Specification

The present invention is about a safety control system, said system including a con- trol unit which includes safety control logic, further including at least one safety sen- sor arrangement, further including at least one machine arrangement, which is oper- able in different modes of operation, wherein each mode of operation is character- ized by a different productivity of the machine arrangement, whereby the control unit receives and evaluates input from the at least one safety sensor arrangement, and in reaction to the result of the evaluation activates a mode of operation of the machine arrangement as determined by the safety control logic, according to the preamble of claim 1.

The present invention is also about a method of operation of a safety control system, said system including a control unit which includes safety control logic, further includ- ing at least one safety sensor arrangement, further including at least one machine arrangement, which is operable in different modes of operation, wherein each mode of operation is characterized by a different productivity of the machine arrangement, whereby the control unit receives and evaluates input from the at least one safety sensor arrangement, and in reaction to the result of the evaluation activates a mode of operation of the machine arrangement as determined by the safety control logic.

Generally speaking, the invention is about safety control in a discrete manufacturing environment or a manufacturing site. The term "machine" is meant to comprise any individual machine or sub-system of a manufacturing site, for example a robot, an assembly machine, a manufacturing cell or even an automated guided vehicle (AGV) used within manufacturing sites to automatically move between different manufactur- ing cells or subsystems.

Safety control in discrete manufacturing has the primary goal of protecting humans against hazards, when working at or entering manufacturing sites. Basically, sensors or switches are used to inform a safety control device about the presence of humans in specific zones, or their attempt to enter such zones. Based on the actual status of the automated manufacturing process, the manufacturing line or individual devices are put into a state that reduces or limits potential hazards to a specified, acceptable range. Very often, this is achieved by stopping the machines, but sometimes it is also sufficient to reduce the speed of motion, or limit the space of movements of particular mechanisms, e.g. industrial robots or machine tools.

In the major cases, stopping the machine is implemented, while drives with safe stopping function (STO) are used. In case of industrial robots, the robot controller also does the safety control of the robot, where supervision of robot tool position and speed is commonly implemented. It is also known to use drives offering safety speed or position control.

In case of (potential) severe hazards, an emergency stop is issued, e.g. via an emer- gency stop button, or corresponding sensor devices. It brings the machine into a safe stop state, which needs dedicated confirmation to restart the machine. The safety control for achieving its primary goal of protecting humans against haz- ards is relying on the availability of proper functioning of sensors and switches.

But sensors and switches might fail, for example in case an internal diagnostic func- tion detects a power supply failure. Or the communication between the sensors or switches and the control logic can be faulty. When implementing safety control, therefore the control logic needs to have a safety concept for dealing with situations when the sensors or switches are not available, for example in case of an internal stop, which can be also called passivation.

Another reason may be when the communication between the sensors and switches and the control logic is in a faulty state. Passivation, or in other words unavailability of sensors or switches or disturbed communication between sensors or switches and the control logic is summarized under the term "failure situation", to be distinct from the "hazard situation" explained earlier.

The control logic comprises a pre-defined reaction in such a failure situation as well.

In the known state of the art, the reaction to a failure situation is the same as the re- action to a hazard situation. So in case a faulty communication to a safety sensor or a failure in the sensor device itself is detected, a corresponding emergency function mode is activated, even if no hazard situation has been detected. This is a machine stop according to stop category 0 or 1 combined with manual resetting/restart of the machine. The productivity of the machine is reduced.

But often, a failure situation, for example the unavailability of the sensor, is only tem- porary, and is resolved more or less automatically within a certain time. In the state of the art, the machine is stopped anyway, causing unnecessary production losses.

So it is the objective of the present invention to improve a safety control system and a method for operating of a safety control system for controlling a machine in such a way, that in case of a failure situation as described above production losses are re- duced. The objective concerning the improvement of the safety control system is achieved according to the invention by a safety control system with the features of claim 1. So according to the invention, the at least one safety sensor arrangement has at least two functionally redundant subsystems, and input to the control unit includes infor- mation indicating availability of the at least two functionally redundant subsystems, whereby the control logic is configured to activate a normal mode of operation char- acterized by normal productivity in case the input indicates availability of all function- ally redundant subsystems, and is configured to activate a fail-stop mode of opera- tion characterized by zero productivity in case the input indicates unavailability of all functionally redundant subsystems, and is configured to activate a fail-operate mode of operation with productivity less than normal but above zero in case input indicates at least temporary unavailability of at least one and availability of at least another one of the functionally redundant subsystems.

