WO2020204790A1 - Safety solution with separable safety module for a remote control system - Google Patents

Safety solution with separable safety module for a remote control system Download PDF

Info

Publication number
WO2020204790A1
WO2020204790A1 PCT/SE2020/050323 SE2020050323W WO2020204790A1 WO 2020204790 A1 WO2020204790 A1 WO 2020204790A1 SE 2020050323 W SE2020050323 W SE 2020050323W WO 2020204790 A1 WO2020204790 A1 WO 2020204790A1
Authority
WO
WIPO (PCT)
Prior art keywords
safety
ocu
module
dcu
instructions
Prior art date
Application number
PCT/SE2020/050323
Other languages
French (fr)
Inventor
Carl WERNSTEDT
Andreas LÅNG
Vedran Sikiric
Original Assignee
Scanreco Ab
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Scanreco Ab filed Critical Scanreco Ab
Publication of WO2020204790A1 publication Critical patent/WO2020204790A1/en

Links

Classifications

    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B19/00—Programme-control systems
    • G05B19/02—Programme-control systems electric
    • G05B19/04—Programme control other than numerical control, i.e. in sequence controllers or logic controllers
    • G05B19/048—Monitoring; Safety
    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B9/00—Safety arrangements
    • G05B9/02—Safety arrangements electric
    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B2219/00—Program-control systems
    • G05B2219/30—Nc systems
    • G05B2219/36—Nc in input of data, input key till input tape
    • G05B2219/36159—Detachable or portable programming unit, display, pc, pda

