DE202018006821U1 - Safe tool changer - Google Patents

Abstract

Tool changer (1) for safely changing tools, the tool changer (1) comprising:
- a master unit (2) comprising:
- a safety controller (21) with at least two separate processing circuit arrangements (22, 23),
- a connecting device (24) which comprises at least two valves (241, 242),
- at least two connection sensors (25, 26),
- a tool unit (3) comprising:
- at least one tool unit sensor (31) which detects whether the tool unit (3) is located in a tool stand (4), the at least one tool unit sensor (31) delivering two output signals (32, 33) and the output signals to the safety controller (21 ) are sent when the tool unit (3) is connected to the master unit (2), the connection means (24) switching between a connected state in which the tool unit (3) is connected to the master unit (2) and a disconnected state is movable in that the tool unit (3) is disconnected from the master unit (2), the connection means (24) being moved from the connected state to the disconnected state when both valves are actuated, and the at least two connection sensors (25, 26) recognize individually whether the tool unit (3) is connected to the master unit (2) via the connection device (24) and the output signals are sent from the connection sensors (25, 26) to the safety controller (21),
the two separate processing circuitry (22, 23) being individually arranged to:
- receive a request to disconnect the tool unit (3),
- receive the output from the at least two connection sensors (25, 26) and the at least one tool unit sensor (31),
- determine on the basis of the output from the at least two connection sensors (25, 26) whether the tool unit (3) is connected to the master unit (2) via the connection device (24),
- determine whether the tool unit (3) is in the tool stand (4) based on the output from the at least one tool unit sensor (31),
- send the result of the determinations to the other processing circuitry,
- receive a result of determinations from the other processing circuitry,
- a first (22) of the two separate processing circuits (22, 23) sends a disconnect signal to operate a first valve (241) of the two valves and a second (23) of the two separate processing circuits (22, 23) sends the disconnect signal to operate a second valve (242) of the two valves if the determination result is identical to the received determination result and if the determination results both indicate that:
◯ no tool unit (3) is connected to the master unit (2), or
◯ the tool unit (3) is connected to the master unit (2) and also located in the tool stand (4), the connecting means (24) being arranged to move to a disconnected state when the at least two separate processing circuitry ( 22, 23) both send a disconnection signal to disconnect the tool unit (3).

Description

technical field

The present invention relates to a tool changer for changing tools safely.

background

For a number of years, robots have been used in industry to perform repetitive work tasks such as welding, riveting, assembly of sub-components, and the like. However, for some work tasks, tools at the end of the robot arm need to be changed in order to increase the number of work tasks that the robot can perform. Separable attachment devices have therefore been developed, enabling the robot to change tools automatically.

Different types of tool changers are commonly used to simplify and allow flexible use of robots in different applications. Such a tool changer is mounted on the robot arm and can, with a special attachment or connection device, grip and hold various tools mounted on tool mounting plates. Gripping and holding the tool must then be safe and comply with current standards and regulations. The word "secure" used in the following text means "according to relevant safety standards". In addition to the secure mechanical design and construction, the logic control of connecting and disconnecting the tool changer must also be secure.

Safely disconnecting or opening the tool changer means that opening is not permitted until no tool is attached in the tool changer, or if a tool is attached, the tool must be in the tool stand.

Current safe control and latching of the disconnect request signal from the robot controller typically uses a safety relay mounted in the robot control cabinet that interrupts the disconnect signal when the goal is to prevent the tool changer from opening. Normally all tool stands are equipped with switches that are wired to the safety relay. Only when all switches indicate that all tools are in the tool stands, i.e. the robot is not holding any tools, should it be possible to open the tool changer.

Such safe solutions involve quite high costs for the additional safety relay and the physical wiring from the tool stand switches to the robot control cabinet. In other words, a problem with existing solutions is that physical cables are required between the tool stand switches and the robot control cabinet, making the system difficult to set up.

The US6840895B2 discloses a robotic tool changer with a safety interlock. The tool changer is simplified in 1 shown. An interlocking switch 34 is used which is a normally open electrical contact and a plunger which is depressed by an actuating surface on the tool stand 4 thus closing the electrical contact. The tool cannot be separated from the robot arm as long as the electrical contact is open; which is the case as long as the tool 5 is not in the tool stand.

A proximity detector 27 on the master unit 2 and a proximity indicator 35 on the tool unit 3 are used to detect whether a tool unit 3 is attached to the master unit 2 . A relay 28 in the master unit is energized by a tool present signal from the proximity detector. When the controller 29 sends a signal to disconnect the tool assembly, the unlock signal cannot actuate the connector 24 without passing through the interlock switch 34 which is closed only when the tool is in the tool stand. In other words, the tool unit cannot be separated from the master unit until a tool present signal is present and the tool is in the tool stand.

With the known solution there is a risk that if one of the input signals fails or is erroneous, the interlocking switch may disconnect the tool unit on the basis of erroneous information. There is therefore a need for a tool changer with improved security.

Summary of the Invention

The aim of the present invention is to at least partially overcome the above problems and to provide an improved tool changer with improved safety when changing tools.

This aim is achieved with a device according to claim 1.

