ES2764983T3 - Procedure for setting an operating mode of a security system - Google Patents

Abstract

Procedure for adjusting a mode of operation of a security system (1), comprising an access system, which is connected to a control system (2) that controls a machine (3); wherein the control system (2) presents a security control (4); characterized by the following procedural steps: - reading in two channels of signals from the access system to the control system (2); - execution of a validity check of the access system signals in the control system (2); - wherein the control system (2) only admits the selection of an operating mode, through an input unit (10), in the presence of valid signals from the access system; - execution of an error control of the selection of the operating mode in the control system (4); - switching to the selected operating mode via the safety control (4) after a successful error control.

Description

DESCRIPTION

Procedure for setting an operating mode of a security system

The present invention relates to a procedure for setting an operating mode of a security system, as well as a security system for executing the procedure.

This type of security systems generally comprises a control system that controls a machine. From the machine, risks to people can arise. Therefore, as a safety measure, a danger zone is monitored next to the machine. Here, an essential security feature consists of an access system connected to the control system, through which controlled access to security-relevant control functions is monitored. Such an access system may consist, for example, of an electronic key system. This electronic key system comprises a key insert and at least one associated key. The key therefore comprises a transponder in which a code is contained. A recognition device is integrated into the key insert, whereby the code on the key can be read without contact when the key is in a mating position on the key insert. The key code can contain a control signal to start or stop the machine. In addition, the code may contain authorization data or information referring to the process as parameters for the operation of the machine.

The machine's danger zone is generally secured with a protective cover or perimeter fence. In this case, a protection door is located in the perimeter fence. Depending on whether the protection door is closed or not, the machine can operate in different operating modes.

In this type of security systems, in general, multiple operating modes are possible. A first mode of operation is automatic mode. In this security mode, nobody can be in the danger zone and the protection door is closed. In this automatic mode, the machine's working mode is enabled without restrictions, so that it also carries out work processes that could put people in the danger area at risk. Other additional operating modes in which safety monitoring is omitted are also possible. In the case of such operating modes, it is possible, for example, to allow authorized persons access to the danger zone by means of corresponding key codes, for example, to carry out repair or installation work there. Depending on the mode of operation, the machine may then come to a complete stop or operate in a restricted mode of operation, for example, at a reduced speed.

One problem with this type of security system is that a switching of the operating mode must be restricted to authorized persons due to legal regulations. Furthermore, switching requires a level of security that cannot be obtained with any conventional system, but requires the use of security technology.

In a first known operating mode switch, the respective operating mode is selected by one or more key switches on the machine. The disadvantage in this case is that the keys can be easily copied and access control is not guaranteed.

In a second known switching of operating mode, push buttons are provided on the machine, which can be activated by means of a key. This solution also has the mentioned disadvantages.

Application DE 10336 814 A1 refers to an electronic device with at least one operating device for controlling the electronic device, in which a device for identifying a user is configured such that the user is automatically identified when operating the electronic device to control the electronic device. In this way, it is possible for the user to propose or execute functions and / or selections of functions depending on their identity.

Application DE 102008060011 A1 refers to a safety control and to a procedure for controlling an automated installation comprising a large number of sensors and a large number of actuators. The object of the present invention is to provide a procedure and a safety system, by means of which a safe adjustment of the operating mode is possible with reduced construction costs.

To meet said object, the features of independent claim 1 are provided. Advantageous embodiments and convenient improvements of the present invention are described in the related claims.

The present invention relates to a method for setting an operating mode of a security system, comprising an access system, which is connected to a control system that controls a machine. The control system features a security control. The procedure comprises the following procedural steps:

• reading on two channels of signals from the access system to the control system;

• execution of a validity check of the access system signals in the control system;

• where the control system only allows the selection of an operating mode, through an input unit, in the presence of valid signals from the access system;

• execution of an error control for the selection of the operating mode in the control system;

• switching to the selected operating mode via the security check after a successful error check.

The present invention also refers to a security system for executing the method according to the invention.

An essential advantage of the method according to the invention, or of the security system according to the invention, is that an error-proof adjustment of the mode of operation of the security system or of the machine secured therewith is possible, without additional construction costs.

For said adjustment of the operating mode, the components already existing in the security system according to the standard can be used. This is particularly valid for the input unit, which is advantageously shaped as a touch screen (English: Touchscreen) or using so-called programmable keys (English: Softkeys).

