Safety circuit with automatic recovery

Abstract

A safety circuit is described that monitors a number of sensors for intrusion of objects or people into the workspace of a robot and controls the drive power to the motion control system via an emergency-stop circuit. The system monitors the motion control system and models it as just another sensor to ensure that it is working properly. In the event that there is intrusion, the safety circuit assigns a degree of intrusion (e.g., precautionary or serious). For serious intrusions, the safety circuit kills drive power thereby preventing additional motion of the robot. Killing drive power (de-energizing the emergency-stop circuit) requires a qualified operator to restart for further operation. For precautionary intrusions, the safety circuit takes control of the motion control system by disabling the power stages of motion control amplifiers but retaining drive power there. This inhibits further motion. The safety circuit keeps the amplifiers inhibited for a period to permit the intrusion time to clear. In the event that the intrusion clears quickly, the safety circuit releases control of the power stage to permit continued operation (automatic recovery). This can reduce the occurrences of nuisance trips of the emergency-stop circuit. Various means in the architecture are described here to ensure and verify that the system is safe. This is advantageous because scrutiny of the approach can be focused on the limited functionality (software, hardware) of the safety circuit. Highly complex functionality (software, hardware) of the motion control system can be safely modeled as potentially unsafe, thereby requiring far less scrutiny.

Description

FIELD OF THE INVENTION

[0002] The present invention relates to a safety circuit that monitors a number of sensors for intrusion of objects or people into the workspace of a robot and controls the drive power to the motion control system via an emergency-stop circuit.

BACKGROUND OF THE INVENTION

[0003] Safety switches or safety sensors serve for shutting off drive power to machinery when people or objects enter a designated work place zone. Typically, a safety switch is connected to the door or opening that provides access to the work place zone. The safety switch is typically tripped when the door is opened, shutting off drive power to the machinery. Devices of this type are used to prevent people or objects from entering the work place zone while the machine is in operation, decreasing the potential for injury and/or damage to the machinery. Other non-tactile-type intrusion sensors are infrared or ultrasonic, whose sensing zone could be a light curtain or fence, or it could be a quadrant or cone. Typically, drive power to machinery is removed when intrusion is detected, which requires a skilled operator to restart the machinery. Frequently occurring nuisance trips can defeat the advantages of having an automatic machine doing unattended or mundane tasks such as automated refueling for automobiles, because the store attendant is forced to frequently come outside to restart drive power. (It is generally accepted that a consumer is not qualified to restart drive power.)

[0004] In an industrial controls environment, presence sensing device initiation (PSDI) is a mode of operation where an intrusion sensor acts as a safeguarding device, but it is also used in a control configuration such that intrusions are monitored so that the “control starts a robot cycle when the sensing field is clear without the need of pressing any additional cycle enable or run buttons” (ANSI/RIA R15.06/1999). This is used to safeguard an operator who is feeding parts to a robot for processing. It is a mode of operation used to start motion for an imminent robot cycle. So far, it lacks sufficient details for implementation, specifically regarding inhibiting motion during the operator's intrusion.

[0005] There are a number of patents in this field including U.S. Pat. Nos. 4,263,647; 5,451,879; 4,616,216; 5,263,570; 4,912,384; 5,319,306; 5,278,454; 5,426,355; 4,481,449; 5,880,954; 4,818,866; 4,898,263; 5,280,622; 6,173,814; 4,437,089; 5,218,196; 5,408,089, all of which are incorporated herein by reference. Also incorporated herein by reference is U.S. Pat. No. 6,392,318 entitled “Programmable Emergency-Stop Circuit.”

[0006] All references cited herein are incorporated by reference in their entirety, to the extent not inconsistent with the explicit teachings set forth herein.

BRIEF SUMMARY OF THE INVENTION

[0007] The safety circuit of the subject invention provides a means for monitoring a number of sensors for intrusion of objects or people into the workspace of a robot, monitors the motion control system, and controls the drive power to the motion control system via an emergency-stop circuit. The safety circuit navigates between permitting the machine to move, inhibiting it for Level 2 Intrusions (precautionary type), and killing drive power for Level 1 Intrusions (serious type). Such navigation establishes a methodology for automated recovery from precautionary situations.

[0008] Now, there is a need for a machine to remove drive power when an intrusion incident becomes serious but to automatically recover from cleared precautionary intrusion incidents without requiring a skilled operator's deliberate action. There is a need to provide a framework for implementing this functionality.

[0009] At a minimum, such a machine consists of an emergency-stop circuit, at least one intrusion sensor, a safety circuit, and a motion control system that is responsible for effecting the motion to carry out the machine's function. When necessary to avoid the most hazardous situation, the safety circuit kills drive power by utilizing a control signal to the emergency-stop circuit, which in turn stops the flow of bulk power to the motion control system. The emergency-stop circuit also possesses a second, independent interface to start and stop this flow of bulk power.

[0010] Accordingly, it is the first object of the invention for the safety circuit take over parts of the motion control system from time to time with the purpose of stopping and disabling motion for each axis but permitting bulk power to remain flowing (HALT state), where the safety circuit subsequently releases control back to the motion control system sometime thereafter (ACTIVE state) so that productivity may resume.

