Patent Application
20250155900
The invention relates to the coordinating of operations of multiple movable pieces of equipment in an industrial plant, such as machinery in a mining plant.
In complex industrial plants, such as mining plants, operation of many movable pieces of machinery has to be coordinated. Examples of such machinery include trucks, earth-moving equipment such as front-loaders or excavators, and drones that are used to survey the plant. The primary goal of the coordination is to avoid collisions between different pieces of machinery. In a related field of technology, namely pick-and-place manufacturing in a factory by robots, WO 2016/128 066 A1 discloses a method for avoiding collisions between two robots that reside at fixed positions side by side, but have arms with overlapping work areas.
In a simple setting where every piece of movable equipment is individually responsible for avoiding collisions with other equipment, the collision avoidance drastically reduces the speed with which the equipment may move. If equipment has to move across large distances within the plant, this costs much time. The better a coordination between different pieces of equipment, the higher moving speeds may be allowed.
It is therefore the objective of the present invention to improve the coordination between movable devices in an industrial plant, such that they may be operated at higher moving speeds without sacrificing safety.
This objective is achieved by a method according to the independent claim. Further advantageous embodiments are detailed in the dependent claims.
The invention provides a computer-implemented method for operating a plurality of devices in an industrial plant. In the course of this method, at least the location of a to-be-controlled device within the industrial plant is obtained. This location may be given at any desired level of granularity. For example, the location may be given as a precise position, or in the form of an area of a zone within which the to-be-controlled device currently is. Optionally, further information about the to-be-controlled device, such as intended operations of this device, may be considered as well.
At least the locations of other devices in the vicinity of the to-be-controlled device are obtained. Again, these locations may be given at any desired level of granularity. Moreover, they may be given in absolute coordinates or relative to the location of the to-be-controlled device, depending on what is most convenient for the application at hand. Conversion between absolute and relative locations is standard-issue.
Based at least in part on a ruleset with rules that are dependent at least on the locations of the other devices, at least one action that may be performed by the to-be-controlled device is determined. In particular, the rules may consider the relative locations of the other devices with respect to the location of the to-be-controlled device. The to-be-controlled device is then caused to perform the at least one action.
The rules in the ruleset may, for example, stipulate that collisions between the devices are to be avoided. If central coordination between multiple devices guarantees that there will be no collision, there is no more need for the devices to move slower in order to avoid collisions. Rather, the devices may move on their planned trajectories at maximum speed. This is in some way analogous to the handling of air traffic. It would be impossible to conduct air traffic in its present volume if every pilot had to handle the avoiding of collisions on his own. At typical cruising speeds, it would be impossible to track so many other planes and react in time. To fly at these speeds, pilots need guarantees from air traffic control that the airspace they are proceeding into is free and no other airplane is supposed to intersect their planned trajectory.
But the rules in the ruleset are not limited to avoiding collisions. Rather, they may consider any potential interaction between multiple devices that may be disadvantageous for the operation of each of these devices, or for the operation of the plant as a whole.
For example, if a first device is to perform a measurement that is sensitive to vibrations, it is to be avoided that another device in the vicinity couples vibrations into the first device or its working area. Other devices in the vicinity then have to keep a sufficient distance from the first device, and/or adapt their intended operations such that they produce less vibrations.
In another example, if a first device is to receive radio communications on a particular frequency, it is to be avoided that another device in the vicinity transmits at high power on the same or very similar frequency, shouting down what the first device is trying to receive. Other devices may then be compelled to keep their distance, direct their radio transmissions away from the first device, change the frequency of their transmissions, and/or reduce their transmit power.
All such interactions can be considered in one single common framework. In this manner, any information about the to-be-controlled device, and/or about the other devices, needs to be acquired only once and can then be re-used as many times as needed in many rules.
One particular advantage of improving the coordination between the activities of multiple devices in the described manner is that the triggering of primary safety systems in the devices may be avoided. For example, even if a vehicle or other movable device is equipped with some emergency stop that will trigger before this device collides with another device, it is a very disadvantageous situation if such a primary safety system is triggered. The device, or even the complete industrial process in which the device is participating, may be brought to a standstill. Also, the triggering of some primary safety systems may cause equipment damage. The systems may be deliberately devised such that in case of need, a minor equipment damage is accepted for the sake of avoiding a far larger calamity. But the damage is not acceptable if the primary safety system is triggered unnecessarily.
In a particularly advantageous embodiment, a mutual cryptographic trust relationship is established among the devices in the industrial plant, and between these devices and an entity that causes the to-be-controlled device to perform the at least one action. For example, this entity may be a central control entity. The cryptographic trust relationship provides a guarantee that if the to-be-controlled device has been instructed to perform the at least one action, this means that the action has been validated against the ruleset by the entity that is competent for this task. For example, if the action is to move the to-be-controlled device to a particular position, this may be done with the maximum available speed without setting aside a safety margin for collision avoidance.
