Monitoring and control of a handling device Number:6,778,867 from the United States Patent and Trademark Office (PTO) owispatent The present invention relates to a monitoring and control device for monitoring a technical system having at least one portable and/or mobile and/or immobile device, and more specifically, a handling device that is a arranged in a protective device, and further including at least one preferably central or decentralized control unit and actuators connected thereto to carry out dangerous actions.<H Monitoring, handling, Monitoring, and, , 6778867.html, Patent, pto, 6778867

Title: Monitoring and control of a handling device

Abstract: The present invention relates to a monitoring and control device for monitoring a technical system having at least one portable and/or mobile and/or immobile device, and more specifically, a handling device that is a arranged in a protective device, and further including at least one preferably central or decentralized control unit and actuators connected thereto to carry out dangerous actions.

Patent Number: 6,778,867 Issued on 08/17/2004 to Ziegler, et al.

Inventors: Ziegler; Olaf (Geilnau, DE), Berberich; Georg (Burgstadt, DE), Som; Franz (Lutzelbach, DE)
Assignee: Elan Schaltelemente GmbH & Co. KG (Wettenberg, DE)
Reis GmbH & Co. Maschinenfabrik (Obernburg, DE)

Appl. No.: 09/554,606

Filed: June 1, 2000

PCT Filed: December 06, 1998

PCT No.: PCT/EP98/07914

PCT Pub. No.: WO99/29474

PCT Pub. Date: June 17, 1999

Foreign Application Priority Data


Dec 06, 1997 [DE]			197 54 208

Current U.S. Class: 700/79 ; 318/563; 318/568.11; 318/568.16; 318/568.2; 700/245; 700/65; 700/66

Current International Class: G05B 19/00 (20060101); B25J 19/00 (20060101); B25J 19/06 (20060101); B25J 9/16 (20060101)

Field of Search: 700/65-66,79,83,213,214,245,264 318/560,563,568.11,448,466,568.1,568.16,568.2

References Cited [Referenced By]

U.S. Patent Documents


4490660	December 1984	Tsuchihashi
4697979	October 1987	Nakashima et al.
5086401	February 1992	Glassman et al.
5271092	December 1993	Kreuzer
5705906	January 1998	Tanabe et al.
5760560	June 1998	Ohya et al.
6636772	October 2003	Renau

Foreign Patent Documents


3902247	Aug., 1990	DE
29620592	Mar., 1997	DE
60160409	Aug., 1985	JP

Primary Examiner: Patel; Ramesh
Assistant Examiner: Barnes; Crystal J
Attorney, Agent or Firm: Dennison, Schultz, Dougherty & MacDonald

Claims

What is claimed is:

1. Monitoring and control device (38) for monitoring a technical system (10) with enhanced safety requirements that comprises at least one portable and/or mobile and/or immobile device a handling device arranged in a protective device, with at least one preferably central and/or decentralized control unit (36) as well as actuators (24-30; K1, K2) connected to the control unit for executing dangerous operations, whereby the monitoring and control device (38) is connected to sensors (20, 22) and/or actuators (24-30) and evaluated, processes and controls their status, the control unit (36) is connected to sensors (20, 22) and/or at least one of the actuators (24-30) and the monitoring and control device (38) via at least one data circuit, that the monitoring and control device (38) transmits at least one release signal to the control unit (36) in accordance with the status of the sensors (20, 22) and/or actuators (24-30) in order to enable at least one operation in the technical system (10), that the release signal triggers an operation, which is monitored by the monitoring and control device (38) by comparing the release signal with stored and/or specified execution and/or function and/or plausibility specifications or processes of movements, and that in case of an error at least one other signal is generated, which transfers the system into a safe condition characterized in that microcontrollers (58, 60, 102, 120) are connected to each other via a connection (88) for mutual data exchange purposes that the actual status values transmitted by the drive controls (50) are declared with an identifier and that upon receipt of these identifiers an interrupt is triggered in each microcontroller (58, 60, 102, 120) of the monitoring and control device, and that the monitoring and control device is equipped with a time expectancy device for safety-related data and that each actual status value and/or value range is assigned at least one safety-related output and/or input (92, 94) of the monitoring and control device (38), with the outputs and/or inputs being connected to passive and/or active switching elements (96, 98).

2. Monitoring and control device in accordance with claim 1, characterized by the fact that the actuator (2430; K1, K2) and/or the sensor (20, 22) has the design of a safety device (14) that transfers the technical system (10) into a safe status.

3. Monitoring and control device in accordance with claim 1, characterized by the fact that the actuator (24-30) includes in particular a drive unit (24-30) with appropriate drive control (50), a contactor (K1, K2), a relay or a valve.

