LU102418B1 - Technique for validating a safety function of a controller - Google Patents

Abstract

A technique for validating a safety function of a controller (110) for controlling an electrical circuit (120) is described. The safety function can be triggered by means of a sensor (130) that is spatially separate from the controller (110) and in signal communication (132) with the controller (110). According to a method aspect of the technology, an identifier (134) arranged on the sensor (130) and indicating the sensor (130) is recorded. A state (104; 114; 144) of the safety function is retrieved using the detected identifier (134). An instruction (102) to actuate the sensor (130) depending on the retrieved state (104; 114; 144) of the safety function is issued. It is determined whether the safety function triggers in response to actuation of the sensor (130).

Description

The invention relates to a technique for validating a safety function of a controller.

In particular, a method for validating a safety function of a controller for controlling an electrical circuit and a portable device performing the method are disclosed.

Portable devices such as smartphones for acquiring measured values and for transmitting the acquired measured values are known in the prior art.

The document "The smart SAFETYTEST 1RC" from the company SAFTETYTEST GmbH, Nuremberg, describes a test device for the safety-related testing of AC consumers and extensions.

The test device uses such a smartphone with an application program.

A barcode reading function identifies an AC consumer as a test item.

The test procedure is menu-guided via the smartphone used.

The smartphone is connected to the test device via a peer-to-peer wireless connection such as Bluetooth.

The readings are stored in a database that can be synchronized via a cloud.

Furthermore, the document "Validation of functional safety - Achieving protection objectives with certainty" from the manufacturer "SICK Sensor Intelligence", Waldkirch, dated November 21, 2020, describes a validation of functional safety.

The installation and function of safety-relevant parts of a control system are described in a review and validation plan.

However, such validations are often not carried out according to plan.

This affects both the time and scope of the validation.

The invention is therefore based on the object of specifying a method in which efficient validation is ensured.

The object is solved with the features of each of the independent claims. Expedient refinements and advantageous developments of the invention are specified in the dependent claims.

Exemplary embodiments of the invention are described below with partial reference to the figures. A first aspect relates to a method for validating a safety function of a controller for controlling an electric circuit. The safety function can be triggered by means of a sensor that is spatially separate from the controller and is in signal communication with the controller. The method includes a step of detecting an identifier arranged on the sensor and indicating the sensor. The method also includes a step of retrieving a status of the safety function using the detected identifier. The method also includes a step of issuing an instruction to actuate the sensor as a function of the retrieved state of the safety function. The method further includes a step of determining whether the safety function triggers in response to actuation of the sensor. Since the instruction to actuate the sensor (e.g. in the course of validation) depends on the retrieved state of the safety function that can be triggered by that sensor, exemplary embodiments of the method can instruct actuation if (e.g. only if) this is due to the retrieved state of the safety function is required. As a result, a point in time of the validation and/or a scope of the validation can be adhered to. In particular, efficient validation is made possible by the state-dependent output of the statement (and thus possibly

Determination} avoids premature or late validation. The retrieved state can take into account a moment in time or a use of the safety function. For example, the condition can be a

State the frequency of use of the safety function (e.g. an actuation of the sensor and/or a triggering of the safety function) outside of the validation. The instruction can be issued depending on the status, in that the instruction is issued if a predetermined period of time has elapsed since the safety function was last used (e.g. since the last validation) and/or if the frequency of use is less than a predetermined period within a predetermined period of time first threshold is As an alternative or in addition, the instruction can be issued depending on the status, in that the instruction is issued if the frequency of use or the number of uses is greater than a predetermined second threshold value since the last validation. Whether the instruction to actuate the sensor is issued (and optionally whether it is determined whether the safety function triggers in response to actuation of the sensor) may depend on the retrieved state of the safety function. The identifier can be detected without contact, for example optically and/or by means of radio communication (optional near-field communication). The identifier may include a grid with optional reflective and absorptive elements. The reflective and absorbing elements can comprise white and black surface elements, respectively.

The grid can be one-dimensional. The grid may include a barcode with black bars as absorbing elements. Alternatively or additionally, the grid can be two-dimensional. The grid may include a quick response (QR) code, for example with black squares as absorbing elements. For detection by means of radio communication (optional near-field communication), the identifier can be a (for example passive) backscattering transponder

(For example, a so-called "tag") for radio frequency identification (in technical terms: radio-frequency identification, or in short: RFID). A portable device can perform the method. The portable device can be referred to as a device for short. The portable device can be a mobile phone (e.g. a smartphone) or a tablet computer. The portable device can comprise a camera for optically capturing the grid, a laser scanner for optically capturing the grid or an antenna, modulator and/or demodulator for near-field communication, which is designed to capture the identifier arranged on the sensor.

Alternatively or additionally, the portable device can include a (for example wireless) data interface for retrieving the status of the safety function using the detected identifier. The data interface can be a radio interface, for example a radio interface to a radio network (for example a radio access network, in technical terms: radio access network, or in short: RAN). The data interface can be a mobile radio interface (for example to a cellular radio network) or a radio interface to a wireless local area network (technically: wireless local area network, or in short: WLAN).

Alternatively or additionally, the wearable device may include a display and/or a speaker for outputting the instruction to actuate the sensor.

The method may further include a step of detecting a position of the portable device. The position can be recorded relative to the sensor or relative to a reference point or reference coordinate system (e.g. inside a building).

The position of the portable device can be determined in a building (e.g. in a production hall) in which the sensor and/or the circuit are arranged, e.g. by means of a WLAN (e.g. a radio network according to the Wi-Fi Alliance), by means of a direct radio transmission (e.g.