For the functionally redundant subsystems of the safety sensor arrangement here in this application in addition also the term first and second safety device is used. It can be two or more safety sensor devices, for example a proximity sensor observing a first safety zone, which is a more critical safety zone, and a camera observing a sec- ond or second or third or Nth safety zones, which are less critical, whereby the first safety zone is a subset of the second or third or Nth safety zone. It can as well be one sensor unit having two or more different observation zones, for example a laser scanner or a camera being configured to observe a first safety zone close to the ma- chine arrangement with a high resolution and a second or third or Nth safety zone reaching out further away from the machine arrangement with less resolution or the like. So the term first and second safety device is used to describe either a sensor or sensor system or a functional sub-unit of a more complex sensor or sensor system. The term "second safety device" is meant to mean a functional kind, so a second safety device is meant to mean one or two or three or N sensors or sensing functions in addition to the first sensor device.

For the term "first or second fail-operate mode" in the context of this application in addition also the term "first or second safety function mode" is used.

In other words, the invention provides a safety control system which has a second safety device for detecting a second hazard situation in a second safety zone or, al- ternatively, is able to achieve some temporarily safe state, for example with safety limited speed, which usually has to be left after a certain pre-defined time. In case of a second safety device, the control logic interacts with the first and second safety devices to detect a failure situation in one of the safety devices and in response to a failure situation in one of the safety devices to switch to the other safety device or to apply one of the failure function modes. In the second case, the control logic brings the system in some temporarily safe state, which usually has to be left after a certain pre-defined time.

According to a preferred embodiment, the safety control system includes a machine or machine arrangement, having a nominal productivity, further including a first safety zone and a second safety zone, whereby the first safety zone is a subset of the se- cond safety zone, further including a first functionally redundant subsystem being configured for detecting a first hazard event in the first safety zone, further including a second functionally redundant subsystem being configured for detecting a second hazard event in the second safety zone, wherein a first fail-operate mode results in a first reduced machine productivity greater than zero but smaller than the normal productivity, and a second fail-operate mode results in a second reduced machine productivity greater than zero but smaller than the nominal productivity and higher than the first reduced machine productivity, wherein the control logic activates the second fail-operate mode in case input to the control logic indicates availability of both functionally redundant subsystems and indicates a second hazard event in the second safety zone but no hazard event in the first safety zone, and wherein the con- trol logic activates the first fail-operate mode in case input to the control logic in- dicates a temporarily unavailability of the first functionally redundant subsystem but availability of the second functionally redundant subsystem and indicates a second hazard event in the second safety zone.

According to a further preferred embodiment the control logic activates the second fail-operate mode in case input to the control logic indicates availability of the first functionally redundant subsystem and at least temporary unavailability of the second redundant subsystem and indicates no first hazard event in the first safety zone.

According to a further preferred embodiment the control logic activates the first fail- operate mode in case input to the control logic indicates at least temporary unavaila- bility of the second redundant subsystem and indicates a first hazard event in the first safety zone. According to a further preferred embodiment the control logic activates the first fail- operate mode in case input to the control logic indicates availability of both the first and second redundant subsystems and indicates a first and a second hazard event in both the first and second safety zones.

According to a further preferred embodiment the control logic activates the normal mode of operation in case input to the control logic indicates availability of the second redundant subsystem and temporary unavailability of the first redundant subsystem and no hazard event in the second safety zone.

According to a further preferred embodiment the machine or the machine arrange- ment is a robot or an Autonomous Guided Vehicle (AGV) or a discrete manufacturing system or a manufacturing cell.

According to a further preferred embodiment the productivity of the machine or the machine arrangement is the speed of moving parts of the machine or the machine arrangement.

According to a further preferred embodiment the first or the second redundant sub- system is a proximity sensor or a light barrier or a laser scanner or a camera.

According to a further preferred embodiment, temporary unavailability of a function- ally redundant subsystem is caused by a temporary communication error like a cyclic redundancy error (CRC error) or a watchdog error.

So according to the invention, the objective is achieved by introducing a fail-over concept to safety control, which avoids unnecessary machine stops in cases where there is a failure situation in a safety device. Fail-over means switching to a redun- dant device or function when a dedicated device or function fails.

In the hierarchical safety control system according to the invention, the hierarchy in the order of increasing critically is given by the sequence of the second, or third or in a generic case Nth, less critical safety zone(s), supervised by the second safety de- vice and detecting a second, or third or in a generic case Nth, hazard situation(s) in the second, or third or in a generic case Nth, safety zone(s), triggering a second, or third or in a generic case Nth, safety function mode(s), which is not stopping the ma- chine, and the subsequent first, critical safety zone supervised by the first safety de- vice and detecting a first hazard situation in the first, critical safety zone, triggering a first safety function mode, which preferably is stopping the machine. So the hierar- chically arranged first and second safety devices are according to the invention used as if they were redundant devices.