4. Monitoring and control device in accordance claim 1, characterized by the fact that the operation comprises a process of movements.

5. Monitoring and control device in accordance with claim 1, characterized by the fact that the data circuit comprises a serial bus line (CAN_A).

6. Monitoring and control device in accordance with claim 5, characterized by the fact that the monitoring and control device (38) is equipped with two channels, each with at least one microcontroller (58, 60, 102, 120), with each microcontroller (58, 60, 102, 120) being connected to the bus line (CAN_A, CAN_B) via a bus controller (62, 64).

7. Monitoring and control device in accordance with claim 1, characterized by the fact that the control unit (36) and the monitoring and control device (38) are physically separate devices.

8. Monitoring and control device in accordance with claim 1, characterized by the fact that a target status value signal is transmitted continuously or once to at least one connected drive control (50) and/or to the monitoring and control device and that from the at least one drive control (50) actual status value signals are transmitted at least to the control unit (36), to both the control unit (36) and the monitoring and control device (38), that the actual status value signals of every drive control (50) are compared to drive-specific values and/or value ranges that have been stored in the monitoring and control device (38) and been transferred by the control unit (36), and that upon deviation from the respective value and/or value range the other signal is generate.

9. Monitoring and control device in accordance with claim 8, characterized by the fact that the actual status values of individual drive units (24-30) are calculated in the monitoring and control device (38) and/or the control unit (36) through kinematic-specific transformation to a handling device specific point (304) and that Cartesian value ranges are stored in a table for n-dimensional movement, wherein n=3, with every actual status value range being assigned at least one output of the monitoring and control device (38).

10. Monitoring and control device in accordance with claim 9, characterized by the fact that the n-dimensional, wherein n=2 or n=3, value ranges stored in the tables are compared with received and transformed actual status values during every cycle.

11. Monitoring and control device in accordance with claim 8, characterized by the fact that the actual status values of all drive units (24-30) are determined and are calculated to a handling device specific point (304) through kinematic-specific transformation and that a Cartesian speed of the point (304) is calculated from at least two transformed position values through differentiation and compared to a specified maximum speed.

12. Monitoring and control device in accordance with claim 11, characterized by the fact that monitoring of the speed occurs in a cyclical manner.

13. Monitoring and control device in accordance with claim 12, characterized by the fact that upon triggering the other signal a Cartesian starting speed V.sub.Start of a point (304) is determined and stored, that after a time period .DELTA.T a current speed V.sub.curr is determined and compared to a starting speed V.sub.Start, with the system being transferred immediately into a safe status when the current speed V.sub.curr is equal to or larger than the starting speed V.sub.Start after the time period .DELTA.T.

14. Monitoring and control device in accordance with claim 1, characterized by the fact that the monitoring and control device (38) is equipped with a two-channel output and input level (66) with crosswise data comparison for evaluating electromechanical safety switches (366) and for addressing external switching devices (376, 378) and/or that at least one additional bus connection (72) is provided in order to integrate the monitoring and control device (38) into a higher-ranking safety bus.

15. Monitoring and control device in accordance with claim 1, characterized by the fact that the control unit (36) transmits target status value information driving to defined positions to the at least one of the actuators (24-30) and to the monitoring and control device (30), with the defined positions being assigned drive-specific values that are transmitted to the monitoring and control device and compared to measured actual status values of the actuators (24-30) and monitored.

16. Monitoring and control device in accordance claim 1, characterized by the fact that with regard to a drive unit (24-30) or drive axis a variety of value ranges is defined, which are monitored by the monitoring and control device (38) in a drive-specific manner, with each actual status value and/or value range being assigned one or more outputs of the monitoring and control device (38).

17. Monitoring and control device in accordance with claim 16, characterized by the fact that the actual status values and/or value ranges can be programmed in a drive-specific manner.

Description

BACKGROUND OF THE INVENTION

The invention relates to a monitoring and control device for monitoring a technical system comprising at least one portable and/or mobile and/or immobile device, particularly a handling device that is arranged in a protective device, comprising at least one preferably central and/or decentralized control unit as well as actuators connected to it to carry out dangerous actions.

Furthermore, the invention concerns a method for the safety-related monitoring of at least one axis of a drive unit, which in particular is meant to monitor a technical system with at least one portable and/or mobile and/or immobile device with enhanced safety requirements, particularly a handling device that is arranged in a protective device, comprising at least one preferably central and/or decentralized control unit as well as actuators connected to it to carry out dangerous actions.