[0011] To make further use of this, it is the second object of the invention to provide the safety circuit with at least one intrusion sensor, such that from the sum of all intrusion sensors, the safety circuit can determine the severity of a single or multiple intrusion incidents, where it decides whether the intrusion is severe or precautionary. Here, the safety circuit continues scrutiny for a precautionary intrusion incident in case it becomes severe.

[0012] To make further use of this, it is the third object of the invention for the safety circuit when in an ACTIVE state to take over when an intrusion incident occurs so that all axes are stopped (HALT state), to remain in the HALT state if any incident is precautionary but no incident is severe, to kill drive power when an incident is severe (KILLED state), and to release control back to the motion control system if all incidents clear thereby enabling automatic recovery (ACTIVE state). It is the further object of the invention for the safety circuit after entering the KILLED state to remain in the KILLED state until drive power is restarted (ACTIVE state) and while in the KILLED state to force drive power off when an intrusion is sensed and to not force drive power off after all intrusions have cleared. It is the further object of the invention for the safety circuit to enter a KILLED state when drive power is lost as sensed by the safety circuit (e.g. emergency-stop button utilized) or prior to the 1st energizing cycle after logic is first powered.

[0013] It is the fourth object of the present invention for the safety circuit to emit a visual and/or audible signal when in the HALT state to alert an intruder that productivity is halted.

[0014] It is the fifth object of the present invention to model the motion control system as a sensor in order to detect continuously that proper motion control is being conducted. Here, the complex motion control system is considered “potentially unsafe”, but the safety circuit's subsequent monitoring renders the overall system “safe”. When properly operating, the “sensor” reports status to demonstrate that the motion control system can definitely control, move, stop, disable, enable each axis of the machine and also definitely handle the case when an axis has a “motion control fault” (e.g. disabling feedback that stops motion when an axis exceeds an error limit or a limit switch trips due to accidental, controlled movement passed a positional limit).

[0015] It is the sixth object of the invention for the safety circuit to declare a “safety circuit fault” when uncertain of the proper operation of the motion control system or any other sensor such that a hazardous situation may exist. The safety circuit kills drive power and enters the ERROR state. While in the ERROR state, it continues to force drive power off, and it remains in the ERROR state until the fault is logged and corrected, if necessary, at which time it returns to the KILLED state.

[0016] When motion control system does have full control of the axes (ACTIVE state), a first scenario for risk assessment is in effect, which considers a person is safely outside the workspace of the machine but further considers he may enter the workspace at any time. During this time, normal machine movements and processing are carried out. Here, the assessment considers it hazardous when the safety circuit senses an uncertainty in the location, velocity, or force of an axis (e.g. bad sensor), does not get data or gets corrupt or incoherent data from the motion control system, or senses that the motion control system does not see or cannot handle a motion control fault (e.g. fails to stop an out-of-control axis). These are hazardous situations, established based on application criteria, and each is a safety circuit fault, because it is not certain that the safety circuit can take over to disable motion and safely stop all axes in the event that person does eventually enter the workspace.

[0017] When the motion control system itself recognizes, based on application established thresholds, a loss in its ability to reliably control motion, it declares a severe motion control fault and requests the safety circuit to remove or kill drive power. Accordingly, it is the seventh object of the present invention to enable the motion control system to explicitly tell the safety circuit either to kill drive power (KILL motion control state) or that the motion control system is ready (READY motion control state).

[0018] When the safety circuit does take over during a precautionary intrusion (HALT state), a second scenario for risk assessment considers that the person has just entered the workspace of the machine but is not in immediate danger. In this case, assessment considers it additionally hazardous when any sensory data from the motion control system shows continued motion or a potential for additional motion, such as positional data showing continued movement. Exceeding an application established threshold for any of these is a safety circuit fault.

[0019] Additionally, certain handshaking between the motion control system and the safety circuit improves overall safety. Accordingly, it is the eighth object of the present invention for the for the motion control system to acknowledge explicitly a take over by the safety circuit (HALT ACK motion control state) and to acknowledge regaining control (READY motion control state). A failure of the motion control system to do either constitutes a safety circuit fault, unless a KILL request is made.

[0020] It is the ninth object of the invention for the safety circuit to periodically test a sensor to ensure proper operation of the sensor. The safety circuit conducts a test of the motion control system by simulating a precautionary intrusion. The motion control system passes the test after: (i) it is determined all axes are stopped after the safety circuit takes over and (ii) subsequently when the motion control system properly regains control.

[0021] It is the tenth object of the invention to provide further handshaking between the motion control system and the safety circuit in order to ensure their synchronization and provide the motion control system a state to reinitialize. Accordingly, the motion control system explicitly communicates READY or NOT READY to the safety circuit, and the safety circuit accommodates by navigating between ACTIVE and DISABLED states, respectively, where all other changes of state criteria have priority. Additionally, a requirement for a READY motion control state is satisfied with a NOT READY motion control state, where the safety circuit navigates to the DISABLED state instead of the ACTIVE state. When in the DISABLED state, since the motion control system is not ready to servo, the safety circuit declares a safety circuit fault whenever sensory data from the motion control system shows motion or a potential for motion, such as an enabled servo amplifier. It is further the object that the safety circuit when in the KILLED state additionally forces drive power off until the motion control system reports a NOT READY motion control state so that it is certain the motion control system has seen the loss of drive power condition before drive power can be restarted.