• - eine Anforderung zum Trennen der Werkzeugeinheit empfangen,
• - die Ausgabe von den mindestens zwei Verbindungssensoren und dem mindestens einen Werkzeugeinheitsensor empfangen,
• - auf Grundlage der Ausgabe von den mindestens zwei Verbindungssensoren feststellen, ob die Werkzeugeinheit mit der Mastereinheit über die Verbindungseinrichtung verbunden ist,
• - auf Grundlage der Ausgabe von dem mindestens einen Werkzeugeinheitsensor feststellen, ob sich die Werkzeugeinheit im Werkzeugständer befindet,
• - das Ergebnis der Feststellungen an die andere Verarbeitungsschaltungsanordnung senden,
• - ein Ergebnis von Feststellungen aus der anderen Verarbeitungsschaltungsanordnung empfangen,
• - ein Trennsignal an die Verbindungseinrichtung zum Trennen der Werkzeugeinheit von der Mastereinheit mit der Verbindungseinrichtung senden, wenn das Ergebnis der Feststellungen identisch ist mit dem empfangenen Ergebnis von Feststellungen und wenn die Ergebnisse der Feststellungen beide erkennen lassen, dass:
  • ◯ keine Werkzeugeinheit mit der Mastereinheit verbunden ist, oder
  • ◯ die Werkzeugeinheit mit der Mastereinheit verbunden ist und sich auch im Werkzeugständer befindet.

According to some aspects of the disclosure, it provides a tool changer for safely changing tools. The tool changer includes a master unit that includes a safety controller with at least two separate processing circuitry, a connector, and at least two connector sensors. The tool changer also includes a tool unit that includes at least one tool unit sensor that detects whether the tool unit is in a tool stand, wherein the at least one tool unit sensor provides two output signals and the output signals are sent to the safety controller when the tool unit is connected to the master unit . The connection device is movable between a connected state, in which the tool unit is connected to the master unit, and a disconnected state, in which the tool unit is disconnected from the master unit, and the at least two connection sensors individually detect whether the tool unit is connected to the master unit via the Connection device is connected, and the output signals from the connection sensors are sent to the safety controller. The two separate processing circuitry are individually arranged to:

• - received a request to disconnect the tool unit,
• - receive the output from the at least two connection sensors and the at least one tool unit sensor,
• - determine whether the tool unit is connected to the master unit via the connection device based on the output from the at least two connection sensors,
• - determine whether the tool unit is in the tool stand based on the output from the at least one tool unit sensor,
• - send the result of the determinations to the other processing circuitry,
• - receive a result of determinations from the other processing circuitry,
• - send a disconnection signal to the connection device to disconnect the tool unit from the master unit with the connection device if the result of the determinations is identical to the received result of determinations and if the results of the determinations both indicate that:
  • ◯ no tool unit is connected to the master unit, or
  • ◯ the tool unit is connected to the master unit and is also located in the tool stand.

The connector is arranged to move to a disconnected state when the at least two separate processing circuitry both send a disconnect signal to disconnect the tool unit. Compared to the prior art, this tool changer provides more safety in several aspects. There are at least two sensors that individually determine whether the tool unit is connected to the master unit. The two sensors must both show that it is connected, so that there is no disconnection if one of the sensors fails. So if a sensor fails, it will be detected immediately and the tool changer will not separate the tool unit.

There is at least one tool unit sensor that detects whether the tool unit is in the tool stand and has at least two outputs, both of which must indicate the same thing for a disconnect to occur. So there are two channels and both channels must show that the tool is in the tool stand before a disconnect occurs. So if a channel has interference, there will be no disconnection.

The determination of whether it is safe to disconnect the tool unit is made independently by two different processing circuitry. In other words, two independent processing circuitries each collect sensor data from all of the sensors and determine what the state of the tool changer is. No separation can take place if both processing circuitry do not agree on the results. Furthermore, both processing circuitry must send a disconnect signal in order for the disconnect to be triggered.

In other words, the two processing circuitry independently determine whether both connection sensors indicate that the tool unit is connected to the master unit, determine whether both channels of tool unit sensors indicate that the tool unit is in the tool stand, and determine whether the other processing circuitry comes to the same conclusions, and sends a disconnect signal if a disconnect is allowed and has been requested. Furthermore, the tool unit will not be disconnected until both processing circuitry send the disconnect signal.

Due to the multiple redundancies and the way the tool changer is built, any defects or errors are detected so that the tool unit is not separated from the master unit in an unacceptable state.

In some aspects, the at least one tool unit sensor includes two 24V power connections that are activated by a passive circuit in the tool stand, and its signals are routed from the tool unit to the security module when the tool unit is in the tool stand and when the tool unit is connected to the master unit connected is. In other words, there are two channels that indicate whether the tool unit is in the tool stand; both are sent to both processing circuitry. If there are discrepancies between the signals, the tool changer will not separate the tool unit. The passive circuitry in the tool stand is circuitry that does not require a power supply, such as an RFID circuitry.

In some aspects, the at least one tool unit sensor is at least two tool unit sensors. The at least one tool unit can therefore include two channels and can also be two different sensors, each with one channel.