The invention also relates to a mechanism for the safety-related monitoring of an axis of a technical system powered by a drive unit, comprising an actual status value transmitter that is coupled with the axis, with the transmitter being connected to a two-channel drive control mechanism for evaluation purposes.

Finally, the invention concerns a method for monitoring the speed of a specific point of a handling device that can be moved, preferably of a robot flange or a tool center point (TCP) of a technical system, particularly of a handling device.

In order to design a handling device in such a way that it can be operated in the vicinity of people as well, DE 39 02 247 A1 suggests designing the actual value transmitter for status acknowledgements and control elements in a redundant fashion and providing a monitoring and safety circuit that is activated when signal deviations occur between the redundant pick-ups.

The monitoring and safety circuit responds to signal deviations between the redundant actual value transmitters; however, external safety precautions are not incorporated in the evaluation. Familiar monitoring and safety circuits also do not provide for the circuit to be able to actively intervene in the process of movements of the handling device.

From DE 296 20 592 U1 we know of a device for the safety-related monitoring of a machine axis that is equipped with a separate processor and actual value recording system as well as an error discovery system through signal comparison testing and compulsory dynamization. The device is equipped with two separate actual value recording systems, which direct their respective actual values to separate processors. The processors compare the actual values with the upper and lower limits.

From the state of the art, we know that for the monitoring and controlling of a braking device for driving mechanisms of a handling device an operator--in the case of a closed braking device--feeds electric current to a driving mechanism to generate a torque and checks visually whether the driving mechanism moves even in the case of a closed braking device. This procedure is not precise and must be conducted separately for each axis.

From the state of the art, we also do not know yet how to monitor the process of movement of a defined point in the Cartesian space with regard to position and speed.

The invention at issue faces, among other things, the problem of making a safety circuit available for the monitoring of processes of movements of a technical system that can be used in a flexible manner and enhances the safety of the technical system.

Furthermore, the invention is based on the problem of further developing a method and a device for the safety-related monitoring of an axis with a drive unit in such a way that the realization of a single-channel actual value recording sensory mechanism for enhanced safety-related requirements is made possible.

Additionally, the invention is based on the problem of further developing a method for controlling and monitoring a braking device in such a way that automatic monitoring or verification is enabled in a simple manner.

SUMMARY OF THE INVENTION

The invention is also based on the problem of monitoring the process of movement of a defined point of a device of the technical system in the Cartesian space.

In order to resolve the primary problem, it is being suggested to connect the monitoring and control device with sensors and/or actuators, evaluating, processing and controlling their respective status, to connect the monitoring and control device with the control unit and have it transmit--in accordance with the status of the sensors and/or actuators--at least one release signal to the control unit in order to enable at least one operation in the technical system, to have the monitoring and control device monitor the execution of this at least one operation and to create another signal in case of errors, moving the system into a safe status.

The monitoring and control device is designed in such a way that it can additionally be integrated into commercially available central and/or decentralized numerical controls in order to monitor dangerous operations of a technical system, particularly three dimensional dangerous movements, in a safety-related manner or manner that protects the operator(s). In case of a defective execution of the operations, a signal is generated to transfer the system into a safe condition.

The monitoring and control device is equipped with input and output levels, to which the sensors and/or actuators are connected. Additionally, interfaces are provided in order to possibly connect the monitoring and control device with the existing central control unit via a bus.

In a preferred version, the monitoring and control device is connected to a robot control mechanism. The design ensures that the at least one actuator and/or the at least one sensor is designed as a safety device that transfers the technical system into the safe status. In particular, the actuator is designed as a drive unit with appropriate drive controls or as a contactor that connects the technical system or the drive controls with energy.

When all actuators and/or sensors are in a condition that agrees with the safety requirements, the release signal of the monitoring and control device triggers an operation such as a process of movement, which is monitored by the control and monitoring device preferably by comparing it with stored and/or specified values such as execution and/or function and/or plausibility specifications or processes of movements.

In order to be able to use the monitoring and control device in a flexible manner, the invention provides for the control unit to be connected to the at least one actuator and/or sensor and the monitoring and control device via at least one data circuit, preferably a serial bus line. In particular, the control unit and the monitoring and control device are physically designed as separate devices.

In order to ensure safe monitoring of the processes of movements, the invention's design is such that the control unit continuously or once transmits a target status value signal to the at least one connected drive control and/or to the monitoring and control device as well as actual status value signals from the at least one drive control to the control unit, preferably both to the control unit and to the monitoring and control device, that the actual status value signals of every drive control are compared to the drive-specific values and/or value ranges that are stored in the monitoring and control device and transmitted by the control unit and that when the respective value and/or value range is left another signal is generated.