For example, the establishing of the mutual cryptographic trust relationship may comprise onboarding the devices and the entity onto a common public-key infrastructure, PKI. The device, respectively the entity, then only needs to prove possession of a private key whose corresponding public key has been signed by a certification authority of the PKI.
In a particularly advantageous embodiment, a space occupied by the to-be-controlled device is obtained. Furthermore, spaces occupied by the other devices in the vicinity of the to-be-controlled devices are obtained. At least one rule of the ruleset stipulates that the space occupied by the to-be-controlled device must not intersect a space occupied by another device in the vicinity of the to-be-controlled device.
In this manner, the avoiding of collisions may be refined to account for devices having different sizes and considering the specific shapes. For example, in a mining plant, a bucket-wheel excavator occupies much more space than a front-loader. Available space in the industrial plant can then be used more efficiently. Occupied space may optionally include space in which a part of the device may move, and/or a space which has to be kept clear for safety while the device is working. For example, the beam of a bucket-wheel excavator may have a “bounding box” with an arbitrarily complex three-dimensional shape around it that is off-limits to other devices because other devices in this “bounding box” might be hit by the beam, by the bucket-wheel, and/or by freshly excavated material, and this bounding box has dynamic position and orientation, i.e. it typically will change position with the movement/operation of the excavator. More complex three-dimensional shapes are conceivable. In conclusion, there are many cases in industrial environments where a simple position or a two-dimensional area of a device is not sufficient to control behavior.
In a further advantageous embodiment, a predicted and/or planned future location of the to-be-controlled device, respectively a predicted and/or planned future space occupied by the to-be-controlled device, is obtained. Also, a predicted and/or planned future location of at least one other device in the vicinity of the to-be-controlled device, respectively a predicted and/or planned future space occupied by this other device, is obtained. In this manner, the collision avoidance may be refined further. In particular, a guarantee that a particular space will be free for entry by the to-be-controlled device, and/or by another device in the vicinity, may be made even more reliable.
As discussed before, in a particularly advantageous embodiment, at least one to-be-controlled device and at least one other device in the vicinity of the to-be-controlled device are work vehicles configured for operating in a mining plant or on a construction site. In such plants and sites, movable devices frequently have to cover large distances, so the benefit of being able to move faster because of a better coordination between devices is most pronounced.
In a further particularly advantageous embodiment, the ruleset further comprises at least one rule that is dependent on whether the location of the to-be-controlled device is within a predetermined zone in the industrial plant. Such zones may thus be regarded as “geofences” that regulate which activities may be performed where in the industrial plant. Unlike “geofences”, which optionally allow using height information for a fence, such zones may represent also complex three-dimensional spaces.
Thus, the behavior of devices, equipment or mobile workflows may be easily reconfigured based on the zone that a device in which it is located, and/or the zone that the device is entering or leaving. Herein, the entering of a zone may include a case where equipment is switched on within a zone. The reconfiguration may range from the basic customization of device parameters to policy-compliant movement of vehicles.
Examples for zones include:
In a particularly advantageous embodiment, the predetermined zones are defined independently from the ruleset and referenced directly or by type/class of zone from the at least one rule in the ruleset. That is, the zones may be defined once and then used in multiple rules of the ruleset, and even re-used for multiple devices of different types. No duplicate work for defining zones is required if a new type of equipment is introduced into the plant.
Thus, building an open and secure industrial geofencing system that runs zone management, localization and location-based services as decoupled functions but integrated over a common secure system infrastructure of a plant or production site allows defining zones and policies/intents using global workflows, sharing them openly in the system, and authenticating them in the location-based service before use.
This improved location intelligence provides deeper insight into the physical state of the system and actionable data to configure industrial devices or sub-systems zone-specific capabilities (e.g., access confidential data, move with higher speed) or limitations (e.g., reduced energy consumption, switching to a safe state) in a systematic and reliable way.
An automation system may thus be equipped with
Herein,
Thus, there is a particular synergy between the use of zones in rules, and in particular the use of zones that are defined independently from the ruleset and referenced from at least one rule in the ruleset, on the one hand, and the establishing of a mutual cryptographic trust relationship on the other hand.
In particular,
To comply with regulations or safety needs, a component may always remain in the most conservative configuration unless it receives explicit clearance by authentic zone data.
