SYSTEM ARCHITECTURE FOR SAFETY APPLICATIONS
Control systems for industrial machinery (e.g., robots) or other devices such as medical devices utilize a safety processor (SP) designed for integration into safety applications and computational components that are not necessarily safety-rated. The SP monitors performance of the non-safety computational components, including latency checks and verification of identical outputs. One or more sensors send data to the non-safety computational components for sophisticated processing and analysis that the SP cannot not perform, but the results of this processing are sent to the SP, which then generates safety-rated signals to the machinery or device being controlled by the SP. As a result, the system may qualify for a safety rating despite the ability to perform complex operations beyond the scope of safety-rated components.
1 .- 26 . (canceled)
27 . A control system comprising:
a sensor configured to produce a sensor output;
one or more non-safety computation modules each including a processor responsive to the sensor output and executing a safety analysis, each non-safety computation module producing control signals in response to detection of a safety condition by the safety analysis; and
a safety processor configured to receive the control signals from the one or more non-safety computation modules and generate therefrom safety-rated signals for controlling a device,
wherein the safety processor is incapable of executing the safety analysis.
28 . The control system of claim 27 , wherein the safety processor is further configured to monitor performance of the one or more non-safety computation modules including latency checks and verification of identical outputs.
29 . The control system of claim 27 , wherein the safety processor is further configured to monitor intermediate results or data structures and error-correcting codes thereof.
30 . The control system of claim 27 , wherein the safety analysis includes execution of an algorithm with non-deterministic or varying run times.
31 . The control system of claim 27 , wherein the sensor is a 3D time-of-flight camera.
32 . The control system of claim 31 , wherein the one or more non-safety computation modules are configured to perform image capture from the time-of-flight camera data, identification, and classification in real time with low latency.
33 . The control system of claim 31 , wherein the one or more non-safety computation modules are configured to analyze occupancy and occlusion of a monitored space by:
generating a three-dimensional representation of the monitored space as a plurality of volumes;
for each sensor pixel having an intensity level above a threshold value, preliminarily marking as unoccupied volumes intercepted by a line-of-sight ray path through the pixel and terminating at an estimated distance from the sensor of an occlusion, marking as occupied the volumes corresponding to a terminus of the ray path, and marking as unknown any volumes beyond the occlusion along the ray path;
for each sensor pixel having an intensity level below the threshold value, preliminarily marking as unknown all voxels intercepted by a line-of-sight ray path through the pixel and terminating at a boundary of the monitored space; and
finally marking as unoccupied volumes that have been preliminarily marked at least once as unoccupied.
34 . The control system of claim 31 , wherein the one or more non-safety computation modules are configured to evaluate safety conditions in a monitored space by:
generating a three-dimensional representation of the monitored space as a plurality of volumes; and
generating a volumetric representation of all points reachable by movable machinery in the workspace within a specified time period.
35 . The control system of claim 27 , wherein the device is at least one robot.
36 . The control system of claim 27 , wherein each non-safety computation module is a dual-processor non-safety computation module.
37 . The control system of claim 27 , wherein the one or more non-safety computation modules are configured to generate a 3D representation of a workcell monitored by the sensor.
38 . The control system of claim 27 , wherein the safety analysis comprises speed and separation monitoring in accordance with at least one of ISO/TS 15066 or ISO 10218-2.
39 . The control system of claim 27 , wherein the safety analysis comprises protective separation distance monitoring in accordance with at least one of ISO/TS 15066 or ISO 10218-2.
40 . The control system of claim 27 , wherein the one or more non-safety computation modules are configured to receive latency tags issued by the safety processor.
41 . The control system of claim 27 , wherein the safety processor is configured to generate and transmit latency tags to the sensor for return to the one or more non-safety computation modules with sensor outputs.
42 . The control system of claim 41 , wherein the safety processor is configured to receive and analyze latency tags returned by the one or more non-safety computation modules to determine whether a duration associated with processing by the one or more non-safety computation modules exceeds a predetermined maximum interval.
43 . The control system of claim 27 , wherein the safety processor is configured to receive and analyze intermediate values returned by the one or more non-safety computation modules to determine whether a processing error by the one or more non-safety computation modules has occurred.
44 . The control system of claim 27 , wherein the one or more non-safety computation modules are not designed to comply with a safety standard.
45 . The control system of claim 27 , wherein the control system qualifies for a safety rating despite comprising the one or more non-safety computation modules.
46 . The control system of claim 27 , wherein the safety processor is configured to (a) transmit the safety-rated signals to a device controller configured to control the device and (b) receive state information from the device controller.
47 . The control system of claim 46 , wherein the one or more non-safety computation modules are configured to transmit only non-safety-rated signals to the device controller.
48 . The control system of claim 27 , wherein the safety processor is configured to transmit the safety-rated signals to a device controller configured to control the device, and the one or more non-safety computation modules are configured to transmit only non-safety-rated signals to the device controller.
49 . The control system of claim 27 , wherein the one or more non-safety computation modules comprise a plurality of non-safety computation modules.
50 . The control system of claim 49 , wherein each non-safety computation module is configured to process a separate sensor channel.