In order to achieve as high an error safety rate as possible, the drive controls and the monitoring and control device, respectively, are equipped with at least two channels in a redundant design, with the channels being connected to each other via the bus line CAN_A and another bus line CAN_B, with control signals and/or actual value information being transmitted via the bus line CAN_A and actual value information via the bus line CAN_B. For the evaluation of electromechanical safety switches or similar sensors and for the addressing of external switching devices or actuators, the monitoring and control device is equipped with a two-channel output and input level, with at least two more bus connections being provided for in order to be able to connect the monitoring and control device with a higher-ranking safety bus.

In a preferred version, the actual status values transmitted from the drive controls are declared with an identifier, with an interrupt being triggered in each microcontroller of the monitoring and control device upon receipt of this identifier and the actual status values being read within a time interval. Additionally, each value and/or value range is assigned at least one safety-related output and/or input of the monitoring and control device, with the outputs and/or inputs being connected to passive and/or active switch elements such as electromechanical safety switches and/or contactors and a relay.

In order to perform service work and to initialize the technical system, the central control unit transmits target status value information to start up defined positions such as SAFE position, SYNC position to the drive units and the monitoring and control device, with the defined positions being assigned drive-specific values that are transmitted to the monitoring and control device and compared with the measured actual status values of the drive units.

According to the invention, the technical system is not equipped with any hardware limit switches such as cams, but rather with axis-specific "electronic cams." In particular, a variety of value ranges is defined with regard to one drive unit or one drive axis, with this unit or axis being monitored by the monitoring and control device in a drive-specific manner, and with each value and/or value range being assigned one or more outputs of the monitoring and control device. The values and/or value ranges can be programmed in an axis-specific manner. When exceeding a status value range, one or more outputs of the monitoring and control device are set so that the technical system can be turned off.

In the method for safety-related monitoring of at least one axis of a drive unit, the problem is resolved in the invention by recording and evaluating an actual status value signal of the at least one axis, with the actual status value signal being formed by two periodic signals that are phase-displaced towards each other, with the sum of the powers of the respective amplitude of the signals being formed and compared to a value within a value range, and with an error signal being generated if the sum is not within the specified value range.

The method with enhanced safety provides for the actual status value signal of the at least one axis to be recorded in a single-channel manner and evaluated in a two-channel manner, with the actual status value signal being formed by two periodic signals that are phase-displaced towards each other, for the sum of the amplitude squares to be formed in each channel and compared to a constant value or a value within the value range, for an error signal to be generated if the sum does not correspond to the specified value or is not within the value range, and for the actual status value signal to be fed to the other two-channel monitoring and control device, which compares the sums of amplitudes squares formed in each channel of the drive control with each other and/or with the constant value or the value within the value range.

Preferably, the actual status value signal is composed of a sine- and a cos-signal, with a plausibility check of the actual value signals being conducted in each channel, thus checking whether the sum of the squares of the output amplitudes at every scanning point of time corresponds to a specified value x, with x being within the range 0.9.ltoreq..times..ltoreq.1.1, preferably x=1=(sin .phi.).sup.2 +(cos .phi.).sup.2.

As an error-avoiding and/or error-controlling measure, the invention provides for a directional signal of a target speed or status value to be generated and compared to a directional signal of the actual speed or status value in a single-channel or two-channel manner and for the values generated in a single-channel or two-channel manner to be fed to the monitoring and control device and compared to each other there.

Furthermore, the invention provides for an internal cross-comparison of the recorded actual values to be conducted between the channels, preferable between the micro-computers, and for a pulse-block to be triggered in case of an error.

When the usual energy supply is lacking for the drive units (power down mode), a standstill monitoring process is conducted, with the actual values being monitored in each channel and a "marker," which is transferred into the monitoring and control device when the usual energy supply sources have been turned back on and compared to the stored target values, being set when the actual values change beyond the set tolerance limit.

In the arrangement for the safety-related monitoring of an axis of a technical system that is driven by a drive unit, comprising an actual status value transmitter that is coupled with the axis and connected to the two-channel drive control for evaluation purposes, the problem is resolved by providing a design in which the actual status value transmitter is a single-channel item and has at least two outputs where two periodic signals that are phase-displaced towards each other can be picked up when the axis turns, in which the outputs are connected to one channel of the drive control, respectively, and in which the individual channels of the drive control are connected on the one hand with a higher-ranking central or decentralized control unit and on the other hand with a two-channel monitoring and control device in order to be able to compare the received actual value signals.