Error-proof selection and setting of an operating mode are particularly ensured by control system error checks; wherein it presents as essential components a security control and, in a particularly advantageous way, a control that is not error-proof.

These error checks test the components of the security system and detect possible errors. The advantage here is that synchronous processes are provided for error controls on the individual components, in particular the input unit, the error-free control and the safety control, whereby parallel channels are obtained, through whose comparison possible errors can be detected with a high degree of reliability, and this in the complete security system, since all the components of the security system are included in the error controls.

An essential aspect of the invention is that the access system has a two-channel output structure, preferably diversified, so that the signals in the control system are read by the two-channel access system. By evaluating the signals, through the security control, it is possible to control whether the control system, in particular the control without error protection, and the access system function properly.

For this purpose, in a particularly advantageous way, the signals from at least one exit of the access system are used in the security control for a validity check.

Also advantageously, the signals of an output channel of the access system are evaluated in the non-error-protected control, in particular such that it is determined whether the signals of the output channel are valid, which can be done, for example, based on a checksum calculation of the signals. The signals read at the security control through the second output channel are then advantageously used for time monitoring, checking whether the signals from the first output signal are read in a predetermined time window. Thanks to this diversified two-channel monitoring structure, high error-proof security is obtained.

According to a particularly preferred embodiment of the invention, the access system is made up of an electronic key system, which comprises a key insert and at least one key. The access system features a data output through which data from a key present in the key insert is read from the unprotected control against errors. The access system has a switching output, through which a switching signal is read in the security control, the switching states of which indicate whether or not a key is present in the key insert.

This establishes a particularly convenient configuration of a diversified two-channel output structure. The unprotected error control, which does not have a failsafe structure, is very suitable for processing large amounts of data, such as data read by the key. In contrast, the security control with its failsafe design should only process a considerably reduced amount of data, since the switching signal read through the access output of the access system is a binary signal. To the extent that, for the execution of the error controls, the security control requires other data from the access system from the control without protection against errors, then they are converted to a format that the security control can process . In general, only the data required for error handling is sent to the security check so that the amount of data can be kept small. This results in a convenient division of labor for the control system, because error-free control is used to process larger amounts of data, whereas only small amounts of data must be processed in security control, so that the The function of the security check can be limited to the error checks that must be run.

According to a particularly advantageous embodiment of the invention, as a first validity check of access system signals during the reading of a switching signal, the switching state of which is indicated by a key present in the key insert, in the security control a time expectancy is started by opening a time interval. In the security control, it is checked whether data from the key have been read within said time interval through the data output in the control that is not error-proof. As a second validity check, in the control not protected against errors, a checksum calculation of the key data read by the data output is performed.

In this form of execution, a two-channel verification structure is implemented, since error controls are performed not only in the security control, but also in the control not protected against errors. By synchronously developing the error controls and their reciprocal controls, a comprehensive test of the control system and the access system is performed.

Particularly advantageously, after a successful validity check, the non-error protected control sends an authorization signal to the input unit, enabling the inputs to the input unit.

This represents a convenient division of labor within the entire system since the non-error protected control, configured as a unit to process larger amounts of data, takes over the data traffic with the input unit.

In a particularly advantageous way, the input unit is made up of a touch screen or by means of so-called programmable keys.

This represents a particularly comfortable and user-friendly interface for a security system user. Although the input unit and the non-error protected control used for its control do not have an error-proof structure per se, this structure ensures a selection of the error-proof mode of operation. This is based on the fact that not only the error-free control, but also the input unit, are integrated into the complete error control system.

A first error control consists in that the input unit is only enabled for the execution of inputs by the user when in the control system, particularly in the control without error protection, the validity verification of the calculation has been successful. checksum carried out from the data output of the access system, thus allowing simple errors in the unsafe electronic key to be recognized and protection against the copy of a key.

In addition, in non-error-protected control, error control checks whether the selected operating mode is within an allowable range.

In this way, the error-proof part of the control system directly verifies the function of the input unit. For this, in the security control, a list of allowed entries is conveniently stored. Said list can be compared, eventually, with the data read by the access system, for example, in such a way that, according to the access authorization contained in the data, only a partial quantity of the operating modes stored in the control of Security is marked as selectable by the input unit. Furthermore, for error control of a selected operating mode, it is reread on the input unit.