When it comes to the reaction of the safety control system to a failure mode in one of the safety devices, i.e., sensors or switches or the like, the advantage of the safety control system according to the present invention is that in such a failure mode the control logic does not trigger the emergency function mode, but switches to the other safety device and applies a failure function mode (instead of the severe emergency function mode), selecting from two failure function modes the less critical one which still fulfills safety requirements. This is seen from the invention in that in case the second safety device is in a failure situation, the first safety device is used instead of the second safety device, but the less critical second safety function mode is applied. This is a surprising finding, as the normal way would be to apply the more critical first safety function together with the first safety device. Advantage of the invention is that by using the less critical second safety function, the productivity of the machine is less reduced as compared to applying the critical first safety function, but still keeping up a high and reasonable level of safety.

In other words, a typical hazard event is that a human enters a defined zone where an operating machine may harm the human seriously. Traditionally, if such an event is detected, the machine is stopped. The concept of hierarchical safety control takes into account that the severity of such a hazard can be differently so that sometime the machine can run at a safely reduced speed instead of stopping, so that the overall productivity of the machine can be en- hanced. For example, one can define a "Zone 1 " around an industrial robot, where the viola- tion of this zone leads to stopping the robot immediately, but if the human is in the neighborhood outside this zone, the robot can run at a reduced speed, so that the robot is able to stop, when human enters "Zone 1 ". This is an example for a hierar- chical control structure according to the invention.

Another example could be an AGV which could run with reduced speed, if obstacles or human worker is within certain, but larger range, and it stops, when the distance becomes critical, like "Zone 1 " in the above example.

In a more general manner, the safety reaction can also depend on more accurate sensing of position, size and velocity of human or obstacles. And the safety reaction can also be stopping certain part of a production line, running on variable speed with parts of the line etc.

First or second safety devices may have first or second safety hazard detection means, which for example can be sensors or switches, which are used to inform a safety logic, also called safety control device, about the presence of a human in spe- cific zones, or their attempt to enter such zones. For example, a near-range environ- ment around a machine, for example a robot or an AGV, can be defined as a first, critical safety zone, because there is a critical danger that a human gets seriously hurt by the machine when he enters this first zone. So the presence of a human in such a first, critical zone is an example for a hazard event according to the present invention.

A wider range environment around the machine, for example the robot or the AGV, would be defined as a second, less critical safety zone. Here there still is some risk that a human gets injured when within this zone, but it is less likely and there is a larger security distance to the dangerous parts of the machine with more reaction time. So the presence of a human in such a second safety zone is also regarded as a hazard event according to the present invention, but will have less severe conse- quences.

The first safety zone usually is a subset of the second safety zone. Based on the actual status of the automated manufacturing process, upon detection of a hazard event, the manufacturing line or individual devices are triggered for exe- cuting a first or second safety function. This means, that for example they are put into a state that reduces or limits potential hazards to a specified, acceptable range. Very often, this is achieved by stopping the machines, but sometimes it is also sufficient to reduce the speed of motion, or limit the space of movements of particular mecha- nisms, e.g. industrial robots or machine tools.

A first safety function would mean, for example, a quite drastic reduction of speed of motion or limitation of the space of movements, and would be triggered in case a human is detected to be within the first safety zone,

A second safety function would mean, for example, a less drastic reduction of speed of motion or limitation of the space of movements, and would be triggered in case a human is detected to be within the second, less critical safety zone.

According to a further preferred embodiment of the present invention, the safety con- trol logic interacts with the machine arrangement to trigger the machine arrangement to the normal function mode in case of occurrence of a failure with the first safety de- vice, and in absence of a hazard situation being detected by the second safety de- vice.

According to a further preferred embodiment of the present invention, the safety con- trol logic interacts with the machine to trigger the machine to the first function mode in case of occurrence of a failure situation with the first safety device and detection of a hazard situation by the second safety device.

According to a further preferred embodiment of the present invention, the control log- ic interacts with the machine to trigger the machine to the first safety function mode in case of occurrence of a failure situation with the second safety device and detection of a hazard situation by the first safety device.

According to a further preferred embodiment of the present invention, the control log- ic interacts with the machine to trigger the machine to the emergency safety function mode in case of occurrence of a failure situation with the first and second safety de- vices.

According to a further preferred embodiment of the present invention, the control log- ic interacts with the first and second safety devices to detect communication errors with the first and second safety devices, the failure situation in one of the safety de- vices being the communication error, for example a CRC or Cyclic redundancy Check error or watchdog error. According to the invention, a method of operation of a safety control system, said system including a control unit which includes safety control logic, further Including at least one safety sensor arrangement, further including at least one machine ar- rangement, which is operable in different modes of operation, wherein each mode of operation is characterized by a different productivity of the machine arrangement , whereby the control unit receives and evaluates input from the at least one safety sensor arrangement and in reaction to the result of the evaluation activates a mode of operation of the machine arrangement as determined by the safety control logic, wherein the at least one safety sensor arrangement has at least two functionally re- dundant subsystems, wherein input to the control unit includes information indicating availability of the at least two functionally redundant subsystems, is characterized by the steps of activation of a normal mode of operation characterized by normal productivity in case the input indicates availability of all functionally redundant sub- systems, and activation of a fail-stop mode of operation characterized by zero productivity in case the input indicates unavailability of all functionally redundant sub- systems, and activation of a fail-operate mode of operation with productivity less than normal but above zero in case input indicates at least temporary unavailability of at least one and availability of at least another one of the functionally redundant subsys- tems.