When the drive unit of a driving mechanism does not permit time value recording, the invention provides for a design in which the two-channel drive control, which is connected to the actual status value transmitter, is located as an integral part of the monitoring and control device or as self-contained unit independently from the drive unit in front of the device. In this case, the monitoring and control device can also be equipped with the drive control for actual value recording purposes. Of course the device for actual value recording can also be located in front of the monitoring and control device as a separate unit.

In a beneficial version, the actual value transmitter has the design of a resolver with two analog outputs for the actual value signals and an input for a reference signal, with the outputs, respectively, being connected to a channel of the drive control via an analog-to-digital converter and with the input for the reference signal being connected to a reference generator, which in turn is connected to the regulating unit of a channel via a control unit.

For control purposes of the actual value recording process, the analog-to-digital converter of the second channel is connected to an interrupt input of the signal processor via a first connection, and the analog-to-digital converter of the first channel is connected via a second connection with an input of a driver component, whose output is connected to an interrupt control unit of the microcontroller. The time between two received interrupt signals (EOC) is measured and a stop signal is then triggered if no interrupt signal (EOC) is detected within a certain time frame. A pulse block is also generated when the reference frequency deviates from a frequency standard.

In order to be able to control the error of a mechanical division for a single-channel drive and transmitter shaft of the resolver, the invention provides for the drive unit to be an electric drive system that is fed as an intermediate circuit, preferably as an AC servomotor.

In a method for controlling and monitoring a braking device with a nominal torque or moment (M.sub.NOM) that is allocated to a drive unit of a technical system such as a handling device, automatic monitoring/verification is enabled by measuring and storing a braking current (C.sub.B) of the drive unit that corresponds to a braking moment when the braking device is opened, by feeding the drive unit with an axis-specific current value (C.sub.TEST), which loads the braking device with a moment that is equal to or smaller than the nominal moment (M.sub.NOM) of the braking device, when the braking device is closed, and by monitoring the drive mechanism simultaneously for standstills.

Based on the invented method, the braking devices are monitored/verified automatically. When the braking devices are closed and current is fed, the drive mechanism is monitored for standstills. As soon as one axis or one drive mechanism moves, an error signal, which points to the defect of a braking device, is generated via the standstill monitoring system. In particular, this design provides the opportunity of monitoring all braking devices of a handling device simultaneously by feeding all drive mechanisms with a current value when the braking device is closed.

In a preferred version, the current value (C.sub.TEST) results from the measured braking current (C.sub.B) and an offset current (C.sub.OFFSET) based on the relation

If the axis or drive mechanism that is to be checked is an axis under gravity load, then the braking device is loaded with a certain moment due to the gravity of e.g. the robot arm, which corresponds to the braking moment. For the purpose of testing the dividing device, the drive mechanism is fed a current value that generates a moment, which has an effect in addition to the moment created by gravity, in the same direction.

According to another development, the invention provides for the current value C.sub.TEST to generate a moment in the drive mechanism that amounts to 60 to 90% of the nominal moment, preferably to 80% of the nominal moment.

Furthermore, the invention includes a design for axes not subject to gravity load in which the braking device can be released via an external switching contact and addressed via an external auxiliary energy source. This operating mode is only applied in emergency situations. The higher-ranking robot control mechanism and/or the monitoring device can be turned off. In this mode, the robot mechanism can be moved manually, for example in order to release a trapped person.

In order to solve production disruptions, the invention provides for the monitoring for standstills of the remaining axes that are subject to gravity load when the braking devices of a group of axes that are not at all or only insignificantly subject to gravity load, such as head axes, are released individually. This operating mode is of advantage when e.g. after a disruption in the current source with a burnt welding wire a welding robot has become jammed in an area of the work piece that is difficult to access. In this case, the braking device can be lifted on a group of axes without gravity load in order to move the axes manually into a better position.

In a preferred version, a current supply source is added for the braking devices via an external control and monitoring device, with a drive control that is connected to the braking device generating a signal with which the braking device of an axis is opened or lifted. Apart from increased safety, this also enhances flexibility with a variety of motors or brakes that are connected.

The invention furthermore relates to a method for monitoring the speed of a moveable, device-specific point of a technical system, particularly a handling device.

In order to be able to monitor the process of movement of the defined point in the Cartesian space, the actual status value signals are recorded by the drive units, Cartesian coordinates of the point are calculated from the actual status value signals through a transformation operation, and the calculated Cartesian coordinates are compared to stored values and/or value ranges in order to generate a signal for stopping the device when the transformed Cartesian coordinates exceed the value and/or value range.