Bluetooth Low Energy, BLE, according to the Bluetooth Special Interest Group), passive RFID, and/or an open location standard, e.g.

Omlox.

For example, position data from Ultra Wide Band Technology (UWB), BLE, RFID, mobile communications (e.g. according to the 3GPP standard 5G) and/or a navigation satellite system (e.g.

Global Positioning System, GPS) and/or combined and made available via a uniform interface.

Alternatively or additionally, the position of the portable device can be determined using a global navigation satellite system, optionally taking into account correction data from a local reference station of the navigation satellite system.

Alternatively or additionally, the retrieved state may indicate a location of the sensor indicated by the identifier.

The detecting step may include matching the location retrieved using the identifier to a location of the portable device.

A plurality of sensors (e.g., a plurality of sensors in signal communication with the controller) may be stored (e.g., mapped or encoded) in the portable device and/or the portable device may access (e.g., via the data interface) a map of the plurality of sensors .

Capturing the identifier may determine the position of the portable device relative to the sensor, for example based on an apparent size of the optically captured identifier and/or a transit time of the identifier captured using the laser scanner and/or a signal strength of the identifier captured using near field communication.

Alternatively or additionally, the relative position can be calculated based on a detected position of the portable device and the position of the sensor indicated by the retrieved state.

Retrieving the status of the safety function and/or issuing the instruction to actuate the sensor and/or determining whether the safety function is triggered can be carried out as a function of the detected relative position. For example, the relative position may include a distance from the handheld device to the sensor. The retrieving and/or the outputting and/or the determining may be performed if the detected distance is less than a predetermined threshold and/or if the detected distance to the sensor is the shortest distance of the handheld device to each of the plurality of sensors.

The signal communication can be wired between the sensor and the controller. Alternatively or in addition, the signal communication between the sensor and the controller can be radio-based, for example in accordance with a standard of the mobile radio standard of the "Third Generation Partnership Project" (3GPP) committee for machine communication or the Internet of Things (technically: Internet of Things, in short: 107) .

The sensors can be in signal communication with the controller via an electrical line (e.g. one wire per channel) or via a radio link. Alternatively or additionally, the signal communication can include modulation symbols according to an orthogonal frequency division multiplex method (in technical terms: orthogonal frequency division multiplexing, OFDM for short). Alternatively or additionally, the sensor (or each of the plurality of sensors) may be in signal communication with the controller via two or more redundant channels.

The safety function may include a circuit shutdown function. The safety function can, for example, include opening a load-break switch in the circuit. Alternatively or additionally, the circuit may include a controller controlled relay (or multiple controller controlled relays). The or each relay can be designed to interrupt the circuit when the safety function is triggered.

The relay can be a contactor. The relay can switch electromechanically or by means of a semiconductor (for example by means of a bipolar transistor with an insulated gate electrode (technically: Insulated-Gate Bipolar Transistor, abbreviated: IGBT).

The controller may also include a counter (e.g. as a state memory). The controller may increment the counter in response to an actuation of the sensor (e.g., any actuation or any actuation in operation of the circuit). Alternatively or additionally, control can include a timer (for example as a memory of the state). The controller can reset the timer upon verification.

The state of the safety function can include a number of times the sensor has been operated, or a length of time since the last execution of the step of determining. Alternatively or additionally, the method can further comprise, in the case of determining the triggering of the safety function in response to the actuation of the sensor, a step of resetting the counter of the number of actuations of the sensor since the last execution of the step of determining and/or a step resetting the timer of the amount of time since the determining step was last performed.

The status of the safety function can include the number of times the sensor has been operated or the length of time since the last validation (for example since the last step of determining).

The instruction to actuate the sensor can be issued if (e.g. only if) the retrieved state has a (e.g. second)

Threshold for the number of times the sensor has been activated since the old execution of the determination's shritis or exceeds a (e.g. first) threshold for the amount of time since the last execution of the determination's determinant 8

The identifier can specify the sensor (unambiguously).

The identifier may uniquely identify the sensor among the plurality of sensors.

The identifier can include a serial number of the sensor and/or a sealant identifier. Alternatively or additionally, the identifier can be a digital type label or a digital type label. The digital type label can be a type label in accordance with the Nam

8 SOOVANES and/or a (e.g. {elhwaise) machine-readable typename, affative or additionally, the identification can include a globally unique, machineiestèrs identification (19) attached to the sensor in accordance with the standard DIN SPEC 81406, ie the identification can be an automatic identification from physical objects and/or initials to the physical

object in IT systems, in particular IoT systems, a large number of sensors can be in signal communication with the controller, the identification can clearly indicate the sensor among the large number of sensors,

Retrieving the state of the safety function using the detected identifier can include sending a database query to a computer network that stores the states of a large number of safety functions or the state of the safety function for each one of a number of sensors. The database query can retrieve the detected identifier specifying the security function and/or the sensor, the database query can be sent via the data interface,

Determining whether the safety function triggers in response to the actuation of the sensor may include a step of issuing an instruction to inspect an open switching state of the circuit, an instruction to inspect a de-energized state of a load of the circuit, and/or an inspection instruction the signal communication between the sensor and the controller. Alternatively or additionally, determining whether the safety function is triggered in response to the actuation of the sensor can include a step of acquiring feedback from the inspection.