Definitions

  • the present invention relates to an operator control unit (OCU) and a device control unit (DCU), where the OCU and DCU function together within a system for professional applications and remote control of a device, where an operator can control the device through the OCU, where the OCU comprises actuators through which the operator can act and create control instructions, and where the DCU is connected to the device and adapted to receive the instructions from the OCU to control the device according to received instructions.
  • OCU operator control unit
  • DCU device control unit
  • the OCU comprises a first safety module, comprising at least one first safety processor, and a first application module, comprising a first application processor, where the first application module is adapted to monitor all actuators of the OCU and to create the instructions according to the status of the actuators, and the first safety module is adapted to monitor safety classified actuators of the OCU, and at least instructions created by the first application module pertaining to safety classified actuators.
  • the first safety module is adapted to detect any disparities between the status of the safety classified actuators and the instructions pertaining to safety classified actuators created by the first application module, and to shut down the communication between the OCU and said DCU if a disparity is detected.
  • the DCU comprises a second safety module, comprising at least one second safety processor, and a second application module, comprising at least a second application processor, where the second safety module is adapted to receive at least all safety classified instructions from the OCU, where the second application module is adapted to receive all other instructions from the OCU.
  • the second safety module is adapted to actively control at least all safety classified interfaces of the DCU according to received instructions
  • the second application module is adapted to actively control other interfaces of the DCU according to received instructions.
  • the present invention also relates to a method for an OCU, used by an operator, to remotely control a device in a professional application, where the OCU comprises actuators through which the operator can act and create control instructions.
  • the OCU comprises a first safety module, comprising at least one first safety processor, and a first application module, comprising a first application processor, where the first application module is used to monitor all actuators of the OCU and to create the instructions according to the status of the actuators.
  • the method teaches that the first safety module is used to monitor safety classified actuators of the OCU, where the first safety module is used to monitor at least instructions pertaining to safety classified actuators created by the first application module, where the first safety module is used to detect any disparities between the status of the safety classified actuators and the instructions pertaining to safety classified actuators created by the first application module, and where the first safety module is used to shut down the communication between the OCU and the DCU if a disparity is detected.
  • the present invention also relates to a method for a DCU connected to a device to control the device in a professional application, and a method for the remote control of a device in a professional application by means of controlling the device through an OCU and a DCU connected to the device, where the DCU receives instructions from the OCU and controls the device according to received instructions.
  • the DCU comprises a second safety module, comprising at least one second safety processor, where the DCU comprises a second application module, comprising a second application processor.
  • the method teaches that the second safety module is used for receiving at least all safety classified instructions from the OCU, and that the second application module is used for receiving all other instructions from the OCU, where the second safety module is used for actively controlling safety related interfaces belonging to the DCU, and where the second application module is used for actively controlling other interfaces of the DCU.
  • the invention also relates to a first computer program product comprising computer program code, which, when executed by a computer, enables the computer to perform the steps of a first safety processor within an OCU according to the inventive method for an OCU.
  • the invention also relates to a second computer program product comprising computer program code, which, when executed by a computer, enables the computer to perform the steps of a second safety processor within a DCU according to the inventive method for a DCU.
  • the invention also relates to a computer readable medium, through which computer program code according any of the inventive first or second computer program product is carried.
  • OCU operator control unit
  • DCU device control unit
  • the safety certification is a must, however, this makes it hard to provide the sought for flexibility in system configuration since every configuration has to be certified, it has to conform with the safety standard.
  • the present invention teaches that the first safety module, with thereto belonging hardware and computer program, is clearly isolated from the rest of the OCU, that the OCU and the first application module is configured or adapted to function within the specific system, and that the first safety module can be used or reused in OCUs adapted or configured to function within other systems or system configurations.
  • One aspect of the invention further teaches that the safety classified actuators are all actuators that are related to any function that is dictated by a safety classification for the device.
  • the present invention teaches that the hardware and computer program belonging to the first safety module is first safety classified hardware and first safety classified computer program.
  • the inventive first safety module When the inventive first safety module is used in a system the system will conform to safety certification given that appropriate regulatory system verification is passed.
  • One aspect of the invention provides a possibility to easily and fast provide new systems, or to modify existing systems, while maintaining required standard of safety without expensive and time consuming safety certification procedures for every new or modified system.
  • the first safety module is adapted to take care of and manage at least all safety classified communication between the OCU and the DCU, that the first application module is adapted to take care of and manage all other communication between the OCU and the DCU, that the first safety module is adapted to manage at least all safety classified functions of the OCU, that the first application module is adapted to manage all other functions of the OCU.
  • the first safety module comprises at least two first safety processors for redundancy.
  • the OCU can be any kind of OCU.
  • the OCU is mobile control unit, such as a handheld control unit or a control unit with a carrier appliance, or a stationary control unit.
  • Examples of possible carrier appliance for a mobile OCU are a strap, belt or vest.
  • the present invention also relates to a DCU, and one aspect of the invention teaches that the second safety module, with thereto belonging hardware and computer program, is clearly isolated from the rest of the DCU, that the DCU and the second application module is configured or adapted to function within the specific system, and that the second safety module can be used or reused in DCUs adapted or configured to function within other systems or system configurations.
  • One aspect of the invention further teaches that the safety classified instructions are all instructions that are related to any function that is dictated by a safety classification for the device.
  • the inventive second safety module When the inventive second safety module is used in a system the system will conform to safety certification given that appropriate regulatory system verification is passed.
  • One aspect of the invention provides a possibility to easily and fast provide new systems, or to modify existing systems, while maintaining required standard of safety without expensive and time consuming safety certification procedures for every new or modified system.
  • the second safety module comprises at least two second safety processors for redundancy.
  • the present invention also relates to a system for professional applications and remote control of a device, comprising an inventive OCU adapted to allow an operator to control the device, and an inventive DCU being connected to the device and adapted to receive instructions from the OCU and to control the device according to the received instructions.
  • the OCU can communicate with the DCU via wireless communication or via wire depending on system configuration.
  • the OCU communicates with the DCU via a black channel, where the communication protocol used in the black channel safely acknowledge that every received message is correct, and where the black channel form a safe communication channel where no safety classification is required.
  • the OCU communicates with the DCU via at least two channels for redundancy, and that the at least two redundant channels form a safety classified communication channel.
  • the present invention also relates to a method for an OCU as defined in the field of invention, which method teaches the use or reuse of the first safety module in OCUs adapted or configured to function within other systems or system
  • safety actuators that are related to any function that is dictated by a safety classification for the device are defined as safety actuators.
  • hardware belonging to the first safety module is first safety classified hardware, and that first safety classified computer program is used to run the first safety classified hardware.
  • the inventive method enables the validation of a safety certificate awarded the first safety module for any system or system configuration where the first safety module is used.
  • first safety module can be used for taking care of and managing at least all safety classified communication between the OCU and the DCU, the use of the first application module for taking care of and managing all other communication between the OCU and the DCU, the use of the first safety module for managing at least all safety classified functions of the OCU, the use of the first application module for managing all other functions of the OCU.
  • At least two first safety processors are used in the first safety module for redundancy.
  • a mobile control unit can be used for the OCU, such as a handheld control unit or a control unit with a carrier appliance, such as a strap, belt or vest. It is also possible to use a stationary control unit for the OCU.
  • the present invention also relates to a method for a DCU as defined in the field of invention, which method teaches the use or reuse of the second safety module in DCUs adapted or configured to function within other systems or system configurations.
  • Hardware belonging to the second safety module is second safety classified hardware, and it is proposed that second safety classified computer program is used to run the second safety classified hardware.
  • One aspect of the invention enables the validation of a safety certificate awarded the second safety module for any system or system configuration where the second safety module is used.
  • At least two second safety processors are used in the second safety module for redundancy.
  • the present invention also relates to a method for the remote control of a device in a professional application, the method comprising the inventive steps of controlling the device through an OCU as described above, and the inventive steps of controlling a DCU connected to the device as described above, where the DCU receives instructions from the OCU and controls the device according to the received instructions.