In a further particularly advantageous embodiment, at least one in the ruleset stipulates:
In particular, for devices whose operation may pose a hazard, such as drones, certain zones in the industrial plant may be designated as no-fly zones. Operations of vehicles may be confined to areas in which they are technically fit to operate. For example, vehicles that are not meant to come into contact with saltwater may be restricted from entering areas close to saltwater. Also, only four-wheel drive vehicles that are meant to be operated underground may enter underground areas of a mining plant.
Restrictions of radio frequency power may, in particular, serve to avoid creating sources of ignition in an area with a potentially explosive atmosphere. For example, as a worst case, it may be assumed that some conductive object in the area may heat up or create a spark if irradiated with radio frequency power of a matching frequency and a sufficient amount of power. It may then be stipulated that radio frequency power may be present in the area only to the extent that this cannot create a source of ignition even under the most favorable conditions for the creation of heat, and/or a spark.
In future automation systems, engineering and operation tools, localization systems, mobile and stationary equipment, i.e. all automation-related assets and functions will be part of a common communication and security context. We leverage this to remove tight coupling of components that today leads to island solutions, double work, and data intransparency. We get an open plug-and-play system without compromising on security.
Zone management includes definition of (no) fly zones for drones, roads, space occupied by mobile equipment, walkable areas, Ex0/1/2 zones, etc. together with properties like speed limits, energy limits, traffic priorities, etc.
This is done independent from services for/within drones, AGVs, instruments, actuators, IO devices, mobile workforce, etc. that adjust their behavior depending on the properties of the zone in which they are (or refrain from entering in the first place).
Integration may be achieved by tagging zone data, cryptographically signing them, and making them generally available within the system.
This may be done using a common dictionary for zone properties, a common root of trust to sign the data, and a common communication infrastructure to publish/query the data.
In a particularly advantageous embodiment, multiple actions to be performed by multiple to-be-controlled devices are determined by a central control entity. In this manner, the available space in the industrial plant, as well as the available moving speeds of the to-be-controlled devices, may be utilized to a better degree. Ideally, all devices perform their motion at the speed which is best for the efficiency of the industrial plant without being encumbered by the requirement of collision avoidance, this collision avoidance being reliably provided by the central control entity.
In a further particularly advantageous embodiment, the at least one to-be-controlled device applies a ruleset of its own at least to:
The filtering of to-be performed actions introduces another layer of safety. For example, if the central control entity commands the performing of a certain action, but the to-be-controlled device is not in the position to perform this action for any reason, the performing of this action may be suppressed. For example, a vehicle may not move automatically as commanded by the central control entity if it is determined by on-board sensors that some obstacle is in the way, or that a door or hatch has been left open.
The independent determining of a to-be-performed action is a backup that ensures at least some functionality of the vehicle in case communication with the central control entity becomes unavailable. For example, in an underground area of a mining plant, communication with the central control entity may not always be reliable.
In a further advantageous embodiment, the central control entity performs a consistency check between actions to be performed by different to-be-controlled devices. In this manner, contradictions in the ruleset, e.g., of the kind that two rules cannot be complied with at the same tie, may be spotted.
In a further particularly advantageous embodiment, at least one device in the industrial plant publishes at least its location, and/or the to-be-controlled device obtains at least one location of another device, according to a publish-subscribe model. In this manner, this information is available to all other devices, but it will only be processed by those devices for which it is relevant. That is, in an industrial plant with many devices, the devices will not be overwhelmed by a flood of messages of which only a tiny portion is relevant. Meaningful publication topics include but are not limited to zone names, device type (including both mobile equipment and people), and it is advantageous to publish/subscribe topics using a spatial or taxonomical hierarchy to allow subscribers to choose a suitable granularity, e.g. mine1.pit1.area.1 or mobileentity.worker.externalcontractor.
In a further advantageous embodiment, a central entity acquires locations of devices and notifies the to-be-controlled device about the identities of devices entering or leaving its vicinity according to a correspondingly defined rule. In this manner, the central entity can act as a broker that provides, to each to-be-controlled device, information about relevant other devices. Which other devices are relevant may, for example, depend on the identities, types and/or locations of these other devices. The notifying facilitates the subscribing of the to-be-controlled device to the position/zone data of other devices within a defined vicinity of the to-be-controlled device.
In a further particularly advantageous embodiment, the to-be-controlled device discovers other devices in its vicinity by evaluating radio transmissions broadcasted by these other devices, and/or responses to a radio interrogation transmitted by the to-be-controlled device. In this manner, the discovery of other devices can be physically constrained to a certain vicinity of the to-be-controlled device. That is, not all devices in the industrial plant respond at once and flood the to-be-controlled device with messages.