Determining whether the safety function triggers in response to actuation of the sensor may include issuing an instruction to inspect an open circuit condition of the circuit and/or issuing an instruction to inspect a de-energized condition of the load (ie.

a load) of the circuit and/or issuing an instruction to inspect the signal communication between the sensor and the controller. The instruction can be issued using the display and/or the speaker. The feedback can be captured using a touch-sensitive surface of the display and/or a microphone. The issued instruction to operate the sensor, the issued instruction to inspect the open circuit state of the circuit, the issued instruction to inspect the de-energized state of the load of the circuit, and/or the issued instruction to inspect signal communication may depend on the detected identifier. The instruction to actuate the sensor may include a description of the actuation of the sensor that is specific to the sensor based on the sensed identifier. As an alternative or in addition, the instruction to inspect the open switching state of the electrical circuit can include a description of the open switching state, which is specific to the electrical circuit in accordance with the detected identifier. Alternatively or additionally, the

instruction to inspect the de-energized state of the load of the circuit include a description of the de-energized state specific to the load according to the detected identifier. Alternatively or additionally, the instruction to inspect the signal communication can include a description of the wiring and/or a configuration of the signal communication that is specific to the sensor based on the detected identifier. Alternatively or additionally, determining whether the safety function triggers in response to the actuation of the sensor (optionally capturing the feedback from the inspection) can include a step of capturing a camera image of the open switching state of the circuit, the de-energized state of the consumer of the circuit, or one Wiring the signal communication between the sensor and the controller.

Alternatively or additionally, determining whether the safety function is triggered in response to the actuation of the sensor can include a step of retrieving a signal of the actuation of the sensor from the controller and/or from a computer network. The controller can be designed to capture the signal from the actuation of the sensor at an interface of the controller for signal communication and/or to output it to the computer network (for example forwarding it).

The signal of the actuation of the sensor can be part of the status of the safety function. As an alternative or in addition, the portable device can update the status of the safety function or call it up again using the data interface. Based on the updated or retrieved state, the portable device can determine whether the security function has triggered in response to actuation of the sensor. The step of determining whether the safety function triggers in response to actuation of the sensor may further include a step of

Comparing an identifier assigned to the interface of the controller with the detected identifier and/or an identifier specified in the status with the detected identifier.

The computer network can include at least one data server and/or one application server. The data server may include storage for storing the state of the security function. The data server can receive (e.g. retrieve) the status from the controller. The data server can send the status to the portable device (e.g. make it available for retrieval). The computer network can be designed for cloud computing. The computer network can be technically referred to as a cloud or be part of a cloud. The cloud can also include network components and/or a cellular network (for example at least one base station that enables the portable device to have radio access to the cellular network). The computer network can be connected to the controller via the Internet to exchange the state.

The sensor can include an emergency stop button, a door switch, a light barrier, a key switch or a laser scanner. A second aspect relates to a portable device for validating a safety function of a controller for controlling a circuit. The safety function can be triggered by means of a sensor that is spatially separate from the controller and is in signal communication with the controller. The portable device includes a detection unit which is designed to detect an identifier which is arranged on the sensor and indicates the sensor. The portable device also includes a retrieval unit that is designed to retrieve a state of the safety function using the detected identifier. The portable device also includes an output unit that is designed to output an instruction to actuate the sensor depending on the retrieved state of the safety function.

The wearable device further includes a determination unit configured to determine whether the security function is triggered in response to the actuation of the sensor.

The determining unit can be an input unit, by means of which a user confirms the triggering; a direct data connection to the controller or an indirect data connection (e.g. via a computer network) to the controller via which the triggering is detected; or a camera that detects an open condition of the controlled circuit.

The invention is explained in more detail below with reference to the drawings using preferred exemplary embodiments.

1 shows a schematic representation of a portable device for validating a safety function in an environment with a controller, a circuit controlled by the controller, a sensor for triggering the safety function and a system for cloud computing according to a first exemplary embodiment; FIG. 2 shows a schematic flow chart of a method according to a second exemplary embodiment, which can be carried out using the portable device of FIG. 1; FIG. 3 shows a schematic representation of a portable device according to a third embodiment, which may be used in the environment of FIG. 1 and/or for carrying out the method of FIG. 2 ; Fig. 4 is a schematic representation of an identifier that may be used with each embodiment;

5 shows a first implementation of the step of determining whether the safety function is triggered, which can be used together with each embodiment; and FIG. 6 shows a second implementation of the step of determining whether the safety function triggers, which can be used together with any embodiment.

1 schematically shows a first exemplary embodiment of a portable device, which is generally designated by reference number 100 . The device 100 can, for example in the system context shown in FIG. 1, interact with a controller 110, a circuit 120, at least one sensor 130 and/or a system 140 for cloud computing. Herein, enumerations of the form "A, B, and/or C" reveal any power set of {A, B, C}.

The controller 110 includes a programmable logic controller (PLC)

112. The state of the safety function of the controller 110 that can be triggered by at least one of the sensors 130 is stored in a (e.g. non-volatile) memory 114 of the controller 110.

The at least one sensor 130 is in signal communication with the PLC 112 via an interface module 116 of the controller 110 . The interface module 116 can have, for example, general purpose inputs and/or general purpose outputs (GPIO). The GPIO can have digital inputs (DI), digital outputs (DI). Digital Output", DO), analog inputs (technical: "Analog Input", Al), analog outputs (technical: "Analog Output", AQ), serial data inputs (technical: "Serial Data In", SDI) and/ or serial data outputs (in technical terms: "Serial Data Out", SDO).

14 / 37 LU102418 The controller 110 controls a circuit 120 via control lines 122. For example, the circuit 120 includes at least one (e.g. mechanical or semiconductor-based) relay 124 which selectively opens the circuit 120 at least at one point as determined by the controller 110 (i.e. interrupts the electrical line in the circuit) and closes (i.e. which electrically conductively connects). The control lines can each connect a DO of the interface module 116 to a relay 124 of the circuit 120 in an electrically conductive manner (for example with a galvanic isolation between the controller 110 and the circuit 120).