On the one hand, this rereading gives the user the opportunity to verify if their entry was correct or was processed correctly. On the other hand, when checking the reading in the safety control, another function check of the input unit and the controller is performed without error protection that controls it.

Finally, upon detection of an error in the control system, an error block is generated.

In this way, the concept of error control is completed to guarantee a safe selection and a reliable configuration of an operating mode in the security system according to the invention. It is essential that regardless of where and at which point in the security system an error is detected, an error lock is immediately performed and the entire system changes to a safe state. It is also essential that when an error occurs, not only an error message is generated in the security system, but also an error lock. Error blocking in this context means that when an error occurs, the procedure for a selection of the operating mode stops until a specific action, predeferable for the application, has been taken to cancel the error blocking.

Next, the present invention is explained by the drawings. The drawings show:

Figure 1: Schematic representation of an embodiment of the security system according to the invention.

Figures 2a-f: Operation diagram for the error-free adjustment of an operating mode of the security system according to Figure 1.

Figure 1 schematically shows the constructive design of a first exemplary embodiment of the security system 1 according to the invention. The security system 1 comprises a control system 2, which controls the operation of a machine. There, the control system 2 presents a security control 4 that can be made up of an error-proof SPS controller. Furthermore, the control system 2 comprises a non-error-proof control 5, which is made up of a non-error-proof SPS controller.

With the machine 3 controlled by the control system 2, work processes are carried out that within a danger zone around the machine 3 can be dangerous for people. To ensure the danger zone, it is delimited with a perimeter fence or with a protective enclosure, which is not shown. In the perimeter fence there is a protective door, which is also not shown, through which people can access the danger area.

Access to the selection of an operating mode is monitored by means of an access system, which in the present case is made up of an electronic key system 6. This electronic key system comprises a key insert, which is not shown, and at least one key associated with it which is also not shown. The key generally comprises a transponder in which a code is contained. A recognition device is integrated into the key insert, whereby the code on the key can be read without contact when the key is in a mating position on the key insert. In addition, the key code may contain authorization data, as well as information related to the process, as parameters for machine operation 3.

As represented in figure 1, the electronic key system 6 has a diversified, two-channel output structure. It comprises a data output 7, through which the data of the key located in the key insert can be read. Furthermore, a switching output LA is provided, through which a binary switching signal can be read. The switching states of the switching signal indicate whether or not a key engages in the key insert. As it can be seen in figure 1, the switching signal of the electronic key system 6 is read through a switching input SI in the security control 4. In contrast, the data of the data output 7 are read in error-free control 5 via bus lines 8a of a bus system. As Figure 1 also shows, a bidirectional data exchange is carried out between lines 9a, 9b, 9c between security control 4 and unprotected control against errors 5. Finally, an input unit 10 is connected to and is controlled by the non-error-protected control 5 via bus lines 8b of the bus system.

In the present case, the input unit 10 is made up of a touch screen. Through the touch screen, information relevant to the operation of the security system 1 can be loaded.

The security system 1 according to figure 1 can operate in multiple operating modes. A first mode of operation is automatic mode. In this automatic mode, no person can be found in the danger zone and the protection door is closed, preventing people from entering the danger zone. In this automatic mode, the working mode of machine 3 is enabled without restrictions, so that it also carries out work processes that could put people in the danger zone at risk.

Other additional operating modes in which safety monitoring is omitted are also possible. In the case of such operating modes, it is possible, for example, to allow authorized persons access to the danger zone by means of corresponding key codes, for example, to carry out repair or installation work there. Depending on the mode of operation, the machine 3 can then either come to a complete stop or operate in a limited mode of operation, eg at a reduced speed.

According to the invention, an error-proof selection of operating mode can be made via the input unit 10. The steps of the procedure necessary for this are summarized in the operation diagram in Figures 2a-f.

In a first step (step # 1 in Figure 2a), a key is inserted into the key insert of the electronic key system 6, so that the key insert reads the data from the key without contact.

By inserting the key, if the key insert recognizes it as a valid key, then the switching status of the switching signal at switching output LA is set to value 1 (step # 2). This switching signal, which indicates the presence of a valid key, is read in the security control 4 through the switching input SI.

The key data read by the key insert is verified with reference to its format and if said verification is successful, then, it is read through data output 7 (step 3).