In some aspects, the two separate processing circuitry are two different types of processing circuitry. Different types of processing circuitry may have different weaknesses and also approach calculations differently. It is therefore advantageous to use two different types so that the processing circuitry is not only redundant in number but also in how it makes calculations and how it processes data. The selection of different technologies brings with it a higher security rating.

In some aspects, the two different types of processing circuitry are selected from the following types: a microcontroller (MCU), a complex programmable logic device (CPLD), a field programmable gate array (FPGA), and a programmable array logic (PAL). Such circuits are accessible, cheap and robust. For example, both MCU and CPLD are inexpensive and easy to program.

In some aspects, the at least two connection sensors are different sensor types. Different types of sensors use different means to detect whether the master unit and the tool unit are connected. Since different sensors may react to different things, it is advantageous to use different sensors as it improves the robustness of the system. For example, if a type of sensor is used that is water sensitive during operation and if the tool changer is used in a humid environment, another sensor may be of a non-water sensitive type to minimize the risk of the sensors interfering at the same time.

In some aspects, the different sensor types are selected from the following types: mechanical switches, electrical contacts, and proximity sensors. These sensor types can represent stable and robust sensors with reliable output.

In some aspects, the mechanical switch includes a normally closed switch that provides a high signal when the tool unit is disconnected from the master unit, the electrical contact includes a bridge that is connected across the tool unit and provides a high signal when the tool unit is connected to the master unit, and the proximity sensors include inductive sensors, magnetic sensors, capacitive sensors, optical sensors and RFID sensors.

In some aspects, the connector includes at least two valves, and wherein the connector is moved from the connected state to the disconnected state when both valves are actuated, and a first of the two separate processing circuitry sends the disconnect signal to actuate a first valve of the two valves and a second of the two separate processing circuitry sending the disconnect signal to actuate a second valve of the two valves. In other words, the connector is arranged to move to a disconnected state when the at least two separate processing circuitry both send a disconnect signal for disconnecting the tool unit, and the disconnect signal is a signal sent by the two processing circuitry to one valve each .

In some aspects, the at least two separate processing circuitry are individually arranged to determine whether any of the received sensor output values indicate an unexpected condition in the tool changer and that they do not send the disconnect signal in case of an unexpected condition. An unexpected condition provides a sensor output value outside of a predetermined range of values. A check for unexpected states thus takes place in both processing circuit arrangements. For example, an unexpected condition is when two sensor readings that should indicate the same condition indicate different states.

character list

• 1 zeigt einen Werkzeugwechsler gemäß der US 6840895 B2 nach dem Stand der Technik,
• 2 zeigt ein Blockschaubild, das die Offenbarung nach Anspruch 1 veranschaulicht,
• 3 zeigt eine Darstellung des Werkzeugwechslers gemäß einigen Aspekten der Offenbarung,
• 4 zeigt eine Darstellung der Hardwarearchitektur des Werkzeugwechslers gemäß einigen Aspekten der Offenbarung,
• 5 zeigt die Schritte, die einzeln von den mindestens zwei Verarbeitungsschaltungsanordnungen ausgeführt werden.

The invention will now be explained in more detail with the description of various embodiments of the invention and with reference to the attached figures.

• 1 shows a tool changer according to the US6840895B2 According to the state of the art,
• 2 shows a block diagram illustrating the disclosure of claim 1,
• 3 12 shows an illustration of the tool changer according to some aspects of the disclosure,
• 4 12 shows a representation of the hardware architecture of the tool changer, in accordance with some aspects of the disclosure;
• 5 Figure 12 shows the steps performed individually by the at least two processing circuitry.

Description of the exemplary embodiments

Aspects of the present disclosure are described more fully below with reference to the accompanying drawings. However, the apparatus disclosed herein may be embodied in many different forms and should not be construed as limited to the aspects set forth herein. Like reference numbers in the drawings refer to like elements throughout.

The terminology used herein is for the purpose of describing particular aspects of the disclosure only and is not intended to be limiting of the invention. As used herein, the singular forms “a”, “an”, “the”, “the” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise.

Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs. It is further understood that terms used throughout this document should be construed to have a meaning consistent with their meaning in the context of this specification and the relevant art, and not in an idealized or overly formal sense, unless they are not expressly so defined herein.

As discussed in the Background section, 1 a simplified representation of the US6840895B2 presented solution, which discloses a robot tool changer 1 with a safety interlock with a relay 28.

As in the US6840895B2 a tool changer 1 normally comprises a master unit 2 and a tool unit 3, the master unit 2 being mounted on the robot arm, with a connecting device 24, i.e. connecting means, for connecting the tool unit 3 with a tool 5 mounted thereon.

In this disclosure, the master unit 2 is provided with an integrated safety controller 21 for safely interlocking a disconnection request from the controller, which is simplified in 2 is shown. 2 Figure 1 is an illustration according to the broadest aspects of the disclosure.

One aspect of the present disclosure is the replacement of the safety relay and all wiring between tool stands and the robot control cabinet with the proposed safety control system. This safety control is an integral part of the tool changer 1 and thus includes the safe locking of a separation request from the robot control.