Optionally, the controller 110 can be designed to control or regulate a current in the circuit, for example by the PLC 112 applying a pulse width modulated control signal to the control line 122 to the semiconductor-based relay 124 .

The controller 110 uses the at least one relay 124 to control a consumer 126 (i.e. a load) in the circuit 120. The consumer 126 can be an electric motor (e.g. an electric actuator). The consumer 126 can be an electric motor for electromechanical actuation (e.g. the actuator). Alternatively or additionally, the consumer 126 can comprise an electric compressor and/or a solenoid valve for generating or controlling the pressure or the flow of a working medium in a (e.g. hydraulic or pneumatic) system.

The consumer 126 can be a drive or an actuator (i.e. an actuator) of a machine (e.g. a production machine) or a plant (e.g. a production plant). The plant can be a production plant, for example a manufacturing plant or a (for example process engineering or chemical) process plant. The at least one sensor 130 can include a safety switch (e.g. an emergency stop button), for example for switching off and/or electromechanically blocking the load 126. Alternatively or additionally, the at least one sensor 130 can include a key switch, for example for restricting access or use of the consumer 126. The emergency stop button 130 and/or the key switch 130 can each be electrically conductively connected to a DI of the interface module 116.

Alternatively or additionally, the at least one sensor 130 can include a light barrier, a laser scanner, an induction loop and/or a quantum sensor, for example for monitoring an area surrounding the consumer 126. The light barrier, the laser scanner, the

The induction loop and/or the quantum sensor, or an evaluation unit thereof, can each be electrically conductively connected to a DI or SDI of the interface module 116 .

The light barrier, the laser scanner or the induction loop can monitor an intrusion (for example a hand) into a working area of the consumer 126 .

The quantum sensor can monitor a room air or protective atmosphere around the load 126 .

The safety function can include controlling the consumer 126 depending on the at least one sensor 130 .

For example it can

Triggering the safety function may include turning off (i.e., de-energizing and/or de-energizing) load 126 in response to actuation of sensor 130.

Alternatively or additionally, the safety function can be triggered by an electromechanical fixing (e.g. braking or blocking) of a shaft or axis of the

Include consumer 126 in response to actuation of sensor 130 .

The safety function can be multi-channel between the controller 110 and the sensor 130 .

For example, the at least one sensor 130 can be redundantly connected to the controller 110 in

Signal communication 132 stand.

Actuation of sensor 130 may be communicated (i.e., signaled) to controller 110 via any of multiple channels.

The controller 110 can be designed to trigger the safety function if at least one of the multiple channels signals the actuation of the sensor 130 . Furthermore, the safety function between the controller 110 and the circuit 120 can be multi-channel. For example, the control line 122 may include multiple redundant channels between the controller 110 and the circuit 120 and/or the controller 110 may control multiple relays 124 (e.g., redundant and/or connected in series in the circuit 120) respectively. The controller 110 can be designed to output the triggering of the safety function on each of the multiple redundant channels between the controller 110 and the circuit 120 in response to the actuation of the sensor 130 (for example at least one of the sensors 130) detected via the signal communication 132 and/or or to control each of the multiple relays 124 to trigger the safety function.

The controller 110 can be designed for (for example redundant) safety function, optionally according to the ISO 13849 standard and/or the IEC 61508 series of standards. For example, the controller 110 can include an expansion module 118 for the safety function. Expansion module 118 and/or PLC 112 may (each, for example) comprise a unit for detecting signals from the at least one sensor 130, a unit for processing signals when the safety function is triggered, and/or a unit for outputting signals to control lines 122 to trigger the safety function. The expansion module 118 can be an expansion module for a performance level (PL) and/or a safety integrity level (SIL, also: safety requirement level, technically also: safety integrity level). The units in the expansion module 118 can, for example, be redundant to the PLC 212, i.e. be present in addition to corresponding units in the PLC 212. Alternatively or additionally, the expansion module 118 can monitor the units of the safety function in the PLC 212.

The PLC 112, the interface module 116 and/or the expansion module 118 for the safety function are mounted or can be mounted on a mounting rail, for example a top-hat rail. When mounted on the mounting rail, the PLC 112, the interface module 116 and/or the expansion module 118 have a data connection via a mounting rail bus extending along the mounting rail and/or are supplied with electrical power via the mounting rail bus. The actuation of one of the sensors 130 (i.e. a detection of the respective sensor 130 as intended) is transmitted from the sensor 130 to the controller 110 via the signal communication 132 . The controller 110 detects the actuation of the sensor 130 and, in response to the detected actuation, outputs a control signal to trigger the safety function on the at least one control line 122 to the circuit 120 .

The memory 114 of the controller 110 counts (e.g. as a counter) the number of actuations (e.g. separately for each sensor 130 and/or each safety function), preferably since the last validation of the safety function or since the last issue of the instruction to actuate the sensor 130. Alternatively or additionally, the memory 114 of the controller 110 (e.g. as a resettable timer) measures the length of time (e.g. separately for each sensor 130 and/or each safety function) since the last validation of the safety function or since the last issue of the instruction to actuate the sensor 130.

The portable device 100 is designed to detect the identifier 134 arranged on the respective sensor 130 (preferably without contact), for example optically using a camera or via radio signals (for example near-field communication, short: NFC) using an antenna.

Preferably, the detection is limited to a short distance between the device 100 and the identifier 134 (and thus the sensor 130), whereby the detection of the identifier 134 indicative of the sensor 130 implies that the portable device 100 is in spatial proximity to the respective sensor.