  • a black channel is proposed to be used in the communication between the OCU and the DCU, where a communication protocol that safely acknowledge that every received message is correct is used in the black channel, thus forming a safe communication channel where no safety classification is required through the black channel.
  • the present invention relates to a first computer program product comprising computer program code, which, when executed by a computer, enables the computer to perform the steps of at least one first safety processor according to the inventive method for an OCU.
  • the present invention also relates to a second computer program product comprising computer program code, which, when executed by a computer, enables the computer to perform the steps of at least one second safety processor according to the inventive method for a DCU.
  • the present invention also relates to a computer readable medium, which could be a non-volatile computer readable medium, where computer program code according to the first or second computer program product is carried by the computer readable medium.
  • the advantages of an OCU, a DCU, a method, computer program product or computer readable medium according to the present invention are that a possibility to easily and fast enable new systems, or to modify existing systems, while maintaining required standard of safety without expensive and time consuming safety certification procedures for every new system is provided.
  • the invention provides a first and second safety module that can be used in different configurations of OCUs and DCUs with a maintained safety certificate. This shortens the time to market for new configurations and systems. Even if the available safety modules are over qualified for a specific application it is easier and less expensive to use the available safety modules than to develop new OCUs and/or DCUs that require a safety certification procedure.
  • FIG. 1 is a schematic and very simplified illustration of an OCU
  • Figure 2 is a schematic and very simplified illustration of an OCU
  • Figure 3a is a simplified illustration of the use of a first and second safety module in a system or system configuration
  • Figure 3b is a simplified illustration of the use of the same first and second safety module that is shown in Figure 3a in another system or system configuration
  • Figure 4 is a schematic and very simplified illustration of a DCU
  • Figure 5 is a simplified illustration of a computer readable medium.
  • FIG. 1 schematically showing an operator control unit, OCU 1 , adapted to function within a system A for professional applications and remote control of a device B and to be used by an operator C to control the device B.
  • the OCU 1 comprises actuators through which the operator C can act and create control instructions.
  • the system A also comprises a device control unit, DCU, 2 connected to the device B, where the DCU 2 is adapted to receive the instructions from the OCU 1 and to control the device B according to received instructions.
  • DCU device control unit
  • the OCU 1 is developed for professional use of an operator C who use them day in and day out.
  • the OCU 1 is sized and carefully positioned to be as convenient as possible and support heavy usage for many hours without causing the operator C fatigue.
  • the actuators on the OCU 1 may be anything of digital and proportional actuators, such as mushroom buttons, digital pushbuttons, digital selectors, rotary selectors, different versions of joysticks, and levers or potentiometers.
  • Two-way communication 3 between the OCU 1 and the DCU 2 enables operator feedback from the controlled device B.
  • the device B can be anything that is controlled by means of a OCU 1 and DCU 2, and there are many divers professional applications where the ability to operate a device from a distance is important for different reasons.
  • the remote control may be required to enable the ability to operate equipment from safer grounds, to provide a better vantage points for the operator, to reduce levels of noise or vibration, to provide greater ease of machine operation, to limit operator fatigue, or to increased efficiency and productivity.
  • One aspect of the invention is described in relation to the control of a device B, and it should be understood that the invention is not limited to any specific device but can be used with any device where a remote control as described above can be advantageous or even required.
  • Figure 1 shows a simplified and schematic figure of a crane, however, examples of devices B are hook/skip loaders, sky lifts, truck cranes, forest winchers, harvesters, drilling rigs, concrete pumps, demolition robots, elevated work platforms, slope movers, crushers, port cranes and overhead cranes.
  • devices B are hook/skip loaders, sky lifts, truck cranes, forest winchers, harvesters, drilling rigs, concrete pumps, demolition robots, elevated work platforms, slope movers, crushers, port cranes and overhead cranes.
  • Figure 2 shows that the OCU 1 comprises a first safety module 1 1 , with at least one first safety processor 1 1 1 and possibly also other hardware 1 12, and a first application module 12, with a first application processor 121 and possibly other hardware 122.
  • the OCU 1 also comprises a communication module 13 adapted to send and receive any instructions 3 between the OCU 1 and the DCU 2.
  • the first application module 12 is adapted to monitor all actuators 41 , 42 of the OCU 1 and to create the instructions 3 according to the status of the actuators 41 , 42.
  • the first safety module 1 1 is adapted to monitor safety classified actuators 41 of the OCU 1 , and that the first safety module 1 1 is adapted to monitor at least instructions 31 pertaining to safety classified actuators 41 created by the first application module 12.
  • the first safety module 1 1 is adapted to detect any disparities between the status of the safety classified actuators 41 and the instructions 31 pertaining to safety classified actuators 41 created by the first application module 12, and the first safety module 1 1 is adapted to shut down the communication 3 between the OCU 1 and the DCU 2 if a disparity is detected.
  • the first safety module 1 1 can be adapted to monitor all actuators 41 , 42 and all instructions 31 , 32 created by the first application module 12 in order to also prevent any miscommunication of instructions 32 that are pertaining to actuators 42 that are not safety classified.
  • first safety module 1 1 with thereto belonging hardware 1 1 1 , 1 12 and computer program 1 1 1 a, is clearly isolated from the rest of the OCU 1 , and that the OCU 1 with its first application module 12 is configured or adapted to function within the specific system A.
  • Figures 3a and 3b illustrates that this distinct isolation makes it possible to use and reuse one and the same first safety module 1 1 as a component in OCUs adapted or configured to function within other systems or system configurations.
  • Figure 3a shows the first safety module 1 1 as a component in an OCU 1 1 with a first application module 12 1 adapted or configured to control a first device B 1 within a first system A 1 .
  • Figure 3b shows the same first safety module 1 1 as a component in another OCU 1 2 with a first application module 12 2 adapted or configured to control second device B 2 within a second system A 2 .
  • the first system A 1 with its first device B 1 , can be a totally different system from the second system A 2 , with its second device B 2 , or it can be the same system but with a somewhat different configuration of the system A or device B. In either case the same first safety module 1 1 is used in both systems or system configurations A 1 , A 2 .
  • Safety classified actuators 41 may be all actuators that are related to any function that is dictated by a safety classification for the device B.
  • the hardware 1 1 1 , 1 12 and computer program 1 1 1 a belonging to the first safety module 1 1 is first safety classified hardware and first safety classified computer program.
  • One aspect of the invention enables the possibility to validate a safety certificate awarded the first safety module 1 1 for any system or system configuration A 1 , A 2 where an OCU 1 1 , 1 2 comprising the first safety module 1 1 is used.
  • the first safety module 1 1 can be adapted to take care of and manage at least all safety classified actuators 41 and safety classified communication 31 between the OCU 1 and the DCU 2, and that the first application module 12 is adapted to take care of and manage all other actuators 42 and all other communication 32 between the OCU 1 and the DCU 2.
  • the first safety module 1 1 comprises at least two first safety processors 1 1 1 , 1 13 with thereto belonging computer programs 1 1 1 a, 1 13a.
  • first application processor 121 is not engaged in the safety concept, however, the first application processor 121 prepares a communication frame with values from safety classified actuators 41 , such as STOP button/Proportional actuators and digital selectors, and assembles it according to set standard and demands for the communication channel 3. It is proposed that both first safety processors 1 1 1 , 1 13 monitor all safety actuators 41 and the instructions 31 pertaining to safety classified actuators 41 to be sent in the communication channel 3. Both first safety processors 1 1 1 1 , 1 13 are comparing values from any safety actuators 41 with the instructions 31 pertaining to safety classified actuators 41 sent in the communication channel 3.
  • safety classified actuators 41 such as STOP button/Proportional actuators and digital selectors
  • both first safety processors 1 1 1 1 , 1 13 are monitoring the complete handling of all instructions 31 , 32 sent through the communication channel 3 to ensure that set standard and demands for the communication is followed.
  • Both first safety processors 1 1 1 , 1 13 are also continuously monitoring each other by constantly checking the status of each other.
  • any of the two first safety processors 1 1 1 , 1 13 finds any one of a set of predefined disparities they will independently from each other shut down the communication channel 3.
  • a safe state for the OCU 1 is achieved by physically stopping the data frames going into the communication channel 3. Doing this ensures no new information is sent to the DCU 2.
  • the first safety module 1 1 is based on a mother board with a set schematic and hardware layout, where the number of actuators will differ between the product sizes but where the same motherboard is used with a defined interface to all possible actuators.
  • An identical first safety module 1 1 can be used for smaller handheld DCUs, but where connection possibilities can be reduced so a smaller layout can be achieved.
  • the same computer program 1 1 1 a can be used in all first safety
  • the present invention can be used in different kinds of systems where needs and requirements dictates what kind of OCU 1 that is used, hence it is proposed that the OCU 1 can be a mobile control unit, as illustrated in Figure 1 , such as a handheld control unit or a control unit with a carrier appliance, such as a strap, belt or vest, or that the OCU 1 is a stationary control unit.
  • One aspect of the invention also relates to a device control unit, DCU 2, and with renewed reference to Figure 1 , it can be seen that the DCU 2 is adapted to be connected to a device B within a system A for professional applications and for the remote control of the device B.
  • the system A comprises an OCU 1 adapted to be used by an operator C to control the device B, where the DCU 2 is adapted to receive instructions from the OCU 1 and to control the device B according to the received instructions.