• Verriegelung des Werkzeugwechslers 1, Trennen nur dann möglich, d.h. Möglichkeit zum Trennen nur dann, wenn:
  1. 1. die Mastereinheit 2 von jeder beliebigen Werkzeugeinheit 3 getrennt ist oder
  2. 2. die Mastereinheit 2 mit der damit verbundenen Werkzeugeinheit 3 im Werkzeugständer 4 angeordnet ist.

The basis of the safety controller 21 is the use of safe input values from various sensors to detect whether the master unit 2 is connected to a tool unit 3 and if it is, whether the tool unit 3 is located with a tool 5 in a tool stand 4 . Using safe logic circuitry and software, the robot will latch the disconnect request under the following conditions:

• Locking of tool changer 1, disconnection only possible, ie possibility of disconnection only if:
  1. 1. the master unit 2 is separate from any tool unit 3 or
  2. 2. the master unit 2 with the tool unit 3 connected to it is arranged in the tool stand 4 .

• • automatisches Verbinden des Werkzeugwechslers 1, wenn ein Werkzeug 5 in den Werkzeugwechsler 1 gesteckt wird
• • eingebaute Überwachung aller Signale und Sensoren
• • Datenübertragung per Bus oder über Drähte
• • automatische Abschaltung 24V während Werkzeugwechsel
• • automatische Unterbrechung der Stromversorgung von Ventilen bei Notaus

The disclosure additionally includes the following benefits:

• • automatic connection of tool changer 1 when a tool 5 is inserted into tool changer 1
• • built-in monitoring of all signals and sensors
• • Data transmission via bus or via wires
• • 24V automatic shutdown during tool change
• • automatic cut-off of the power supply to valves in the event of an emergency stop

The safety unit or, to put it another way, the safety controller 21 is mounted on or arranged in the master unit 2 of the tool changer 1, as in FIG 2 is shown. As previously discussed, illustrated 2 the disclosure according to its broadest aspects and shows a tool changer 1 for changing tools safely. The tool changer 1 comprises a master unit 2 which comprises a safety controller 21 with at least two separate processing circuit arrangements 22,23. The master unit 2 also comprises a connection device 24 and at least two connection sensors 25, 26.

The two separate processing circuitry 22, 23 are, according to some aspects of the disclosure, two different types of processing circuitry 22, 23. Different types of processing circuitry 22, 23 may have different weaknesses and also approach calculations differently. For example, some processing circuitry may be more sensitive to physical movement or temperature differences. It is therefore advantageous to use two different types in order for the processing circuitry 22, 23 to be redundant not only in number but also in how they make calculations and how they process data. The selection of different technologies brings with it a higher security rating. For example, both MCU and CPLD are inexpensive and easy to program. The two different types of processing circuitry 22, 23 are selected, for example, from the following types: a microcontroller (MCU), a complex programmable logic device (CPLD), a field programmable gate array (FPGA) and a programmable array logic (PAL). Such circuits are accessible, cheap and robust.

The tool changer 1 also includes a tool unit 3 which includes at least one tool unit sensor 31 which detects whether the tool unit 3 is in a tool stand 4, the at least one tool unit sensor 31 provides two output signals 32, 33 and the output signals are sent to the safety controller 21 , when the tool unit 3 is connected to the master unit 2. The tool unit is a unit attached to a tool 5 . The tool unit is used to connect the tool to the robot via the master unit. The tool unit 3 can be an integral part of the tool 5 or the tool unit can be attached to the tool so that the tool 5 is connected to the robot via the tool unit and the master unit.

According to some aspects of the disclosure, the at least one tool unit sensor 31 comprises two 24V power connections that are activated by a passive circuit 41 in the tool stand 4, and its signals are routed from the tool unit 3 to the safety module when the tool unit 3 is in the tool stand 4 and when the tool unit 3 is connected to the master unit 2. In other words, there are two channels 32, 33 for the output signal, which indicate whether the tool unit 3 is in the tool stand 4; both are sent to both processing circuitry 22, 23 in the safety controller. If there are discrepancies between the signals, the tool changer 1 does not separate the tool unit 3. The passive circuit 41 in the tool stand 4 is a circuit that does not require a power supply, such as an RFID circuit. In some aspects, the at least one tool unit sensor 31 is at least two tool unit sensors. The at least one tool unit 3 therefore includes two channels and can also be two different sensors, each with one channel. In such a case, the two tool unit sensors are individual sensors that do not affect their respective output signals. Other types of sensors that can be used are inductive sensors and magnetic sensors.

The connecting device 24 is movable between a connected state in which the tool unit 3 is connected to the master unit 2 and a disconnected state in which the tool unit 3 is disconnected from the master unit 2 . The connection device is in 2 represented as a two-port box from the safety controller 21 . The figure only shows a tool changer 1 with connections for illustrative purposes. The connection device is a complex part of the system and Reaction examples are described in more detail below.