The portable device 100 is also designed to set up a data connection to a system 140 for cloud computing (in short: a cloud 140).

The cloud 140 includes a computer network 146, for example with data storage and cloud computing applications.

Optional is the

Cloud can be reached via a radio network 148 (also: radio access network), for example a mobile network or campus network.

The portable device 100 can include a radio modem and a mobile radio antenna coupled thereto, for example to set up the data connection to the cloud 140. The controller 110 is designed to set up a (e.g. wireless or wired) network connection 142 to the cloud 140 and send the status of the security function to one (e.g. decentralized)

To send memory 144 of the cloud 140 (for example to a memory of the computer network 146).

The portable device 100 retrieves the state of the security function using the detected identifier 134 from the cloud 140 (e.g. from the decentralized

memory 144 and/or from the computer network 146).

Depending on the retrieved state of the security function, the portable device 100 issues an instruction 102 to actuate the sensor 130 and determines whether the security function triggers in response to the sensor 130 actuation.

This validates the safety function.

Technically speaking, the safety function can also be referred to as a safety function.

FIG. 2 shows a schematic flowchart of a method 200 for validating a safety function of a controller for controlling an electric circuit according to a second exemplary embodiment.

The method 200 can be implemented by the portable device 100, for example according to the first embodiment.

Alternatively or additionally, the method 200 in a system environment with the controller 110, the

Circuit 120, one of the sensors 130 and/or the cloud 140 are executed. The safety function can be triggered by means of a sensor 130 that is spatially separate from the controller 110 and is in signal communication 132 with the controller 110 . The method 200 includes a step 202 of detecting an identifier 134 arranged on the sensor 130 and identifying the sensor 130. In a step 204, a state of the safety function, which is stored, for example, in at least one of the memories 104, 114 and 144, is retrieved. When retrieving, the security function and/or the sensor 130 can be specified using the detected identifier.

In a step 206, an instruction 102 to actuate the sensor 130 depending on the retrieved state of the safety function is output. It is then determined (e.g., interrogated, observed, or detected) in a step 208 whether the safety function triggers in response to actuation of sensor 130 (eg, whether the safety function triggered in response to actuation of sensor 130).

FIG. 3 shows a schematic representation of the portable device 100 according to a third exemplary embodiment, which can be implemented as a development of the first and/or second exemplary embodiment. For example, the portable device 100 according to the third embodiment can be used in a system environment with the controller 110, the circuit 120, one of the sensors 130 and/or the cloud 140 according to the first embodiment.

The portable device 100 includes a detection unit 302 which is designed to detect the identifier 134 arranged on the sensor 130 and indicating the sensor 130 according to step 202. The detection unit 302 can be a unit for NFC or an RFID reader.

Furthermore, the portable device 100 includes a retrieval unit 304, which is designed to retrieve a state of the safety function using (for example by specifying) the detected identifier 134 (for example from the cloud 140). The retrieval unit 304 may include a wireless network connection, such as a WLAN or cellular interface.

Furthermore, the portable device 100 includes an output unit 306, which is designed to output an instruction 102 to actuate the sensor 130 depending on the retrieved state of the safety function.

The output unit 306 can be a screen. Furthermore, the portable device 100 comprises a determination unit 308 which is designed to determine whether the safety function is triggered in response to the actuation of the sensor 130 . For a user query in step 208, the determination unit can be a functional unit with the output unit 306, for example a touch-sensitive screen. Alternatively or additionally, the determination unit 308 can be a functional unit with the retrieval unit 304 for feedback directly from the controller 110 or for feedback via the computer network 146 .

The handheld device 100 or method 200 may enable validation of safety functions in machines and systems without the operating personnel having to locate the sensors 130 using a conventional printed plan. The step 202 of detecting the identifier 134 arranged on the respective sensor 130 ensures that a user can find the sensor 130, identify it correctly and, for example, confirm the correct installation and functioning in step 208. The portable device 100 and the method 200 can also avoid this That the validation (which can also be referred to as a test} signed in a conventional manner by the executive staff, scanned and archived on a network drive must be, since this process is unnecessary due to step 208.

Alternatively or additionally, the portable device 100 or the method 200 can ensure that the validation is carried out as prescribed at regular intervals (e.g. time intervals since the last validation or after a predetermined number of actuations of the sensor 130) by the output 206 of the Statement 102 depends on the retrieved state. Optionally, validation errors can be avoided due to the output of the inspection instruction. In large plants, for example, it is not always easy to locate and identify the sensors 130 (e.g. switchgear) with the result that sensors 130 that have traditionally been checked are incorrect. This can be ruled out on the basis of the identifier 134 recorded in step 202 and the status thus called up in step 204 .

Furthermore, while conventionally only a functional test was often carried out, the portable device 100 or the method 200 can enable a check for installation errors which can affect the correct functioning of the safety device (i.e. the safety function). To this end, the method 200 described can output the instruction for inspecting the signal communication 132 between the sensor 130 and the controller 110 and/or in step 208 can record feedback from the inspection. With this technology, the validation process can be simplified for the user and give the user more legal certainty.

Another aspect concerns a system. The system may include the computer network 146 and/or a computer program product executed by or executable by the computer network 146 for managing and displaying the safety function (eg, the safety functions of multiple sensors 130 or loads 126 of the machines). For example, the computer program product can include a web server or a cloud software module that receives (e.g. queries) and stores the state 114 of the safety function from the controller, and provides the stored state 144 of the safety function, for example wirelessly to the portable device 100. Alternatively or additionally, the system may include the controller 110.

