EP3139354B1 - Method for adjusting an operating mode of a security system - Google Patents

Description

The invention relates to a method for setting an operating mode of a security system and to a security system for carrying out the method.

Such a security system generally includes a control system that controls a machine. The machine can pose a risk to persons. As a safety measure, a danger zone on the machine is therefore monitored. An essential security element here is an access system connected to the control system, by means of which a controlled access to security-relevant control functions is monitored. Such an access system may for example be formed by an electronic key system. This electronic key system comprises a key insert and at least one key associated therewith. The key typically includes a transponder in which a code is contained. In the key insert, a recognition device is integrated, by means of which the code in the key can then be read out without contact, when the key is in an engaged position in the key insert. The code of the key may include a control signal for starting or stopping the machine. Furthermore, the code may contain authorization data or process-oriented information such as parameters for the operation of the machine.

Typically, the danger zone of the machine is secured with a protective cover or fencing. In the fence is then a protective door. Depending on whether the safety door is closed or not, the machine can be used in different operating modes.

With such security systems, several operating modes are generally possible. A first operating mode is the automatic mode. In this safety mode, no person may be in the danger zone and the protective door is closed. In this automatic mode of operation of the machine is fully released, so that in particular also work operations are carried out, which could lead to hazards to persons in the danger zone. In addition, other modes are possible in which the safety monitoring is bypassed. In such modes, for example, authorized persons can be granted access to the danger zone by appropriate codes of keys, for example to carry out repair or installation work there. Depending on the operating mode, the machine can then be stopped completely or driven in a restricted operating mode, for example at reduced speed.

A problem with such safety systems is that operating mode switching must be restricted to authorized persons due to legal regulations. In addition, a level of security is required for the switchover, which can not be achieved with any conventional systems, but makes the use of safety technology necessary.

In a first known mode switching the respective mode is selected via one or more keyswitch on the machine. The disadvantage here is that the keys can be easily copied and control over the access is not guaranteed.

In a second known mode switching buttons are provided on the machine, which can be unlocked by means of a key. This solution has the disadvantages mentioned.

The DE 103 36 814 A1 relates to an electronic device with at least one operating device for controlling the electronic device, in which a device for identifying a user is configured such that the user when operating the electronic device for controlling the electronic Device is automatically identified. This makes it possible to propose to the user depending on his identity functions and / or function selections for selection or to execute them.

The DE 10 2008 060 011 A1 relates to a safety controller and method for controlling an automated system comprising a plurality of sensors and a plurality of actuators.

The invention has for its object to provide a method and a security system, by means of which a reliable mode setting is made possible with low design effort.

To solve this problem, the features of the independent claims are provided. Advantageous embodiments and expedient developments of the invention are described in the dependent claims.

• Zweikanaliges Auslesen von Signalen des Zugangssystems in das Steuerungssystem,
• Durchführen einer Gültigkeitsüberprüfung der Signale des Zugangssystems in dem Steuerungssystem,
• wobei das Steuerungssystem nur bei Vorliegen gültiger Signale des Zugangssystems die Auswahl einer Betriebsart über eine Eingabeeinheit freigibt,
• Durchführen einer Fehlerkontrolle der Auswahl der Betriebsart in der Sicherheitssteuerung,
• Umschalten auf die ausgewählte Betriebsart durch die Sicherheitssteuerung nach positiv durchgeführter Fehlerkontrolle.

The invention relates to a method for setting an operating mode of a security system, comprising an access system, which is connected to a control system controlling a machine. The control system has a safety control. The method comprises the following method steps:

• Dual-channel reading of signals from the access system into the control system,
• Performing a validity check of the signals of the access system in the control system,
• wherein the control system releases the selection of a mode of operation via an input unit only in the presence of valid signals of the access system,
• Performing an error control of the selection of the operating mode in the safety control,
• Switching to the selected operating mode by the safety controller after a positive error check.

Furthermore, the invention relates to a security system for carrying out the method according to the invention.

An essential advantage of the method according to the invention or of the safety system according to the invention is that a fail-safe adjustment of the operating mode of the safety system or the machine thus secured is made possible without any additional design effort.

For this operating mode setting, standard components can already be used on the safety system. This applies in particular to the input unit, which is advantageously designed in the form of a touchscreen or by means of so-called softkeys.

The fail-safe selection and setting of a mode of operation is ensured, in particular, by error checks of the control system, the latter having a safety control as an essential component and, particularly advantageously, a non-error-proof control.

