Patent Application
20060087773
This application claims the benefit of European Patent Application No. 04023988.1 filed Oct. 8, 2004, and entitled “Configurable Modular Safety System.”
The invention relates to a modular safety system for safety control in emergency stop applications and, in particular, to industrial emergency stop applications.
Modular safety systems for safety control in emergency stop applications are, for example, used for the control of robot cells, wherein the access to the robot cell and the operation of said robot must be controlled under various manufacturing conditions. Usually, the inputs to such a modular safety system include an emergency stop switch, a safety gate with an additional monitored door fastening device, safety mats, safety light curtains, and the robot position. Depending on the input conditions, an output signal is created by the modular safety system to switch a safety relay for an emergency stop of the robot. Various other applications in industrial safety control exist.
For simple manufacturing tasks, safety switching devices are very widely spread; however, in fully automated manufacturing plants they are limited for cost reasons or because they do not provide for diagnosis and monitoring in higher order controllers. On the other side, complex failure safe controllers are used in extremely sophisticated manufacturing facilities; however, they are too costly for small and mid-range applications because further programming systems are required resulting in high engineering costs and the handling can only be done be specifically trained staff.
In mid-rage and even in small-range applications, modular safety systems are used due to their cost-effectiveness.
One such modular safety systems is the F-200-system, which is commercially available from Tesch GmbH & Co. KG, Wuppertal. This modular safety system includes a base module, which has two input channels with a single, dual or three-channel activation, independently of one another. Therefore, for example, an emergency stop switch and a safety gate with an additionally monitored door fastening device can be connected, so that each contact can be monitored independently. Also, foot switch mats or safety mats and safety light curtains with relay outputs can be used as initiating devices. The base module monitors the individual channels constantly to check the connection to one another and to check for interruptions. It opens the safety contacts if either an appropriate E-stop or fault condition occurs. The status of input/output and diagnostic information are indicated by LED lamps, signalled by relay contacts and semiconductor outputs, and transmitted to a serial data interface on the front of the module. That base module may be expanded by additional safety input extension modules and/or contact extension modules.
A further example of a known modular safety system is the safety center that is commercially available from Schleicher Elektronik GmbH & Co. KG, D-13597 Berlin and includes a base module and at least one input module. The safety center has two multifunction groups A and B, which can operate as independent devices or be combined with one another. Separate or joint operation of the input circuit groups A and B on the input module is configured with a switch on the front of the base module. Input function selection is done by the use of two rotary switches located in the front plane of the input module.
The known modular safety systems show a disadvantage of limited flexibility so that they are not suited for more complex applications.
It would therefore be desirable to provide a system with a more complex functionality.
A modular safety system for safety control in emergency stop applications is disclosed that includes a plurality of input channels, a plurality of output groups, and a plurality of safe relay outputs. As such, each input is assigned to at least one of the output groups and each output group controls at least one of the plurality of safe relay outputs. The modular safety system also includes means for configuring the system at least three freely programmable output groups.
In accordance with one embodiment, the system is organized in a modular way, which means it includes at least one input module for inputting the respective input signals from a plurality of sensors, a basic module for controlling the system and at least one output module for controlling the safe relay outputs. For example, each input module may include two independent inputs, wherein each input may include one, two, or three channels.
In according with a further embodiment, each input module includes a configuration means for configuring the input functions and for selecting the desired output groups. In this regard, the configuration means may include a set of rotary switches. In one embodiment, a maximum of ten input modules may be combined with one basic module. Additionally, input modules may be saved in a memory, for example, an EEPROM located in the base module, so that the settings of the configuration means is compared with the memory content at each new start up of the system. In the case that the configuration of the input modules has been changed without proper authorization, the safety system will not start. Further, the current configuration may be programmed in the memory before the first starting of the system using appropriate programming means.
In a further embodiment, internal errors of the safety system are saved into the above mentioned memory, wherein internal errors may be an exceeded synchrony time limit or an unlocked safety input. Furthermore, if not all channels of an input circuit are interrupted and a reset button is pressed, the faults or errors can be deleted by unlocking all input channels simultaneously.
It is contemplated that each output module, (for example, a maximum of six output modules combined with one base module), include a given number of safe relay outputs. The number of safe relay outputs of each output module may be four, wherein, for example, three safe relay outputs are normally open (NO) and one safe relay output is normally closed (NC). Further, each output module may be assigned to one output group.