  • Figure 4 illustrates that the DCU 2 comprises a second safety module 21 , comprising at least one second safety processor 211 and possibly other hardware 212, and a second application module 22, comprising a second application processor 221 and possibly other hardware 222.
  • the DCU 2 also comprises a communication module 23 adapted to receive and also any communication 3 between the OCU 1 and the DCU 2.
  • the second safety module 211 can be adapted to receive at least all safety classified instructions 31 from the OCU 1
  • the second application module 22 can be adapted to receive all other instructions 32 from the OCU 1.
  • the second safety module 21 is adapted to actively control safety classified interfaces 51 of the DCU 2 according to received instructions 31
  • the second application module 22 is adapted to actively control other interfaces 52 of the DCU 2 according to received instructions 32.
  • the second safety module 21 is adapted to actively control all safety related interfaces of the DCU 2.
  • One aspect of the invention teaches that the second safety module 21 , with thereto belonging hardware 211 , 212 and computer program 211 a, is clearly isolated from the rest of the DCU 2, and that the DCU 2 with its second application module 22 is configured or adapted to function within the specific system A.
  • Figures 3a and 3b illustrates that this distinct isolation makes it possible to use and reuse one and the same second safety module 21 in DCUs adapted or configured to function within other systems or system configurations.
  • Figure 3a shows the second safety module 21 as a component in a DCU 2 1 with a second application module 22 1 adapted or configured to control a first device B 1 within a first system A 1 .
  • Figure 3b shows the same first safety module 21 as a component in another DCU 2 2 with a first application module 22 2 adapted or configured to control second device B 2 within a second system A 2 .
  • the first system A 1 with its first device B 1 , can be a totally different system from the second system A 2 , with its second device B 2 , or it can be the same system but with a somewhat different configuration of the system A or device B. In either case the same second safety module 21 is used in both systems or system configurations A 1 , A 2 .
  • Safety classified instructions 31 are all instructions that are related to any function that is dictated by a safety classification for the device B.
  • the hardware 21 1 , 212 and computer program 21 1 a belonging to second safety module 21 is second safety classified hardware and second safety classified computer program. This enables the possibility to validate a safety certificate awarded the second safety module 21 for any system or system configuration A 1 , A 2 where the second safety module 21 is used.
  • the second safety module 21 comprises at least two second safety processors 21 1 , 213 for redundancy.
  • One proposed aspect of the invention teaches that the second application processor 221 is not engaged in the safety concept, however, the second application processor 221 effect and control parts on the DCU 2 that are NOT safety classified.
  • Examples of tasks that can be given to the two second safety processors 21 1 , 213 are:
  • SRDO:s CANopen safety objects
  • either one of the second safety processor 211 , 213 finds any fault, then the hardware outputs are de-energized and values in SRDO will show safe state. It is also proposed that either of the second safety processors 211 , 213 have the possibility to stop the second application processor 221 if needed.
  • a safe state for the DCU 2 is achieved by ensuring that outputs to the safety classified interfaces 51 are deactivated. It is proposed that predefined safety requirements ensure that safe state is reached when no information from the PCU 1 is received within a predefined time frame.
  • the second safety module 21 can be based on a mother board featuring only safety classified outputs through a defined connector. This can be used in various DCUs 2 1 , 2 2 where the different variants will add NONE safety classified outputs and electronics but will feature the exact same second safety module 21 regardless of DCU variant.
  • the same computer program 211 a can be used in all second safety processors 211 , 213.
  • the present invention also relates to a system A for professional applications and remote control of a device B, the system comprising an OCU 1 as described above adapted to control the device B, and a DCU 2 as described above being connected to the device B, where the DCU 2 is adapted to receive instructions from the OCU 1 and to control the device B according to the received instructions.
  • Figure 1 illustrates a system where the OCU 1 communicates with the DCU 2 via wireless communication 3, however, it should be understood that the invention is not limited to the means of communication between the OCU 1 and the DCU 2 so it is also possible that the OCU 1 communicates with the DCU 2 via wire, as
  • One possible solution for communication protocol is that the OCU 1 communicates with the DCU 2 via a black channel, where the communication protocol used in the black channel safely acknowledge that every received message is correct, and that the black channel form a safe communication channel where no safety classification is required. It is possible to set up a Controller Area Network (CAN) bus for the communication 3 between the OCU 1 and the DCU 2, which will provide a fast, reliable, robust and secure communication.
  • CAN Controller Area Network
  • Another possible solution for communication protocol is that the OCU 1 communicates with the DCU 2 via at least two channels for redundancy, and that the at least two redundant channels form a safety classified communication channel 3.
  • the present invention also relates to a method for an operator control unit OCU 1 , used by an operator C, to remotely control a device B in a professional application, where the OCU 1 comprises actuators through which the operator C can act and create control instructions.
  • the method comprises the steps of the OCU 1 sending the instructions to a device control unit, DCU 2, connected to the device B, and controlling the device B according to the sent instructions.
  • the OCU 1 comprises a first safety module 1 1 , with at least one first safety processor 1 1 1 and possibly other hardware 1 12, and a first application module 12, with a first application processor 121 and possibly other hardware 122.
  • the method proposes:
  • the inventive method proposes the definition of the safety classified actuators 41 as all actuators that are related to any function that is dictated by a safety classification for the device B.
  • Hardware 1 1 1 1 , 1 12 belonging to the first safety module is first safety classified hardware, and the method proposes running the first safety classified hardware by means of first safety classified computer program.
  • One aspect of the invention makes it possible to validate a safety certificate awarded the first safety module 1 for any system or system configuration A 1 , A 2 where the first safety module 1 is used.
  • One aspect of the invention proposes the use of the first safety module 1 1 for taking care of and managing at least all safety classified communication between the OCU 1 and the DCU 2, the use of the first application module 12 for taking care of and managing all other communication between the OCU 1 and the DCU 2, the use of the first safety module 1 1 for managing at least all safety classified functions of the OCU 1 , and the use of the first application module 12 for managing all other functions of the OCU 1 .
  • One aspect of the invention teaches the use of at least two first safety processors 1 1 1 , 1 13 with thereto belonging computer programs 1 1 1 a, 1 13a in the first safety module 1 1 for redundancy.
  • the inventive method can be implemented with different kinds of control units, and it is proposed to use a mobile control unit for the OCU 1 , such as a handheld control unit or a control unit with a carrier appliance, such as a strap, belt or vest. It is also possible to use a stationary control unit for the OCU 1 .
  • a mobile control unit for the OCU 1 such as a handheld control unit or a control unit with a carrier appliance, such as a strap, belt or vest. It is also possible to use a stationary control unit for the OCU 1 .
  • One aspect of the invention also relates to a method for a device control unit, DCU 2, connected to a device B to control the device B in a professional application.
  • the method comprises the steps of receiving instructions from an operator control unit, OCU 1 , used by an operator C, and controlling the device B according to the received instructions.
  • the DCU 2 comprises a second safety module 21 , comprising at least one second safety processor 21 1 and possibly other hardware 212, and a second application module 22, comprising a second application processor 221 and possibly other hardware 222.
  • the method proposes: - the use of the second safety module 21 for receiving at least all safety classified instructions 31 from the OCU 1 ,
  • Hardware 21 1 , 212 belonging to the second safety module 2 is second safety classified hardware, and it is proposed to run the second safety classified hardware by means of second safety classified computer program.
  • One aspect of the invention makes it possible to validate a safety certificate awarded the second safety module 2 for any system or system configuration A 1 , A 2 where the second safety module 2 is used.
  • the invention also relates to a method for the remote control of a device B in a professional application, the method comprising the steps of controlling the device B through an OCU 1 , and a DCU connected to the device B as described above, where the DCU 2 receives instructions 3 from the OCU 1 and controls the device B according to the received instructions 3.
  • the invention teaches the use of wireless communication 3, or the use of wire, between the OCU 1 and the DCU 2.
  • Different protocols for communication can be used between the OCU 1 and the DCU 2, and one aspect of the invention teaches the use of a black channel in the communication 3 between the OCU and the DCU, and the use of a communication protocol in the black channel that safely acknowledge that every received message is correct, thus forming a safe communication channel 3 where no safety classification is required through the black channel.
  • Another aspect of the invention proposes the use of at least two channels in the communication 3 between the OCU 1 and the DCU 2 for redundancy, and the forming of a safety classified communication channel through the at least two redundant channels.
  • the present invention also relates to a first computer program product comprising computer program code 111 a’, which, when executed by a computer, enables the computer to perform the steps of at least one first safety processor 111.
  • the first computer program product comprises computer program code 111 a’, 113a’, which, when executed by respective computer, enables respective computer to perform the steps of the two first safety processors 111 , 113.
  • the present invention also relates to a second computer program product comprising computer program code 211 a’, which, when executed by a computer, enables the computer to perform the steps of at least one second safety processor 211.
  • the second computer program product comprises computer program code 211 a’, 213a’, which, when executed by respective computer, enables
  • Figure 5 illustrates that the present invention also relates to a computer readable medium 6, in the figure exemplified by a compact disc. It should be understood that the computer readable medium can be any kind of non-volatile computer readable medium. An aspect of the invention teaches that computer program code 111 a’, 211 a’ according to the first or second computer program product is carried by the computer readable medium 6.