So concerning a method of operation of a safety control system for controlling a ma- chine, said system having a hierarchical safety control structure with a control logic, a first safety device for detecting a first hazard situation in a first safety zone and in re- sponse to that triggering a first safety function mode, a second safety device for de- tecting a second hazard situation in a second safety zone and in response to that triggering a second safety function mode, the invention teaches that the method comprises the following steps:

- the control logic detects if there is a failure situation in one of the safety devices;

- if there is a failure situation in one of the safety devices, the control logic switches to the other safety device or applies one of the failure function modes. According to a further preferred embodiment of the present invention, the machine is being operable at least in a normal function mode and in an emergency function mode, the safety control system having a control logic communicatively coupled to the machine, a first safety device, communicatively coupled to the control logic, the control logic using the first safety device for detecting a first hazard situation in a first, critical safety zone, a second safety device communicatively coup!ed to the control logic, the control logic interacting with the machine in a way to operate in normal function mode in absence of a hazard situation, with the further steps: - the control logic uses the second safety device instead of the first safety device in case that a failure situation has been detected with the first safety device, and the control logic triggers the second safety function mode in case that a failure situation has been detected with the second safety device and no hazard situation has been detected by the first safety device. According to a further preferred embodiment of the present invention, the method comprises the further step that the safety control logic triggers the normal function mode in case that a failure situation has been detected with the first safety device, and no hazard situation has been detected by the second safety device.

According to a further preferred embodiment of the present invention the method comprises the further step that the control logic triggers the first function mode in case that a failure situation has been detected with the first safety device and a haz- ard situation has been detected by the second safety device.

According to a further preferred embodiment of the present invention the method comprises the further step that the control logic triggers the first safety function mode in case that a failure situation has been detected with the second safety device and a hazard situation has been detected by the first safety device.

According to a further preferred embodiment of the present invention the method comprises the further step that the control logic triggers the emergency safety func- tion mode in case that a failure situation has been detected with the first and second safety devices.

The invention will be described in greater detail by description of three embodiments with reference to the accompanying drawings, wherein

Fig. 1 is an exemplary and schematic representation of a safety control system according to the invention, Fig. 2 is an exemplary and schematic representation of a further embodiment of a safety control system according to the invention, Fig. 3 shows an example of hierarchical safety zone for a robot cell,

Fig. 4 shows an example with hierarchical safety zone for AGV,

Fig. 5 shows schematically the generalized scenario of a safety control system with basic safety logic,

Fig. 6 shows a scheme of failover and recovery for CRC errors

Fig. 7a-c show a schematic representation of an embodiment of the invention in dif- ferent failure situations.

Figure 1 shows an exemplary and schematic representation of a safety control sys- tem according to the invention. The safety control system 1 includes a control unit 3 which includes safety control logic. The control unit 3 receives input from a process via a process sensor arrangement 4. The process can be any technical process, for example a manufacturing cell, a robot or a robot system with several robots, or an autonomous guided vehicle (AGV), or a chemical process plant or a subsystem of a chemical process plant or the like. The term process is in the context of this invention here thus as well used to describe a machine.

The process or machine has certain safety critical zones which are surveyed by the safety sensor arrangement 4. This will be explained in more detail below in the con- text of figure 2, 3, 4 and 7a-c.

The control unit 3 receives signals containing information from the safety sensor ar- rangement 4, and evaluates the input received. For this purpose, the control unit 3 includes at least one input/output unit (l/O-unit). The safety control logic arranges for the evaluation of the information received at the input and generation of respective output signals containing respective output information to the process or machine, here in figure 1 schematically represented as machine arrangement 5. The machine arrangement 5, or machine or process, is operable in different modes of operation. For example, if the machine arrangement is an AGV, the different modes of operation can be different speeds, ranging from zero or stop, slow speed, a bit faster speed, normal speed. The same holds if the machine arrangement is a robot with at least one robot arm. Here the different modes of operation can as well be speed of move- ment of the robot arm or arms or even the area covered by the robot arm or arms, ranging from standstill via only a small segment, a larger segment to the full opera- tion zone. Each mode of operation is associated with a certain productivity of the ma- chine or machine arrangement or process. So for example if the robot stands still, productivity is zero. If it moves only slowly, productivity is low. If it moves with normal speed, productivity is normal.