A wide variety of input functions may be selected by the configuration means for identifying the input signals of the safety sensors of each input. For example, the functions may be a one channel emergency stop, a two channel emergency stop, or a three channel emergency stop. As a further example, the functions may be a safe gate with start up test, a safe gate without start up test, a light curtain, which needs both inputs, a two-hand operation or a mixed input, wherein input 1 of one input module is connected to a two-channel emergency stop and input 2 of that input module is connected to a light curtain.
Further, each input may be assigned to at least one output group. For example, the inputs of a given input module may be assigned to group 1, group 2, group 1+2, group 3, group 1 to 3, group 2+3, or group 1+2+3. This means, for example, in the case that both inputs of one input module are assigned to group 1, that group 1 is active, if all group 1 inputs and input containing group 1, so-called combined inputs, are closed. Further, the output state of at least one of those output groups may be a logical function of the output states of at least one of the other output groups. For example, the output “group 3” may be the following logical function:
(input 1 or group 1) and (input 2 or group 2)=group 3.
This example may be called muting with cross-control.
In accordance with a further embodiment, a so called safe area input may be provided in the configuration means of an input module, which may be defined by the following logical equation:
((input 1 or group 1) and (input 2 or group 2)) or input “safe area”=group 3.
This functionality provides, for example, in a robot application, that the robot will run if it is located in a safe area, regardless of the other inputs. Other logical functions comparable to the above mentioned logical combinations are possible.
Further, delay timer means may be provided, for example, as delay timer modules, so that the switching times of the respective safe relays may be delayed for a given group.
In accordance with another embodiment, the input modules, the basic module, and the output modules are interconnected by a flat band cable, providing for the signal flow from the input modules via the basic module to the output modules.
Further, the basic module or controller module may be provided with an integrated diagnostic interface, for example, an RS 232/485 interface or an alternative device net communication interface. With those interfaces, the safety system may be connected to an external data processing means, for example, a computer.
Referring to
The upper terminal row 9 of the input module 2 serves as a first input, whereas the lower terminal row 8 serves as a second input with, in the example shown, a maximum of three channel activations. The modules 1, 2, 3 are interconnected by two different types of flat cables (not shown) through their sockets 12, 13, 14, and 15. Further, a plurality of LEDs 16-20 in each module serves for information about the state of an associated module 1, 2, 3.
For each input module 2, input and output functions are defined. Therefore, as shown in
As an example, the input functions of the input module 2 include two inputs that function as follows.
Furthermore, Table 2 lists as an example the possible group selections made using “select group” switches 26, 27 that, according to the illustrated example, include setting 0 to setting 8. It should be recognized that the following is for exemplary purposes only, and thus, other numbers of settings are also possible. For example, setting 1 means that both inputs of the respective input module activates the output Group 1, wherein Group 1 is active, if all Group 1 and Group 1 combined inputs are closed.
Referring now to
According to one embodiment, the operation of the robot is limited by the following restrictions, which lead to the truth table as given in Table 3.
If there is no operator at access station 35 (90°) and access station 36 (270°), in other words, no operator has crossed the light curtains LC90 or LC270, there are no restrictions for the robot operation.
If there is no operator present at access station 36 (270°) but operator OP1 has entered access point 35 (90°) by crossing the light curtain LC90, the robot 30 can only operate in the position 270°, i.e., at access station 36 (270°).
If an operator OP2 has entered access station 36 (270°), the robot 30 can only operate in the position 90°, i.e., at access station 35 (90°), otherwise the robot is stopped.
If both operators OP1 and OP2 have entered the respective access stations 35, 36 (90° and 270°), there is no working position for the robot possible without potentially encountering the operators OP1 and OP2, so that the robot operation will come to a stop.
The following truth table depicts this situation in detail and includes the inputs LC270 (light curtain 270°), LC90 (light curtain 90°), RB270 (robot 30 at position 270°) and RB90 (robot at position 90°).
Now, in the example described with respect to
Referring now to
Here, an additional safe operating area 44 was added to the working space 33 of the robot, so that the operation of that robot 30 will not be stopped, when the robot is located in the additional safe area 44.
This leads to a truth table as given in Table 4:
Here, too, inputs of the safety mats and the gate 34 have not been considered in the above truth table. Such a situation may be complied by using a position signal of the root indicating that the robot is located in the safe area, i.e. a logical one, or that it is not in the safe area, i.e. a logical zero. This signal may be used in the logical equation according to group selection setting 9.
| Number | Date | Country | Kind |
|---|---|---|---|
| 04023988.1 | Oct 2004 | EP | regional |
