., as opposed to providing static labels or other static visuals on the material testing system). Furthermore, disclosed example notifications are intuitive, such as by providing commonly understood color schemes (e.g., green, yellow, red) to signify the state of the material testing system.

In some examples, the operator interface includes a hazard indicator, in which the one or more processors are configured to control the hazard indicator while the restriction on the actuator is reduced. Some examples further include a crosshead configured to move to position the material under test or to apply force to the material under test, wherein the actuator is configured to drive the crosshead, and the restriction on the actuator in the setup state includes an upper limit on a rotational travel speed of the crosshead.

In some example material testing systems, the operator interface further includes one or more visual indicators configured to selectively emphasize corresponding ones of the operator selectable inputs, in which the one or more processors are configured to control one or more of the visual indicators to emphasize corresponding ones of the operator-selectable inputs based on the state of the material testing system. In some examples, the one or more processors are configured to transition the state from one of the restricted states to one of the unrestricted states in response to a predefined input to the operator interface. In some examples, the operator interface includes a state indicator configured to output an indication of a present state of the material testing system.

In disclosed examples, a material testing system includes a rotatable actuator configured to control an operator-accessible torsional testing component of the material testing system, a virtual interlock configured to engage or disengage with the actuator to prevent or allow rotational movement of the actuator, and control circuitry. The control circuitry is configured to control the actuator to perform a material testing process, monitor a plurality of inputs associated with operation of the material testing system, identify an operational state of the material testing system from a plurality of predetermined operational states based on the plurality of inputs and the material testing process, the plurality of predetermined operational states comprising one or more of a disabled state, a setup state, a caution state, or a testing state, and control the virtual interlock based on the identified state.

In some examples, the virtual interlock is configured to prevent one or more of power or control signals from activating rotational movement of the actuator.

In some examples, the control circuitry is further configured to identify activation of a non-rotational testing process and engage the brake to lock the actuator from rotational movement in response. In examples, wherein the non-rotational testing process comprises an axial testing process. In examples, the non-rotational testing operates under a plurality of predetermined operational states comprising one or more of a disabled state, a setup state, a caution state, or a testing state.

In some examples, the operational state of the non-rotational testing process holds priority over the operational state of the torsional system. In some examples, when the non-rotational testing process is operating in the setup state, the control circuitry is configured to control the virtual interlock to engage to prevent powered rotational movement of the torsional system.

In examples, the control circuitry is further configured to control the virtual interlock to engage or disengage in response to a signal from one or more sensors. In some examples, engagement of the virtual interlock corresponds to a restricted mode, such that the disabled state, the caution state, and the setup state correspond to the restricted mode preventing operation of the actuator. In examples, the restriction mode corresponds to application of restrictions on the actuator while the control circuitry does not control the actuator in response to operator inputs. In examples, the testing state corresponds to an unrestricted mode allowing operation of the actuator, the testing state corresponds to a reduction in restrictions on the actuator operation while controlling the actuator to perform a torsional material testing process or a jog or a return.

In some examples, the restrictions include one or more of limiting a rotational speed of the actuator, limiting a number of revolutions of the actuator, or limiting an angle of rotation of the actuator. In examples, the limiting is limited to a particular threshold or limited to zero movement. In some examples, the virtual interlock is engaged and the brake is disengaged and the actuator is configured to allow the operator to manually position the actuator in the setup state.

In examples, the control circuitry includes a control processor configured to perform the control of the actuator, and one or more safety processors configured to perform the monitoring of the plurality of inputs, the identifying the state of the material testing system, and the controlling of the virtual interlock.

In some disclosed examples, a material testing system includes a rotatable actuator configured to control an operator-accessible torsional testing component of the material testing system, a brake to prevent rotational movement of the rotatable actuator, a virtual interlock configured to engage or disengage with the actuator to prevent or allow rotational movement of the actuator, and control circuitry. The control circuitry is configured to control the actuator to perform a material testing process, monitor a plurality of inputs associated with operation of the material testing system, identify an operational state of the material testing system from a plurality of predetermined operational states based on the plurality of inputs and the material testing process, the plurality of predetermined operational states comprising one or more of a disabled state, a setup state, a caution state, or a testing state, and control the virtual interlock based on the identified state.

In some examples, the brake is configured to physically lock the actuator from free rotational movement. In examples, the brake is configured for manual engagement or disengagement. In examples, the control circuitry is further configured to identify activation of a non-rotational testing process and engage the brake or the virtual interlock to lock the actuator from free rotational movement in response.

In some examples, the non-rotational testing process comprises an axial testing process.

As used herein, a "crosshead" refers to a component of a material testing system that applies directional (axial) and/or rotational force to a specimen. A material testing system may have one or more crossheads, and the crosshead(s) may be located in any appropriate position and/or orientation in the material testing system.

<FIG> is an example material testing system <NUM> to perform mechanical property testing. The example material testing system <NUM> may be, for example, a universal testing system capable of static mechanical testing. The material testing system <NUM> may perform, for example, compression strength testing, tension strength testing, shear strength testing, bend strength testing, deflection strength testing, tearing strength testing, peel strength testing (e.g., strength of an adhesive bond), torsional strength testing, and/or any other compressive and/or tensile testing. Additionally or alternatively, the material testing system <NUM> may perform dynamic testing.

The example material testing system <NUM> includes a test fixture <NUM> and a computing device <NUM> communicatively coupled to the test fixture <NUM>. The test fixture <NUM> applies loads to a material under test <NUM> and measures the mechanical properties of the test, such as displacement of the material under test <NUM> and/or force applied to the material under test <NUM>. While the example test fixture <NUM> is illustrated as a dual column fixture, other fixtures may be used, such as single-column test fixtures. The example test fixture <NUM> may include one or more of a rotary drive system <NUM> to rotate the material under test <NUM> to perform torsional material testing and/or a displacement strength testing system to apply a force to the material under test <NUM>.

The example computing device <NUM> may be used to configure the test fixture <NUM>, control the test fixture <NUM> and its components (e.g., testing systems <NUM> and/or <NUM>, as provided in <FIG>), and/or receive measurement data (e.g., transducer measurements such as force and displacement) and/or test results (e.g., peak force, break displacement, etc.) from the test fixture <NUM> for processing, display, reporting, and/or any other desired purposes. In some examples, an operator interface <NUM> is arranged on or near the material testing system <NUM>. The interface <NUM> may present information regarding an operating mode, testing process, material information, etc., as well as accept inputs and/or commands from an operator (alternatively or in addition to the example operator interface <NUM>).

<FIG> is a block diagram of an example implementation of the material testing system <NUM> of <FIG>. The example material testing system <NUM> of <FIG> includes the test fixture <NUM> and the computing device <NUM>. The example computing device <NUM> may be a general-purpose computer, a laptop computer, a tablet computer, a mobile device, a server, an all-in-one computer, and/or any other type of computing device.