[0022] It is the eleventh object of the invention for the resulting system to be used as an automatic refueling system for automobiles.

BRIEF DESCRIPTION OF THE DRAWINGS

[0023] FIG. 1 depicts a schematic diagram of the safety circuit of the subject invention.

[0024] FIG. 2 depicts a schematic diagram of the motion control system connections.

[0025] FIG. 3 depicts a schematic diagram of the safety circuit state machine of the subject invention.

[0026] FIG. 4 depicts a schematic diagram of a reciprocal and redundant safety circuit.

DETAILED DISCLOSURE OF THE INVENTION

[0027] The safety circuit of the subject invention provides a means for monitoring a number of sensors for intrusion of objects or people into the workspace of a robot, monitors the motion control system, and controls the drive power to the motion control system via an emergency-stop circuit. Initially, detailed description of FIG. 1 is provided, and this is followed by a discussion of how the safety circuit navigates between permitting the machine to move, inhibiting it for Level 2 Intrusions (precautionary type), and killing drive power for Level 1 Intrusions (serious type). Intrusions have been qualified according to the concept of levels, thereby creating a framework that determines appropriate response, viz. whether and how it may recover.

[0028] FIG. 1 is a simplified schematic given from the safety circuit perspective, where the “safety micro” 10 carries out the safety circuit function. One skilled in the art will understand the components in this figure and further understand that multiple, redundant, and reciprocally communicating “safety micros” are typically employed in order to achieve sufficiently reliable control. Such a designer can easily adapt the novel aspects identified here to the more involved typical situation.

[0029] In FIG. 1, the term “motion control system” 11 is used in a general way to represent all of the hardware and software components (exclusive of the emergency-stop circuit) that perform motion control. For example, this includes the actual motion controller, a PC, servomotor amplifiers, servomotors, all process-related software, and the like. The approach here is to treat the motion control system like it is a sensor. And, therefore just as any other sensor, the motion control system is assumed to be unreliable, requiring constant monitoring and periodic checking to ensure proper operation. Also in FIG. 1, the emergency-stop circuit (e-stop circuit 12) controls the flow of bulk power to the servo amplifiers and motors, has an operator's interface to stop and start the flow (not shown), and finally has control 14 and status 15 signals that interface independently with each safety micro which enables each safety micro to stop the flow (if necessary) and determine e-stop circuit status (energized or de-energized). Each intrusion sensor 13 has control (not shown) and status signals 16 that interface to a dedicated safety micro, which enables the safety micro to initiate a test and to determine a sensory value.

[0030] The sensory input data 17 from the motion controller can be provided over a bi-directional serial data link 19 to the safety micro, e.g.:

[0031] 1) watchdog input status from the motion controller (and PC), e.g. a timestamp;

[0032] 2) servomotor positions, commanded velocities, and command torque values from the motion controller, with associated timestamp;

[0033] 3) servomotor hall sensor states (or redundant encoder position data) for redundant position data, with associated timestamp;

[0034] 4) amplifier control signal states; and

[0035] 5) motion controller state (feedback on state, motion controller faults, etc.).

[0036] 6) data integrity check, a cyclic redundancy check (CRC)

[0037] Alternatively, or to some extent, the safety circuit could connect directly, in-parallel to the various components, e.g. encoders, servo amplifiers, thereby in the extreme obviating the need for the communications link. However, this multiplies all wiring by two, which is not practical.

[0038] For the link, a multitude of infinities exist for how the designer can specify the protocol for packeting this data for such a transfer. The following Table 1 represents the preferred method, a stream of bytes flowing from the motion controller to the safety micro. Note that some data may be omitted based on a given application or a given design. Also, some data may not be required every packet or for every axis (see<axis data mask>). The required level of safety for an application will dictate what data is required.

TABLE 1
Packet from motion controller to safety micro.
Data	Axis Data	Description (example)
<destination address>		1 byte for safety circuit
		address
<source address>		1 byte for motion
		controller address
<overall length>		2 bytes corresponding to
		number of bytes of data
		to follow, excluding
		CRC
<overall motion		1 byte corresponding to:
controller state>		NOT-READY
		READY
		HALT-ACK
		KILL
<overall timestamp>		2 bytes from local
		motion controller system
		time or a simple counter
		incremented each use
<number of axes>		1 byte for number of axis
		data sub-packets
<axis sub-packet begin>	<axis identifier>	1 byte
	<axis data mask>	2 bytes describing what
		follows for this axis
		(bit-wise OR):
		1: primary axis data
		actual position with
		timestamp
		2: primary axis data
		includes commanded
		position
		4: primary axis data
		includes commanded
		velocity
		8: primary axis data
		includes commanded
		torque
		16: redundant axis data
		actual position with
		timestamp
		32: amplifier state (fault
		and enable)
		64: amplifier current
		sense
		128: limit-switch-home-
		state data
		256: axis state
	<primary axis data>	containing:
		raw actual position data
		(8 bytes)
		commanded position
		(8 bytes)
		commanded velocity
		(8 bytes)
		command torque
		(2 bytes)
		timestamp (2 bytes)
		corresponding with
		above data
	<redundant axis	containing:
	data>	raw redundant actual
		position data (8 bytes)
		timestamp (2 bytes)
		corresponding with
		above data
	<amplifier state>	1 byte containing:
		current amplifier fault
		status
		current amplifier enable
		status
	<amplifier current	2 bytes for current sense
	sense>	(proportional to actual
		torque)
	<limit-switch-home-	1 byte for limit switches
	state>	and home state (4 bits for
		limit switches, 1 bit for
		whether axis has been
		homed)
<axis sub-packet end>	<axis state>	1 byte corresponding to
		state motion controller
		has for this axis (e.g.):
		FEEDBACK_OFF
		FEEDBACK_ON
		MOVING
		STOPPING
		HOMING
		TESTING
		JOYSTICK_ON
		Repeat for remaining
. . .		axes
<CRC>		2 bytes for cyclic
		redundancy check