In a preferred version, verification of a safely reduced speed occurs relative to the handling device-specific point, with a difference vector being calculated by subtracting a first Cartesian coordinate set at a first scanning point in time from a second Cartesian coordinate set at a second scanning point in time, with a Cartesian speed of the point being determined via a time difference between the first and the second scanning point in time and with a signal being generated to stop the drive units when the calculated speed exceeds a specified maximum speed.

In another preferred method, a so-called brake ramp monitoring process occurs, where upon the triggering of a signal for stopping the device a starting speed of the point is determined and stored, where after a given time period the current speed is determined and compared to the starting speed and where then, when the current speed after the time period is equal to or larger than the starting speed, a signal is generated to immediately stop the device.

Further developments result from the sub-claims, which include at least in part invented versions of the inventions.

BRIEF DESCRIPTION OF THE DRAWINGS

Further details, advantages and features of the invention do not only result from the claims, the features derived therefrom--either on their own and/or in combination--, but also from the following description of the versions described in the figures.

They show:

FIG. 1 diagrammatic view of a technical system, comprising a handling device that is arranged in a protective room,

FIG. 2 a logic diagram of a control system used to control and/or regulate the handling device,

FIG. 3 a logic diagram of a monitoring and control device,

FIG. 4 a logic diagram for addressing a power level,

FIG. 5 a logic diagram of a drive control,

FIGS. 6-9 basic circuit designs of the safety switching elements integrated in a hand-held programming device,

FIG. 10 a flow chart of the function "SAFE POSITION,"

FIG. 11 a flow chart of the function "SYNCHRONOUS POSITION,"

FIG. 12 basic layout of axis-specific, programmable "electronic cams,"

FIG. 13 basic layout of a Cartesian cam,

FIG. 14 a flow chart for monitoring axis-specific electronic cams,

FIG. 15 a flow chart for monitoring a Cartesian cam,

FIG. 16 a speed diagram for depicting the function "brake ramp monitoring,"

FIG. 17 a pulse diagram to explain the release of the function "safely reduced speed,"

FIG. 18 a flow chart to explain the function "safely reduced speed,"

FIG. 19 a pulse diagram to explain the function "TILT OPERATION,"

FIG. 20 a pulse diagram to explain the function "PULSE OPERATION,"

FIG. 21 a logic diagram to address braking units,

FIG. 22 a flow chart of the function "EMERGENCY STOP-ROUTINE,"

FIG. 23 a flow chart of the function "POWER DOWN MODE," and

FIG. 24 a logic diagram of hardware elements that are active in case of a power failure.

DETAILED DESCRIPTION OF THE INVENTION

FIG. 1 depicts the diagrammatic view of a technical system 10 with enhanced safety requirements. In the described example, the technical system 10 consists of a handling device 12, which is arranged within a safety design such as the protective room 14 together with two placement spots 16, 18, which can be fed via allocated protective doors 20, 22. The handling device 12 is described as a robot 12 in the following.

In the example described here, the robot 12 can be moved around at least four axes 23, 25, 27, 29, with each axis 23, 25, 27, 29 being assigned an actuator 24, 26, 28, 30, which is described as a drive unit 24, 26, 28, 30 in the following. Of course the actuator can also be a contactor that supplies the drive unit 24, 26, 28, 30 with energy. In order to be able to synchronize the robot 12 for example after a power failure, a synchronization point or contact 32 is arranged within the protective room 14.

When the robot 12 is located in a position above the placement spot 18, then protective door 20 can be opened in order to feed the placement spot 16. During this phase, the position of the robot 12 is monitored in a manner as described in the following. Sensors like switching contacts of the protective door 20 are connected to actual status value signals of the robot 12 so that a disconnection is created when the robot 12 leaves its position above the placement spot 18 within a certain specified safety area.

FIG. 2 shows a control system 34, consisting of a central and/or decentralized control unit such as the robot control 36, the drive units 24 through 30 as well as a monitoring and control device 38, which is called the safety controller 38 in the following. The robot control 36 is connected via an interface 40 with a hand-held programming device 46 and a bus line CAN_A with the drive units 24-30 and the safety controller 38 in a stranded manner. Furthermore, the safety controller 38 is connected to the hand-held programming device 46 via a connecting line 44. The hand-held programming device 46 can also be used to program the robot control 36, for which the interface 42 of the safety controller 38 is connected via a bus line CAN_C and the CAN interface 40 with the robot control 36.