The example computing device <NUM> of <FIG> includes a processor <NUM>. The example processor <NUM> may be any general-purpose central processing unit (CPU) from any manufacturer. In some other examples, the processor <NUM> may include one or more specialized processing units, such as RISC processors with an ARM core, graphic processing units, digital signal processors, and/or system-on-chips (SoC). The processor <NUM> executes machine readable instructions <NUM> that may be stored locally at the processor (e.g., in an included cache or SoC), in a random access memory <NUM> (or other volatile memory), in a read only memory <NUM> (or other non-volatile memory such as FLASH memory), and/or in a mass storage device <NUM>. The example mass storage device <NUM> may be a hard drive, a solid-state storage drive, a hybrid drive, a RAID array, and/or any other mass data storage device.

A bus <NUM> enables communications between the processor <NUM>, the RAM <NUM>, the ROM <NUM>, the mass storage device <NUM>, a network interface <NUM>, and/or an input/output interface <NUM>.

The example network interface <NUM> includes hardware, firmware, and/or software to connect the computing device <NUM> to a communications network <NUM> such as the Internet. For example, the network interface <NUM> may include IEEE <NUM>. X-compliant wireless and/or wired communications hardware for transmitting and/or receiving communications.

The example I/O interface <NUM> of <FIG> includes hardware, firmware, and/or software to connect one or more input/output devices <NUM> to the processor <NUM> for providing input to the processor <NUM> and/or providing output from the processor <NUM>. For example, the I/O interface <NUM> may include a graphics processing unit for interfacing with a display device, a universal serial bus port for interfacing with one or more USB-compliant devices, a FireWire, a field bus, and/or any other type of interface. The example material testing system <NUM> includes a display device <NUM> (e.g., an LCD screen) coupled to the I/O interface <NUM>. Other example I/O device(s) <NUM> may include a keyboard, a keypad, a mouse, a trackball, a pointing device, a microphone, an audio speaker, a display device, an optical media drive, a multi-touch touch screen, a gesture recognition interface, a magnetic media drive, and/or any other type of input and/or output device.

The example computing device <NUM> may access a non-transitory machine readable medium <NUM> via the I/O interface <NUM> and/or the I/O device(s) <NUM>. Examples of the machine readable medium <NUM> of <FIG> include optical discs (e.g., compact discs (CDs), digital versatile/video discs (DVDs), Blu-ray discs, etc.), magnetic media (e.g., floppy disks), portable storage media (e.g., portable flash drives, secure digital (SD) cards, etc.), and/or any other type of removable and/or installed machine readable media.

The example material testing system <NUM> of <FIG> further includes the test fixture <NUM> coupled to the computing device <NUM>. In the example of <FIG>, the test fixture <NUM> is coupled to the computing device via the I/O interface <NUM>, such as via a USB port, a Thunderbolt port, a FireWire (IEEE <NUM>) port, and/or any other type serial or parallel data port. In some other examples, the test fixture <NUM> is coupled to the network interface <NUM> and/or to the I/O interface <NUM> via a wired or wireless connection (e.g., Ethernet, Wi-Fi, etc.), either directly or via the network <NUM>.

The test fixture <NUM> of <FIG> includes a frame <NUM>, a load cell <NUM>, a displacement transducer <NUM>, a torsional material testing system <NUM> (e.g., including rotary drive system <NUM>), a cross-member loader <NUM>, material fixtures <NUM>, a control processor <NUM>, and a safety system <NUM>. The frame <NUM> provides rigid structural support for the other components of the test fixture <NUM> that perform the test. The load cell <NUM> measures force applied to a material under test by the cross-member loader <NUM> via the grips <NUM>. The cross-member loader <NUM> applies force to the material under test, while the material fixtures <NUM> (also referred to as grips) grasp or otherwise couple the material under test to the cross-member loader <NUM>. The example cross-member loader <NUM> includes a motor <NUM> (or other actuator) and a crosshead <NUM>. The crosshead <NUM> couples the material fixtures <NUM> to the frame <NUM>, and the motor <NUM> causes the crosshead to move with respect to the frame to position the material fixtures <NUM> and/or to apply force to the material under test.

In some examples, a torsional testing system <NUM> is additionally or alternatively included. The torsional testing system <NUM> includes a rotational motor <NUM> (or other actuator) and is configured to rotate the grips <NUM>, causing the crosshead to rotate with respect to the frame <NUM> to position the material fixtures <NUM> and/or to apply force to the material under test. The rotational motor <NUM> and/or other components of the torsional testing system <NUM> may be manually configured, controlled via manual input, and/or automatically controlled by the control processor <NUM>. The crosshead <NUM> and the grips <NUM> are operator-accessible components. Example actuators that may be used to provide force and/or motion of a component of the material testing system <NUM> include electric motors, pneumatic actuators, hydraulic actuators, piezoelectric actuators, relays, and/or switches.

Example grips <NUM> include compression platens, jaws, or other types of fixtures, depending on the mechanical property being tested and/or the material under test. The grips <NUM> may be manually configured, controlled via manual input, and/or automatically controlled by the control processor <NUM>. The crosshead <NUM> and the grips <NUM> are operator-accessible components.

The example control processor <NUM> communicates with the computing device <NUM> to, for example, receive test parameters from the computing device <NUM> and/or report measurements and/or other results to the computing device <NUM>. For example, the control processor <NUM> may include one or more communication or I/O interfaces to enable communication with the computing device <NUM>. The control processor <NUM> may control the torsional testing system <NUM> to increase or decrease an applied rotational force, rotational speed of the actuator, number of revolutions, and/or an angle of rotation from the rotational motor <NUM>. In some examples, the control processor <NUM> controls the cross-member loader <NUM> to increase or decrease applied force, control the fixture(s) <NUM> to grasp or release a material under test, and/or receive measurements from the displacement transducer <NUM>, the load cell <NUM> and/or other transducers.

The example safety system <NUM> provides an additional layer of monitoring and control to the test fixture <NUM>. The safety system <NUM> monitors operator inputs and the state of the test fixture <NUM>. In the example of <FIG>, the safety system <NUM> restricts operation of the test fixture <NUM> by the user so that the test fixture <NUM> is only controllable by the user when the machine is in an appropriate state. In response to detecting one or more conditions, the safety system <NUM> will automatically cause the test fixture <NUM> to go to a restricted state (e.g., a restricted setup state, disable all power and motion that could present a hazardous condition, etc.).

The safety system <NUM> selectively adds, removes, increases, and/or decreases restrictions on operation of the material testing system based on monitoring input signals from the material testing system <NUM>, input signals from the safety system <NUM>, and/or control signals from the control processor <NUM>. The safety system <NUM> controls operation of the material testing system <NUM> by determining a state, from multiple predetermined states, in which the material testing system <NUM> is to be operated at any given time. Example predetermined states include one or more restricted states, in which one or more operations of the material testing system <NUM> are restricted (e.g., disabled, limited, etc.) and one or more unrestricted states, in which the restrictions of the restricted states are reduced and/or removed. In the example of <FIG>, the safety processor <NUM> attaches to and/or interrupts the control of the torsional testing system <NUM> and/or the fixture(s) <NUM> by the control processor <NUM>. In some other examples, the safety system <NUM> may directly control the torsional testing system <NUM> and/or the cross-member loader <NUM> and/or the fixture(s) <NUM> while enforcing any applicable restrictions on the actuators.