These error checks test the components of the safety system and detect any errors. The advantage here is that in the error controls in the individual components, in particular the input unit, the non-failsafe control and safety control, synchronous processes are provided, whereby parallel channels are obtained, can be detected by their comparison with high certainty occurring errors, in the whole Security system, as the error controls include all components of the security system.

An essential aspect of the invention is that the access system has a two-channel, preferably diverse output structure, so that two-channel signals are read from the access system into the control system. By evaluating the signals, the safety controller can be used to check whether the control system, in particular the non-failsafe controller, and the access system work correctly.

For this purpose, the signals of at least one output of the access system in the security controller are particularly advantageously used for a validity check.

Further advantageous signals of an output channel of the access system are evaluated in the non-error-safe control, in particular, whether the signals of the output channel are valid, which can be done for example on the basis of a checksum calculation of the signals. The read via the second output channel in the safety control signals are then advantageously used for a time monitoring such that it is checked whether the signals of the first output signal are read in a predetermined time window. This diversified dual-channel monitoring structure achieves a high level of fail-safety.

According to a particularly advantageous embodiment of the invention, the access system is formed by an electronic key system comprising a key insert and at least one key. The access system has a data output, via which data of a key used in the key insert are read into the non-failsafe controller. The access system has a switching output, via which a switching signal whose switching states indicate whether a key is present in the key insert or not is read into the safety controller.

This represents a particularly expedient embodiment of a diversified two-channel output structure. The non-failsafe controller, which has no fail-safe structure, is well suited to process larger amounts of data, such as the data read in by the key. By contrast, the safety controller with its fail-safe structure only has to process a considerably reduced amount of data since the switching signal read in via the switching output of the access system is a binary signal. Insofar as the security controller requires further data of the access system from the non-failsafe controller for performing error checks, these are converted into a format that can be processed by the security controller. In general, only the data required for the error control are sent to the safety controller, so that the amount of data can be kept low. Thus, an appropriate division of labor for the control system results in such a way that the non-failsafe controller is used for processing larger amounts of data, while only small amounts of data are processed in the security control must be so that the function of the safety control can be limited to the error controls to be performed.

According to a particularly advantageous embodiment of the invention, as a first validation check of signals of the access system when reading a switching signal whose switching state signals a key located in the key insert, a time expectation in the safety control by opening a time interval is started. The safety controller checks whether, within this time interval, data of the key has been read into the non-failsafe controller via the data output. As a second validation check, a checksum calculation of the data read in from the data output of the key is performed in the non-failsafe controller.

In this embodiment, a dual-channel verification structure is realized since error checks are performed not only in the safety control but also in the non-error-proof control. Through the synchronous execution of the error controls and their mutual checks, a comprehensive testing of the control system and the access system is realized.

Particularly advantageously, the non-failsafe controller sends an authorization signal to the input unit after successful validation, thereby enabling input to the input unit.

This represents an expedient division of labor within the overall system, since the non-failsafe controller, as a unit designed to process larger amounts of data, handles the data traffic with the input unit.

Particularly advantageously, the input unit is formed by a touchscreen or by so-called softkeys.

This provides a particularly comfortable, easy-to-use interface for a user of the security system.

Although the input unit and the non-fail-safe control used to drive them do not themselves have a fail-safe configuration, a fail-safe mode selection is ensured via this structure. This is due to the fact that not only the non-failsafe controller but also the input unit is integrated into the overall system of error control.

A first error control is that a release of the input unit for making entries by a user only takes place in the control system, in particular the non-failsafe controller, the validity check of the checksum calculation performed by the data output of the access system was successful and thus simple errors on the secure electronic key can be recognized as well as protection against copying a key is realized.

Furthermore, it is checked in the non-failsafe control as error control whether the selected operating mode is within a permissible range.

Thus, the function of the input unit is checked directly by the fail-safe part of the control system. Conveniently, a list of permissible entries is stored in the safety control for this purpose. If appropriate, this list can be compared with the data read in by the access system, for example such that, depending on the access authorization contained in the data, only a subset of the operating modes stored in the security control can be selected as being selectable by the input unit.

Furthermore, the error control of a selected mode, this is read back to the input unit.

On the one hand, this readback gives the user the possibility of checking whether his input was correct or correctly processed has been. Furthermore, by checking the read back in the safety controller, another error control of the input unit and the non-fail-safe controller controlling it takes place.

Finally, error detection is generated upon detection of an error in the control system.