[0039] Particularly, the safety micro monitors the above data to determine whether a properly functioning system exists, e.g. that communication comes and that the redundant position sensors for a given servomotor are compatible (within an acceptable differences). Actual velocity is calculated by the safety micro from the sequence of position data. Also, position, velocity and torque commands and actual values can be monitored, ensuring they are within proper bounds. After the axis is homed, limit switch values can be monitored with respect to minimum and maximum positions, ensuring all are compatible, where each switch trips when it should. Finally, actual and command positions and velocities can be compared, ensuring position and velocity errors are within prescribed bounds. Note: to do this, the safety circuit requires beforehand certain ‘setup data’ for each axis, like maximum position error, velocity and torque, minimum and maximum positions.

[0040] Several features and options exist to guard against certain single failures in the generation and transmission of the above data. First of all, redundant position sensors exist for each axis or servomotor to accommodate a position sensor failure. Each position data maintains a timestamp to make sure that the motion controller is not merely re-sending old data. The data assembled into a packet is typically raw unprocessed data, which makes it unlikely that unintended corruption occurs due to software bugs related to processing the data. (However, in the event that the redundant position sensor is not collocated [e.g. a linkage exists between the sensors], some processing might be required in order to facilitate comparison between the sensors. Conceivably, this could be done in the safety circuit.)

[0041] Each safety micro checks for temporal consistency among the positional data and the associated timestamps and continuously compares them with their redundant counterparts. This protects against wild memory corruption within the motion controller's computer, which could result from the use of a bad pointer. A cyclic redundancy check can be used to ensure that data is not corrupted en-route from the motion controller to the safety micro.

[0042] The preferred approach described here does funnel two position sensors for a given axis or servomotor through a single motion controller computer in a manner deemed sufficiently safe. Further options exist for the most scrutinizing applications that avoid this funneling but remain within the purview of the present invention. For example, the packet in Table 1 can be split into two packets in order to further guard against memory errors internal to the motion controller. Secondly, redundant position data can be obtained by each safety micro from a second, independent source, e.g. directly from the servo amplifier (hall sensors) or from another source within the motion control system that is capable of generating a packet. Additionally, the safety micro can interface directly to the amplifiers, retrieving fault status and current sensing signals.

[0043] The packet in the reverse direction, going from the safety micro to the motion controller, may contain data corresponding to the state of the safety circuit and a request for data in the event the above packets are sent per request instead of automatically at prescribed intervals. (See Table 2.) As typical, a dedicated destination address can be used as a broadcast address, so that the safety circuit can broadcast to a multitude of motion controllers that drive power is killed, etc.

TABLE 2
Data packet from safety micro to motion controller
Data                   Description
<destination address>  1 byte (e.g. 255 is broadcast)
<source address>       1 byte (safety micro address)
<overall length>       2 bytes corresponding to number of bytes of data
                       to follow, excluding CRC
<overall timestamp>    2 bytes corresponding with system clock on
                       safety micro or a simple counter incremented
                       each use
<safety circuit state> 1 byte corresponding to current state:
                       KILLED
                       ERROR
                       DISABLED
                       ACTIVE
                       HALT
<source>               1 byte for (address of) source causing current
                       state
<data request>         1 byte:
                       SEND PACKET
                       NO PACKET
<CRC>                  2 bytes for cyclic redundancy check

[0044] One of the key features of the invention is the ability of the safety circuit to “take over” control of the servomotor amplifiers, which can be verified for the most reliability. The verification for reliability is done periodically and is referred to as a “take-over test”.

[0045] The safety micro takes over control by disabling the servomotor amplifiers employing a connection 18 to the servomotor amplifier inhibit that is in-parallel with the motion controller's similar connection. (In other words, either inhibit signal coming from the safety micro or the motion controller can inhibit the servomotor amplifier.) FIG. 2 illustrates this by showing inside the motion control system 11 how the connection 18 logically combines with the motion controller's connection 21 to create the INHIBIT signal that inhibits the servo amplifier 22. Note that in practice, the inhibit connection at the servo amplifier has a pull-up resistor on input, which means open collector outputs 21 and 18 can simply be hardwired there, making the OR gate 20 unnecessary.