Example restricted states include a setup state, caution state and a disabled state. In the setup state, the safety system <NUM> restricts one or more actuators (e.g., the motor <NUM> and/or the grip actuator(s) <NUM>), and controls (or permits control of) the actuators in response to operator inputs. Example restrictions on the motor <NUM> includes an upper rotational speed limit of the actuator, limiting a number of revolutions of the actuator, and/or limiting an angle of rotation of the actuator relative to the test fixture <NUM>. In the disabled state, the safety system <NUM> restricts the actuators and the control processor <NUM> does not control the actuator in response to operator inputs (e.g., does not attempt to control the motor <NUM>, or is prevented from controlling the motor <NUM> via de-energization).

Example unrestricted states include a testing state. In the example testing state, the safety system <NUM> reduces restrictions on the actuator (e.g., motor <NUM>), while the control processor <NUM> controls the actuator(s) to perform testing (e.g., in accordance with a material testing procedure or program executed by the control processor <NUM>). In the testing state, the control processor <NUM> may control the actuator(s) to perform actions such as jogging of the rotational motor <NUM>, for which the operator should not be physically proximate the crosshead <NUM> and/or the pneumatic grips <NUM>.

The example material testing system <NUM> of <FIG> may further include one or more control panels <NUM>, including multiple state indicators <NUM> and one or more mode switches <NUM>. The mode switches <NUM> may include buttons, switches, and/or other input devices located on an operator control panel. For example, the mode switches <NUM> may include buttons that control the motor <NUM> to jog (e.g., change rotational position) of the material under test via the grips <NUM>, a mode control button that is depressed in conjunction with another button to enable the safety system <NUM> to permit operation in an unrestricted state, and/or any other input devices that could result in operation in an unrestricted state.

The state indicators <NUM> correspond to a set of predetermined states (e.g., the disabled, setup, caution, and testing states described above) to which the safety system <NUM> can set the material testing system <NUM>. As described in more detail below, the safety system <NUM> controls the state indicators <NUM> to provide an indication as to the present state of the material testing system <NUM> as determined by the safety system <NUM>. The state indicators <NUM> may include lights, displays, audio, mechanical systems, and/or any other indication that can be identified by the operator.

<FIG> is a block diagram of an example implementation of the safety system <NUM> of <FIG>. As illustrated in <FIG>, the safety system <NUM> includes a safety processor <NUM>.

The example safety processor <NUM> includes multiple, redundant processing cores 304a, 304b. The processing cores 304a, 304b execute redundant instructions 306a, 306b and receive redundant inputs, such that the processing cores 304a, 304b should, during normal operation of the test fixture <NUM>, produce substantially identical outputs. The safety processor <NUM> (e.g., via the redundant cores 304a, 304b) monitors the plurality of inputs and determines the state of the material testing system <NUM> based on the inputs. The safety processor <NUM> may compare outputs of the redundant instructions 306a 306b and control the state of the material testing system <NUM> based on the comparison of the outputs.

The example safety processor <NUM> and/or the redundant processing cores 304a, 304b may be include general purpose central processing unit (CPU) from any manufacturer. In some examples, the safety processor <NUM> and/or the redundant processing cores 304a, 304b may include one or more specialized processing units, such as RISC processors with an ARM core, graphic processing units, digital signal processors, and/or system-on-chips (SoC). The safety processor <NUM> and/or the redundant processing cores 304a, 304b execute machine readable instructions, such as the redundant instructions 306a, 306b that may be stored locally at the processor (e.g., in an included cache or SoC), in a storage device such as a random access memory, a read only memory, and/or a mass storage device.

The redundant processing cores 304a, 304b and the redundant instructions 306a, 306b allow redundant and/or diverse inputs and outputs to be processed by the safety system <NUM>, which provides a highly reliable and predictable system. Thus, while representative inputs and outputs are illustrated in <FIG>, these inputs and/or outputs may be duplicated to support the redundant processing cores 304a, 304b and the redundant instructions 306a, 306b. The redundant instructions 306a, 306b (e.g., embedded software, operating system, and generated code) execute by the safety processor <NUM> is compliant with the processes outlined in international standards, including but not limited to ISO <NUM>-<NUM>, which pertains to "Safety Related Parts of Control Systems. " While the example safety processor <NUM> includes multiple, redundant processing cores, in other examples the safety processor <NUM> may include a single processing core, or multiple, non-redundant processing cores.

The safety system <NUM> of <FIG> further includes an actuator disabling circuit <NUM> (e.g., a virtual interlock) that selectively disables operation of the torsional testing system <NUM>. For example, engagement of the actuator disabling circuit <NUM> may disable a power amplifier <NUM> from providing energy to the motor <NUM> of the torsional testing system <NUM>. Additionally or alternatively, the actuator disabling circuit <NUM> (or another actuator disabling circuit) may disable the grip actuator(s) <NUM> from providing energy to the pneumatic grip(s) <NUM>. The power amplifier <NUM> receives input power and outputs power to the motor <NUM> to control movement of the motor <NUM>. The example actuator disabling circuit <NUM> and the power amplifier <NUM> may be implemented using a safety rated Safe Torque Off (STO) high-reliability servo power amplifier. The control processor <NUM> may control the motor <NUM> and rotational movement of the crosshead <NUM> via a motor control signal <NUM> to the power amplifier <NUM>.

In response to an STO signal <NUM> from the safety processor <NUM>, the actuator disabling circuit <NUM> disables the connected actuator (e.g., the rotational motor <NUM>). For example, the actuator disabling circuit <NUM> may disconnect all energy to the motor <NUM> (and/or other moving parts in the material testing system <NUM>), in less than a certain predefined period of time. The example actuator disabling circuit <NUM> may provide an STO feedback signal <NUM> to the safety processor <NUM>, which indicates whether the actuator disabling circuit <NUM> is currently disabling the actuator. The safety processor <NUM> may compare the STO signal <NUM> to the STO feedback signal <NUM> to detect faults.

In the example material testing system <NUM>, movement of the rotational motor <NUM> and any internal components is stopped after activation of the STO signal <NUM> as specified by international standards. Most of the subsystems of the safety system <NUM> disclosed herein activate the actuator disabling circuit <NUM> to safely stop rotational movement of the material fixturing system <NUM> and/or the material under test. Additionally, the power amplifier <NUM> may include a motor braking circuit <NUM> to decelerate the motor <NUM> before applying the STO signal <NUM>. The motor braking circuit <NUM> allows the motor <NUM> to stop in a more controlled manner by eliminating continued movement by mechanical inertia after shutting down drive power. Using pre-disabling braking reduces or minimizes the motion of the crosshead <NUM> after the motor <NUM> is de-energized. Thus, the example actuator disabling circuit <NUM> and the motor braking circuit <NUM> provide a Category <NUM> stop as defined in the IEC <NUM>-<NUM> standard, which is the "Electrical Safety Standard for Machinery.