The examples given above with the robot or the AGV are for exemplary example on- ly. It is understood, that for all kind of processes, including but not limited to, man- ufacturing processes with various other kinds of machines or chemical production processes, in an equivalent way different modes of operation with assigned different productivities can be defined.

In figure 1 the above explained is in an abstract manner illustrated as a machine ar- rangement 5, the modes of operation are indicated schematically as functional blocks or subsystems F ₀ with numeral 11 , F _N with numeral 12, Ft with numeral 13, F ₂ with numeral 14. Each functional block or subsystem is assigned a specific productivity. Function block or subsystem F ₀ is characterized by productivity P ₀ , function block or subsystem F _N is characterized by productivity P _N , function block or subsystem F ₁ is characterized by productivity P-i, function block or subsystem F ₂ is characterized by productivity P ₂ . Productivity P _N is the normal productivity. Productivity P ₀ is zero productivity, equivalent to a system stop. Productivity P ₁ is lower than normal produc- tivity PN, but larger than zero. Productivity P ₂ is larger than P- _f , but smaller than nor- mal productivity PN- The safety sensor arrangement 4 has two functionally redundant subsystems 8, 7. It could be even more than two. The function of the safety sensor arrangement 4 is surveillance of safety zones in the process, or in proximity to a machine or machine arrangement 5. Surveillance means that the safety sensor arrangement 4 with the functionally redundant subsystems 6, 7 detects potentially hazardous events H ₁ , H ₂ in the safety zones. A hazard event can be for example an obstacle in the path of tan AGV or a human person within the operation zone of a robot or robot system within reach of the robot arm or arms. Functionally redundant means, that both subsystems 6, 7 can redundantly be used for safety surveillance or detection of such hazard events. This can for example mean that there are two safety zones around the ma- chine 5, a critical one and a less critical one. The critical safety zone is for example characterized in that there is a high potential danger for the machine if an obstacle is within this zone, or there is a high potential safety risk for a human person potentially residing within this zone. So functionally redundant subsystems can for example be two subsystems surveying different safety zones each. This can be realized by one senor having two or more modes of surveillance for different zones, or by two different sensors, one for the first zone, and one for the other zone.

Each of the functionally redundant subsystems 6, 7 transmits information concerning presence or absence of a hazard event within its surveillance area to the control unit 3, using first signal input lines 15, 16. And in addition each of the functionally redun- dant subsystems 6, 7 transmits information concerning its availability to the control unit 3, using availability indicating input lines 8, 8'. Availability of a functional redun- dant subsystem of the sensor arrangement 4 can be limited or lacking either due to malfunction of the subsystem 6, 7 itself, or due to disturbed communication between the subsystem 6, 7 and the control unit 3.

Lacking availability of a safety sensor subsystem is a potential safety risk. Therefore in traditional safety control systems, as soon a availability of a safety sensor ar- rangement or safety sensor subsystem is not given any more, the related functional block or subsystem in the machine arrangement will be set to emergency stop, meaning zero productivity. In a significant number of cases, this would not be neces- sary, as the availability of the respective safety sensor or safety sensor subsystem gets restored automatically after a short time. Therefore in the safety control system 1 according to the invention as shown in figure 1 , the control logic 3 is configured to activate a normal mode of operation F _N charac- terized by normal productivity P _N in case the input indicates availability of all func- tionally redundant subsystems 6, 7, and is configured to activate a fail-stop mode Fo of operation characterized by zero productivity P ₀ in case the input 8 indicates una- vailability of all functionally redundant subsystems 6, 7, and is further configured to activate a fail-operate mode F ₁ , F ₂ of operation with productivity less than normal but above zero in case input 8 indicates temporary unavailability of at least one and availability of at least another one of the functionally redundant subsystems 6, 7. So only in case all subsystems are not available, the fail stop mode with zero productiv- ity is activated. In case of temporary unavailability of one of the subsystems, as long as at least one of the redundant subsystems is available, the machine arrangement will be set to a state of reduced productivity only, not zero, which increases to a large extent the overall availability of the safety-controlled machine arrangement 5. Looking now at figure 2, this shows an exemplary and schematic representation of a further embodiment of a safety control system 1 ' according to the invention. Figure 2 schematically shows a safety control system 1 ' for controlling a machine 2. The ma- chine 2 may be a robot, an AGV, or any other machine used in a discrete manufac- turing system or manufacturing cell. Related to the machine 2 there are defined a first, critical safety zone Z ₁ and a second, less critical safety zone Z ₂ . The first safety zone Z ₁ is being located closer to the machine 2 than the second safety zone Z ₂ . The first, critical safety zone Z1 is a subset of the second, less critical safety zone Z ₂ .