Thus, the concept of error control to ensure a safe selection and a safe setting of a mode in the security system according to the invention is completed. It is essential that regardless of where and at which point of the security system an error is detected, an error latching takes place immediately and the entire system thus enters a safe state. It is also essential that in the security system when an error occurs not only an error message, but a Fehlerverrastung. Error locking in this context means that if an error occurs, the procedure for a mode selection is stopped until a specific, application-specific predefinable action has been performed, which eliminates the error lock.

Figur 1:

Schematische Darstellung eines Ausführungsbeispiels des erfindungsgemäßen Sicherheitssystems.

Figur 2a-f:

Ablaufdiagramm zur fehlersicheren Einstellung einer Betriebsart des Sicherheitssystems gemäß Figur 1.

The invention will be explained below with reference to the drawings. Show it:

FIG. 1:

Schematic representation of an embodiment of the security system according to the invention.

FIGS. 2a-f:

Flow chart for fail-safe setting of an operating mode of the safety system according to FIG. 1 ,

FIG. 1 schematically shows the structure of an embodiment of the security system according to the invention 1. The security system 1 comprises a control system 2, which controls the operation of a machine 3. The control system 2 comprises a safety controller 4, which may be formed by a fail-safe PLC control. Furthermore, the control system 2 comprises a non-failsafe controller 5 formed by a non-fail-safe PLC controller.

With the machine 3 controlled by the control system 2, work processes are carried out which can lead to hazards to persons within a danger zone around the machine 3. To protect the danger area this is delineated with a fencing or enclosure, not shown. In the fence there is a protective door, also not shown, through which people can get access to the danger zone.

Access to the selection of an operating mode is monitored by means of an access system, which in the present case is formed by an electronic key system 6. This electronic key system 6 comprises a key insert, not shown, and at least one assigned thereto, also not shown key. The key typically includes a transponder in which a code is contained. In the key insert, a recognition device is integrated, by means of which the code in the key can then be read out without contact, when the key is in an engaged position in the key insert. The code of the key may include authorization data as well as other process-oriented information such as parameters for the operation of the machine 3.

The electronic key system 6 has, as in FIG. 1 shown, a diverse, two-channel output structure on. This comprises a data output 7, via which data of the key used in the key insert can be read out. Furthermore, a switching output LA is provided, via which a binary switching signal can be read out. The switching states of the switching signal indicate whether or not a key is engaged with the key insert. How out FIG. 1 can be seen, the switching signal of the electronic key system 6 is read via a switching input SI in the safety controller 4. In contrast, the data of the data output 7 are read into the non-failsafe controller 5 via bus lines 8a of a bus system. As figure 1 Furthermore, a bidirectional data exchange takes place between the safety controller 4 and the non-failsafe controller 5 via lines 9a, 9b, 9c. Finally, via bus lines 8b of the bus system, an input unit 10 is connected to the non-failsafe controller 5 and is controlled by this.

The input unit 10 is formed in the present case of a touch screen. Via the touch screen 1 relevant information can be entered for the operation of the security system.

The security system 1 according to FIG. 1 can be operated in several operating modes. A first operating mode is the automatic mode. In this automatic mode, no person may be in the danger zone and the protective door is closed so that people are prevented from entering the danger zone. In this automatic mode of operation of the machine 3 is fully released, so that with this particular work operations are performed, which could lead to hazards to persons in the danger area. In addition, other modes are possible in which the safety monitoring is bypassed. In such modes, for example, authorized persons can be granted access to the danger zone by appropriate codes of keys, for example to carry out repair or installation work there. Depending on the operating mode, the machine 3 can then be stopped completely or driven in a restricted operating mode, for example at a reduced speed.

According to the invention, a fail-safe selection of an operating mode can be carried out via the input unit 10. The process steps required for this purpose are shown in the flowchart of FIGS. 2a-f summarized.

In a first step (step no. 1 in FIG. 2a ) a key is inserted into the key insert of the electronic key system 6, so that the key insert contactless read the data of the key.

By inserting the key, if this is recognized by the key insert as a valid key, the switching state of the switching signal at the switching output LA is set to the value 1 (step no. 2). This switching signal indicating the presence of a valid key is read into the safety controller 4 via the switching input SI.

The data of the key read from the key insert is checked for its format and then, if this check was successful, read in via the data output 7 (step no. 3).

With the setting of the switching signal to the value 1, which is read into the safety controller 4, it is checked in the safety controller 4 whether the data read out at the data output 7 are read into the non-failsafe controller 5 within a predetermined time interval. For this purpose, a time expectation is started in the safety controller 4 (step no. 4). In this case, a time interval of predetermined length is opened and checked as to whether the data of the key are read into the non-failsafe controller 5 within this time interval.