The example safety processor <NUM> monitors the motor <NUM> and/or the motor braking circuit <NUM> while pre-disabling braking is occurring to confirm that the motor <NUM> is braking. If the safety processor <NUM> determines that the motor <NUM> is not slowing down during the braking, then the safety processor <NUM> performs a braking failure mitigation to cease the braking and immediately de-energize the motor <NUM>. By implementing braking failure mitigation to the two-stage disabling sequence, the safety processor <NUM> may shorten stopping distance in situations in which the braking is ineffective. While the shortest stopping distance occurs when the pre-disabling braking is operative, when the pre-disabling braking is not completely operative, then a two-stage sequence involving an inoperative pre-disabling braking can have a longer stopping distance than a single-stage sequence (e.g., only disconnection). A secondary advantage of braking failure mitigation is that the mitigation enables more flexibility in implementing the two-stage disabling sequence, in that a wider range of components and systems can be used for high-performance braking with a braking failure mitigation process that can catch failures with the braking system.

The example safety system <NUM> further includes an emergency stop <NUM> (e.g., a button, a switch, etc.) that provides an emergency stop input signal <NUM> to the safety processor <NUM>. The emergency stop <NUM> may be a manually operated emergency stop button, which is a complementary-type safety function. The emergency stop <NUM> includes two channel redundancy for signaling. The emergency stop <NUM> may include an emergency stop switch <NUM>, emergency stop detection circuits <NUM>, and an actuator disabling circuit <NUM>. The emergency stop <NUM> is independently controllable using the hardware and embedded software of the safety processor <NUM>. For example, in response to detecting the emergency stop input signal <NUM> from the emergency stop detector <NUM>, the safety processor <NUM> sets the state of the material testing system <NUM> to the disable state and provides an emergency stop output signal <NUM> to the emergency stop <NUM> (e.g., to the emergency stop switch <NUM>).

The emergency stop switch <NUM>, in response to the emergency stop output signal <NUM>, controls the actuator disabling circuit <NUM> to control the actuator disabling circuit <NUM> and/or the motor braking circuit <NUM> to stop the motor <NUM> (e.g., via motor break <NUM>). The example actuator disabling circuit <NUM> may have a first connection to the motor braking circuit <NUM>, and second redundant connections to the actuator disabling circuit <NUM>. When the actuator disabling circuit <NUM> is triggered, the actuator disabling circuit <NUM> activates the motor braking circuit <NUM>, delays for a time to permit the braking to occur, and then activates the actuator disabling circuit <NUM> to de-energize the applicable actuator.

In addition or as an alternative to control via the safety processor <NUM>, the emergency stop switch <NUM> may directly actuate the actuator disabling circuit <NUM> within the power amplifier <NUM>, such as by physical interruption of the STO signal <NUM> between the safety processor <NUM> and the actuator disabling circuit <NUM>. The safety processor <NUM> monitors the emergency stop detection circuits <NUM> and acts as a redundant monitor to the hardware. The safety processor <NUM> outputs the STO signal <NUM> to control the actuator disabling circuit <NUM> to continue to disable the motor <NUM> so that, when the emergency stop switch <NUM> is released, the material testing system <NUM> will remain disabled (e.g., in a restricted state) and require user interaction to re-enable operation of the motor <NUM>.

The example material testing system <NUM> (e.g., the test fixture <NUM>) is compatible with interlock guarding systems with redundant or diverse contacts. The example safety system <NUM> may include one or more guards <NUM> and guard interlocks <NUM> configured to provide physical and/or virtual barriers to operator access to the material testing system <NUM> while operating in an unrestricted state. For example, the guards <NUM> may include physical barriers that are opened and closed to control access to the volume around the pneumatic grips <NUM> and/or the crosshead <NUM> (and/or other moving components). In some examples, the guard <NUM> includes a motor brake <NUM>, which is configured for manual and/or automatic engagement. For instance, the motor brake <NUM> may be engaged by an operator and/or the safety system <NUM> to physically prevent rotation of the motor <NUM>. Example physical barriers include guard doors, which may use redundant safety switches to monitor whether the doors guarding the protected volume are open or closed. Each door switch has mechanically linked normally open and normally closed contacts, which may be dynamically pulsed (e.g., by the guard interlocks <NUM>) and/or otherwise received as inputs. Pulsing permits plausibility diagnostic checking of the guard door switches in real time.

Additionally or alternatively, the guards <NUM> may include virtual guards that monitor the volume around the pneumatic grips <NUM> and/or the crosshead <NUM> for intrusion into the volume. Example virtual guards may include light curtains, proximity sensors, and/or pressure pads. While virtual guarding does not physically prevent access, the virtual guarding outputs guarding signals to the guard interlocks <NUM>, which output interlock signals <NUM> to the safety processor <NUM> and/or actuator disabling circuit <NUM> (e.g., similar to the emergency stop switch <NUM> discussed above).

The interlocks <NUM> may trigger the actuator disabling circuit <NUM> to de-energize the motor <NUM>. In some examples, the safety processor <NUM> controls re-enabling of the power amplifier <NUM> when the guard interlocks <NUM> are no longer triggered, in a similar manner as the emergency stop switch <NUM> discussed above.

Additionally or alternatively, the example safety system <NUM> may default to a restricted "setup" state when an operator enters the protected volume of the material testing system <NUM>, thereby disabling or de-energizing actuators of the system <NUM>.

The example safety system <NUM> includes multiple state indicators <NUM> and mode switches <NUM>. The example safety processor <NUM> monitors the mode switches <NUM> by, for example, dynamically pulsing the mode switches <NUM> to generate or obtain mode switch input signals <NUM> (e.g., one or more mode switch inputs for each of the mode switches <NUM>). In some examples, the mode switches <NUM> are high-reliability switches. The safety processor <NUM> may test the mode switches <NUM> for short circuits or other faulty conditions periodically, aperiodically, in response to events (e.g., at startup of the material testing machine), on a predetermined schedule, and/or at any other times.

The example safety processor <NUM> controls the state indicators <NUM> to indicate the state of the material testing system <NUM> to the operator. For example, the safety processor <NUM> may output indicator signals <NUM> to the state indicators <NUM>. If the state indicators <NUM> are lights, the output indicator signals <NUM> may, for example, control each of the lights to be on, off, flashing, and/or any other output for the lights. In some examples, the safety processor <NUM> determines the conditions of the indicators via indicator feedback signals <NUM>. Example indicator feedback signals <NUM> may indicate to the safety processor <NUM> whether each of the state indicators <NUM> is on, off, short-circuited, open-circuited, and/or any other status or condition of the state indicators <NUM>. If the processor determines that one or more of the state indicators <NUM> are not in the commanded proper state, the safety processor <NUM> controls the material testing system to be in a restricted state provides a notification to the operator (e.g., via the control panel <NUM> or other notification).

The safety system <NUM> includes a power supply monitor <NUM> to monitor the power supplies (e.g., DC and AC power supplies) that provide power to components of the material testing system <NUM>. The power supply monitor <NUM> provides one or more power supply status signals <NUM> to the safety processor <NUM> and/or to the watchdog circuit <NUM> (described below) to indicate whether the monitored power supplies are within respective voltage and/or current ranges. If the power supply monitor <NUM> determines that one or more of the power supplies are out of tolerance, the safety processor <NUM> and/or to the watchdog circuit <NUM> may disable the material testing system <NUM> and alert the operator.