When the switching signal is set to value 1, which is read in safety control 4, safety control 4 controls whether the data read in data output 7 is read in the control without error protection 5 within a predetermined time interval. For this, in the security control 4 a time expectation is started (step n ° 4). There, a time interval of a predetermined duration is opened and it is checked whether the key data is read from the non-error protected control 5 within said time interval.

This reading (step 5) is carried out through bus lines 8a of the bus system. There, the data is read as known in a defined input area of the control without error protection and then copied into a defined data area of the control without error protection 5.

As a first error control, in the non-error protected control 5, a checksum calculation of the key data is performed (step 6). Then, it is verified if the checksum is correct, that is, if it corresponds to an admissible value (step 7).

As an additional error control, in the security control 4 it is verified whether the data of the electronic key system 6 is read in the control without error protection 5 within the time interval that defines the time expectation. Since this data is only read in the control without error protection 5, after performing the checksum calculation in the control without error protection 5, an authorization level is assigned in the variable with the symbolic name read authorization for the read data and is recorded in a MW01 flag word or a corresponding data area which is sent from the unprotected control 5 to the safety control 4. Such a flag word forms a data format readable by the control Security 4. Based on this signal word MW01, a check is then carried out on the security control 4 to determine if the key data has been received within the time expectation (steps # 8-10).

When an error is detected during checksum calculation or time expectancy monitoring, then a bypass is made to an error lock. In the case of a referral to an error lock, the selection of the operating mode stops immediately and can only continue if the user performs a predetermined action, for example, by making a specific entry on the touch screen.

With the aforementioned error controls it can be verified whether the electronic key system 6 and the control system 2, in particular the control without error protection 5, are working correctly. In particular, in this way it is possible to check whether a key is actually present in the key insert. When there is no key in the key insert, no data is transmitted to security control 4, so the checksum assumes the inadmissible value of zero, thereby making a bypass to error blocking.

When the checksum corresponds to an allowable value, security control 4 sends the authorization level to input unit 10 (step # 11), whereby input unit 10 is released for mode selection of operation (step n ° 12). For this, advantageously, an image is formed in the input unit 10, through which a user can select an operating mode.

The user-selected operating mode is assigned in the input unit 10 to the variable with the symbolic name Select-MSO and then sent to the control without error safety 5. In the control without error safety 5, the selected operating mode is copied to the MW03 indicator word, which can be read by the security control 4. This MW03 indicator word is then sent by the non-error protected control 5 to the security control 4 ( step n ° 14).

In the security control 4, it is also queried whether the error-free control 5 sends new data. This is determined in security control 4 because a non-zero value appears in indicator word MW01 (step # 15).

Finally, in steps No. 16 and 17, the security control 4 checks whether an acceptable code is displayed in the indicator word MW03, and thus, if the selected operating mode is in an admissible range (steps No. 16 and 17).

To do this, a list of permissible operating modes is stored in the security control. Then, by a simple comparison of the read indicator word MW03 with the list stored in the security control 4, it is possible to determine if an allowed operating mode has been selected.

When there is no allowable operating mode, a bypass is made to an error lock.

However, when there is a permitted operating mode, in safety controller 4, the permitted operating mode, i.e. the content of the MW03 indicator word, is copied to the MW05 indicator word, which is then sent to the control without security against errors 5 (steps n ° 18, 19).

This MW05 indicator word is then sent by the non-failsafe control 5 to the control unit 10. There, the user is shown the selected operating mode (step # 20). This indication is made with a different image from the image in which the user made the selection of the operating mode. This is a condition for a safe re-reading of the selected operating mode. A second condition for this is that the rereading is carried out on a variable (here MW05) different from the variable for reading the operating mode (here MW03).

As soon as the selected operating mode has been shown to the user by re-reading on input unit 10, the selection must be confirmed by the user by input on input unit 10 (step # 21).

In the event of a negative confirmation, an error variable with the symbolic name ErrorMSO is set in input unit 10, thereby making a derivation to an error lock (step 23).

Upon positive confirmation, a variable with the symbolic name SwitchMSO (step 22) is set in input unit 10 and sent to the control unit without error protection 5 via the bus system. The operating mode selected in this way is then copied to the indicator word MW07 and sent to security control 4 (step 24).

Then, in the security control 4, a comparison is made to determine if the selected operating mode (contained in the signal word MW03) corresponds to the confirmed operating mode (contained in the signal word MW07) (step 25).