The connector, according to some aspects of the disclosure, comprises at least two valves, and wherein the connector is moved from the connected state to the disconnected state when both valves are actuated, and a first 22 of the two separate processing circuitry 22, 23 uses the disconnect signal to actuate one first valve 241 of the two valves and a second 23 of the two separate processing circuitry 22, 23 sends the disconnect signal to operate a second valve 242 of the two valves. In other words, the connecting device 24 is set up so that it moves into a disconnected state when the at least two separate processing circuit arrangements 22, 23 both send a disconnect signal for disconnecting the tool unit 3, and the disconnect signal is a signal transmitted by the two processing circuit arrangements 22 , 23 is sent to one valve at a time. The two valves are, for example, monostable, double 3/2-way valves, normally open/normally closed. A single monostable valve or a single bistable valve can be used, but not with the same degree of safety as using monostable double valves. Valve selection can be influenced by other factors, such as cost.

The at least two connection sensors 25, 26 individually detect whether the tool unit 3 is connected to the master unit 2 via the connection device 24. The output signals from the connection sensors 25, 26 are sent to the safety controller 21.

As with the processing circuitry, the at least two link sensors 25, 26 are also different sensor types, according to some aspects of the disclosure. Different types of sensors use different means to detect whether the master unit 2 and the tool unit 3 are connected. Since different sensors may react to different things, it is advantageous to use different sensors as it improves the robustness of the system. For example, if one type of sensor is used that is water sensitive during operation and the tool changer 1 is used in a humid environment, the other sensor may be of a non-water sensitive type to minimize the risk of the sensors interfering at the same time. In some aspects, the different sensor types are selected from the following types: mechanical switches, electrical contacts, and proximity sensors. These sensor types can represent stable and robust sensors with reliable output. In some aspects, the mechanical switch includes a normally closed switch that provides a high signal when the tool unit 3 is disconnected from the master unit 2, the electrical contact includes a bridge connected across the tool unit 3 and a high signal provides when the tool unit 3 is connected to the master unit 2, and the proximity sensors include inductive sensors, magnetic sensors, capacitive sensors, optical sensors and RFID sensors. Choosing different technologies brings with it higher security ratings. A bridge is both reliable and cheap. Inductive sensors are reliable and are characterized by a good MTTF value, the mean time to failure, than mechanical sensors, for example.

It should be noted that both the processing circuitry and the connection sensors can be of the same type. There are many aspects to consider when determining which processing types and sensor types to select, with robustness and reliability being very important aspects.

• - eine Anforderung zum Trennen der Werkzeugeinheit 3 empfangen,
• - die Ausgabe von den mindestens zwei Verbindungssensoren 25, 26 und dem mindestens einen Werkzeugeinheitsensor 31 empfangen,
• - auf Grundlage der Ausgabe von den mindestens zwei Verbindungssensoren 25, 26 feststellen, ob die Werkzeugeinheit 3 mit der Mastereinheit 2 über die Verbindungseinrichtung 24 verbunden ist,
• - auf Grundlage der Ausgabe von dem mindestens einen Werkzeugeinheitsensor 31 feststellen, ob sich die Werkzeugeinheit 3 im Werkzeugständer 4 befindet,
• - das Ergebnis der Feststellungen an die andere Verarbeitungsschaltungsanordnung senden,
• - ein Ergebnis von Feststellungen aus der anderen Verarbeitungsschaltungsanordnung empfangen,
• - ein Trennsignal an die Verbindungseinrichtung 24 zum Trennen der Werkzeugeinheit 3 von der Mastereinheit 2 mit der Verbindungseinrichtung 24 senden, wenn das Ergebnis der Feststellungen identisch ist mit dem empfangenen Ergebnis von Feststellungen und wenn die Ergebnisse der Feststellungen beide erkennen lassen, dass:
  • ◯ keine Werkzeugeinheit 3 mit der Mastereinheit 2 verbunden ist, oder
  • ◯ die Werkzeugeinheit 3 mit der Mastereinheit 2 verbunden ist und sich auch im Werkzeugständer 4 befindet.

The two separate processing circuitry 22, 23 both check the sensor readings from all sensors and additionally check each other for consistency to see if both processing circuitry are coming to the same results. In the process of determining whether the processing circuitry should send a disconnect signal, the two separate processing circuitry 22, 23 are individually arranged to:

• - received a request to disconnect the tool unit 3,
• - receive the output from the at least two connection sensors 25, 26 and the at least one tool unit sensor 31,
• - determine on the basis of the output from the at least two connection sensors 25, 26 whether the tool unit 3 is connected to the master unit 2 via the connection device 24,
• - determine whether the tool unit 3 is in the tool stand 4 based on the output from the at least one tool unit sensor 31,
• - send the result of the determinations to the other processing circuitry,
• - receive a result of determinations from the other processing circuitry,
• - send a disconnection signal to the connection device 24 for disconnecting the tool unit 3 from the master unit 2 with the connection device 24 if the result of the determinations is identical to the received result of determinations and if the results of the determinations both indicate that:
  • ◯ no tool unit 3 is connected to the master unit 2, or
  • ◯ the tool unit 3 is connected to the master unit 2 and is also located in the tool stand 4.

In other words, both processing circuitry perform the above steps individually. The steps of both processing circuitry are in 5 illustrated.