For example, the PLC 112 can be a freely programmable control platform. The controller 110 can be designed to detect the actuation (e.g. the switching cycles) of the sensor 130 and/or to communicate with the computer network 146 or the computer program product via the network connection 142. Alternatively or additionally, the system can have at least one sensor 130 include, for example, an emergency stop button, which can also be referred to as a safety switching device. In each exemplary embodiment, the identifier 134 can comprise a digital identification plate.

Alternatively or additionally, the system can include the portable device 100 and/or a computer program product that executes the method 200, for example a validation application (short: app).

In each exemplary embodiment, the portable device 100 can be configured to carry out the following steps or the method 200 can include the following steps. The sensor 130 (e.g. a safety switching device) is detected based on its identifier 134 (e.g. a QR code) in step 202. Alternatively or additionally, the identifier and/or a type plate determined by the identifier 134 can be displayed in step 206. Alternatively or additionally, in step 206 the instruction for inspecting the sensor (for example a validation instruction) can be output. The validation guidance may depend on the identifier collected.

The method 200 can be implemented at the application level of the portable device 100 . In each embodiment, the portable device 100 can be a tablet computer or a subscriber device (technically:

"User Equipment", UE) of the cellular network, for example in accordance with a cellular standard of the "Third Generation Partnership Project" (3GPP) committee.

The computer network 146 or the computer program product executed by the computer network 146 (technically also: cloud software) can be designed to assign the circuit 120 (e.g. the machine) to the at least one associated sensor 130 (e.g. a safety switching device). save. For example, a data structure can be created in the decentralized memory 144 which assigns the at least one sensor 130 to the circuit 120 on the basis of its identifier 134 . Furthermore, each sensor 130 (for example each safety switching device) is optionally assigned a description (for example using the identifier of the sensor 130). The description may be stored in remote storage 144 and/or stored in memory 104 of portable device 100 . In every embodiment! the identifier 134 of the sensor 130 can be an equipment identifier. Alternatively or additionally, the identifier 134 can be a combination of the type specification of the sensor 130 and the serial number of the sensor 130 . In each embodiment, the description of the sensor 130 and/or the state (e.g., in memory 104, 114, and/or 144) of the sensor 130 may include at least one of the following descriptive information. A first item of descriptive information is the content of the digital identification plate. A second item of descriptive information is a resource identifier 134 of the sensor 130 and/or a resource identifier 134 of the associated controller 110. A third item of descriptive information is a maximum time period until the next validation, i.e. the first threshold value. A fourth description information is a maximum number of switching cycles until the next validation, i.e. the

24 / 37 LU102418 second threshold.

Fifth descriptive information is validation guidance, i.e., the instruction for inspection.

The signal communication 132 between the sensor 130 and the controller 110 can be wiring of the message output of the sensor 130 (for example the safety switching device) to the controller 110 .

Each request for the safety function (i.e. the safety function), i.e. each actuation of the sensor 130, is recorded by the controller 110 and transmitted to the decentralized memory 144 (for example the computer network 146 with cloud software executed by the computer network 146).

The number of times the sensor 130 has been actuated (i.e. the switching cycles), i.e. the status of the safety function, is updated in the decentralized memory 144 by the transmission from the controller 110 to the decentralized memory 144 .

The instruction to actuate the sensor 130 (i.e. as part of the validation) can be issued 206 if the number of actuations reaches or exceeds the maximum number of actuations.

Alternatively or additionally, a multi-stage output can be implemented in step 206, for example the output 206 can be dependent on the proportion of the number of operations in the maximum number of operations.

For example, a three-stage output 206 can output the colors green, yellow and red (analogous to a traffic light), preferably for a first, second and third third of the number of actuations at the maximum number of actuations.

In step 206, the user is informed of the current status (also: status) of the safety functions and receives an alarm signal when a preset threshold value is reached, for example the instruction to activate the sensor 130 (i.e. the request to carry out the validation}. With the portable Device 100 or the validation application for executing the method 200, the sensor 130 (e.g. the

Switching device) detected by a QR code attached to the sensor 130 as a machine-readable identifier 134. Optionally, the contents of the digital nameplate and/or the asset identifier and/or at least one of the above information is displayed on the screen 306 of the portable device 100 . Validation information (also: status information) from the status of the security function is displayed on the screen 306 of the portable device 100 after confirmation by the user in response to the displayed information. The validation information can include at least one of the following information. A first piece of validation information is the date of the last validation. A second piece of validation information indicates the person who performed the validation. A third piece of validation information indicates the current number of switching cycles since the last validation. Alternatively or additionally, at least one or each piece of validation information can be stored in the memory 104 of the device 100, in the memory 114 of the controller 110 and/or in the decentralized memory 144.

Optionally, in step 206, a validation plan is retrieved as instructions (i.e., the instruction for inspection) from the controller 110 and/or from the decentralized memory 144 (e.g. from the cloud 140) and is output by the user on the screen 306 for execution.

Alternatively or additionally, after the determination in step 208 (e.g. a confirmation by the user or a positive response to the triggering from the controller 110 and/or from the decentralized memory 144 and/or from the computer network 146), the status is supplemented with the validation information of the validation carried out and/or displayed on screen 306. The validation information can include at least one of the following information. A first validation information is the date of the performed validation. A second piece of validation information indicates which person performed the validation.

A third piece of validation information indicates the number of switching cycles between the last validation and the validation carried out.

Alternatively or additionally, at least one or each piece of validation information can be stored in memory 104 of device 100, in memory 114 of controller 110 and/or in decentralized memory 144.

The inspection instruction may include at least one of the following inspection instructions.

A first inspection instruction can request to check a correct installation and/or attachment, and optionally to remedy any deficiencies found.