Abstract

The present invention relates to an operator control unit (OCU) and a device control unit (DCU), where the OCU (1) and DCU (2) function together within a system (A) for professional applications and remote control of a device (B). The OCU (1) comprises actuators through which an operator (C) can act and create control instructions. The DCU (2) is connected to the device (B) and adapted to receive the instructions from the OCU (1) and to control the device (B) according to received instructions. The OCU (1) comprises a first safety module and a first application module, where the first safety module is clearly isolated from the rest of the OCU, enabling the first safety module to be used or reused in OCUs adapted or configured to function within other systems or system configurations. The DCU (2) comprises a second safety module, and a second application module, and the second safety module is clearly isolated from the rest of the DCU (2), enabling that the second safety module can be used or reused in DCUs adapted or configured to function within other systems or system configurations.

Description

SAFETY SOLUTION WITH SEPARABLE SAFETY MODULE FOR A REMOTE
CONTROL SYSTEM
Field of invention
The present invention relates to an operator control unit (OCU) and a device control unit (DCU), where the OCU and DCU function together within a system for professional applications and remote control of a device, where an operator can control the device through the OCU, where the OCU comprises actuators through which the operator can act and create control instructions, and where the DCU is connected to the device and adapted to receive the instructions from the OCU to control the device according to received instructions.
The OCU comprises a first safety module, comprising at least one first safety processor, and a first application module, comprising a first application processor, where the first application module is adapted to monitor all actuators of the OCU and to create the instructions according to the status of the actuators, and the first safety module is adapted to monitor safety classified actuators of the OCU, and at least instructions created by the first application module pertaining to safety classified actuators.
The first safety module is adapted to detect any disparities between the status of the safety classified actuators and the instructions pertaining to safety classified actuators created by the first application module, and to shut down the communication between the OCU and said DCU if a disparity is detected.
The DCU comprises a second safety module, comprising at least one second safety processor, and a second application module, comprising at least a second application processor, where the second safety module is adapted to receive at least all safety classified instructions from the OCU, where the second application module is adapted to receive all other instructions from the OCU.
The second safety module is adapted to actively control at least all safety classified interfaces of the DCU according to received instructions, and the second application module is adapted to actively control other interfaces of the DCU according to received instructions.
The present invention also relates to a method for an OCU, used by an operator, to remotely control a device in a professional application, where the OCU comprises actuators through which the operator can act and create control instructions. The OCU comprises a first safety module, comprising at least one first safety processor, and a first application module, comprising a first application processor, where the first application module is used to monitor all actuators of the OCU and to create the instructions according to the status of the actuators.
The method teaches that the first safety module is used to monitor safety classified actuators of the OCU, where the first safety module is used to monitor at least instructions pertaining to safety classified actuators created by the first application module, where the first safety module is used to detect any disparities between the status of the safety classified actuators and the instructions pertaining to safety classified actuators created by the first application module, and where the first safety module is used to shut down the communication between the OCU and the DCU if a disparity is detected.
The present invention also relates to a method for a DCU connected to a device to control the device in a professional application, and a method for the remote control of a device in a professional application by means of controlling the device through an OCU and a DCU connected to the device, where the DCU receives instructions from the OCU and controls the device according to received instructions.
The DCU comprises a second safety module, comprising at least one second safety processor, where the DCU comprises a second application module, comprising a second application processor.
The method teaches that the second safety module is used for receiving at least all safety classified instructions from the OCU, and that the second application module is used for receiving all other instructions from the OCU, where the second safety module is used for actively controlling safety related interfaces belonging to the DCU, and where the second application module is used for actively controlling other interfaces of the DCU. The invention also relates to a first computer program product comprising computer program code, which, when executed by a computer, enables the computer to perform the steps of a first safety processor within an OCU according to the inventive method for an OCU.
The invention also relates to a second computer program product comprising computer program code, which, when executed by a computer, enables the computer to perform the steps of a second safety processor within a DCU according to the inventive method for a DCU. The invention also relates to a computer readable medium, through which computer program code according any of the inventive first or second computer program product is carried.
Background art
In the next generation of remote control systems flexibility in configuration is a major feature that is sought for and requested by the industry.
In industrial applications it is known to have a system with an operator control unit (OCU), or transmitter, used by an operator to control a device through different actuators on the OCU, and a device control unit (DCU), or receiver, on the device to receive instructions from the PCU to control the device according to received signals from the PCU. In heavy industry safety is very important and the system must conform to specified safety requirements and undergo a safety certification process in order to achieve safety certification according to a certain safety standard.
Whenever there is a change in the system configuration the whole system have to undergo a new safety certification process to make sure that the new system conform with the safety requirements in order for the changed system to be certified.
The safety certification is a must, however, this makes it hard to provide the sought for flexibility in system configuration since every configuration has to be certified, it has to conform with the safety standard.
Summary of the invention
Problems
In relation to the background art it is a problem to provide a possibility to develop new systems, or a system with large flexibility in configuration, without having to put every possible system, or every configuration of a system, through an expensive and time consuming development/validation and safety certification process.
Lengthy development and project time, safety requirements and safety interfaces that changes from device to device, and requirements or demands on a short time to market for new devices or systems are problems in a process where the safety certification is a complex and time consuming process by itself.
Solutions From the standpoint of the field of the invention, as described above, and with the purpose of providing a solution to mentioned problems the different aspects of the invention will now be described, where one aspect is the OCU.
The present invention teaches that the first safety module, with thereto belonging hardware and computer program, is clearly isolated from the rest of the OCU, that the OCU and the first application module is configured or adapted to function within the specific system, and that the first safety module can be used or reused in OCUs adapted or configured to function within other systems or system configurations.
One aspect of the invention further teaches that the safety classified actuators are all actuators that are related to any function that is dictated by a safety classification for the device.
With the purpose of providing a clearly isolated first safety module the present invention teaches that the hardware and computer program belonging to the first safety module is first safety classified hardware and first safety classified computer program.
This will make it possible to allow a safety certificate awarded the first safety module to be valid for any system or system configuration where the first safety module is used.
When the inventive first safety module is used in a system the system will conform to safety certification given that appropriate regulatory system verification is passed.
One aspect of the invention provides a possibility to easily and fast provide new systems, or to modify existing systems, while maintaining required standard of safety without expensive and time consuming safety certification procedures for every new or modified system.
It is proposed that the first safety module is adapted to take care of and manage at least all safety classified communication between the OCU and the DCU, that the first application module is adapted to take care of and manage all other communication between the OCU and the DCU, that the first safety module is adapted to manage at least all safety classified functions of the OCU, that the first application module is adapted to manage all other functions of the OCU.
With the purpose of safety it is proposed that the first safety module comprises at least two first safety processors for redundancy. Depending on the industrial system in which the OCU is functioning the OCU can be any kind of OCU. It is proposed that the OCU is mobile control unit, such as a handheld control unit or a control unit with a carrier appliance, or a stationary control unit. Examples of possible carrier appliance for a mobile OCU are a strap, belt or vest.
The present invention also relates to a DCU, and one aspect of the invention teaches that the second safety module, with thereto belonging hardware and computer program, is clearly isolated from the rest of the DCU, that the DCU and the second application module is configured or adapted to function within the specific system, and that the second safety module can be used or reused in DCUs adapted or configured to function within other systems or system configurations.
One aspect of the invention further teaches that the safety classified instructions are all instructions that are related to any function that is dictated by a safety classification for the device.
With the purpose of providing a clearly isolated second safety module the present invention teaches that hardware and computer program belonging to the second safety module is second safety classified hardware and second safety classified computer program.
This will make it possible to allow a safety certificate awarded the second safety module to be valid for any system or system configuration where the second safety module is used.
When the inventive second safety module is used in a system the system will conform to safety certification given that appropriate regulatory system verification is passed.
One aspect of the invention provides a possibility to easily and fast provide new systems, or to modify existing systems, while maintaining required standard of safety without expensive and time consuming safety certification procedures for every new or modified system.
With the purpose of safety it is proposed that the second safety module comprises at least two second safety processors for redundancy.
The present invention also relates to a system for professional applications and remote control of a device, comprising an inventive OCU adapted to allow an operator to control the device, and an inventive DCU being connected to the device and adapted to receive instructions from the OCU and to control the device according to the received instructions.
It should be understood that the OCU can communicate with the DCU via wireless communication or via wire depending on system configuration.
Regardless of a wired or wireless communication it is proposed that the OCU communicates with the DCU via a black channel, where the communication protocol used in the black channel safely acknowledge that every received message is correct, and where the black channel form a safe communication channel where no safety classification is required.
It is also possible that the OCU communicates with the DCU via at least two channels for redundancy, and that the at least two redundant channels form a safety classified communication channel.
The present invention also relates to a method for an OCU as defined in the field of invention, which method teaches the use or reuse of the first safety module in OCUs adapted or configured to function within other systems or system
configurations.
It is proposed that all actuators that are related to any function that is dictated by a safety classification for the device are defined as safety actuators.
It is also proposed that hardware belonging to the first safety module is first safety classified hardware, and that first safety classified computer program is used to run the first safety classified hardware.
The inventive method enables the validation of a safety certificate awarded the first safety module for any system or system configuration where the first safety module is used.
It is proposed that first safety module can be used for taking care of and managing at least all safety classified communication between the OCU and the DCU, the use of the first application module for taking care of and managing all other communication between the OCU and the DCU, the use of the first safety module for managing at least all safety classified functions of the OCU, the use of the first application module for managing all other functions of the OCU.
It is also proposed that at least two first safety processors are used in the first safety module for redundancy.
A mobile control unit can be used for the OCU, such as a handheld control unit or a control unit with a carrier appliance, such as a strap, belt or vest. It is also possible to use a stationary control unit for the OCU.