The example safety system <NUM> further includes one or more speed sensor(s) <NUM>. The example speed sensor(s) <NUM> may be integrated, redundant, and/or diverse speed monitoring sensors. The speed sensor(s) <NUM> provide speed signal(s) <NUM>, which are representative of the crosshead speed, to the safety processor <NUM>. The safety processor <NUM> monitors the speed signal(s) <NUM> to ensure the motor <NUM> does not exceed an upper speed limit (e.g., motor speed limit(s) <NUM>) as determined by the current operating mode of the machine. For example, the value of the upper speed limit may depend on whether the material testing system <NUM> is in a restricted state or an unrestricted state. In some examples, two speed sensors that operate on different principles may be used in the material testing system <NUM> to prevent the sensors <NUM> from sustaining common cause failures. The speed signal <NUM> of each speed sensor <NUM> is read and compared by the safety processor <NUM> to verify that the speed signals <NUM> are in agreement. If one speed sensor <NUM> indicates a different speed than another speed sensor <NUM>, the safety processor <NUM> disables the material testing system <NUM> (e.g., via the actuator disabling circuit <NUM>).

The example motor movement limit(s) <NUM> may include a speed and/or rotational limit that specifies a limit on the rotational speed or angle of the motor <NUM>. When the motor movement limit(s) <NUM> is reached, the safety processor <NUM> stops the motion of the motor <NUM>. In some examples, the motor movement limit(s) <NUM> are multi-level limits, where the number of limits that are triggered indicate how far the motor movement limit(s) <NUM> have been exceeded. In some examples, a first level limit is handled by the safety processor <NUM> to stop operation of the applicable actuator (or all actuators), such as the motor <NUM>. As the motor <NUM> continues to move beyond the first level limit and hits a second level limit (e.g., farther outside of the acceptable range than the first level limit), the motor movement limit <NUM> may trigger a direct connection (e.g., a hardware connection) to the actuator disabling circuit <NUM> and/or the motor braking circuity <NUM>, and/or to the actuator disabling circuit <NUM>, to trigger the two phase disabling of the motor <NUM>.

When the safety processor <NUM> is controlling the material testing system <NUM> in a restrictive state (e.g., during the disable, caution, or setup state), the safety processor <NUM> disables the motor <NUM>. Conversely, when the safety processor <NUM> is controlling the material testing system <NUM> in the testing state, the safety processor <NUM> provides a control signal <NUM> to cause the motor controller <NUM> to enable the motor <NUM> to rotate test specimens during testing. The example motor controller <NUM> may monitor the torsional testing system <NUM> (e.g., via rotation sensor(s) <NUM>) to ensure the motor <NUM> operates within the predetermined restrictions and/or desired operating parameters. The motor controller <NUM> feeds the rotational signals <NUM> to the safety processor <NUM> to verify that the commanded speeds, force, angles, etc., are being enforced.

In some examples, the motor controller <NUM> is controlled via an operator input using a foot pedal switch. For example, the foot pedal switch may include separate switches to activate rotation and to deactivate rotation of the motor <NUM>. The switches may be mechanically linked switches, which may be dynamically pulsed to check for plausibility between the switches and/or to monitor for potential faults in the switches (e.g., electrical faults).

The safety processor <NUM> further controls the motor controller <NUM> to de-energize the motor <NUM> when power is disabled to the material testing system <NUM>. For example, the safety processor <NUM> may control the motor <NUM> (e.g., via one or more programs, circuits, etc.) to enable activation when powered, but to be normally deactivate the actuators such that the motor <NUM> is prevented from rotating when the material testing system <NUM> is unpowered.

The example safety system <NUM> further includes a watchdog circuit <NUM>. The watchdog circuit <NUM> communicates with the safety processor <NUM> periodically, aperiodically, in response to one or more events or triggers, and/or at any other time to verify the operation of the safety processor <NUM>. For example, the safety processor <NUM> may communicate a heartbeat signal, or a response to a challenge from the watchdog circuit <NUM>, to indicate to the watchdog circuit <NUM> that the safety system <NUM> is operating properly. If the watchdog circuit <NUM> does not receive an expected signal from the safety processor <NUM>, the watchdog circuit <NUM> disables the material testing system <NUM> and notifies the operator.

The example safety processor <NUM>, the example emergency stop <NUM>, the example guard interlock <NUM>, the example motor speed limit(s) <NUM>, and/or the example watchdog circuit <NUM> are coupled (e.g., connected via hardware) to the actuator disabling circuit <NUM>. When any of the safety processor <NUM>, the emergency stop <NUM>, the guard interlock <NUM>, the crosshead travel limit(s) <NUM>, and/or the watchdog circuit <NUM> determine that a respective condition is satisfied so as to disable the material testing system <NUM> (e.g., activation of the emergency stop switch <NUM>, tripping of the guard <NUM>, exceeding a rotational movement limit <NUM>, and/or triggering of the watchdog circuit <NUM>), the actuator disabling circuit <NUM> is used to activate the motor braking circuit <NUM> and the actuator disabling circuit <NUM>. The safety processor <NUM> may determine that the state of the material testing system <NUM> is the disabled state.

While the example control processor <NUM> and the safety processor <NUM> are illustrated as separate processors, in other examples the control processor <NUM> and the safety processor <NUM> may be combined into a single processor or set of processors that are not divided into control and safety functions. Furthermore, the control processor <NUM>, the safety processor <NUM>, and/or combined processors may include non-processing circuitry, such as analog and/or digital circuitry to perform one or more specialized functions.

<FIG> and <FIG> show a flowchart representative of example machine readable instructions <NUM> which may be executed by the safety processor <NUM> of <FIG> to control states of the torsional material testing system of <FIG>. The example instructions <NUM> may be executed to determine a state of the material testing system from a plurality of predetermined states, enforce restrictions on the actuator (e.g., motor <NUM>), and automatically set the state of the torsional material testing system to the restricted state (and/or one of the restricted state subgroups) in response to completion of an action involving controlling the actuator.

At block <NUM>, the material testing system <NUM> and/or one or more subsystems may be powered on. If the material testing system <NUM> is not powered on, block <NUM> iterates until the material testing system <NUM> is turned on. When the material testing system <NUM> is powered on (block <NUM>), at block <NUM> the safety system <NUM> sets the state of the material testing system <NUM> to a disabled state and disables one or more actuator(s) (e.g., the rotational motor <NUM>, the grip actuator(s) <NUM>). For example, the safety system <NUM> may default the actuator disabling circuit <NUM> to de-energizing the motor <NUM>.

At block <NUM>, the safety processor <NUM> is initialized. For example, the safety processor <NUM> may perform fault checks (e.g., checking inputs, outputs, and/or attached devices for open circuits and/or closed circuits), redundancy checks (e.g., determining that redundant inputs and/or redundant outputs are in agreement), and/or other initialization processes.

At block <NUM>, the safety processor <NUM> determines whether any faults are detected in the safety system <NUM> (e.g., detected during the initialization process). If faults are detected (block <NUM>), the safety processor <NUM> outputs a fault alert (e.g., via the control panel <NUM>, via the computing device <NUM>, etc.). The example instructions <NUM> may then end.

When faults are not detected (block <NUM>), at block <NUM> the safety processor <NUM> determines whether an operator input has been received to transition the material testing system <NUM> from the disabled state to a setup state. For example, the safety processor <NUM> may require one or more specified inputs (e.g., pressing an unlock button) to transition from the disabled state. If the operator input has not been received (block <NUM>), block <NUM> iterates while the material testing system <NUM> remains in the disabled mode to await the operator input.