A second inspection instruction can ask to check whether the user (also: operator) has easy access to the sensor 130 (e.g. a button).

A third inspection instruction can prompt to check whether the sensor 130 (which can also be referred to as a command generator) has damage, and optionally to rectify any deficiencies found.

A fourth inspection instruction can ask to check whether the type plate and/or the identifier 134 (which can also be referred to as a marking) are damaged or illegible, and optionally to rectify any deficiencies found.

A fifth

Inspection instruction can request to check whether the sensor 130 is dirty or moisture or dust has penetrated, and optionally to correct any deficiencies found. A sixth inspection instruction can request to check the signal communication 132 (e.g. the wiring and cable guides) and /or make sure the wires are connected to a

The terminal strip of the controller 110 is properly fastened and, optionally, correct any defects that may have been found.

Instruction 102 for actuating sensor 130 can also be referred to as instruction 102 for validating the safety function.

The instruction

102 for actuating the sensor 130 can request that the safety function be checked.

For example, in step 208 it can be determined whether the triggering of the safety function is correct.

Alternatively or additionally, it can be determined in step 208 whether the expected result

For example, an interruption of the circuit 120 and / or a rest position of the consumer 126 has occurred according to the safety specification.

For example, in step 206, the instruction 102 can prompt you to press the button 130 and confirm that both contacts 124 open and the drive 126 switches off immediately.

In an implementation variant of step 208, the successful implementation of the validation is confirmed by the user using the portable device 100 or the validation application executing the method 200.

The device 100 or the validation application executing the method 200 can be designed to read the status of the safety function (for example the data set identified by the identifier 134) in the memory 104 of the portable device 100 and/or in the memory 114 of the controller 110 and/or or update in the decentralized storage 144 (e.g. via the cloud software).

4 schematically shows the content and/or structure of the digital identification plate. The type plate can include information according to the 2006/42/EC directive (Machinery Directive). Alternatively or additionally, the digital nameplate includes a machine or product designation; a company name and full address of the manufacturer and his authorized representative, if any; a CE marking, a series or type designation and, if applicable, a serial number; and a year of manufacture or year in which the manufacturing process was completed.

Alternatively or additionally, the digital nameplate can be an electronic nameplate, for example according to the DIN 66277 standard.

The identifier 139 can be a machine identifier for globdai-unique identification of the assigned sensor 130.

The identification 134 and/or its detection in step 202 can be designed in accordance with the standard DIN SPEC 314082018 12;

S Identifier 134 must be an OR code according to the ISCHEC 18004 standard.

For example, the identifier 134 can include the digital type code (optionally including a sarkan number}), alternatively or additionally, the identifier 134 can include the equipment identifier. The identifier 134 can be stored in the memory 104 of the portable device 100 and/or in the memory 114 of the controller 110 ig and/or in the dorentraien memory 144 with the associated digital Typansohild and / or the associated serial number be linked,

Fig. 5 schematically shows a closed information file (represented by an arrow) for a first implementation of the tube 308 of the

35 Determining whether the safety function is triggered. The actual implementation of step 508 can be used together with any exemplary embodiment, e.g. alternatively or in addition to its determination by input from the user according to the exemplary embodiment in Fig. 104.

0 After the sensor 130 has been activated in response to the instruction 108 in step 208, the alarm 110 triggers the security function and transmits this change in state 114 of the security function to the portable device 100 (e.g. via single radio transmission between the alarm 110 and the device 1901 andfor to the dezeniralan memory 144

(e.g. in the computer network 148}

The arithmetic unit 148, for example as a server according to the hypertext transfer protocol HTTP), informs (for example via the mobile radio network 148) the portable device 100, optionally by means of a so-called fush

a0 method (for example according to an NTTPR server push) whether or that the security function has triggered, alternatively or additionally Iragl the portable device 100 after the issuance 208 of the instruction 102 the decentralized

Store 144 to determine 208 whether or that the safety function has triggered. FIG. 6 schematically shows a closed information flow (represented by an arrow) for a second implementation of the step 208 of determining whether the safety function is triggered. The second implementation of step 208 may be used in conjunction with any embodiment, for example alternatively or in addition to determination 208 by user input and/or to the first implementation of step 208.

The handheld device 100 includes a camera that captures the state of the circuit 120, such as the state of the load 126. For example, the camera can capture movement of the drive 126 or actuator 126 . If the detected movement of the consumer 126 stops in response to the issuance 206 of the instruction 102, the portable device 100 determines that the safety function is triggered in step 208. Although the invention has been described in terms of exemplary embodiments, those skilled in the art will appreciate that various changes may be made and equivalents may be substituted. Furthermore, many modifications can be made to suit a specific situation or material! adapt to the teaching of the invention. Accordingly, the invention is not limited to the disclosed embodiments, but includes all embodiments that fall within the scope of the appended claims.