The present invention also relates to a method for a DCU as defined in the field of invention, which method teaches the use or reuse of the second safety module in DCUs adapted or configured to function within other systems or system configurations.
It is proposed that all instructions that are related to any function that is dictated by a safety classification for the device are defined as being safety classified instructions.
Hardware belonging to the second safety module is second safety classified hardware, and it is proposed that second safety classified computer program is used to run the second safety classified hardware.
One aspect of the invention enables the validation of a safety certificate awarded the second safety module for any system or system configuration where the second safety module is used.
It is also proposed that at least two second safety processors are used in the second safety module for redundancy.
The present invention also relates to a method for the remote control of a device in a professional application, the method comprising the inventive steps of controlling the device through an OCU as described above, and the inventive steps of controlling a DCU connected to the device as described above, where the DCU receives instructions from the OCU and controls the device according to the received instructions.
It is proposed that wireless communication or communication by wire is used between the OCU and the DCU.
Regardless of a wired or wireless communication a black channel is proposed to be used in the communication between the OCU and the DCU, where a communication protocol that safely acknowledge that every received message is correct is used in the black channel, thus forming a safe communication channel where no safety classification is required through the black channel.
It is also possible to use at least two channels in the communication between the OCU and the DCU for redundancy, thus forming a safety classified
communication channel through the at least two redundant channels.
The present invention relates to a first computer program product comprising computer program code, which, when executed by a computer, enables the computer to perform the steps of at least one first safety processor according to the inventive method for an OCU.
The present invention also relates to a second computer program product comprising computer program code, which, when executed by a computer, enables the computer to perform the steps of at least one second safety processor according to the inventive method for a DCU.
The present invention also relates to a computer readable medium, which could be a non-volatile computer readable medium, where computer program code according to the first or second computer program product is carried by the computer readable medium.
Advantages
The advantages of an OCU, a DCU, a method, computer program product or computer readable medium according to the present invention are that a possibility to easily and fast enable new systems, or to modify existing systems, while maintaining required standard of safety without expensive and time consuming safety certification procedures for every new system is provided.
A large flexibility in configuration of systems without having to put every possible configuration through an expensive and time consuming safety certification process is provided.
The invention provides a first and second safety module that can be used in different configurations of OCUs and DCUs with a maintained safety certificate. This shortens the time to market for new configurations and systems. Even if the available safety modules are over qualified for a specific application it is easier and less expensive to use the available safety modules than to develop new OCUs and/or DCUs that require a safety certification procedure.
Brief description of the drawings
An OCU, a DCU, a method, a first and second computer program product and a computer readable medium according to the present invention will now be described in more detail with reference to the accompanying drawings, where:
Figure 1 is a schematic and very simplified illustration of an OCU and
DCU as they are used to control a device,
Figure 2 is a schematic and very simplified illustration of an OCU, Figure 3a is a simplified illustration of the use of a first and second safety module in a system or system configuration,
Figure 3b is a simplified illustration of the use of the same first and second safety module that is shown in Figure 3a in another system or system configuration,
Figure 4 is a schematic and very simplified illustration of a DCU, and Figure 5 is a simplified illustration of a computer readable medium.
Detailed description of embodiments as presently preferred
The present invention will now be described with reference to figure 1 , schematically showing an operator control unit, OCU 1 , adapted to function within a system A for professional applications and remote control of a device B and to be used by an operator C to control the device B. The OCU 1 comprises actuators through which the operator C can act and create control instructions.
The system A also comprises a device control unit, DCU, 2 connected to the device B, where the DCU 2 is adapted to receive the instructions from the OCU 1 and to control the device B according to received instructions.
The OCU 1 is developed for professional use of an operator C who use them day in and day out. The OCU 1 is sized and carefully positioned to be as convenient as possible and support heavy usage for many hours without causing the operator C fatigue.
The actuators on the OCU 1 may be anything of digital and proportional actuators, such as mushroom buttons, digital pushbuttons, digital selectors, rotary selectors, different versions of joysticks, and levers or potentiometers.
Two-way communication 3 between the OCU 1 and the DCU 2 enables operator feedback from the controlled device B.
The device B can be anything that is controlled by means of a OCU 1 and DCU 2, and there are many divers professional applications where the ability to operate a device from a distance is important for different reasons. The remote control may be required to enable the ability to operate equipment from safer grounds, to provide a better vantage points for the operator, to reduce levels of noise or vibration, to provide greater ease of machine operation, to limit operator fatigue, or to increased efficiency and productivity. One aspect of the invention is described in relation to the control of a device B, and it should be understood that the invention is not limited to any specific device but can be used with any device where a remote control as described above can be advantageous or even required. Figure 1 shows a simplified and schematic figure of a crane, however, examples of devices B are hook/skip loaders, sky lifts, truck cranes, forest winchers, harvesters, drilling rigs, concrete pumps, demolition robots, elevated work platforms, slope movers, crushers, port cranes and overhead cranes.
Figure 2 shows that the OCU 1 comprises a first safety module 1 1 , with at least one first safety processor 1 1 1 and possibly also other hardware 1 12, and a first application module 12, with a first application processor 121 and possibly other hardware 122. The OCU 1 also comprises a communication module 13 adapted to send and receive any instructions 3 between the OCU 1 and the DCU 2.
It is proposed that the first application module 12 is adapted to monitor all actuators 41 , 42 of the OCU 1 and to create the instructions 3 according to the status of the actuators 41 , 42.
It is also proposed that the first safety module 1 1 is adapted to monitor safety classified actuators 41 of the OCU 1 , and that the first safety module 1 1 is adapted to monitor at least instructions 31 pertaining to safety classified actuators 41 created by the first application module 12.
The first safety module 1 1 is adapted to detect any disparities between the status of the safety classified actuators 41 and the instructions 31 pertaining to safety classified actuators 41 created by the first application module 12, and the first safety module 1 1 is adapted to shut down the communication 3 between the OCU 1 and the DCU 2 if a disparity is detected.
One aspect of the invention proposes that the first safety module 1 1 can be adapted to monitor all actuators 41 , 42 and all instructions 31 , 32 created by the first application module 12 in order to also prevent any miscommunication of instructions 32 that are pertaining to actuators 42 that are not safety classified.
One aspect of the invention teaches that the first safety module 1 1 , with thereto belonging hardware 1 1 1 , 1 12 and computer program 1 1 1 a, is clearly isolated from the rest of the OCU 1 , and that the OCU 1 with its first application module 12 is configured or adapted to function within the specific system A. Figures 3a and 3b illustrates that this distinct isolation makes it possible to use and reuse one and the same first safety module 1 1 as a component in OCUs adapted or configured to function within other systems or system configurations.
Figure 3a shows the first safety module 1 1 as a component in an OCU 11 with a first application module 121 adapted or configured to control a first device B1 within a first system A1. Figure 3b shows the same first safety module 1 1 as a component in another OCU 12 with a first application module 122 adapted or configured to control second device B2 within a second system A2. The first system A1, with its first device B1, can be a totally different system from the second system A2, with its second device B2, or it can be the same system but with a somewhat different configuration of the system A or device B. In either case the same first safety module 1 1 is used in both systems or system configurations A1, A2.
Safety classified actuators 41 may be all actuators that are related to any function that is dictated by a safety classification for the device B.
The hardware 1 1 1 , 1 12 and computer program 1 1 1 a belonging to the first safety module 1 1 is first safety classified hardware and first safety classified computer program.
One aspect of the invention enables the possibility to validate a safety certificate awarded the first safety module 1 1 for any system or system configuration A1, A2 where an OCU 11 , 12 comprising the first safety module 1 1 is used.
One aspect of the invention proposes that the first safety module 1 1 can be adapted to take care of and manage at least all safety classified actuators 41 and safety classified communication 31 between the OCU 1 and the DCU 2, and that the first application module 12 is adapted to take care of and manage all other actuators 42 and all other communication 32 between the OCU 1 and the DCU 2.
With the purpose of achieving redundancy, it is proposed that the first safety module 1 1 comprises at least two first safety processors 1 1 1 , 1 13 with thereto belonging computer programs 1 1 1 a, 1 13a.
One aspect of the invention teaches that the first application processor 121 is not engaged in the safety concept, however, the first application processor 121 prepares a communication frame with values from safety classified actuators 41 , such as STOP button/Proportional actuators and digital selectors, and assembles it according to set standard and demands for the communication channel 3. It is proposed that both first safety processors 1 1 1 , 1 13 monitor all safety actuators 41 and the instructions 31 pertaining to safety classified actuators 41 to be sent in the communication channel 3. Both first safety processors 1 1 1 , 1 13 are comparing values from any safety actuators 41 with the instructions 31 pertaining to safety classified actuators 41 sent in the communication channel 3.
It is also proposed that both first safety processors 1 1 1 , 1 13 are monitoring the complete handling of all instructions 31 , 32 sent through the communication channel 3 to ensure that set standard and demands for the communication is followed.
Both first safety processors 1 1 1 , 1 13 are also continuously monitoring each other by constantly checking the status of each other.
If any of the two first safety processors 1 1 1 , 1 13 finds any one of a set of predefined disparities they will independently from each other shut down the communication channel 3.
Examples of such disparities are:
- a deviation between the statuses of the safety classified actuators 41 and the information 31 in the data frames to be transmitted by the application processor 121 ,
- an incorrectly created communication frame with regards to set standard and demands for the communication channel 3,
- an incorrect behavior from the other first safety processor, and
- any other hard ware errors detected from self-tests etc.
A safe state for the OCU 1 is achieved by physically stopping the data frames going into the communication channel 3. Doing this ensures no new information is sent to the DCU 2.
One aspect of the invention teaches that the first safety module 1 1 is based on a mother board with a set schematic and hardware layout, where the number of actuators will differ between the product sizes but where the same motherboard is used with a defined interface to all possible actuators.
An identical first safety module 1 1 can be used for smaller handheld DCUs, but where connection possibilities can be reduced so a smaller layout can be achieved. The same computer program 1 1 1 a can be used in all first safety
processors 1 1 1 , 1 13, regardless model and size of the OCU 1 . The present invention can be used in different kinds of systems where needs and requirements dictates what kind of OCU 1 that is used, hence it is proposed that the OCU 1 can be a mobile control unit, as illustrated in Figure 1 , such as a handheld control unit or a control unit with a carrier appliance, such as a strap, belt or vest, or that the OCU 1 is a stationary control unit.
One aspect of the invention also relates to a device control unit, DCU 2, and with renewed reference to Figure 1 , it can be seen that the DCU 2 is adapted to be connected to a device B within a system A for professional applications and for the remote control of the device B.
The system A comprises an OCU 1 adapted to be used by an operator C to control the device B, where the DCU 2 is adapted to receive instructions from the OCU 1 and to control the device B according to the received instructions.
Figure 4 illustrates that the DCU 2 comprises a second safety module 21 , comprising at least one second safety processor 211 and possibly other hardware 212, and a second application module 22, comprising a second application processor 221 and possibly other hardware 222. The DCU 2 also comprises a communication module 23 adapted to receive and also any communication 3 between the OCU 1 and the DCU 2.