[0046] FIG. 2 also illustrates further typical connections, such as the HALL SENSORS and DRIVE signals between the servo amplifier 22 and the servomotor 23. The HALL SENSORS, which are used for commutation, are shown as redundant position feedback to the motion controller 25. It is redundant to the primary output of the position sensor 24. Also shown is CONTROL signal from the motion controller to the servo amplifier that is typically an analog command voltage representative of the desired current to the servomotor. The servo amplifier outputs a FAULT signal when for any reason the output drive stages are not active. This is monitored by the motion controller and can be used as a control to release the hardware brake 26. The AND gate 27 is functionally equivalent to an actual circuit that releases the hardware brake (RELEASE is active) when the e-stop circuit 12 is energized and there is no fault in the servo amplifier (inverting input of FAULT at 27). The additional outputs shown from the e-stop circuit 28 and 29 represent bulk power that power the hardware brake and servo amplifier, respectively.

[0047] Now, the in-parallel connection 18 from the safety micro to the servomotor amplifier is thought of here as the “electronic brake”, and the condition when used is referred to here as the “HALT” condition. Copley of Westwood, Mass., a company selling motion control products, actually markets a servomotor amplifier (Model 5121) that possesses a ‘BRAKE’ input, which is handy for the present invention since it obviates the need for the in-parallel connection and provides a current-controlled stop when used.

[0048] Acknowledgment of the HALT condition is provided by the motion controller, which aborts whatever motion was proceeding and reports status to the safety micro. The safety circuit has various ways of making sure the motion controller recognizes the HALT, by monitoring commanded velocity and torque (should go to zero), motion controller's amplifier state (should be inhibited), motion controller's state (should go to HALT-ACK), and motion controller's axis state (should go to FEEDBACK_OFF). An automated recovery sequence may then commence, wherein the safety micro releases control and the motion controller regains it. Throughout the duration of the HALT condition, the emergency-stop circuit is energized, and drive power is retained to the servomotor amplifiers.

[0049] Alternatively, the take over command can be packeted and communicated over the bi-directional communications link 19. The safety micro can disable the servo amplifiers by using the safety-micro-to-motion-controller packet in Table 2 by specifying an “HALT” safety circuit state where the motion controller has been pre-configured to respond by disabling the servo amplifiers on behalf of the safety circuit.

[0050] The utilization of the capability of the safety micro to reliably take over control is a key feature of the safety circuit proposed here. Specifically, automatic recovery is proposed for certain intrusion incidents as they clear. This pertains only to Level 2 Intrusions (precautionary). Once a particular intrusion incident is sustained it becomes a Level 1 Intrusion (serious!, which requires the safety circuit to kill drive power.

[0051] In practice, a study should be conducted for a given application, a given system and a given set of intrusion sensors in order to establish criteria for quantifying whether a given intrusion incident is classified as a Level 1 Intrusion or a Level 2 Intrusion. A qualitative example criteria set is provided in Table 3.

TABLE 3
Qualitative examples establishing differences
between Level 1 and Level 2 incidents
Level 2 Intrusion (precautionary) Level 1 Intrusion (serious)
Momentary (e.g. less than half-second) Sustained (e.g. more than a few
                                 seconds)
Object identified in peripheral area Object identified close to robot
Occurs in home position (idle robot) Occurs in another process state
                                 (e.g. while moving)

[0052] A comprehensive design for how the safety circuit functions has been developed. This design is best explained by describing the safety circuit state machine shown in FIG. 3. The state machine approach to safety circuit design is a good method for describing how the safety circuit functions and for establishing a solid foundation for its implementation. Specifically, the state machine describes what can or cannot be done while in a given state and describes what a next state is for a given set of sensor data. In practice, the state machine runs as a software component on the safety micro.

[0053] Consider that the safety circuit begins in the KILLED state 30, during which drive power is forced-off (not active) when there is an intrusion. It stays in this state until such time that either a safety circuit fault is detected (S, then the state changes to ERROR 31) or until all tests have passed, there are no intrusions, and drive power is started (T, then it goes to DISABLED 32). This is determined when either condition S or T is true, where S has priority.

[0054] Generally, a “safety circuit fault” is a failure or suspected failure of some component within any part of the system. The failure could be electronic or mechanical hardware, or it could be software or communications link. In any event, the safety circuit must sense the failure and place the system into a known safe state, where the motors are all stopped. According to RIA 15.06/1999, “a control reliable safety circuit shall be designed, constructed, and applied such that any single component failure shall not prevent the stopping action of the robot.” Here, response to a safety circuit fault is to enter the ERROR state and immediately kill drive power, keeping it off while in the ERROR state.

[0055] Once drive power is killed or commanded to be killed as a result of a safety circuit fault, the subsequent response and assessment of safety is application specific and typically a design issue. For example, typical inquiries relate to situations where drive power is not removed quickly enough or whether the machine does not completely stop within a safe enough distance after drive power is removed. Latency between the safety circuit determining there is a safety circuit fault and the subsequent killing of drive power is also a design issue.