In some aspects, receiving a request occurs from a robot controller. According to some aspects, the output values of the sensors are received via direct wiring to the sensors in the master unit. In some aspects, determining whether the tool unit is connected to the master unit is performed by comparing the sensor output data to stored data indicating which output data values indicate a connected tool unit and which output data values indicate a disconnected tool unit. Determining whether the tool unit is in the tool stand using the sensor output values from the tool unit sensor can be done in the same way. The processing circuitry may have access to internal memories storing these values for comparison, or they may have access to a memory unit in the safety controller. Sending and receiving the results of the determinations occurs through physical wiring between the processing circuitry.

The connector 24 is arranged to move to a disconnected state when the at least two separate processing circuitry 22, 23 both send a disconnect signal to disconnect the tool unit 3.

This tool changer 1 as shown in 2 shown and described above, provides more security compared to the prior art in several aspects. There are at least two sensors that individually determine whether the tool unit 3 is connected to the master unit 2 . The two sensors must both show that it is connected, so that there is no disconnection if one of the sensors fails. So if a sensor has a fault, this is detected immediately and the tool changer 1 does not separate the tool unit 3 .

In some aspects, receiving a request to disconnect the tool assembly occurs from a robot controller.

There is at least one tool unit sensor 31 that detects whether the tool unit 3 is in the tool stand 4 and has at least two outputs, both of which must indicate the same thing for a disconnect to occur. So there are two channels and both channels must show that the tool is in the tool stand 4 before a disconnect occurs. So if a channel has interference, there will be no disconnection.

Determining whether a separation is safe is made independently by two different processing circuits 22, 23. In other words, two independent processing circuits 22, 23 each acquire sensor data from all sensors and determine the status of the tool changer 1. No separation can take place if both processing circuitry 22, 23 disagree on the results. Furthermore, both processing circuitry 22, 23 must send a disconnect signal in order for the disconnect to be triggered.

In other words, the two processing circuit arrangements 22, 23 independently determine whether both connection sensors 25, 26 indicate that the tool unit 3 is connected to the master unit 2, determine whether both channels indicate from the tool unit sensors that the tool unit 3 located in the tool stand 4 and determine if the other processing circuitry is coming to the same conclusions and send a disconnect signal if a disconnect is allowed and has been requested. Furthermore, the tool unit 3 will not be disconnected until both processing circuitry 22, 23 send the disconnect signal.

Due to the multiple redundancies and the way the tool changer 1 is constructed, any defects or errors are detected, so that the tool unit 3 is not separated from the master unit 2 in an impermissible state.

It should be noted that the tool 5 and the tool stand 4 in 2 are shown with dashed lines. The reason for this is that they are not part of the claimed tool changer 1, but are needed in the figure for a good overview of how the tool changer is constructed.

In some aspects, the at least two separate processing circuitry 22, 23 are individually arranged to determine whether any of the received sensor output values indicate an unexpected condition in the tool changer 1 and, in the event of an unexpected condition, not to send the disconnect signal. An unexpected condition provides a sensor output value outside of a predetermined range of values. A check for unexpected states therefore takes place in both processing circuit arrangements 22, 23. The check for unexpected states is thus carried out in both processing circuit arrangements, an unexpected state being, for example, that two sensor values which should indicate the same state indicate different states; for example, one connection sensor indicates that the tool unit is connected to the master unit and the other connection sensor indicates that the tool unit is not connected to the master unit. The predefined value range depends on the sensor type used. In some aspects, the processing circuitry is instructed to determine whether sensor output values are outside of a predetermined range, or in other words, deviate from an expected condition, by comparing the sensor output data to stored values in a database. The stored values indicate which sensor values are associated with a connected state and which values are associated with a disconnected state.

In some aspects, the robot controller may command the safety controller to emergency stop. This is to shut off the power to the valves to avoid the risk of electric shock to maintenance personnel during maintenance work. It is an automatic shutoff of power to valves in the event of an emergency stop. Power to the valves is also removed in the event of an internal error in the tool changer, i.e. an error condition detected by the processing circuitry. This corresponds to putting the tool changer in a locked state.

3 10 illustrates an exemplary system having a tool changer, in accordance with some aspects of the disclosure. Tool unit 3 is shown below master unit 2 in the connected position. The safety controller 21 has two modules here, the data transmission module 211 and the safety module 212. The data transmission module can also be an integral part of the safety module 212. The safety module has all safety-related parts for the locking functions described above and below, while the data transmission module is used for signal coupling with the robot controller. This coupling can take place via an I/O module or bus module.

The exemplary system has two monostable, double 3/2-way normally open/normally closed valves 241, 242 which in their passive, i.e. stable, state keep the tool changer 1 closed. Due to the redundancy of the system, both valves must be actuated in order for the tool changer to open. In this document, the valve control signals are provided with “WW open1” and “WW open2” as reference symbols.

The security module has two separate processing circuitry 22, 23 for "open WW1" and "open WW2" which operate independently for the logic control and which are implemented with different programmable technologies. To prove whether the tool changer 1 is empty, two connection sensors 25, 26 are used in parallel. A connection sensor 25 uses a normally closed switch "WW_empty" which provides a high signal to detect whether tool changer 1 is empty, and another connection sensor 26 uses a bridge "WA_connected" across tool unit 3 to indicate detect whether a tool is attached to the tool changer 1. The combined signals "WW_empty" and "WA_connected" are referred to in this document as "WA_present". In this example, an inductive proximity sensor 25 is used for "WW_empty" and an electrical bridge connection 26 is used for "WA_connected". However, any mechanical or electrical sensor or proximity sensor can be used.