The safety control system 1 further comprises a control unit 3 which includes a safety logic and which is communicatively linked to the machine 2. There is further a first safety device D _{1 (} reference numeral 6, which is communicatively linked to the safety logic 3. It has a first hazard detecting means configured for detecting a hazard event H ₁ in the first safety zone Z ₁ . There is further a second safety device D ₂ , reference numeral 7, communicatively linked to the safety logic 3. It has second hazard de- tecting means configured for detecting a hazard event H ₂ in the second safety zone Z ₂ . Safety devices 6, 7 with hazard detecting means can be any kind of sensors known to be used for this purpose, for example proximity sensors, light barrier, laser scanner or the like. Safety devices 6, 7 are examples for what the more general and abstract term" functionally redundant sensor subsystems 6, 7, of a safety sensor ar- rangement 4" means. Here in figure 2 the first and second hazard detection means 6, 7, together form a kind of virtual safety sensor arrangement 4.

The machine 2 includes further a first actuator system having first safety function means configured to be triggered for executing a first safety function by the safety logic 3. The machine 2 includes further a second actuator system having second safety func- tion means configured to be triggered for executing a second safety function by the safety logic 3.

The first and second actuator systems may be, for example, the drives for the robot axis, or the drives for driving the AGV, or the like. Safety functions in this example would then be for example different drive speeds, the emergency function would in this example be the stop of the drives.

The control unit 3 further has input evaluation means 10 being configured to deter- mine the functional status and/or availability of the first and second safety devices 6, 7. The control unit 3 further has activation means 9 being configured for, in case of functioning and availability of the first and second safety devices 6, 7, triggering or activating the first actuator system for executing the first safety function upon detect- ing of a hazard event in the first safety zone Z ₁ , triggering or activating the second actuator system for executing the second safety function upon detecting a hazard event in the second safety zone Z ₂ . Input evaluation means 10 and activation means 9 may be implemented, for example, as I/O devices and associated program routines as part of a control operating program stored in memories within and executed by a microcomputer as part of the control unit 3 and its control logic. The activation means 9 are configured for triggering or activating the first actuator sy- stem for executing the first safety function F, upon determination of malfunction and/ or unavailability of the first safety device 6 and function and availability of the second safety device 7, and upon detecting a hazard event in the second safety zone Z ₂ .

The activation means 9 are further configured for triggering or activating the second actuator system for executing the second safety function F ₂ , in case the input evalu- ation means 10 determine a malfunction and/or unavailability of the second safety device 7 and determine functioning and availability of the first safety device 6, as long as the first safety means or hazard detection means 6 do not detect a hazard in the first safety zone Z ₁ , The activation means 9 are further configured for triggering or activating the second actuator system for executing the second safety function F ₂ , in case the input evalua- tion means 10 determine a malfunction and/or unavailability of the second safety de- vice 7 and function and availability of the first safety device 6, if the first hazard de- tection means or first safety device 6 does detect a hazard in the first safety zone Z ₁ , The activation means 9 are further configured for logic triggering the machine 2 for transition into a safe state, i.e. emergency stop for example, if the input evaluation means 10 determine malfunction and/or unavailability of the first and the second safety devices 6, 7.

In the following, the concept of hierarchical safety control as it is applied in the safety control system according to the invention will be explained.

A typical hazard event is that a human enters a defined zone where an operating machine may harm the human seriously. Traditionally, if such an event is detected, the machine is stopped. However, the severity of such a hazard can be differently so that sometime the machine can run at a reduced speed instead of stopping, so that the overall productivity of the machine is enhanced significantly.

For example see figures 2 or 3, one can define a first critical safety zone Z ₁ around a machine 2 or a machine arrangement 5, an industrial robot for example, where the violation of this zone leads to stopping the robot immediately, but if the human is in the neighborhood outside this zone Z ₁ , the robot can run at a reduced speed, so that the robot is able to stop, when the human enters zone Z ₁ .

Another example could be an AGV, see figure 4, which could run with reduced speed, if obstacles or a human worker is within a certain, but larger range Z ₂ , and it stops, when the distance becomes critical, like zone Z ₁ in the above example as shown in figure 4.

In a more general manner, the safety reaction can also depend on more accurate sensing of position, size and velocity of human or obstacles. And the safety reaction can also be stopping certain part of a production line, running on variable speed with parts of the line etc.

All these lead to a hierarchical safety control scheme that is beneficial in terms of en- hanced productivity while ensuring the same safety level.

In a simplified and generalized manner, we assume the following scenario: D ₁ := Safety device 1

H ₁ := Localized hazard event, to be detected by D ₁

F ₁ := (Safety) Function 1 (e.g. safe stop)

P ₁ := Productivity when operating with F ₁

D ₂ := Safety device 2

H ₂ := Less-localized hazard event, to be detected by D ₂

F ₂ := (Safety) Function 2 (e.g. reduced speed)

P ₂ := Productivity when operating with F ₂

with

100% = P _N > P ₂ > P ₁ > P ₀ = 0

and

H ₁ is subset of H ₂

which means that H ₁ is of the same kind like H ₂ , and is covered by H ₂ , but is more localized or detailed. In the robot example, figure 3 or 2, D ₁ would be a local sensor protecting the work space of the robot, and D ₂ a sensor observing the neighborhood. And with the AGV example, D ₁ could be a local sensor (e.g. laser scanner) sensing the front area ahead, and D ₂ a remote camera observing the work cell.