As discussed before, the method may be at least partially computer-implemented. The invention therefore also relates to one or more computer programs with machine-readable instructions that, when executed on one or more computers and/or compute instances, cause the one or more computers to perform the method described above. In this context, a virtualization platform, a hardware controller, network infrastructure devices (such as switches, bridges, routers or wireless access points), as well as end devices in the network (such as sensors, actuators or other industrial field devices) that are able to execute machine readable instructions are to be regarded as computers as well.
The invention therefore also relates to a non-transitory storage medium, and/or to a download product, with the one or more computer programs. A download product is a product that may be sold in an online shop for immediate fulfillment by download. The invention also provides one or more computers and/or compute instances with the one or more computer programs, and/or with the one or more non-transitory machine-readable storage media and/or download products.
The method may optionally be upgraded with the following variants:
The geofencing application/LBS does not need to bring its own zone management or localization functions. Today, these are typically tightly coupled. Innovations include:
This provides industry-grade geofencing for open and modular automation systems:
Further innovations include mobile zones (moving with the device), preemptive zoning (using predicted zones to anticipate and prevent potentially problematic system states), and global consistency checking on zone data (e.g. moving devices cannot simply disappear or “tunnel” to a remote location, etc.) as network-based connected services (considering network location instead or addition to spatial location). By making zone and location data transparently available throughout the system, other zoned/geofencing applications can make use of all this data without the providing application having to know any details about this.
Software-defined safety zones also enable new approaches for mobile equipment safety (note that today, this will rather complement the basic safety certification process). This is not intended at this point in time to replace safety certification processes or the built-in safety functions of (mobile) equipment, but to complement these functions for higher productivity and flexibility of the production process.
In the following, the invention is illustrated using Figures without any intention to limit the scope of the invention. The Figures show:
In step 105, a mutual cryptographic trust relationship 6 is established among the devices 21-25, and between these devices 21-25 and an entity 5 that is used to cause a to-be-controlled device to perform at least one action 4. In the example shown in
In step 110, at least the location 21a of a to-be-controlled device 21 within the industrial plant 1 is obtained.
In step 120, at least the locations 22a-25a of other devices 22-25 in the vicinity of the to-be-controlled device 21 are obtained.
In step 130, based at least in part on a ruleset 3 with rules that are dependent at least on the locations 22a-25a of the other devices 22-25, at least one action 4 that may be performed by the to-be-controlled device 21 is determined.
In step 140, the to-be-controlled device 21 is caused to perform the action 4.
According to block 111, a space 21b occupied by the to-be-controlled device 21 may additionally be obtained. According to block 121, spaces 22b-25b occupied by the other devices 22-25 in the vicinity of the to-be-controlled device 21 may then be obtained as well. According to block 131, at least one rule of the ruleset 3 may then stipulate that the space 21b occupied by the to-be-controlled device 21 must not intersect a space 22b-25b occupied by another device 22-25 in the vicinity of the to-be-controlled device 21.
According to block 112, a predicted and/or planned future location 21a′ of the to-be-controlled device 21, respectively a predicted and/or planned future space 21b′ occupied by the to-be-controlled device 21, may additionally be obtained. According to block 122, a predicted and/or planned future location 22a′-25a′ of at least one other device 22-25 in the vicinity of the to-be-controlled device 21, respectively a predicted and/or planned future space 22b′-25b′ occupied by this other device 22-25, may then be obtained as well. Predicted future spaces 21b′-25b′ may then be used additionally to evaluate rules in the ruleset 3.
According to block 132, the ruleset 3 may comprise at least one rule that is dependent on whether the location 21a of the to-be-controlled device 21 is within a predetermined zone 11 in the industrial plant 1.
According to block 133, at least one rule in the ruleset 3 may stipulate
According to block 134, multiple actions 4 to be performed by multiple to-be-controlled devices may be determined by a central control entity 5. According to block 134a, the central control entity may perform a consistency check between actions 4 to be performed by different to-be-controlled devices 21-25.
According to block 135, at least one to-be-controlled device 21 may apply a ruleset of its own at least to:
Within the zone 11, 11a, power density of radio communications is curtailed, so that the radio frequency energy can never be converted to sufficient heat or even a spark that may serve as an ignition source.
This means that only transmitter 23 and base station 24 can communicate with each other without any restriction as to transmit power. For communications to and from transmitter 21, power density produced during beamforming must be limited because transmitter 21 is in the first zone 11, 11a. But also communication between base stations 24 and 25 has to be limited in power density because the beam passes through the first zone 11, 11a. A possible alternative is to route traffic between base stations 24 and 25 via a relay station R on paths that stay clear of zones 11, 11a, 11b.
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/EP2022/052882 | 2/7/2022 | WO |