When the operator input is received (block <NUM>), at block <NUM> the safety processor <NUM> sets the state of the material testing system <NUM> to a setup state. In accordance with setting the setup state, the safety processor <NUM> enables the actuator(s) (e.g., the motor <NUM>), restricts the actuator(s), and indicates the state as disabled (which may include one or more subgroups, such as a setup or caution state, indicated, e.g., via the state indicators <NUM>). In some examples, the safety processor <NUM> controls one or more visual indicators on the control panel <NUM> to selectively emphasize corresponding ones of the operator selectable inputs (e.g., mode switches <NUM>) based on the state of the material testing system <NUM> being the disabled or restricted state. For example, the safety processor <NUM> may control the visual indicators to emphasize the inputs that may be used by the operator in a setup mode (e.g., manual rotation of the rotational drive system <NUM>) and deemphasize the inputs that may not be used in the setup mode (e.g., jogging function).

At block <NUM>, the safety processor <NUM> monitors input signals of the safety system <NUM> (e.g., sensor signals <NUM>, <NUM>, <NUM>, <NUM>, <NUM>), feedback signals (e.g., feedback signals <NUM>, <NUM>, <NUM>), and/or control signals (e.g., signals from the control processor <NUM>). The safety processor <NUM> may monitor the signals to, for example, identify operator commands and/or conditions that would cause the safety processor <NUM> to recognize a change in the state of the torsional material testing system <NUM>.

At block <NUM>, the safety processor <NUM> and/or the control processor <NUM> determine whether an operator control signal has been received to actuate the actuator(s) with restrictions (e.g., at a low speed or pressure), thereby entering into an unrestricted (or lower restriction) state (e.g., the testing state) but without performing a testing process. For example, the operator may select one or more mode switches <NUM> to rotate the crosshead <NUM> at a low jogging speed via the motor <NUM>. If an operator control signal has been received to actuate an actuator (block <NUM>), at block <NUM> the control processor <NUM> controls the actuator in accordance with restrictions (e.g., speed restrictions, force restrictions, operator clearance restrictions) applied by the safety processor <NUM>.

At block <NUM>, the safety processor <NUM> outputs an indication of the controlled actuation. For example, the safety processor <NUM> may control one or more of the state indicators <NUM> to flash, cause the computing device <NUM> to output an indication of the actuation, and/or provide any other indication(s).

At block <NUM>, the safety processor <NUM> monitors the input signals of the safety system <NUM> (e.g., sensor signals <NUM>, <NUM>, <NUM>, <NUM>, <NUM>), feedback signals (e.g., feedback signals <NUM>, <NUM>, <NUM>), and/or control signals (e.g., signals from the control processor <NUM>). At block <NUM>, the safety processor <NUM> determines whether the actuation has ended. For example, the safety processor <NUM> may pulse the mode switches <NUM> to determine whether one or more of the operator controls signals has changed, and/or monitor input signals and feedback signals to identify triggering of guards and/or interlocks, faults, and/or any other event that would cause an interruption of the actuation. If the actuation has not ended (block <NUM>), control returns to block <NUM> to continue to control the actuator. When the actuation has ended (block <NUM>), the safety processor <NUM> returns control to block <NUM>.

Turning to <FIG>, if an operator control signal has not been received to actuate the actuator(s) (block <NUM>), at block <NUM> the safety processor <NUM> and/or the control processor <NUM> determine whether an operator control signal has been received to actuate the actuator(s) with reduced restrictions (e.g., to perform a testing process at a high speed or pressure). For example, operator inputs may be received to enter into the testing state and performing a test. If an operator control signal has not been received to actuate the actuator(s) with reduced restrictions (block <NUM>), control returns to block <NUM>.

If an operator control signal has been received to actuate the actuator(s) with reduced restrictions (block <NUM>), at block <NUM> the safety processor <NUM> sets the state of the material testing system <NUM> to the testing state, the grip actuator(s) <NUM>, and reduces the actuator restriction(s). In some examples, the safety processor <NUM> enables the motor <NUM> and/or the grip actuator(s) <NUM> to be controlled by the control processor <NUM> in the testing state. The example safety processor <NUM> further controls the state indicators <NUM> to indicate that the material testing system <NUM> is in the testing state.

At block <NUM> the safety processor <NUM> and/or the control processor <NUM> determine whether an operator control signal has been received to initiate performance of a torsional material test (e.g., with reduced restrictions) and/or another action with reduced restrictions (e.g., high speed jogging of the crosshead <NUM>). For example, operator inputs and/or inputs from the computing device <NUM> may be received to perform a programmed material test involving high rotational forces.

If an operator control signal has been received to perform a torsional strength material test and/or another action (block <NUM>), at block <NUM> the safety processor <NUM> sets the state of the material testing system <NUM> to the testing state, and enables the actuator(s) (e.g., the motor <NUM>, the grip actuator(s) <NUM>). The example safety processor <NUM> further controls the state indicators <NUM> to indicate that the material testing system <NUM> is in the testing state.

At block <NUM> the control processor <NUM> controls the actuator to perform the programmed test and/or another action (e.g., with reduced and/or eliminated restrictions). At block <NUM>, the safety processor <NUM> outputs an indication of the ongoing material testing. For example, the safety processor <NUM> may control one or more of the state indicators <NUM> to flash, cause the computing device <NUM> to output an indication of the unrestricted actuation, and/or provide any other indication(s).

At block <NUM>, the safety processor <NUM> monitors the input signals of the safety system <NUM> (e.g., sensor signals <NUM>, <NUM>, <NUM>, <NUM>, <NUM>), feedback signals (e.g., feedback signals <NUM>, <NUM>, <NUM>), and/or control signals (e.g., signals from the control processor <NUM>). At block <NUM>, the safety processor <NUM> determines whether the torsional strength material test and/or other action has ended. For example, the safety processor <NUM> may pulse the mode switches <NUM> to determine whether one or more of the operator controls signals has changed, and/or monitor input signals and feedback signals to identify triggering of guards and/or interlocks, faults, and/or any other event that would cause an interruption of the actuation. If the actuation has not ended (block <NUM>), control returns to block <NUM> to continue to perform the material test and/or other action.

When the actuation has ended (block <NUM>), the safety processor <NUM> automatically changes the state to a restricted state and returns control to block <NUM>.

<FIG> illustrates an example operator interface <NUM> that may be used to implement the control panel <NUM> of <FIG> and <FIG>. The operator interface <NUM> may be attached to the example test fixture <NUM>, located proximate to the text fixture (such as the operator interface <NUM> of <FIG>), and/or located remotely from the test fixture <NUM>. For example, the operator interface <NUM> may be implemented as a built-in operator panel or switch on a base of the test fixture <NUM>.

The example operator interface <NUM> includes multiple input devices (e.g., buttons, switches, etc.) which provide inputs to the control processor <NUM> and/or to the safety system <NUM> of <FIG> and/or <NUM>. The example input devices include a state control button <NUM>, which controls the transition from a restricted state (e.g., the disabled state, the caution state, and/or setup state) to an unrestricted state (e.g., the testing state), and may be required to be used to perform actions involving the unrestricted states. The state control button <NUM> may be considered as an "unlock" button or safety input that enables use of the material testing system in unrestricted states.