After placing a tool in the tool stand 4, the tool changer 1 is lifted into an open or in other words disconnected state. However, if the "WA_present" signals indicate that a tool unit 3 is still in the tool changer 1 when it is lifted from the tool storage stand, the tool changer 1 will close automatically. This is to ensure that the tool unit 3 is connected to the tool in a connected manner position can be held without risk of accidental dropping.

In order to detect whether the tool changer 1 with the tool 5 is in the tool stand 4, double output signals 32, 33 "tool_in_stand" are used, which are in 3 are shown as tool_in_rack_1 and tool_in_rack_2. In this example, an RFID sensor is used, which is a passive circuit 41 in the tool stand, but any proximity sensor can be used. Both processing circuitry 22, 23 use the two "WA_present" signals and the two "tool_in_stand" signals. Since both signals, WW Open1 and WW Open2, must be active for a disconnect, ie for opening tool changer 1, a fault in one of the circuits will prevent tool changer 1 from opening in dangerous situations. Furthermore, the results from both processing circuitry must be identical for the output signals to be switched active.

To control the opening and closing of the tool changer, a signal from the robot controller is used to inform the safety controller 21 that an open command has been given. Depending on the configuration of the data transfer module, this signal could be sent in different ways, e.g. via a bus or via discrete signals, but is referred to as "OpenWW".

In some aspects, the connecting device 24 comprises a locking piston (not shown) which is actuated when the tool unit 3 is connected. For internal monitoring of the tool changer 1, two magnetic sensors 243, 244 are used to determine the position of the tool changer locking piston. The two magnetic sensors each have an output signal, the “WW_closed” or “WW_open” signal, for the safety controller. Furthermore, the pressure on each side of the locking piston is monitored by two pressure sensors 245, 246 with output signals labeled "Pressure_WW_Close" and "Pressure_WW_Open". These sensors and their output signals are used to control the correct functioning of the hardware. According to some aspects, the master unit 2 thus comprises two separate pressure sensors arranged on two sides of the locking piston for monitoring the air pressure, the output values from the pressure sensors are received in the safety controller 21 .

In addition to the control signal locking described above, the tool changer 1 also has status monitoring, e.g. when a tool unit 3 is connected (WA_present) or when the tool unit 3 with tool is placed in a tool stand 4 (“tool_in_stand”). These status signals can be read in the robot controller 6. In addition to the signals previously mentioned, the diagnostic status of the tool changer is provided via combined signals from the tool changer sensors. So, the ready signal is generated by comparing sensor readings to the expected readings given the system input signal (OpenWW). In the same way as the ready signal, a ready_to_open_WW signal is generated from the safety controller 21 to the robot controller 6, but indicates the status of whether the tool changer is in a connected or disconnected position.

If the internal monitor indicates an unexpected condition, the safety controller 21 automatically enters an error state and switches both output signals, "WW_open1" and "WW_open2", low to keep the tool changer 1 in a connected position.

For monitoring purposes, the robot controller may receive error signals, error code signals, and/or sensor signals from the safety controller.

The safety controller 21 may also include a relay which is used to remove 24V power to the tool, if any, during the connection or disconnection process. This is to prevent arcing.

4 describes the hardware architecture according to some aspects of the disclosure. In some aspects, this is a different way of showing the structure in 3 . However, some details may differ due to the implementation of the tool changer. The two previously mentioned separate processing circuit arrangements 22, 23 are here a first circuit with a microcontroller, MCU, and a second circuit with a Complex Programmable Logic Device, CPLD. The circuits send actuator output signals to activate the pneumatic valves that control the pneumatic cylinder when a disconnect is commanded and when the processors have determined that a disconnect is allowed. The boxes marked “Insulation” are intended to indicate where there is electrical insulation. The electrical isolators are designed to remove noise so that only the desired signal passes. The electrical isolator is, for example, an optical isolator.

Starting in the top left corner, an OpenWW control signal is sent from a robot controller to the two processing circuitry. The sensors used as input to the processing logic are shown on the left. These are WW_empty, WA_connected, tool_in stand_1 and tool_in_stand_2. All four signals are sent to both processing circuitry.

Several signals are sent to the robot controller. Both processing circuitry send error signals, Error 1 and Error 2, when they have detected errors in the tool changer that require the robot to be shut down. The processing circuitry also sends a diagnostic signal to the robot controller. In this setup example, all sensors also send their output signals to the robot controller.

With the mutual monitoring between the processing circuitry, it is illustrated that the processing circuitry send their determined sensor status to each other as previously described. The processing circuitry checks one another and only activates the output signals to the valves when equal results are calculated. The actuating circuits in the valves are also aligned with the signals Feedback_AUS1/2, and the disconnection process is completely interrupted if they differ.