This reading (step no. 5) takes place via the bus lines 8a of the bus system. In this case, the data are read in a defined input range of the non-failsafe controller 5 in a known manner and then copied into a specified data area of the non-failsafe controller 5.

The first error control is carried out in the non-failsafe controller 5, a calculation of the checksum of the data of the key (step no. 6). Then it checks whether the checksum is correct, that is, whether it corresponds to a permissible value (step no. 7).

As a further error control, it is checked in the safety controller 4 whether the data of the electronic key system 6 are read into the non-failsafe controller 5 within the time interval defining the time expectancy. Since these data are read only in the non-failsafe controller 5 are, assigned in the non-failsafe control 5 checksum calculation an authorization level in the variable with the symbolic name read authorization for the read data and written in a flag word MW01 or a corresponding data area sent from the non-failsafe controller 5 to the safety controller 4 becomes. Such a flag word forms a readable by the safety controller 4 data format. On the basis of this flag word MW01 then takes place in the safety controller 4, the check whether the data of the key within the time expectation were received (steps no. 8 - 10).

If an error is detected during the check sum calculation or the monitoring of the time expectation, a branch into an error lock occurs. When branching into an error lock mode selection is immediately stopped and can only be continued if the user performs a predetermined action, for example, makes a specific input on the touch screen.

With the aforementioned error checks can be checked whether the electronic key system 6 and the control system 2, in particular the non-failsafe controller 5, work correctly. In particular, it can be checked in this way whether a key is actually present in the key insert. If no key is present in the key insert, no data is transmitted to the security controller 4, so that then the checksum assumes the invalid value zero, whereby a branch into the Fehlerverrastung takes place.

If the checksum corresponds to an allowable value, the permission level is sent from the security controller 4 to the input unit 10 (step # 11), thereby enabling the input unit 10 for selecting a mode (step # 12). In the input unit 10, an image is advantageously constructed for this purpose, via which a user can select an operating mode.

The user-selected mode is assigned in the input unit 10 to the variable with the symbolic name Select-MSO and then sent to the non-failsafe controller 5. In the non-failsafe controller 5, the selected mode is copied to the flag word MW03, which can be read by the safety controller 4. This flag word MW03 is then sent from the non-failsafe controller 5 to the security controller 4 (step # 14).

In the safety controller 4 is further queried whether 5 new data are sent from the non-failsafe controller. This is determined in the safety controller 4 by the fact that in the flag word MW01 a value not equal to zero appears (step No. 15).

Finally, steps Nos. 16 and 17 in the safety controller 4 are checked to see if a permissible code appears in the flag word MW03, and thus whether the selected mode is within an allowable range (Steps Nos. 16, 17).

For this purpose, a list of permissible operating modes is stored in the safety controller 4. Then it can be determined in the safety controller 4 by a simple comparison of the read flag word MW03 with the stored list, whether an allowable mode has been selected.

If there is no permissible operating mode, a branch takes place into an error lock.

However, if there is an allowable mode, in the safety controller 4, the allowable mode, that is, the content of the flag word MW03 is copied to the flag word MW05, which is then sent to the non-fail safe controller 5 (steps Nos. 18, 19).

This flag word MW05 is then sent from the non-failsafe controller 5 to the input unit 10. There the selected operating mode is displayed to the user (step no. 20). This display takes place in another picture than in the picture in which the user made the mode selection. This is a prerequisite for a safe reading back of the selected operating mode. A second prerequisite for this is that reading back into a variable (here MW05) takes place that differs from the variable for reading in the operating mode (here MW03).

Once the user has been presented with the selected mode by reading back on the input unit 10, the selection must be confirmed by the user by an input to the input unit 10 (step # 21).

In the case of a negative acknowledgment, an error variable with the symbolic name ErrorMSO is set in the input unit 10, as a result of which a branch into an error lock is made (step no. 23).

In the case of a positive acknowledgment, a variable with the symbolic name SwitchMSO is set in the input unit 10 (step No. 22) and sent to the non-failsafe controller 5 via the bus system. The thus selected mode is then copied to the flag word MW07 and sent to the safety controller 4 (step # 24).

A comparison is then made in the safety controller 4 as to whether the selected operating mode (contained in the flag word MW03) corresponds to the confirmed operating mode (contained in the flag word MW07) (step no. 25).