Jog buttons <NUM>, <NUM> control the motor <NUM> to jog the crosshead <NUM> rotationally (e.g., up or down, left or right, and/or other directions based on relative orientation of the motor and crosshead). For example, the motor <NUM> may turn in a right-hand or left-hand rotational direction for rotational crosshead movement. When depressed individually, the jog buttons <NUM>, <NUM> control the crosshead <NUM> to move in the right-hand and left-hand rotational directions at a low speed (e.g., determined by the safety processor <NUM>). When a jog button <NUM>, <NUM> is depressed simultaneously with the state control button <NUM>, the safety processor <NUM> may reduce the speed restriction on the motor <NUM> and allow jogging of the crosshead <NUM> at higher speeds. The example jog buttons <NUM>, <NUM> may serve as directional inputs. In some examples, the operator interface <NUM> may control the torsional material testing system as well as non-rotational testing systems, such as axial testing systems, as disclosed herein.

As used herein, received "simultaneously" refers to both inputs being activated or depressed at any given time, not necessarily that both buttons have to be initially depressed at exactly the same moment.

A start button <NUM> controls the control processor <NUM> to initiate a material test. A return button <NUM> controls the control processor <NUM> to return the crosshead <NUM> to a predetermined rotational position, which may be accomplished at low speed or high speed. In some examples, the safety processor <NUM> requires that the start button <NUM> and/or the return button <NUM> be depressed in conjunction with the state control button <NUM>. A stop button <NUM> controls the control processor <NUM> to stop or pause a running test. An emergency stop switch <NUM> may be included to implement the emergency stop switch <NUM> of <FIG>.

The operator interface <NUM> further includes state indicators <NUM>-<NUM> to output an indication of a present state of the material testing system <NUM>. The example state indicators <NUM>-<NUM> are lights representative of each of the states of the material testing system <NUM> that may be determined by the safety processor <NUM>. In the example of <FIG>, the operator interface <NUM> includes a disabled state indicator <NUM>, a setup state indicator <NUM>, a caution state indicator <NUM>, and a testing state indicator <NUM>. Each of the state indicators <NUM>-<NUM> is lit when the safety processor <NUM> determines that the material testing system <NUM> is in the corresponding state, while the state indicators <NUM>-<NUM> not corresponding to the present state are unlit. Although shown as four individual indicators, the state indicators may be a single indicator (e.g., with one or more characteristics that changes in response to a change in state), or two indicators, one corresponding to a restrictive state and one corresponding to an unrestrictive state. In some examples, the state indicators represent the operating state of the material testing system <NUM> and all sub-systems (e.g., torsional and/or axial testing systems). In some examples, the state indicators represent the operating state of the torsional testing system or the axial testing systems. In some examples, two or more state indicators are presented, specific to a particular testing system.

<FIG> illustrates another example operator interface <NUM> that may be used to implement that control panel <NUM> of <FIG> and <FIG>. The example operator interface <NUM> may be a handset having a limited set of input devices (e.g., buttons, switches, etc.). The operator interface <NUM> may be attached to the example test fixture <NUM>, located proximate to the test fixture, and/or located remotely from the test fixture <NUM>. The operator interface <NUM> includes a state control button <NUM> (e.g., similar or identical to the state control button <NUM> of <FIG>), jog buttons <NUM>, <NUM> (e.g., similar or identical to the jog buttons <NUM>, <NUM>), a start button <NUM> (e.g., similar or identical to the start button <NUM>), and a return button <NUM> (e.g., similar or identical to the return button <NUM>).

The operator interfaces <NUM>, <NUM> may include custom buttons <NUM>, which may provide additional or alternative functions to the operator. In some examples, the additional or alternative functions are subject to the restrictions of one or more of the restricted states. In the example of <FIG>, custom button <NUM> is configured as a rotational jog button, whereas custom button <NUM> is a rotary return button, both to control the motor <NUM> of the torsional material testing system <NUM>.

<FIG> illustrates the example material testing system <NUM> of <FIG> and the operator interfaces of <FIG> during a startup routine of the material testing system <NUM>. The material testing system <NUM> is powered up and initializes in the disabled state, in which the disabled indicator <NUM> is illuminated (e.g., white) to indicate that the material testing system is in the disabled state. In some examples, only two indicators (restricted and unrestricted) are presented, such as when the interface is directed to control of the torsional testing system <NUM>. Additionally, a user interface <NUM> executing on the computing device <NUM>, <NUM> of <FIG> and <FIG> also includes a prominent action indicator <NUM> that the material testing system <NUM> is in the disabled state. The example operator interfaces <NUM> and <NUM> illuminate or emphasize only the buttons that provide a function when pressed. At the power up stage (e.g., in the disabled state), only the state control button <NUM> is functional. In addition to the power up event, the disabled state may occur when the emergency stop switch is triggered, when a guarding system is triggered, in response to a fault, and/or any other events to which the safety processor <NUM> responds by setting the state to the disabled state.

When the operator presses the state control button <NUM> button, the safety processor <NUM> changes the system to the setup state. <FIG> illustrates the example material testing system <NUM> of <FIG> and the operator interfaces <NUM>, <NUM> of <FIG> in the setup state of the material testing system <NUM>. After the safety processor <NUM> sets the state to the setup state, the safety processor <NUM> controls the setup indicator <NUM> to illuminate (e.g., blue or green) to indicate the setup state to the operator. Additionally, the user interface <NUM> includes a prominent indication <NUM> that the material testing system <NUM> is in the setup state (e.g., Ready to Setup). In the setup state, additional control buttons are emphasized or illuminated (e.g., Jog) to indicate that additional functions are now available. In some examples, a non-rotational testing system may be operating in the setup state (e.g., an axial testing system), while the torsional testing system <NUM> remains in a restricted state.

<FIG> the example material testing system <NUM> of <FIG> and the operator interfaces of <FIG> while jogging the crosshead <NUM> with reduced restrictions in the testing state (or, in some examples, the caution state). For example, in some applications, in order to eliminate motivation to attempt to bypass the safety system <NUM>, the safety processor <NUM> may reduce one or more restrictions in the testing state to allow for a rotational jog of the crosshead <NUM>. While the material testing system <NUM> is in the testing state illustrated in <FIG>, the operator may simultaneously press the state control button <NUM> and the jog button <NUM>. In response to the combination of the buttons <NUM> and <NUM>, the control processor <NUM> controls the motor <NUM> to rotate the crosshead <NUM>, and the safety processor <NUM> sets the state of the material testing system <NUM> to the testing state (or, in some examples, the caution state), and reduces the restrictions applied to the motor <NUM>. As a result, the motor <NUM> is permitted to rotate the crosshead in the commanded direction. The safety processor <NUM> will further control the testing indicator <NUM> (or, in some examples, the caution indicator <NUM>) to light and/or flash, and the user interface software includes a prominent hazard indicator <NUM> that the material testing system <NUM> is performing the jogging movement, which may include text, flashing the indication <NUM> and/or the testing indicator <NUM> (or, in some examples, the caution indicator <NUM>), and/or any other emphasis. In some examples, the hazard indicator <NUM> may continuously display active warning label warning of a specific potential hazard.