The second safety module 211 can be adapted to receive at least all safety classified instructions 31 from the OCU 1 , and the second application module 22 can be adapted to receive all other instructions 32 from the OCU 1.
It is proposed that the second safety module 21 is adapted to actively control safety classified interfaces 51 of the DCU 2 according to received instructions 31 , and that the second application module 22 is adapted to actively control other interfaces 52 of the DCU 2 according to received instructions 32.
It is thus proposed that the second safety module 21 is adapted to actively control all safety related interfaces of the DCU 2.
One aspect of the invention teaches that the second safety module 21 , with thereto belonging hardware 211 , 212 and computer program 211 a, is clearly isolated from the rest of the DCU 2, and that the DCU 2 with its second application module 22 is configured or adapted to function within the specific system A.
Figures 3a and 3b illustrates that this distinct isolation makes it possible to use and reuse one and the same second safety module 21 in DCUs adapted or configured to function within other systems or system configurations. Figure 3a shows the second safety module 21 as a component in a DCU 21 with a second application module 221 adapted or configured to control a first device B1 within a first system A1. Figure 3b shows the same first safety module 21 as a component in another DCU 22 with a first application module 222 adapted or configured to control second device B2 within a second system A2. The first system A1, with its first device B1, can be a totally different system from the second system A2, with its second device B2, or it can be the same system but with a somewhat different configuration of the system A or device B. In either case the same second safety module 21 is used in both systems or system configurations A1, A2.
Safety classified instructions 31 are all instructions that are related to any function that is dictated by a safety classification for the device B.
It is proposed that the hardware 21 1 , 212 and computer program 21 1 a belonging to second safety module 21 is second safety classified hardware and second safety classified computer program. This enables the possibility to validate a safety certificate awarded the second safety module 21 for any system or system configuration A1, A2 where the second safety module 21 is used.
It is proposed that the second safety module 21 comprises at least two second safety processors 21 1 , 213 for redundancy.
One proposed aspect of the invention teaches that the second application processor 221 is not engaged in the safety concept, however, the second application processor 221 effect and control parts on the DCU 2 that are NOT safety classified.
Examples of tasks that can be given to the two second safety processors 21 1 , 213 are:
constantly monitoring data coming from communication channel 3 regarding values from safety actuators 41 ,
constantly monitor data coming from communication channel 3 regarding the format of received communication frame to ensure that set standard and demands for the communication channel 3 is/are followed,
monitoring the other second safety processor by constantly checking status of the same,
controlling and monitoring the hardware outputs for STOP (STOP & LOOP) and unintended movement,
sending CANopen safety objects (SRDO:s) with status of the hardware signals STOP and unintended movement and the digital selectors, and performing internal safety checks.
If either one of the second safety processor 211 , 213 finds any fault, then the hardware outputs are de-energized and values in SRDO will show safe state. It is also proposed that either of the second safety processors 211 , 213 have the possibility to stop the second application processor 221 if needed.
A safe state for the DCU 2 is achieved by ensuring that outputs to the safety classified interfaces 51 are deactivated. It is proposed that predefined safety requirements ensure that safe state is reached when no information from the PCU 1 is received within a predefined time frame.
The second safety module 21 can be based on a mother board featuring only safety classified outputs through a defined connector. This can be used in various DCUs 21, 22 where the different variants will add NONE safety classified outputs and electronics but will feature the exact same second safety module 21 regardless of DCU variant. The same computer program 211 a can be used in all second safety processors 211 , 213.
The present invention also relates to a system A for professional applications and remote control of a device B, the system comprising an OCU 1 as described above adapted to control the device B, and a DCU 2 as described above being connected to the device B, where the DCU 2 is adapted to receive instructions from the OCU 1 and to control the device B according to the received instructions.
Figure 1 illustrates a system where the OCU 1 communicates with the DCU 2 via wireless communication 3, however, it should be understood that the invention is not limited to the means of communication between the OCU 1 and the DCU 2 so it is also possible that the OCU 1 communicates with the DCU 2 via wire, as
schematically illustrated in Figures 2 and 4.
It is possible to setup communication 3 between the OCU 1 and the DCU 2 according to different protocols.
One possible solution for communication protocol is that the OCU 1 communicates with the DCU 2 via a black channel, where the communication protocol used in the black channel safely acknowledge that every received message is correct, and that the black channel form a safe communication channel where no safety classification is required. It is possible to set up a Controller Area Network (CAN) bus for the communication 3 between the OCU 1 and the DCU 2, which will provide a fast, reliable, robust and secure communication.
Another possible solution for communication protocol is that the OCU 1 communicates with the DCU 2 via at least two channels for redundancy, and that the at least two redundant channels form a safety classified communication channel 3.
The present invention also relates to a method for an operator control unit OCU 1 , used by an operator C, to remotely control a device B in a professional application, where the OCU 1 comprises actuators through which the operator C can act and create control instructions. The method comprises the steps of the OCU 1 sending the instructions to a device control unit, DCU 2, connected to the device B, and controlling the device B according to the sent instructions.
The OCU 1 comprises a first safety module 1 1 , with at least one first safety processor 1 1 1 and possibly other hardware 1 12, and a first application module 12, with a first application processor 121 and possibly other hardware 122.
The method proposes:
- the use of the first application module 12 to monitor all actuators 41 , 42 of the OCU 1 ,
- the use of the first application module 12 to create the instructions 31 , 32 according to the status of the actuators 41 , 42,
- the use of the first safety module 1 1 to monitor safety classified actuators 41 of the OCU 1 ,
- the use of the first safety module 1 1 to monitor at least instructions 31
pertaining to safety classified actuators 41 created by the first application module 12,
- the use of the first safety module 1 1 to detect any disparities between the status of the safety classified actuators 41 and the instructions 31 pertaining to safety classified actuators 41 created by the first application module 12,
- the use of the first safety module 1 1 to shut down the communication 3
between the OCU and the DCU if a disparity is detected, and
- the clear isolation of the first safety module 1 1 , with thereto belonging
hardware 1 1 1 , 1 12 and computer program 1 1 1 a, from the rest of the OCU 1 , thus enabling the use or reuse of the first safety module 1 1 in OCUs 11 , 12, adapted or configured to function within other systemsA1, A2 or system configurations. The inventive method proposes the definition of the safety classified actuators 41 as all actuators that are related to any function that is dictated by a safety classification for the device B.
Hardware 1 1 1 , 1 12 belonging to the first safety module is first safety classified hardware, and the method proposes running the first safety classified hardware by means of first safety classified computer program.
One aspect of the invention makes it possible to validate a safety certificate awarded the first safety module 1 for any system or system configuration A1, A2 where the first safety module 1 is used.
One aspect of the invention proposes the use of the first safety module 1 1 for taking care of and managing at least all safety classified communication between the OCU 1 and the DCU 2, the use of the first application module 12 for taking care of and managing all other communication between the OCU 1 and the DCU 2, the use of the first safety module 1 1 for managing at least all safety classified functions of the OCU 1 , and the use of the first application module 12 for managing all other functions of the OCU 1 .
One aspect of the invention teaches the use of at least two first safety processors 1 1 1 , 1 13 with thereto belonging computer programs 1 1 1 a, 1 13a in the first safety module 1 1 for redundancy.
The inventive method can be implemented with different kinds of control units, and it is proposed to use a mobile control unit for the OCU 1 , such as a handheld control unit or a control unit with a carrier appliance, such as a strap, belt or vest. It is also possible to use a stationary control unit for the OCU 1 .
One aspect of the invention also relates to a method for a device control unit, DCU 2, connected to a device B to control the device B in a professional application.
The method comprises the steps of receiving instructions from an operator control unit, OCU 1 , used by an operator C, and controlling the device B according to the received instructions.
The DCU 2 comprises a second safety module 21 , comprising at least one second safety processor 21 1 and possibly other hardware 212, and a second application module 22, comprising a second application processor 221 and possibly other hardware 222.
The method proposes: - the use of the second safety module 21 for receiving at least all safety classified instructions 31 from the OCU 1 ,
- the use of the second application module 22 for receiving all other
instructions 32 from the OCU 1 ,
- the use of the second safety module 21 for actively controlling safety related interfaces 51 belonging to the DCU,
- the use of the second application module 22 for actively controlling other interfaces 52 of the DCU 2, and
- the clear isolation of the second safety module 21 , with thereto belonging hardware 21 1 , 212 and computer program 21 1 a, from the rest of the DCU 2,
thus enabling the use or reuse of the second safety module 2 in DCUs 21, 22 adapted or configured to function within other systems or system configurations A1, A2.
It is proposed that all instructions that are related to any interface 51 that is dictated by a safety classification for the device B is defined as being a safety classified instruction 31 .
Hardware 21 1 , 212 belonging to the second safety module 2 is second safety classified hardware, and it is proposed to run the second safety classified hardware by means of second safety classified computer program.
One aspect of the invention makes it possible to validate a safety certificate awarded the second safety module 2 for any system or system configuration A1, A2 where the second safety module 2 is used.
With the purpose of providing redundancy the use of at least two second safety processors 21 1 , 213 in the second safety module 21 is proposed.
The invention also relates to a method for the remote control of a device B in a professional application, the method comprising the steps of controlling the device B through an OCU 1 , and a DCU connected to the device B as described above, where the DCU 2 receives instructions 3 from the OCU 1 and controls the device B according to the received instructions 3.
The invention teaches the use of wireless communication 3, or the use of wire, between the OCU 1 and the DCU 2.
Different protocols for communication can be used between the OCU 1 and the DCU 2, and one aspect of the invention teaches the use of a black channel in the communication 3 between the OCU and the DCU, and the use of a communication protocol in the black channel that safely acknowledge that every received message is correct, thus forming a safe communication channel 3 where no safety classification is required through the black channel.
Another aspect of the invention proposes the use of at least two channels in the communication 3 between the OCU 1 and the DCU 2 for redundancy, and the forming of a safety classified communication channel through the at least two redundant channels.
The present invention also relates to a first computer program product comprising computer program code 111 a’, which, when executed by a computer, enables the computer to perform the steps of at least one first safety processor 111.
When two first safety processors 111 , 113, are used in the first safety module 11 then the first computer program product comprises computer program code 111 a’, 113a’, which, when executed by respective computer, enables respective computer to perform the steps of the two first safety processors 111 , 113.
The present invention also relates to a second computer program product comprising computer program code 211 a’, which, when executed by a computer, enables the computer to perform the steps of at least one second safety processor 211.
When two second safety processors 211 , 213, are used in the second safety module 21 then the second computer program product comprises computer program code 211 a’, 213a’, which, when executed by respective computer, enables
respective computer to perform the steps of the two second safety processors 211 , 213.
Figure 5 illustrates that the present invention also relates to a computer readable medium 6, in the figure exemplified by a compact disc. It should be understood that the computer readable medium can be any kind of non-volatile computer readable medium. An aspect of the invention teaches that computer program code 111 a’, 211 a’ according to the first or second computer program product is carried by the computer readable medium 6.
It will be understood that that the invention is not restricted to the
aforedescribed and illustrated exemplifying embodiments thereof and that
modifications can be made within the scope of the invention as defined by the accompanying Claims.