[0056] What remains here is to ensure that any single component failure can be discovered by the safety circuit. Typically, this is satisfied with redundancy, diversity, and periodic testing. For example, consider two safety micros, each of differing technology, and each connected to a sensor monitoring the same zone, each of differing technology, say one is ultrasonic and the other is passive infrared. (For example, see FIG. 4.) Each safety micro can continuously sense the zone and compare results, declaring an intrusion incident when either or both senses an object. However, suppose that at some point one sensor fails, e.g. ultrasonic, unknown to its safety micro. This is a latent failure, and it can cause a hazardous situation when environmental conditions exist that adversely affect the other good sensor, e.g. a black-panted intruder not seen by the infrared sensor. In order to safely handle this scenario, periodic checking of each sensor channel is conducted, but never both simultaneously. This can be done either at prescribed intervals or before each “cycle”, where cycle is defined by the application. To be sure the sensor works properly, deliberate tripping must be done. For example, a mechanical flap can enter the sensor zone. This discovers the safety circuit fault where mud covers the ultrasonic sensor deadening it so it does not sense the flap. Failing such a test is a safety circuit fault. In this way, no latent failures exist at the next demand upon the safety function.

[0057] Now, it is the concept here to treat the motion control system like it is a sensor, where this “sensor” senses (responds and stays in sync with) the state of the safety micro and senses reliably the position and behavior of at least one axis of a machine. As such, the objective of this sensor is not to sense intrusion but rather to detect that proper motion control is being conducted.

[0058] One must ponder what single failures can occur inside the motion controller and the motion control system, including what is necessary to generate and deliver the packet detailed in Table 1. Safeguards are in place to account for these (see above). It is believed that the safety circuit disclosed here reveals any conceivable single component failure within the motion control system. Such a failure, a safety circuit fault, is discovered when any of the following occurs:

[0059] A: No data, corrupt or incoherent data, e.g.:

[0060] (1) safety circuit does not receive packets, timestamps are erroneous, or CRC fail

[0061] (2) axis state not in sync with amplifier state or motion control state (e.g. packet says feedback is off, but amplifier is enabled or packet says feedback is on, but motion controller is ‘NOT READY’) B: An uncertainty in location, velocity, or force of an axis (suspected bad component), e.g.:

[0062] (1) discrepancy between primary and redundant position sensors,

[0063] (2) maximum actual velocity exceeded

[0064] (3) maximum current sense exceeded (proportional to actual torque)

[0065] (4) limit switches not in sync with positions after axis is homed (e.g. one does not trip when it should)

[0066] (5) motion controller state not in sync with safety circuit (e.g HALT-ACK state is stuck)

[0067] (6) motion control system not in sync with self (apparent motion when feedback is off for a given axis)

[0068] C: Failure of the motion control system to see or handle a motion control fault, e.g.:

[0069] (1) maximum commanded or actual velocity exceeded, sustained

[0070] (2) discrepancy between commanded or actual velocities, sustained

[0071] (3) maximum commanded torque exceeded, sustained

[0072] (4) maximum position error exceeded, sustained

[0073] (5) no apparent response to amplifier fault

[0074] (6) minimum or maximum position exceeded, sustained

[0075] (7) no response to limit switch trip when motion control state is not TESTING and not HOMING

[0076] D: Failure of the motion control system to acknowledge a take over, failure to stop an axis, or an apparent potential for continued motion when in the HALT or DISABLED states, e.g.:

[0077] (1) axis did not stop or it was not determined to have stopped when safety circuit took over motion control system during a Level 2 Intrusion incident (e.g. actual velocity was non-zero, discrepancy was found between redundant and primary position sensors, limit switches not in sync with positions, or motion controller failed to acknowledge the incident with incompatible state or axis state, non-zero commanded velocity or torque)

[0078] Note that the above is not an exhaustive set. Also, as it is seen from (D1), a failure to stop during the HALT or DISABLED states constitutes a safety circuit fault, where drive power is subsequently killed and motion is thus stopped.

[0079] Now, certain applications require ‘testing’ to determine if there is a latent failure in the ability of the safety circuit to take over control and achieve the powered stop during an Level 2 incident (HALT). Thus, the take-over test so described is for the motion control system the same as the mechanical flap test is for the ultrasonic sensor. This completes the analogy of using the motion control system as a sensor.

[0080] Recovery (condition R in FIG. 3) from a safety circuit fault depends on the source of the fault and perhaps on the application. Typically, an incompatible data set from the motion controller would be indicative of a failure of one of the position sensors. The requires a maintenance operation to debug, reset, and correct. A corrupt data set, on the other hand, is identified by a failed CRC. It requires a log in the event that it is occasional, but likewise a maintenance operation when it is frequent. So, some safety circuit faults just log and auto-reset (back to KILLED state), while other require maintenance to be reset.

[0081] A safety circuit fault is distinguished from a motion control fault, e.g. software position limit exceeded or a limit switch tripped expectedly for a given out-of-bounds position. The motion control fault results from a properly operating motion control system determining that motion is not within prescribed bounds. A “motion control fault” and subsequent response are defined by the design and configuration of the motion control system. Response by the motion controller can be controlled stopping, disabling feedback, or requesting drive power to be killed. This request can come through the serial data link, e.g. KILL motion control state, which is a “severe motion control fault” that it is a component which establishes condition Z in FIG. 3.