If these values are different, a branch into an error lock occurs.

However, if both values are identical, the safety controller 4 performs a changeover to the selected operating mode, for which purpose corresponding outputs of the control system 2 are set by the safety controller 4 (step No. 26).

The entire described chain will also pass through as the key is pulled out. Here, all variables must assume the value 0. The output LA must be reset in time. Thus, by checking in the secure controller 4, it is ensured that no values can be stored in the non-secure parts of the controller 5 and the input system 10. This results in a functional check of all components of the security system 1.

LIST OF REFERENCE NUMBERS

(1)

security system

(2)

control system

(3)

machine

(4)

safety control

(5)

non-failsafe control

(6)

electronic key system

(7)

data output

(8a-b)

bus line

(9a-c)

management

(10)

input unit

(LA)

switching output

(SI)

switching input

Claims (16)

1. Method of setting an operating mode of a safety system (1), comprising an access system which is connected with a control system (2) controlling a machine (3), wherein the control system (2) comprises a safety control (4), characterised by the following method steps:

   - twin-channel reading-out of signals of the access system into the control system (2),

   - carrying out a validity check of the signals of the access system in the control system (2),

   - wherein the control system (2) releases the selection of an operating mode by way of an input unit (10) only when valid signals of the access system are present,

   - performing a fault check of the selection of the operating mode in the safety control (4), and

   - switching over to the selected operating mode by the safety control (4) after positive performance of a fault check.
2. Method according to claim 1, characterised in that the access system has a diversified output structure.
3. Method according to one of claims 1 and 2, characterised in that the signals of at least one output of the access system are utilised in the safety control (4) for a validity check.
4. Method according to any one of claims 1 to 3, characterised in that the safety system (1) comprises in addition to the safety control (4) a non-failsafe control (5), wherein the non-failsafe control (5) controls the input unit (10) and wherein the signals of a first output of the access system are read into non-failsafe control (5) and the signals of the second output of the access system are read into the safety control (4).
5. Method according to claim 4, characterised in that the access system is formed by an electronic key system (6) comprising a key insert and at least one key, that the access system has a data output (7) by way of which data of a key present in the key insert are read into the non-failsafe control (5), and that the access system has a switching output (LA) by way of which a switching signal, the switching states of which indicate whether or not a key is present in the key insert, is read into the safety control (4).
6. Method according to claim 5, characterised in that an expectation time period is started in the safety control (4), by opening a time interval, as first validity check of signals of the access system when reading-in a switching signal having a switching state signalling a key present in the key insert and that it is checked in the safety control (4) whether within this time interval data of the key have been read by way of the data output (7) into the non-failsafe control (5).
7. Method according to claim 6, characterised in that a test sum computation of the data, which are read-in from the data output (7), of the key is carried out as a second validity check in non-failsafe control (5).
8. Method according to claim 7, characterised in that the non-failsafe control (5) transmits an authorisation signal to the input unit (10) after a successful validity check, whereby inputs at the input unit (10) are released.
9. Method according to any one of claims 1 to 3, characterised in that the input unit (10) is formed by a touchscreen.
10. Method according to claim 9, characterised in that after receipt of the authorisation signal an image, in which a mode of operation can be selected, is formed or made accessible in the touchscreen.
11. Method according to any one of claims 1 to 10, characterised in that it is checked as fault check in the non-failsafe control (5) whether the selected mode of operation lies in a permissible range.
12. Method according to any one of claims 1 to 11, characterised in that for the fault control of a selected operating mode this is fed back to the input unit (10).
13. Method according to claim 12, characterised in that the selected operating mode and the read-back operating mode are displayed in different images of the input unit (10).
14. Method according to any one of claims 1 to 13, characterised in that on discovery of a fault in the control system (2) a fault lock is generated.
15. Method according to any one of claims 5 to 14, characterised in that when a key is drawn out of the key insert of the key system (6) a function check of all components of the safety system (1) is carried out.
16. Safety system (1) comprising an access system which is connected with a control system (2) controlling a machine, wherein the control system (2) comprises a safety control (4), characterised in that the access system has a twin-channel output structure configured to read out signals into the control system (2), that the control system (2) is configured to carry out a validity check of the signals of the access system, wherein the control system (2) is configured to release selection of an operating mode by way of an input unit (10) if valid signals of the access system are present, that the safety control (4) is configured to perform a fault check of the selection of the operating mode and that the safety system (4) is configured to undertake switching-over to the selected operating mode after positive performance of the fault check.

Images