The safety control logic would be:

If H ₁ then

F ₁ // Productivity P ₁

Else

If H ₂ then F ₂ // Productivity P ₂

End If

Figure 5 illustrates this generalized scenario with corresponding basic safety logic, where any detected or implied safety device faults lead to E-Stop. The corresponding safety control implementation may follow the rules below:

NOK means either malfunction or unavailability of the safety device due to any rea- son, including temporary communication error.

In the following, the concept of fail-over as it is applied in the safety control system according to the invention will be explained.

Failover, general speaking, means switching to a redundant device or function, when a dedicated device or function fails.

As described above, in case, H ₁ cannot be detected due to malfunction of D ₁ or other reasons, e.g. communication error, it would cause the activation of emergency stop F _e , running the machine with P ₀ .

After F _e , the system must undergo error diagnostics and recovery, and must be re- started. The average time period for this process would be T _e .

But in case of temporary unavailability of the device, thus, if the device's function re- covers after an acceptable time period without the need to manually repair and re- start the system, one can try to bridge this time period by using redundant devices or functions.

Assume that H ₁ is covered indirectly by H ₂ , thus H ₁ is subset of H ₂ . It is then possible to change the logic using D ₂ as failover device of D ₁ , like this:

In this case, the machine would run at 100%, if no safety zone violation is detected. Thus, if D ₁ is not working, the safety control remains intact with switching of (H ₂ im- plies F ₂ ) to (H ₂ implies F ₁ ), running at 100% if no safety zone violation, or at least with P ₁ , when H ₂ . The productivity is lower than with D ₁ working, but higher compared with always stopping the machine, if D ₁ is not working.

In case D ₂ is at least temporarily, not available, the situation is slightly different: H ₂ is only partially covered by H ₁ . and D ₁ cannot be used as failover device to detect H _2.

However, we can use F ₂ as failover function for (D ₂ is NOK) in combination with H ₁ then F ₁ , thus activate F ₂ once D ₂ is NOK, and activate F-,, when H ₁ is detected by D ₁ . Because of H ₁ is subset of H ₂ , H ₂ is sufficiently considered with this failover strategy.

The resulting safety control implementation follows the rules below:

In the following, a sample scenario is described in which the failure situation is a CRC (cyclic redundancy check) error.

In the sample scenario it is assumed that the safety device D ₁ is connected remotely via PROFINET (with PROFIsafe protocol), temporary communication errors like CRC or Watchdog errors can occur, which in the current practice lead to emergency stop of the system. In the following, it is described how the failover concept can be applied to such scenarios.

Actually, failover is just a temporary solution to keep the machine running until the partial failure is recovered. Typically, if a safety device fails, manual intervention is needed to recover the failure, e.g. replace the device and restart the safety control. But in some cases, the failure is just temporary.

In this scenario, a closer look is taken at CRC errors, which are typical examples for temporary failures of the communication to the safety device. CRC errors can be de- tected by the safety controller. According to state of the art before the present inven- tion, an occasional single CRC error would cause an emergency stop, if no additional measure is implemented to cover this situation in the safety protocol implementation.

But in most cases, CRC errors disappear after a short time period, and a stable communication with the device is established again. In such a situation, when above described failover concept is applied, the system does not have to be stopped with a single CRC error, since there is a redundant safety device, and can recover itself au- tomatically by switching back to the normal safety functions, when the next telegram becomes valid, see figure 6.

Multiple CRC errors within a defined time interval are interpreted as a serious failure, in which case the machine must be stopped, see also Figure 6. The commonly ap- plied time interval for detection of CRC error accumulation is currently 100 hours.

A CRC error can be detected by proofing the check-sum. Therefore, the safety con- troller registers the communication failure and interprets it as a malfunction of the corresponding safety device, if CRC errors appear repeatedly.

In case of failure of the safety device itself, automatic recovery is unfortunately not possible. The safety control must be restarted.

In the following, a sample scenario is described in which the failure situation is a watchdog error. Another typical example for a temporary communication error are watchdog errors. These errors can happen each minute or even more often, depending on the param- eters used. The watchdog time defines the compromise between safety function re- sponse time and availability. The smaller the watchdog time is set, coming closer to the black channel performance, the higher is the probability that one may have to stop the machine because of a sudden black channel performance deficiency.