[0082] In the DISABLED state 32, drive power is active, but the motion controller is not yet ready for feedback control. The safety circuit stays in this state until one of the following occurs:

[0083] 1) drive power is killed, a safety circuit fault is detected, or there is a severe motion control fault (Z, then it goes back to KILLED); or

[0084] 2) there is any intrusion (V, then it goes to HALT); or

[0085] 3) there is no intrusion and the motion control system is ready to servo (U, then it goes to ACTIVE).

[0086] This is determined when either condition Z, V, or U is true, where Z has priority over V and V has priority over U.

[0087] While in the ACTIVE state 33, the safety circuit continues to monitor all sensors and the motion control system for proper operation. The safety circuit stays in this state until one of the following occurs:

[0088] 1) drive power is killed, a safety circuit fault is detected, or there is a severe motion control fault (Z, then it goes back to KILLED); or

[0089] 2) there is any intrusion (V, then it goes to HALT); or

[0090] 3) there is no intrusion and the motion control system is not ready to servo (W, then it goes to DISABLED).

[0091] This is determined when either condition Z, V, or W is true, where Z has priority over V and V has priority over W.

[0092] When going to the HALT state, the safety circuit takes over the motion control system causing all axes to stop. While in the HALT state 34, the safety circuit decides whether an existing intrusion incident is a Level 1 Intrusion. If it is, condition Q, then the safety circuit kills drive power and goes to the KILLED state. Also, in the HALT state, the safety circuit continues to monitor for follow-on or subsequent intrusion incidents that warrant similar scrutiny, and it makes sure the motion control system is in sync, properly recognizing the current state. While in this state, audio and visual warning can be supplied to alert the disinterested intruder, so he can get out of the way thereby permitting automatic recovery.

[0093] The safety circuit stays in the HALT state until one of the following occurs:

[0094] 1) drive power is killed, a safety circuit fault is detected, or there is a severe motion control fault (Z, then back to KILLED); or

[0095] 2) an intrusion incident becomes a Level 1 Intrusion (Q, then back to KILLED); or

[0096] 3) the Level 2 Intrusion clears and the motion control system is not ready to servo (Y. then it goes to DISABLED); or

[0097] 4) the Level 2 Intrusion clears and the motion control system is ready to servo (X, then it goes to ACTIVE). Note that the take-over test is a simulated Level 2 Intrusion incident. A change of state occurs here when either condition Q, Z, X, or Y is true, where Z and Q have priority over Y and Y has priority over X.

[0098] FIG. 4 illustrates the typical application where multiple redundant safety micros 10 and 40 are used. Each has connections 17, 18, to the same motion control system 11 and 14, 15 to the same emergency stop circuit 12. Each has connections 16 to independent, redundant sensors 13, 41 that monitor identical zones. For example, the first sensor for each safety micro monitors the same area (called ‘Zone A’). Typically, these two sensors will be of differing, diverse technology to help ensure that some environmental condition does not affect both adversely (e.g. if both were passive infrared, they might both be blind to black pants of an intruder).

[0099] The safety micros monitor each other via a serial communications link 42 and constantly compare what they see to make sure that the intrusion sensors work. They take turns testing each sensor to ensure reliability (so that one sensor is always active for a given zone). They also take turns periodically running take-over tests of the motion control system. Apparently, a safe safety circuit can be designed such that the communications between the motion controller and each safety micro 17, 18 and between the safety micros themselves 42 can be carried out over the same serial communications link in a round-robin, multi-master format. Obviously, up to three separate links can be employed, forming in the end a three-way bi-directional link, independent links between the motion controller and each safety micro and then a third between the two safety micros.

[0100] It should be understood that the examples and embodiments described herein are for illustrative purposes only and that various modifications or changes in light thereof will be suggested to persons skilled in the art and are to be included within the spirit and purview of this application.

Claims

1. An electronic control system for machinery comprising: at least one sensor for providing at least one intrusion signal of an unsafe condition associated with the sensor; a safety circuit for receiving said signal, determining a severity level, and controlling operation of the machinery in a plurality of operating states based on said severity level.

2. The electronic control system of claim 1 wherein said operating states comprise at least one of unrestricted operation (ACTIVE), partially restricted operation (HALT), totally restricted operation (KILLED), and standby (DISABLED); and said states are carried out by at least one of a motion control system and an emergency-stop circuit.

3. The electronic control system of claim 2 wherein the severity level comprises a first level (LEVEL 1) and a second level (LEVEL 2), wherein said first level is more severe than said second level.

4. The electronic control system of claim 2 wherein said ACTIVE state does not restrict operation of said machine.

5. The electronic control system of claim 2 wherein said HALT state restricts motion for each affected axis through said motion control system.

6. The electronic control system of claim 2 wherein said KILLED state stops motion for each affected axis through said motion control system and stops the flow of bulk power to the machine through said emergency-stop circuit.

7. The electronic control system of claim 2 wherein said DISABLED state is a standby state prior to going to the ACTIVE state.

8. The electronic control system of claim 3 wherein the safety circuit initiates the HALT state from the ACTIVE state upon receiving said intrusion signal.

9. The electronic control system of claim 8 wherein the safety circuit remains in the HALT state upon determining LEVEL 2 severity and returns to the ACTIVE state when said LEVEL 2 severity is cleared.