The drive units 24-30 have the same design, which will be explained on the example of the drive unit 24. In order to record actual status value signals, the drive unit 24 has a resolver 48, which is connected to a drive control 50 with redundant design. The drive control 50 has two channels or circuits 52, 54, with each channel containing its own CAN controller 56, 58. The CAN controllers 56 are connected among each other with the bus CAN_A, which connects the drive control 50 on the one hand with the robot control 36 and on the other hand with the safety controller 38. The CAN controllers 58 are connected among each other via another bus CAN_B, which connects the controllers 58 with the safety controller 38. The drive unit 24 comprises furthermore a motor, a power supply part, possibly a gear mechanism and a braking unit (not shown).

The safety controller 38 also has a two-channel design and an autonomous micro-computer 5, 60 in each channel. The micro-computers 58, 60, respectively, are connected via a CAN controller 62, 64 with the bus line CAN_B or the bus line CAN_A. Furthermore, the micro-computers 58, 60 are connected to an input-output level 66 in order to connect or read safe input and outputs. Safe inputs and outputs of the input-output level 66 are e.g. connected to contacts of the protective doors 20, 22 of the protective room 14. For additional data exchange, the micro-computers 58, 60 can be coupled via further CAN controllers 68, 70 and an interface 72 with a higher-ranking safety bus.

The robot control 36 assumes the responsibility of all central regulating and control tasks and is not subject to any safety considerations. In particular, the robot control 36 is physically independent from the safety controller 38 so that operational processes occur in separate devices. It is planned that the safety controller is connected via the input/output level 66 with the sensors or switching contacts of the protective doors 20, 22 and via the bus lines CAN_A and CAN_B with the actuators or drive units 24, 26, 28, 30 in order to evaluate, process and control the status. In accordance with the status of the switching contacts of the protective doors 20, 22 and/or drive units 24, 26, 28, 30, the safety controller transmits at least one release signal to the control unit 36 so that the robot 12 can execute an operation. Afterwards, the execution of the at least one operation is continuously monitored by the safety controller. In case of an error, another signal is generated, with which the system 10 is transferred into the safe status.

The next signal involves a "STOP-1" function, i.e. the signal initiates a controlled stop, with energy supply to the drive units being maintained in order to achieve a stopping and interrupt energy supply only when the standstill has been reached.

In the robot control 36 all target status values of the respective drive units 24-30 are calculated and transferred one after the other via the bus CAN_A to the drive units 24-30. The drive units 24-30, respectively, transfer an actual status value back to the robot control via the bus CAN_A, whereupon in the robot control 36 values such as slipping distance, towing distance etc. can be calculated.

For recording purposes of the actual status value the resolver 48 is provided, which is mechanically coupled directly with the motor via a motor shaft. Analog actual value signals exist at the output of the resolver 48, which are digitized in the drive control 50. The resolver 48 supplies the drive control 50 with information, which serves for the axis-specific regulating of processes. In particular, a current regulating process for the power supply part addressing the motor is achieved with the drive control 50. The actual value information, however, is not transferred via the bus CAN_A to the robot control 36, but also transferred to the safety controller 38 via the bus lines CAN_A and CAN_B in a redundant manner in order to be monitored there.

FIG. 3 depicts a detailed layout of the safety controller 38. The safety controller 38 is supplied with energy by an external power supply unit 74. Every micro-computer 58, 60 is assigned its own power supply part 76, 78, which is connected to the power supply unit 74. The CAN controllers 62, 64 are connected via the transceiver 80, 82 with the bus lines CAN_A and CAN_B. Furthermore, the micro-computers 58, 60 are connected via the additional CAN controllers 68, 70 and transceivers 84, 86 with a higher-ranking safety bus. The interface 42 for the hand-held programming device 46 is connected via the bus CAN_C on the one hand with the robot control 36 and on the other hand with the hand-held programming device 46, with the bus CAN_C being physically looped through within the safety controller 38.

The micro-computers 58, 60 are connected to each other via a connection 88 for the purpose of data exchange. This way, the actual values that are received in the individual channels can be compared with each other.

Alternatively to the hand-held programming device 46, the safety controller 38 and/or the control device 36 can also be operated via a control panel (not shown), whose interface is part of the safety controller 38 and connected to at least one micro-computer 58, 60.

The input/output unit 66 comprises an output level 92 and an input level 94. The output level comprises switching transistors that can be addressed by the micro-computers 58, 60. The input level 94 comprises inputs to which safety switching devices such as emergency/off switches or other switching contacts can be connected. A safety switching device is connected between an input of the first and second micro-computer 58, 60 or an output of the first and second micro-computer 58, 60, respectively. The inputs are read inputs of the respective micro-computer 58, 60 and the outputs are write outputs of the micro-computers 58, 60. Actuators such as contactors can be connected to the output level 92 for the switching of a release signal. The input level 94 exists in order to be able to connect sensor such as switching contacts, emergency off switches, proximity switches, etc.