List of reference symbols Portable device 100 Instructions for actuating the sensor 102 State of the safety function, for example memory of the portable device 104 Controller 110 Programmable logic controller (PLC) of the controller 112 State of the safety function,

For example memory of the controller 114 interface module of the controller 116 extension module for the safety function,

for example "Performance Level" (PL) and/or "Safety Integrity Level" (SIL) 118

Circuit 120 Control lines from the controller to the circuit 122 Relay, optional contactor, the circuit 124 Consumers, such as actuators or drives 126 Sensors, such as emergency stop buttons or light barriers 130

Signal communication between sensor and controller 132 Identification of the sensor 134 Cloud computing system, in short: Cioud 140 Network connection of the controller to the cloud 142 Status of the safety function,

preferably decentralized memory of the cloud 144 computer network 146 radio network, for example mobile radio network 148 method 200 step of recording the identifier 202

step of retrieving the state 204 step of issuing an instruction to actuate the sensor 206 step of determining whether the safety function is triggered 208

registration unit,

e.g. RFID reader or camera 302 polling unit of the portable device,

e.g. interface to the radio network 304

Output unit of the portable device, e.g. display 306

destination unit,

e.g. touch screen or camera 308

Claims (16)

patent claims 1. Method (200) for validating a safety function of a controller (110) for controlling a circuit (120), the safety function being performed by means of a sensor that is spatially separate from the controller (110) and in signal communication (132) with the controller (110). (130) can be triggered, the method (200) comprising: detecting (202) an identifier (134) arranged on the sensor (130) and indicative of the sensor (130); retrieving (204) a status (104; 114; 144) of the security function using the detected identifier (134); Outputting (206) an instruction (102) to actuate the sensor (130) depending on the retrieved state (104; 114; 144) of the safety function; and determining (208) whether the security function triggers in response to actuation of the sensor (130). 2. The method (200) according to claim 1, wherein the identifier (134) is recorded without contact, optionally optically or by means of near-field communication. The method (200) of claim 1 or 2, wherein the method (200) is performed by a portable device (100). The method (200) of claim 3, further comprising: sensing a position of the handheld device (100) relative to the sensor (130), optionally wherein the retrieved state indicates a position of the sensor (130) indicated by the identifier. 5. The method (200) according to any one of claims 1 to 4, wherein the signal communication (132) between the sensor (130) and the controller (110) is wired, or wherein the signal communication (132) between the sensor (130) and the Control (110) is radio-based. 6. The method (200) according to any one of claims 1 to 5, wherein the safety function comprises a switch-off function of the electric circuit (120), optionally opening a load-break switch of the electric circuit (120), or wherein the electric circuit (120) has a control (110 ) Controlled relay (124), optionally a contactor, which is designed to interrupt the circuit (120) when the safety function is triggered. 7. The method (200) according to any one of claims 1 to 6, wherein the state (104; 114; 144) of the safety function is a number of actuations of the sensor (130) or a period of time since the last execution of the step of determining (208 ), includes; and/or wherein the method (200) further comprises, in the case of determining (208) the triggering of the safety function in response to the actuation of the sensor (130), resetting (210) a counter of the number of actuations of the sensor (130), or a timer of the length of time since the step of determining (208) was last performed. 8. The method (200) according to any one of claims 1 to 7, wherein the instruction (102) for actuating the sensor (130) is issued (206) if the retrieved state (104; 114; 144) has a threshold value for the number of sensor (130) actuations, or the amount of time since the determining step (208) was last performed. The method (200) of any one of claims 1 to 8, wherein a plurality of sensors (130) are in signal communication (134) with the controller (110), and wherein the identifier (134) identifies the sensor (130) among the plurality of sensors (130) clearly indicates. 10. The method (200) according to any one of claims 1 to 9, wherein the retrieval (204) of the state (104; 114; 144) of the security function by means of the detected identifier (134) comprises: sending a database query to a computer network (146), that stores states (104; 114; 144) of a plurality of security functions or the state (104; 114; 144) of the security function for each of a plurality of sensors (130), wherein the database query uses the detected identifier (134) to uniquely indicate the security function and/or the sensor (130). 11. The method (200) of any one of claims 1 to 10, wherein determining (208) whether the safety function triggers in response to actuation of the sensor (130) comprises: issuing an instruction to inspect an open circuit state of the circuit (120 ), an instruction to inspect a de-energized state of a load (126) of the circuit (120), or an instruction to inspect the signal communication (132) between the sensor (130) and the controller (110); and collecting feedback from the inspection. 12. The method (200) of any one of claims 1 to 11, wherein the issued instruction to actuate the sensor (130), the issued instruction to inspect the open circuit state of the circuit (120), the issued instruction to inspect the unpowered state of the load (126) of the circuit (120), and/or the instruction issued to inspect the signal communication depends on the detected identifier. 13. The method (200) of any one of claims 1 to 12, wherein determining (208) whether the safety function triggers in response to actuation of the sensor (130) optionally capturing feedback from the inspection comprises: capturing a camera image of the open switching state of the circuit (120), the power-free state of the load (126) of the circuit (120), or wiring of the signal communication between the sensor (130) and the controller (110). 14. The method (200) of any one of claims 1 to 13, wherein determining (208) whether the safety function triggers in response to actuation of the sensor comprises: retrieving a signal of actuation of the sensor (130) from a computer network (146 ), wherein the controller (110) is designed to detect the signal of the actuation of the sensor (130) at an interface (116) of the controller (110) to the signal communication (132) and forward it to the computer network (146). 15. The method (200) according to any one of claims 1 to 14, wherein the sensor (130) comprises an emergency stop button, a light barrier, a key switch or a laser scanner. 16. Portable device (100) for validating a safety function of a controller (110) for controlling a circuit (120), the safety function being able to be triggered by means of a sensor (130) that is spatially separate from the controller and in signal communication with the controller (132). , wherein the portable device (100) comprises: a detection unit (302) which is adapted to detect an identifier (134) arranged on the sensor (130) and indicating the sensor (130); a retrieval unit (304) which is designed to retrieve a state (104; 114; 144) of the safety function using the detected identifier (134); an output unit (306) which is designed to output an instruction (102) to actuate the sensor (130) depending on the retrieved state (104; 114; 144) of the safety function; and a determination unit (308) which is designed to determine whether the safety function is triggered in response to the actuation of the sensor (130).