In the current state of the art practiced before the invention was made, there is no limitation on the occurrence frequency of a Watchdog error. But one would stop each time, similar to a CRC fault, if nothing is done to handle this on the application level.

A fail-over concept for the Watchdog error according to the present invention is par- ticularly beneficial for automatic guided vehicles (AGV) in automatic storage handling systems. Such AGVs are very often connected through wireless networks and con- trolled from the central location.

In case that the wireless connection is suddenly too slow, by a disturbance or a blocking wall impairing data transfer, etc., then the AGV control system loses com- munication to the central station and flags a Watchdog error because the communi- cation via wireless connection is too slow. One could start a timer instead of stopping the AGV in case of a Watchdog error. If within, e.g. 3 seconds the communication is not back and running, the AGV is stopped. Otherwise, it uses the local safety sen- sors, e.g. a laser scanner, as failover devices. In this scenario, the local sensor is D ₁ , equivalent to the first safety device 6, which detects presence of obstacles or humans in the immediate front of the vehicle, and triggers a controlled stop. Furthermore D ₂ , equivalent to the second safety device 7, observes the larger area and is connected via wireless communication to the local AGV control. If D ₂ is temporarily unavailable, the local AGV can switch to reduced speed and rely on the local sensor for an acceptable time period.

Of course, the concrete implementation of safety control with failover of devices or functions must take all aspects into consideration, which have impact on the achiev- able safety rating.

F ₁ g. 7 a - c shows a schematic representation of an embodiment of the invention in different failure situations, as example for a preferred embodiment of the control sys- tem according to the present invention. Figure 7a shows in a schematic and exemplarily way, a safety control system 1 , simi- lar to the one shown in figure 1. Figures 7a - c illustrate the method for operating a safety control system according to the invention. Figure 7a shows the situation where both safety sensor subsystems 6, 7 are available and functioning.

In case the first safety sensor subsystem 6, D ₁ , detects a hazard situation, Hi , in zone Z ₁ , the more safety critical zone, then the safety logic in the control unit 3 acti- vates the machine arrangement 5, the respective actuator, into the first mode of op- eration F ₁ with strongly reduced productivity P-i , F ₁ and P ₁ as defined and explained above.

In case the second safety sensor subsystem 7, D ₂ , detects a hazard situation, H ₂ , in zone Z ₂ , which includes Z1 by the way as Z1 is a subunit of Z2, the les safety critical zone, then the safety logic in the control unit 3 activates the machine arrangement 5, the respective actuator, into the second mode of operation F ₂ with less strongly re- duced productivity P ₂ , F ₂ and P2 as defined and explained above.

Figure 7b shows the situation where the safety sensor subsystem 6 is not available, symbolized by the dashed lines, but safety sensor subsystem 7 is available. In this scenario there is application of failover of D ₁ to D ₂ with failover from F ₂ to F ₁ . This means, in case the second safety sensor subsystem 7, D ₂ , detects a hazard event, the safety logic in the control unit 3 activates the machine arrangement 5, the respec- tive actuator, into the first mode of operation F ₁ with strongly reduced productivity P-i. This is a failover in the sense that for safety reasons the more restrictive safety func- tion Ft is applied for a hazard situation detected by subsystem D ₂ which is observing the less critical safety zone Z ₂ . But as Z ₂ includes Z ₁ , it might be that the hazard situ- ation detected by D ₂ has occurred in safety zone Z ₁ , and so it is in the sense of safe- ty control useful to activate the more restrictive safety function F ₁ , So as a failover the combination subsystem 1.2 - 2,3.1 or 7 -F ₁ comes to place.

Figure 7c shows the situation where the safety sensor subsystem 7, D ₂ , is not availa- ble, symbolized by the dashed lines, but safety sensor subsystem 6, D ₁ , is available, in case of unavailability of D ₂ , there is no explicit failover of device function. Instead, the safety function for H ₂ is taken as a general failover function, i.e., F ₂ is triggered if (D ₂ NOK). In other words, if D ₂ is NOK, then F ₂ is triggered, reducing speed and productivity from P ₀ to P ₂ , even if D ₁ does not detect a hazard situation, for safety and precaution reasons. If then in addition D ₁ detects a hazard situation in zone Z ₁ , then F ₁ is triggered, further reducing speed and productivity to

List of reference numerals

1 safety control system

r safety control system

3 control unit

4 safety sensor arrangement

5 machine arrangement

6 first safety sensor subsystem D ₁

7 second safety sensor subsystem D ₂

8 information indicating availability of subsystem

8' information indicating availability of subsystem

9 activation means

10 input evaluation means

1 1 functional block / functional subsystem

12 functional block / functional subsystem

13 functional block / functional subsystem

14 functional block / functional subsystem

15 first signal input line

16 second signal input line

Z1 first, critical safety zone

Z2 second, less critical safety zone