As in 4 can be seen, there are two pneumatic valves; Channel 1 and Channel 2. The air pressure in both valves is monitored with sensors that provide the signals Pressure_WW_Close and Pressure_WW_Open. When both valves are actuated, one valve is used to actuate a pneumatic cylinder on the opening side and another valve is used to exhaust air from the closing side to separate the tool assembly. A spring can be used to mechanically hold the cylinder closed when the valves are not operating or air pressure is lacking. Two magnetic sensors with output signals WW_closed and WW_open are also used here to monitor the position of the tool changer locking piston.

Reference List

1

tool changer

2

master unit

21

safety control

211

data transfer module

212

security module

22

First processing circuitry

23

Second Processing Circuitry

24

connecting device

241

first valve

242

second valve

243

First magnetic sensor

244

Second magnetic sensor

245

First pressure sensor

246

Second pressure sensor

25

First connection sensor

26

Second connection sensor

27

Proximity detector (state of the art)

28

Relay (state of the art)

29

steering

3

tool unit

31

tool unit sensor

32

First output signal

33

Second output signal

34

Interlock Switch (Prior Art)

35

Proximity indicator (state of the art)

4

tool stand

41

passive circuit

5

Tool

6

robot controller

QUOTES INCLUDED IN DESCRIPTION

This list of documents cited by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent Literature Cited

• US 6840895 B2 [0007, 0027, 0031, 0032]

Claims (9)

Tool changer (1) for safely changing tools, the tool changer (1) comprising: - a master unit (2) comprising: - a safety controller (21) with at least two separate processing circuit arrangements (22, 23), - a connecting device (24) which comprises at least two valves (241, 242), - at least two connection sensors (25, 26), - a tool unit (3) comprising: - at least one tool unit sensor (31) which detects whether the tool unit (3) is located in a tool stand (4), the at least one tool unit sensor (31) delivering two output signals (32, 33) and the output signals to the safety controller (21 ) are sent when the tool unit (3) is connected to the master unit (2), the connection means (24) switching between a connected state in which the tool unit (3) is connected to the master unit (2) and a disconnected state is movable in that the tool unit (3) is disconnected from the master unit (2), the connection means (24) being moved from the connected state to the disconnected state when both valves are actuated, and the at least two connection sensors (25, 26) recognize individually whether the tool unit (3) is connected to the master unit (2) via the connection device (24) and the output signals are sent from the connection sensors (25, 26) to the safety controller (21), the two separate processing circuitry (22, 23) being individually arranged to: - receive a request to disconnect the tool unit (3), - receive the output from the at least two connection sensors (25, 26) and the at least one tool unit sensor (31), - determine on the basis of the output from the at least two connection sensors (25, 26) whether the tool unit (3) is connected to the master unit (2) via the connection device (24), - determine whether the tool unit (3) is in the tool stand (4) based on the output from the at least one tool unit sensor (31), - send the result of the determinations to the other processing circuitry, - receive a result of determinations from the other processing circuitry, - a first (22) of the two separate processing circuits (22, 23) sends a disconnect signal to operate a first valve (241) of the two valves and a second (23) of the two separate processing circuits (22, 23) sends the disconnect signal to operate a second valve (242) of the two valves if the determination result is identical to the received determination result and if the determination results both indicate that: ◯ no tool unit (3) is connected to the master unit (2), or ◯ the tool unit (3) is connected to the master unit (2) and also located in the tool stand (4), the connecting means (24) being arranged to move to a disconnected state when the at least two separate processing circuitry ( 22, 23) both send a disconnection signal to disconnect the tool unit (3). Tool changer (1) after claim 1 wherein the at least one tool unit sensor (31) comprises two 24V power connections activated by a passive circuit (41) in the tool stand (4) and its signals are routed from the tool unit (3) to the security module when the Tool unit (3) is in the tool stand (4) and when the tool unit (3) is connected to the master unit (2). Tool changer (1) after claim 1 or 2 , wherein the at least one tool unit sensor (31) is at least two tool unit sensors (31). Tool changer (1) after claim 1 wherein the two separate processing circuitry (22, 23) are two different types of processing circuitry (22, 23). Tool changer (1) after claim 4 , wherein the two different types of processing circuitry (22, 23) are selected from the following types: a microcontroller (MCU), a complex programmable logic device (CPLD), a field-programmable gate array (FPGA) and a programmable array logic ( PAL). Tool changer (1) after claim 1 , wherein the at least two connection sensors (25, 26) are different sensor types. Tool changer (1) after claim 6 , where the different sensor types are selected from the following types: mechanical switches, electrical contacts and proximity sensors. Tool changer (1) after claim 7 , whereby the mechanical switch one at rest comprises a normally closed switch which provides a high signal when the tool unit (3) is disconnected from the master unit (2), the electrical contact comprises a jumper which is connected across the tool unit (3) and provides a high signal, when the tool unit (3) is connected to the master unit (2), and the proximity sensors include inductive sensors, magnetic sensors, capacitive sensors, optical sensors and RFID sensors. A tool changer (1) according to any one of the preceding claims, wherein the at least two separate processing circuitry (22, 23) are individually arranged to: - determine if any of the received sensor output values indicate an unexpected condition in the tool changer (1) and that in case of an unexpected condition: ◯ do not send the disconnect signal, whereby an unexpected condition provides a sensor output value outside of a predetermined value range.

Images