When these values differ, a referral is made to an error lock.

But, when the two values are identical, safety control 4 switches to the selected operating mode; where for this purpose by the security control 4 corresponding outputs of the control system 2 are established (step n ° 26).

The entire sequence described also runs when the key is removed. In this case, all variables must adopt the value 0. The LA output must be restarted simultaneously. Thus, by checking in the safe control 4, it is guaranteed that no value can remain stored in the unsafe parts of the control 5 or the input system 10. In this way, a control of the operation of all the components of the control system Safety 1. List of reference symbols

(1) Security system

(2) Control system

(3) Machine

(4) Security check

(5) Control not protected against errors (6) Electronic key system (7) Data output

(8a-b) Bus line

(9a-c) Line

(10) Input unit

(LA) Switching output

(YES) Switching input

Claims (16)

1. Procedure for setting an operating mode of a security system (1), comprising an access system, which is connected to a control system (2) that controls a machine (3); wherein the control system (2) has a security control (4); characterized by the following procedural steps: • reading on two channels of signals from the access system to the control system (2); • execution of a validity check of the access system signals in the control system (2); • where the control system (2) only allows the selection of an operating mode, through an input unit (10), in the presence of valid signals from the access system; • execution of an error control for the selection of the operating mode in the control system (4); • switching to the selected operating mode via safety control (4) after a successful error control. 2. Method according to claim 1, characterized in that the access system has a diversified exit structure. Method according to one of claims 1 or 2, characterized in that the signals from at least one exit of the access system are used in the security control (4) for a validity check. Method according to one of Claims 1 to 3, characterized in that the security system (1) additionally presents a security control (4) that is not error-proof (5); wherein the non-error-proof control (5) controls the input unit (10); and where the signals from a first exit of the access system are read in the non-error-proof control (5), and the signals from the second exit of the access system, in the security control (4). Method according to claim 4, characterized in that the access system is made up of an electronic key system (6), which comprises a key insert and at least one key; because the access system presents a data output (7), through which data is read from a key present in the key insert in the control that is not error-proof (5); and because the access system has a switching output (LA), through which, in the security control (4), a switching signal is read, the switching states of which indicate whether or not a key is present in the key insert. Method according to claim 5, characterized in that as the first validity check of access system signals during the reading of a switching signal, the switching status of which signals a key present in the key insert, in the security control ( 4) a time expectancy is initiated by opening a time interval; and because in the security control (4) it is checked whether within this time interval data from the key has been read through the data output (7) in the non-error-proof control (5). 7. Procedure according to claim 6, characterized in that as a second validity check, in the control not protected against errors (5), a checksum calculation of the key data read by the data output (7) is performed. . Method according to claim 7, characterized in that after a successful validity check, the non-error protected control (5) sends an authorization signal to the input unit (10), enabling the inputs to the input unit (10 ). Method according to one of Claims 1 to 3, characterized in that the input unit (10) is made up of a touch screen (English: Touchscreen). Method according to claim 9, characterized in that after receiving the authorization signal on the touch screen, an image is formed or accessible, in which an operating mode can be selected. Method according to one of Claims 1 to 10, characterized in that in the control (5) that is not failsafe, as error control it is checked whether the selected operating mode is in an allowable range. Method according to one of Claims 1 to 11, characterized in that for error control of a selected operating mode, it is reread in the input unit (10). 13. Method according to claim 12, characterized in that the selected operating mode and the re-operating mode are shown in different images of the input unit (10). Method according to one of Claims 1 to 13, characterized in that when an error is detected in the control system (2), an error block is generated. Method according to one of Claims 5 to 14, characterized in that when a key is removed from the key insert of the key system (6), a functional check is carried out on all the components of the security system (1). 16. Security system (1), comprising an access system, which is connected to a control system (2) that controls a machine (3); wherein the control system (2) has a security control (4); characterized in that the access system has a two-channel output structure that is configured to read signals in the control system (2); because the control system (2) is configured to execute a validity check of the access system signals; wherein the control system (2) is configured to enable the selection of an operating mode through an input unit (10) in the case of presenting valid signals from the access system; because the security control (4) is designed to execute an error control of the selection of the operating mode; and in that the security control (4) is configured to assume a switch to the selected operating mode after a successful error control.