Safety circuit with automatic recovery

• US 20030050735A1
• Filed: 09/11/2002
• Published: 03/13/2003
• Est. Priority Date: 09/12/2001
• Status: Active Grant

• Current Assignee: Eigenpoint Company
• Original Assignee: Eigenpoint Company
• Inventors: Griffis, Michael
• Granted Patent: US 6,683,432 B2
• Time in Patent Office: Days
• US Class Current: 700/255
• CPC Class Codes: G05B 19/4061 Avoiding collision or forbidden zones
• CPC Class Codes: G05B 2219/37631 Means detecting object in forbidden zone
• CPC Class Codes: G05B 2219/39088 Inhibit movement in one axis if collision danger

Abstract

A safety circuit is described that monitors a number of sensors for intrusion of objects or people into the workspace of a robot and controls the drive power to the motion control system via an emergency-stop circuit. The system monitors the motion control system and models it as just another sensor to ensure that it is working properly. In the event that there is intrusion, the safety circuit assigns a degree of intrusion (e.g., precautionary or serious). For serious intrusions, the safety circuit kills drive power thereby preventing additional motion of the robot. Killing drive power (de-energizing the emergency-stop circuit) requires a qualified operator to restart for further operation. For precautionary intrusions, the safety circuit takes control of the motion control system by disabling the power stages of motion control amplifiers but retaining drive power there. This inhibits further motion. The safety circuit keeps the amplifiers inhibited for a period to permit the intrusion time to clear. In the event that the intrusion clears quickly, the safety circuit releases control of the power stage to permit continued operation (automatic recovery). This can reduce the occurrences of nuisance trips of the emergency-stop circuit. Various means in the architecture are described here to ensure and verify that the system is safe. This is advantageous because scrutiny of the approach can be focused on the limited functionality (software, hardware) of the safety circuit. Highly complex functionality (software, hardware) of the motion control system can be safely modeled as potentially unsafe, thereby requiring far less scrutiny.

Claims

1. An electronic control system for machinery comprising:

at least one sensor for providing at least one intrusion signal of an unsafe condition associated with the sensor;

a safety circuit for receiving said signal, determining a severity level, and controlling operation of the machinery in a plurality of operating states based on said severity level.

2. The electronic control system of claim 1 wherein said operating states comprise at least one of unrestricted operation (ACTIVE), partially restricted operation (HALT), totally restricted operation (KILLED), and standby (DISABLED);

and said states are carried out by at least one of a motion control system and an emergency-stop circuit.

3. The electronic control system of claim 2 wherein the severity level comprises a first level (LEVEL 1) and a second level (LEVEL 2), wherein said first level is more severe than said second level.

4. The electronic control system of claim 2 wherein said ACTIVE state does not restrict operation of said machine.

5. The electronic control system of claim 2 wherein said HALT state restricts motion for each affected axis through said motion control system.

6. The electronic control system of claim 2 wherein said KILLED state stops motion for each affected axis through said motion control system and stops the flow of bulk power to the machine through said emergency-stop circuit.

7. The electronic control system of claim 2 wherein said DISABLED state is a standby state prior to going to the ACTIVE state.

8. The electronic control system of claim 3 wherein the safety circuit initiates the HALT state from the ACTIVE state upon receiving said intrusion signal.

9. The electronic control system of claim 8 wherein the safety circuit remains in the HALT state upon determining LEVEL 2 severity and returns to the ACTIVE state when said LEVEL 2 severity is cleared.

10. The electronic control system of claim 3 wherein the safety circuit initiates the KILLED state from the HALT state upon determining a LEVEL 1 severity.

11. The electronic control system of claim 3 wherein the safety circuit initiates the KILLED state from said HALT state upon determining at least one of a loss of drive power, a fault signal from said safety circuit, or a fault signal from said motion control system.

12. The electronic control system of claim 3 wherein the safety circuit initiates a DISABLED state from the HALT state when said LEVEL 2 severity is cleared and a fault signal from said motion control system is determined.

13. The electronic control system of claim 3 wherein the safety circuit initiates the KILLED state from the ACTIVE state upon receiving said LEVEL 1 severity.

14. The electronic control system of claim 3 wherein the safety circuit initiates the DISABLED state from the ACTIVE state upon determining a fault signal from said motion control system.