Claims

1 . An operator control unit (OCU) (1 ), adapted to function within a system (A) for professional applications and remote control of a device (B) and to be used by an operator (C) to control said device (B), where said OCU (1 ) comprises actuators (41 , 42) through which said operator (C) can act and create control instructions (3), where said system (A) comprises a device control unit (DCU) (2) connected to said device (B), where said DCU (2) is adapted to receive said instructions (3) from said OCU (1 ) and to control said device (B) according to said received instructions, where said OCU (1 ) comprises a first safety module (1 1 ), comprising at least one first safety processor (1 1 1 ), and a first application module (12), comprising at least a first application processor (121 ), where said first application module (12) is adapted to monitor all actuators (41 , 42) of said OCU (1 ) and to create said instructions (3) according to the status of said actuators (41 , 42), where said first safety module (1 1 ) is adapted to monitor safety classified actuators (41 ) of said OCU (1 ), where said first safety module (1 1 ) is adapted to monitor at least instructions pertaining (31 ) to safety classified actuators (41 ) created by said first application module (12), where said first safety module (1 1 ) is adapted to detect any disparities between the status of said safety classified actuators (41 ) and said instructions pertaining (31 ) to safety classified actuators created by said first application module (12), and where said first safety module (1 1 ) is adapted to shut down the communication (3) between said OCU (1 ) and said DCU (2) if a disparity is detected, characterised in, that said first safety module (1 1 ), with thereto belonging hardware (1 1 1 , 1 12) and computer program (1 1 1 a), is isolated from the rest of said OCU (1 ), that said OCU (1 ) and said first application module (12) is configured or adapted to function within said specific system (A), and that said first safety module (1 1 ) can be used or reused in OCUs (11, 12) adapted or configured to function within other systems (A1, A2) or system configurations.
2. An OCU according to claim 1 , characterised in, that said safety classified actuators (41 ) are all actuators that are related to any function that is dictated by a safety classification for said device (B).
3. An OCU according to claim 1 or 2, characterised in, that a safety certificate awarded said first safety module (11 ) is valid for any system or system configuration (A1, A2) where said first safety module (11 ) is used.
4. An OCU according to any preceding claim, characterised in, that said first safety module (11 ) is adapted to take care of and manage at least all safety classified communication (31 ) between said OCU (1 ) and said DCU (2), that said first application module (12) is adapted to take care of and manage all other
communication (32) between said OCU (1 ) and said DCU (2), that said first safety module (11 ) is adapted to manage at least all safety classified functions of said OCU (1 ), that said first application module (12) is adapted to manage all other functions of said OCU (1 ).
5. An OCU according to any preceding claim, characterised in, that said first safety module (11 ) comprises at least two first safety processors (111 , 113) for redundancy.
6. An OCU according to any preceding claim, characterised in, that said OCU (1 ) is mobile control unit, such as a handheld control unit or a control unit with a carrier appliance, such as a strap, belt or vest.
7. An OCU according to any one of claims 1 to 5, characterised in, that said OCU (1 ) is a stationary control unit.
8. A device control unit (DCU) (2) adapted to be connected to a device (B) within a system (A) for professional applications and for the remote control of said device (B), said system comprising an operator control unit (OCU) (1 ), adapted to be used by an operator (C) to control said device (B), where said DCU (2) is adapted to receive instructions from said OCU (1 ) and to control said device (B) according to said received instructions, where said DCU (2) comprises a second safety module (21 ), comprising at least one second safety processor (211 ), and a second
application module (22), comprising at least a second application processor (221 ), where said second safety module (21 ) is adapted to receive at least all safety classified instructions (31 ) from said OCU (1 ), where said second application module (22) is adapted to receive all other instructions (32) from said OCU (1 ), where said second safety module (21 ) is adapted to actively control at least all safety classified interfaces (51 ) of said DCU (2) according to received instructions (31 ), and where said second application module (22) is adapted to actively control other interfaces (52) of said DCU (2) according to received instructions (32), characterised in, that said second safety module (21 ), with thereto belonging hardware (211 , 212) and computer program (211 a), is isolated from the rest of said DCU (2), that said DCU (2) and said second application module (22) is configured or adapted to function within said specific system (A), and that said second safety module (21 ) can be used or reused in DCUs adapted or configured to function within other systems or system configurations.
9. A DCU according to claim 8, characterised in, that said safety classified instructions (31 ) are all instructions that are related to any function that is dictated by a safety classification for said device (B).
10. A DCU according to claim 8 or 9, characterised in, that a safety certificate awarded said second safety module (21 ) is valid for any system or system
configuration (A1, A2) where said second safety module (21 ) is used.
11. A DCU according to any one of claims 8 to 10, characterised in, that said second safety module (21 ) comprises at least two second safety processors (211 , 213) for redundancy.
12. A system (A) for professional applications and remote control of a device (B), said system (A) comprising an OCU (1 ) according to any one of claims 1 to 7 adapted to control said device (B), and a DCU (2) according to any one of claims 8 to 11 being connected to said device (B), where said DCU (2) is adapted to receive instructions from said OCU (1 ) and to control said device (B) according to said received instructions.
13. A system according to claim 12, characterised in, that said OCU (1 ) communicates with said DCU (2) via a black channel, that the communication protocol used in said black channel safely acknowledge that every received message is correct, and that said black channel form a safe communication channel where no safety classification is required.
14. A method for an operator control unit (OCU) (1 ), used by an operator (C), to remotely control a device (B) in a professional application, where said OCU (1 ) comprises actuators through which said operator (C) can act and create control instructions, said method comprising the steps of said OCU (1 ) sending said instructions to a device control unit (DCU) (2), connected to said device (B), and controlling said device (B) according to said sent instructions, where said OCU (1 ) comprises a first safety module (1 1 ), comprising at least one first safety processor (1 1 1 ), and a first application module (12), comprising a first application processor (121 ), where said first application module (12) is used to monitor all actuators (41 ,
42) of said OCU (1 ) and to create said instructions (31 , 32) according to the status of said actuators (41 , 42), where said first safety module (1 1 ) is used to monitor safety classified actuators (41 ) of said OCU (1 ), where said first safety module (1 1 ) is used to monitor at least instructions (31 ) pertaining to safety classified actuators (41 ) created by said first application module (12), where said first safety module (1 1 ) is used to detect any disparities between the status of said safety classified actuators (41 ) and said instructions (31 ) pertaining to safety classified actuators (41 ) created by said first application module (12), and where said first safety module (1 1 ) is used to shut down the communication (3) between said OCU (1 ) and said DCU (2) if a disparity is detected, characterised in, the isolation of said first safety module (1 1 ), with thereto belonging hardware (1 1 1 , 1 12) and computer program (1 1 1 a), from the rest of said OCU (1 ), thus enabling the use or reuse of said first safety module (1 1 ) in OCUs (11, 12) adapted or configured to function within other systems (A1, A2) or system configurations.
15. A method according to claim 14, characterised in, the definition of said safety classified actuators (41 ) as all actuators that are related to any function that is dictated by a safety classification for said device (B).
16. A method according to claim 14 or 15, characterised in, validating a safety certificate awarded said first safety module (1 1 ) for any system or system
configuration (A1, A2) where said first safety module (1 1 ) is used.
17. A method according to any one of claims 14 to 16, characterised in, the use of said first safety module (11 ) for taking care of and managing at least all safety classified communication between said OCU (1 ) and said DCU (2), the use of said first application module (12) for taking care of and managing all other communication between said OCU (1 ) and said DCU (2), the use of said first safety module (11 ) for managing at least all safety classified interfaces of said OCU (1 ), the use of said first application module (12) for managing all other interfaces of said OCU (1 ).
18. A method according to any one of claims 14 to 17, characterised in, the use of at least two first safety processors (111 , 113) in said first safety module (11 ) for redundancy.
19. A method according to any one of claims 14 to 18, characterised in, the use of a mobile control unit for said OCU (1 ), such as a handheld control unit or a control unit with a carrier appliance, such as a strap, belt or vest.
20. A method according to any one of claims 14 to 18, characterised in, the use of a stationary control unit for said OCU (1 ).
21. A method for a device control unit (DCU) (2) connected to a device (B) to control said device (B) in a professional application, said method comprising the steps of receiving instructions from an operator control unit (OCU) (1 ) used by an operator (C), and controlling said device (B) according to said received instructions, where said DCU (2) comprises a second safety module (21 ), comprising at least one second safety processor (211 ), where said DCU (2) comprises a second application module (22), comprising a second application processor (221 ), where said second safety module (21 ) is used for receiving at least all safety classified instructions (31 ) from said OCU (1 ), where said second application module (22) is used for receiving all other instructions (32) from said OCU (1 ), where said second safety module (21 ) is used for actively controlling safety related interfaces (51 ) belonging to said DCU (2), and where said second application module (22) is used for actively controlling other interfaces (52) of said DCU (2), characterised in, the isolation of said second safety module (21 ), with thereto belonging hardware (211 , 212) and computer program (211 a), from the rest of said DCU (2), thus enabling the use or reuse of said second safety module (2) in DCUs (21, 22) adapted or configured to function within other systems or system configurations (A1, A2).
22. A method according to claim 21 , characterised in, the definition of said safety classified instructions (31 ) as all instructions that are related to any function that is dictated by a safety classification for said device (B).
23. A method according to claim 21 or 22, characterised in, validating a safety certificate awarded said second safety module (2) for any system or system configuration (A1, A2) where said second safety module (2) is used.
24. A method according to any one of claims 21 to 23, characterised in, the use of at least two second safety processors (211 , 212) in said second safety module (21 ) for redundancy.
25. A method for the remote control of a device (B) in a professional application, said method comprising the steps of controlling said device (B) through an OCU (1 ) according to any one of claims 14 to 20, and a DCU (2) according to any one of claims 21 to 24 connected to said device (B), where said DCU (2) receives instructions (3) from said OCU (1 ) and controls said device (B) according to said received instructions (3).
26. A method according to claim 25, characterised in, the use of a black channel in the communication (3) between said OCU (1 ) and said DCU (2), the use of a communication protocol in said black channel that safely acknowledge that every received message is correct, and the forming of a safe communication channel (3) where no safety classification is required through said black channel.
27. A first computer program product, characterised in, that said first computer program product comprises computer program code (111 a’), which, when executed by a computer, enables said computer to perform the steps of at least one first safety processor (111 ) according to any one of claim 14 to 20 or 25 to 26.
28. A second computer program product, characterised in, that said second computer program product comprises computer program code (21 1 a’), which, when executed by a computer, enables said computer to perform the steps of at least one second safety processor (21 1 ) according to any one of claim 21 to 26.
29. Computer readable medium (6), characterised in, that computer program code (1 1 1 a’, 21 1 a’) according to claim 27 or 28 is carried by said computer readable medium (6).
PCT/SE2020/050323 2019-04-05 2020-03-30 Safety solution with separable safety module for a remote control system WO2020204790A1 (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
SE1950429-9 2019-04-05
SE1950429 2019-04-05

Publications (1)

Publication Number Publication Date
WO2020204790A1 true WO2020204790A1 (en) 2020-10-08

Family

ID=72667366

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/SE2020/050323 WO2020204790A1 (en) 2019-04-05 2020-03-30 Safety solution with separable safety module for a remote control system

Country Status (1)

Country Link
WO (1) WO2020204790A1 (en)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080147206A1 (en) * 2004-08-30 2008-06-19 Abb Ab Control system for Real Time Applications for Cooperative Industrial Robots
US20120297101A1 (en) * 2009-11-23 2012-11-22 Abb Ag Safety module for an automation device
US20120296446A1 (en) * 2009-11-23 2012-11-22 Abb Ag Control system for controlling safety-critical and non-safety-critical processes
US20150019154A1 (en) * 2013-07-11 2015-01-15 Yokogawa Electric Corporation Field device and data processing method

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080147206A1 (en) * 2004-08-30 2008-06-19 Abb Ab Control system for Real Time Applications for Cooperative Industrial Robots
US20120297101A1 (en) * 2009-11-23 2012-11-22 Abb Ag Safety module for an automation device
US20120296446A1 (en) * 2009-11-23 2012-11-22 Abb Ag Control system for controlling safety-critical and non-safety-critical processes
US20150019154A1 (en) * 2013-07-11 2015-01-15 Yokogawa Electric Corporation Field device and data processing method

Similar Documents

Publication Publication Date Title
US6466844B1 (en) Robot, robot system, and robot control method
US8005572B2 (en) Flexible connection of teaching devices to programmable controllers
US9124999B2 (en) Method and apparatus for wireless communications in a process control or monitoring environment
CN101876816B (en) Method and operating device for operating a security-oriented industrial automation component
US10576638B2 (en) Teaching device
US20090030550A1 (en) Automatic machine system and wireless communication method thereof
CN108073139A (en) Safety switching apparatus, operating terminal and Machinery Control System
US8401678B2 (en) Mobile control and monitoring system
WO2006051355A1 (en) A control system, a method to operate a control system, a computer data signal and a graphical user interface for rail-borne vehicles
KR101272464B1 (en) Control system of stage device
US11038443B2 (en) Motor control system and motor control apparatus
WO2020204790A1 (en) Safety solution with separable safety module for a remote control system
KR101735919B1 (en) Inverter controlling method
CN103963056A (en) Robot system
KR101952953B1 (en) Error management method of construction machinery for providing information of current operable works
CN115515878A (en) Method for operating a people conveyor by reliably configuring an electronic safety device
CN110605712B (en) Robot system and safety control device
CN112925261A (en) Communication control device
JP2007026241A (en) Abnormality monitoring method and controller using it
CN104411564B (en) Method and assembly for controlling a technical system
CN113557481B (en) Safety control device and safety control system
CN110050443A (en) To operation system of substrate
US20220305659A1 (en) Method and system for automatically securing the operation of a robot system controlled by a mobile operating device
JP2020142906A (en) Communication method, communication system, transmitter and receiver
CN116074750A (en) Wireless emergency stop system, method and unmanned vehicle

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20783434

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20783434

Country of ref document: EP

Kind code of ref document: A1