If the operator releases the state control button <NUM>, the jogging movement may continue with reduced restrictions in the testing state. When the operator releases the jog button <NUM>, the control processor <NUM> stops the jogging movement and the safety processor <NUM> automatically sets the state of the material testing system <NUM> to the setup state and restores the restrictions. In some other examples, when the operator releases either of the state control button <NUM> or the jog button <NUM>, the safety processor <NUM> automatically sets the state of the material testing system <NUM> to the setup state and restores the corresponding restrictions.

<FIG>, <FIG>, and <FIG> illustrates the example material testing system <NUM> of <FIG> and the operator interfaces <NUM>, <NUM> while progressing from the disabled and/or setup state to the testing state to initiate a material test. The example setup state illustrated in <FIG> may be similar or identical to the setup state illustrated in <FIG>, except that a specimen <NUM> is held in the grips <NUM>.

The operator may start the material test by first pressing the state control button <NUM> and then the start button <NUM>. The safety processor <NUM> controls the caution indicator <NUM> to illuminate in response to the press of the state control button <NUM> (<FIG>), and the user interface <NUM> displays an indication <NUM> of the testing and/or caution state (e.g., a yellow border and/or active warning overlay). In response to subsequent press of the start button <NUM>, the safety processor <NUM> then transitions to illuminating the testing indicator <NUM> (<FIG>) and the user interface <NUM> displays an indication <NUM> of the testing state (e.g., a red border and/or active warning overlay). The control processor <NUM> may then proceed to perform the configured test when the safety processor <NUM> sets the state to the testing state (e.g., an unrestricted drive mode). The overlay in the user interface <NUM> may be removed after a period of time, to enable the user to observe the ongoing test measurements on the user interface <NUM>. However, the safety processor <NUM> may continue to provide other visual, audible, and/or otherwise perceptible warnings during the testing (e.g., displaying or flashing the testing indicator <NUM>, displaying or flashing a red border as the indication <NUM> on the user interface <NUM>.

In some examples, the control processor <NUM> may be configured with a test method that pauses the test for operator interaction with the specimen <NUM>, such as removal of an extensometer. When the test reaches the point where the interaction is required, the control processor <NUM> pauses the test (e.g., ceases actuation by the motor <NUM>). When the pause point is reached, the safety processor <NUM> sets the material testing system <NUM> to the setup state and the user interface <NUM> displays an indication that the test is paused. Additionally or alternatively, the safety processor <NUM> may control the setup indicator <NUM> to visually indicate (e.g., light up, flash) to indicate the test is not complete but in the paused state.

The operator may then resume the test by simultaneously pressing the state control button <NUM> (e.g., unlock) and the start button <NUM>. The safety processor <NUM> and the control processor <NUM> may then resume the test using the same sequence of indicators as to start the test as described above. In some examples, when the state control button <NUM> is pressed, the user interface <NUM> displays an indication that the system is in the caution state and that a test is paused.

When the test has been completed, the safety processor <NUM> automatically sets the state to the setup state and applies the associated restrictions.

<FIG>, <FIG>, and <FIG> illustrates the example material testing system of <FIG> and the operator interfaces <NUM>, <NUM> of <FIG> while progressing from the setup state to the testing state to return the crosshead <NUM> to a desired position (e.g., radial and/or axial position). After a previous test ended, the material testing system <NUM> is set to the setup or disabled state, which is indicated by the illumination of the setup indicator <NUM>. The crosshead <NUM> may be positioned, for example, at the location at which the prior test finished. In the setup state, the operator is permitted to remove specimens and/or interact with the test fixture <NUM> and/or the operator interfaces <NUM>, <NUM>, with the restrictions applied by the safety processor <NUM>.

When the operator is ready to return the crosshead <NUM> to the desired position (e.g., to run another test), the operator may initiate the return by pressing the state control button <NUM> and the return button <NUM> (for rotational movement) and/or the return button <NUM> (for axial movement) simultaneously or sequentially. The safety processor <NUM> controls the caution indicator <NUM> to illuminate in response to the press of the state control button <NUM> (<FIG>), and the user interface <NUM> displays an indication <NUM> of the caution state (e.g., a yellow border and/or active warning overlay). In response to subsequent press of the return buttons <NUM> and/or <NUM>, the safety processor <NUM> then transitions to illuminating the testing indicator <NUM> (<FIG>) and the user interface <NUM> displays an indication <NUM> of the testing state (e.g., a red border and/or active warning overlay). The control processor <NUM> may then proceed to control the motor <NUM> to move the crosshead <NUM> with reduced or eliminated speed restrictions when the safety processor <NUM> sets the state to the testing state (e.g., an unrestricted drive mode).

After the crosshead <NUM> has reached the desired position (e.g., a test starting position), the safety processor <NUM> automatically sets the state to the setup state.

Although the material testing system <NUM> consistently (e.g., constantly) has the safety functions enabled and operating, some of the parameters used by the safety system <NUM> may be adjustable to provide desired interactions (e.g., slower jog speeds than a default jog speed). The example computing device <NUM> may enable an administrator or other authorized operators to control some parameters of the safety system <NUM>.

While the computing system <NUM> may provide an interface for configuration of the safety system parameters, the example computing system <NUM> does not participate in the enforcement of the parameters. To modify parameters of the safety system <NUM> from the default parameters, the authorized operator or administrator may be required to enable a software security system that authenticates the authorized operator attempting to make changes.

When the security system is enabled, the operator may modify parameters such as the jog rate, grip pressure, point of control (e.g., local or remote), interlock behavior (moveable guard), and/or whether to dismiss notifications when performing actions such as starting a material test. Before and/or after modification, the security system requires the input of valid authentication information to permit the modification of the settings to be committed to the safety system <NUM> for enforcement. The safety system <NUM> may be shut down to store configuration changes, resulting in the changing of the state of the material testing system <NUM> to the disabled state.

The security system for modification is a keyless system, which allows an administrator or other authorized operator to configure the safety system in a manner that is consistent with a particular risk assessment, and prevents a standard operator from overriding these settings. The keyless administrative function prevents accidental and/or purposeful misuses that can occur with conventional safety systems that use a key or selection control.

As used herein, the term "non-transitory machine-readable medium" is defined to include all types of machine-readable storage media and to exclude propagating signals.

Claim 1:
A material testing system (<NUM>), comprising:
a rotatable actuator configured to control an operator-accessible torsional testing component of the material testing system (<NUM>);
a virtual interlock configured to engage or disengage with the actuator to prevent or allow rotational movement of the actuator;
a brake (<NUM>) to prevent rotational movement of the rotatable actuator; and a control circuitry configured to:
control the actuator to perform a material testing process;
monitor a plurality of inputs associated with operation of the material testing system (<NUM>);
identify an operational state of the material testing system (<NUM>) from a plurality of predetermined operational states based on the plurality of inputs and the material testing process, the plurality of predetermined operational states comprising one or more of a disabled state, a setup state, a caution state, or a testing state; and
control the virtual interlock based on the identified state
wherein the control circuitry is further configured to identify activation of a non-rotational testing process and engage the brake (<NUM>) to lock the actuator from rotational movement in response.