15. The electronic control system of claim 3 wherein the safety circuit initiates the KILLED state from the DISABLED state upon determining at least one of a loss of drive power, a fault signal from said safety circuit, or a fault signal from said motion control system.

16. The electronic control system of claim 3 wherein the safety circuit initiates the ACTIVE state from the DISABLED state when no intrusion signal is received and no fault signal from said motion control system is determined.

17. The electronic control system of claim 3 wherein the safety circuit initiates the HALT state from the DISABLED state when said intrusion signal is received.

18. The electronic control system of claim 3 wherein the safety circuit initiates the DISABLED state from the KILLED state when no intrusion signal is received, drive power is started, and safety tests have passed.

19. The electronic control system of claim 3 wherein the safety circuit initiates an ERROR state from the KILLED state when a fault signal from said safety circuit is determined.

20. The electronic control system of claim 19 wherein the safety circuit returns from said ERROR state to the KILLED state when the safety circuit is corrected eliminating the fault.

21. The electronic control system of claim 1 wherein said sensor comprises an intrusion sensor.

22. A method for providing electronic control of machinery comprising:

sensing at least one unsafe condition;

determining a level of severity of the unsafe condition; and

controlling the operation of the machinery in a plurality of operating states based on said severity level.

23. The method for providing electronic control of claim 22 wherein said operating states comprise at least one of unrestricted operation (ACTIVE), partially restricted operation (HALT), totally restricted operation (KILLED), and standby (DISABLED);

and said states are carried out by at least one of a motion control system and an emergency-stop circuit.

24. The method for providing electronic control of claim 23 wherein the severity level comprises a first level (LEVEL 1) and a second level (LEVEL 2), wherein said first level is more severe than said second level.

25. The method for providing electronic control of claim 23 wherein said HALT state restricts motion for each affected axis through said motion control system.

26. The method for providing electronic control of claim 23 wherein said KILLED state stops motion for each affected axis through said motion control system and stops the flow of bulk power to the machine through said emergency-stop circuit.

27. The method for providing electronic control of claim 23 wherein said DISABLED state is a standby state prior to going to the ACTIVE state.

28. The method for providing electronic control of claim 24 wherein the safety circuit initiates the HALT state from the ACTIVE state upon receiving said intrusion signal.

29. The method for providing electronic control of claim 28 wherein the safety circuit remains in the HALT state upon determining LEVEL 2 severity and returns to the ACTIVE state when said LEVEL 2 severity is cleared.

30. The method for providing electronic control of claim 24 wherein the safety circuit initiates the KILLED state from the HALT state upon determining a LEVEL 1 severity.

31. The method for providing electronic control of claim 24 wherein the safety circuit initiates the KILLED state from said HALT state upon determining at least one of a loss of drive power, a fault signal from said safety circuit, or a fault signal from said motion control system.

32. The method for providing electronic control of claim 24 wherein the safety circuit initiates a DISABLED state from the HALT state when said LEVEL 2 severity is cleared and a fault signal from said motion control system is determined.

33. The method for providing electronic control of claim 24 wherein the safety circuit initiates the KILLED state from the ACTIVE state upon receiving said LEVEL 1 severity.

34. The method for providing electronic control of claim 24 wherein the safety circuit initiates the DISABLED state from the ACTIVE state upon determining a fault signal from said motion control system.

35. The method for providing electronic control of claim 24 wherein the safety circuit initiates the KILLED state from the DISABLED state upon determining at least one of a loss of drive power, a fault signal from said safety circuit, or a fault signal from said motion control system.

36. The method for providing electronic control of claim 24 wherein the safety circuit initiates the ACTIVE state from the DISABLED state when no intrusion signal is received and no fault signal from said motion control system is determined.

37. The method for providing electronic control of claim 24 wherein the safety circuit initiates the HALT state from the DISABLED state when said intrusion signal is received.

38. The method for providing electronic control of claim 24 wherein the safety circuit initiates the DISABLED state from the KILLED state when no intrusion signal is received, drive power is started, and safety tests have passed.

39. The method for providing electronic control of claim 24 wherein the safety circuit initiates an ERROR state from the KILLED state when a fault signal from said safety circuit is determined.

40. The method for providing electronic control of claim 39 wherein the safety circuit returns from said ERROR state to the KILLED state when the safety circuit is corrected eliminating the fault.