10. The electronic control system of claim 3 wherein the safety circuit initiates the KILLED state from the HALT state upon determining a LEVEL 1 severity.

11. The electronic control system of claim 3 wherein the safety circuit initiates the KILLED state from said HALT state upon determining at least one of a loss of drive power, a fault signal from said safety circuit, or a fault signal from said motion control system.

12. The electronic control system of claim 3 wherein the safety circuit initiates a DISABLED state from the HALT state when said LEVEL 2 severity is cleared and a fault signal from said motion control system is determined.

13. The electronic control system of claim 3 wherein the safety circuit initiates the KILLED state from the ACTIVE state upon receiving said LEVEL 1 severity.

14. The electronic control system of claim 3 wherein the safety circuit initiates the DISABLED state from the ACTIVE state upon determining a fault signal from said motion control system.

15. The electronic control system of claim 3 wherein the safety circuit initiates the KILLED state from the DISABLED state upon determining at least one of a loss of drive power, a fault signal from said safety circuit, or a fault signal from said motion control system.

16. The electronic control system of claim 3 wherein the safety circuit initiates the ACTIVE state from the DISABLED state when no intrusion signal is received and no fault signal from said motion control system is determined.

17. The electronic control system of claim 3 wherein the safety circuit initiates the HALT state from the DISABLED state when said intrusion signal is received.

18. The electronic control system of claim 3 wherein the safety circuit initiates the DISABLED state from the KILLED state when no intrusion signal is received, drive power is started, and safety tests have passed.

19. The electronic control system of claim 3 wherein the safety circuit initiates an ERROR state from the KILLED state when a fault signal from said safety circuit is determined.

20. The electronic control system of claim 19 wherein the safety circuit returns from said ERROR state to the KILLED state when the safety circuit is corrected eliminating the fault.

21. The electronic control system of claim 1 wherein said sensor comprises an intrusion sensor.

22. A method for providing electronic control of machinery comprising: sensing at least one unsafe condition; determining a level of severity of the unsafe condition; and controlling the operation of the machinery in a plurality of operating states based on said severity level.

23. The method for providing electronic control of claim 22 wherein said operating states comprise at least one of unrestricted operation (ACTIVE), partially restricted operation (HALT), totally restricted operation (KILLED), and standby (DISABLED); and said states are carried out by at least one of a motion control system and an emergency-stop circuit.

24. The method for providing electronic control of claim 23 wherein the severity level comprises a first level (LEVEL 1) and a second level (LEVEL 2), wherein said first level is more severe than said second level.

25. The method for providing electronic control of claim 23 wherein said HALT state restricts motion for each affected axis through said motion control system.

26. The method for providing electronic control of claim 23 wherein said KILLED state stops motion for each affected axis through said motion control system and stops the flow of bulk power to the machine through said emergency-stop circuit.

27. The method for providing electronic control of claim 23 wherein said DISABLED state is a standby state prior to going to the ACTIVE state.

28. The method for providing electronic control of claim 24 wherein the safety circuit initiates the HALT state from the ACTIVE state upon receiving said intrusion signal.

29. The method for providing electronic control of claim 28 wherein the safety circuit remains in the HALT state upon determining LEVEL 2 severity and returns to the ACTIVE state when said LEVEL 2 severity is cleared.

30. The method for providing electronic control of claim 24 wherein the safety circuit initiates the KILLED state from the HALT state upon determining a LEVEL 1 severity.

31. The method for providing electronic control of claim 24 wherein the safety circuit initiates the KILLED state from said HALT state upon determining at least one of a loss of drive power, a fault signal from said safety circuit, or a fault signal from said motion control system.

32. The method for providing electronic control of claim 24 wherein the safety circuit initiates a DISABLED state from the HALT state when said LEVEL 2 severity is cleared and a fault signal from said motion control system is determined.

33. The method for providing electronic control of claim 24 wherein the safety circuit initiates the KILLED state from the ACTIVE state upon receiving said LEVEL 1 severity.

34. The method for providing electronic control of claim 24 wherein the safety circuit initiates the DISABLED state from the ACTIVE state upon determining a fault signal from said motion control system.

35. The method for providing electronic control of claim 24 wherein the safety circuit initiates the KILLED state from the DISABLED state upon determining at least one of a loss of drive power, a fault signal from said safety circuit, or a fault signal from said motion control system.

36. The method for providing electronic control of claim 24 wherein the safety circuit initiates the ACTIVE state from the DISABLED state when no intrusion signal is received and no fault signal from said motion control system is determined.

37. The method for providing electronic control of claim 24 wherein the safety circuit initiates the HALT state from the DISABLED state when said intrusion signal is received.

38. The method for providing electronic control of claim 24 wherein the safety circuit initiates the DISABLED state from the KILLED state when no intrusion signal is received, drive power is started, and safety tests have passed.

39. The method for providing electronic control of claim 24 wherein the safety circuit initiates an ERROR state from the KILLED state when a fault signal from said safety circuit is determined.

40. The method for providing electronic control of claim 39 wherein the safety circuit returns from said ERROR state to the KILLED state when the safety circuit is corrected eliminating the fault.