Generally, the technical system 12 with the appropriate control 36 and drive units 24-30 is addressed via power supply contactors or main contactors K1, K2, which are connected directly with an output of the monitoring and control device 38.

Alternatively, addressing can also occur in accordance with the layout in FIG. 4, with the outputs of the monitoring and control device 38 being eliminated.

FIG. 4 is a basic logic diagram for addressing the power unit of the drive units 24-30. The monitoring switching contacts of the protective doors 20, 22 are connected to a safety relay component 96. Outputs of the safety controller 38 are connected to a second safety relay component 98. The outputs of the safety relay components are coupled with each other and address the main contactors K1, K2 of a power switch 100. The drive unit is supplied with energy via the main contactors K1, K2. Addressing of the main contactors K1, K2 occurs either via the safety controller 38, the protective doors 20, 22 or a combination of both signals.

The robot control 36 can address a total of 24 drive units, with the safety controller 38 being in a position to monitor the same amount of axes.

The safety controller 38 receives the actual status values of the respective drive units 24-30 via the buses CAN_A and CAN_B. Both buses serve the redundant actual status value recording process. The bus CAN_A represents an operational bus for the robot control 36, with the bus CAN_B representing a transmission circuit that is additionally integrated into the system in order to achieve redundancy. Since in this case two independent transmission mediums are involved, the occurrence time of the second error is decisive for discovering hardware errors in one of the two transmission circuits. All information transmitted via the buses CAN_A or CAN_B is processed in the separate CAN controllers 62, 64 and made available to the respective micro-computers 58, 60. The higher-ranking micro-computers 58, 60 are also decoupled. Thus, this is a completely redundant system as far as the transmission medium and the processing of received information is concerned.

All safety-relevant signals are sent to the inputs of the input level 94. This way, the safety controller 38 also assumes the evaluation of the sensors such as electromechanical safety switches, in addition to monitoring tasks. Via the output level 92, actuators such as external electromechanical relay combinations can be selected, which can then be combined with external signals, for example protective door signals, or the outputs of the safety controller 38 are connected directly with the power contactors K1, K2.

FIG. 5 depicts a logic diagram of the drive control 50 with the resolver 48. The drive control 50 consists of the redundant circuits 52 and 54. The circuit 52 is equipped with a micro-computer 102, which has the CAN controller 56 as an integral component and chip. The CAN controller 56 is connected to the bus CAN_A, consisting of the data lines CAN_A_H and CAN_A_L, via a transceiver 104. Furthermore, the micro-computer 102 includes an internal SRAM 106, a IO control mechanism 108 as well as an IR processing device 110 and is connected to an analog-to-digital converter via a bus 112. An output 116 of the analog-to-digital converter 14 is connected on the one hand directly with the micro-computer 102 and on the other hand with the micro-computer 102 via a divider 117.

The second channel 54 is equipped with a first signal processor 120 with internal SRAM memory as well as an internal IR processing device 124. The first signal processor 120 is connected to a second signal processor 128 via a DPRAM 126. This in turn is coupled with the micro-computer 102 via a DPRAM 130. The signal processor 128 is connected to a driver 132, which controls the CAN controller 58. The CAN controller 58 is connected to the bus CAN_B via a transceiver 134, which comprises the lines CAN_B_H and CAN_B_L.

The signal processor 120 is connected via a bus with an analog-to-digital converter 136 on the one hand and with a control element 138, which contains a timer, a counter and a status generator, on the other hand. The control element 138 is furthermore connected via a bus with the micro-computer 102. The control element 138 is also connected via a bus with a frequency generator 140, which generates a reference signal for the resolver 48. For this purpose, an output of the frequency generator 140 is connected to an input 142 of the resolver. And finally, the control element 138 has another output, where the SOC (start of conversion) signal can be found. This output is connected to an input of the analog-to-digital converters 114, 136.

The resolver has a first output 144, where a sine signal can be found. The first output 144 is connected to an input of the analog-to-digital converter 114, 136 via an amplifier. Furthermore the resolver has a second output 146, where a cosine signal can be found. The second output 146 is connected to an input of the analog-to-digital converters 114, 116 via an amplifier. The resolver 48 is coupled via a shaft 148 and a motor 150. The resolver 48 is adjusted synchronously to the motor phases.

With reference to FIG. 2 it should be noted that the drive control 50 represents a self-contained unit, with the safety controller 38 exercising no influence whatsoever on the drive control 50. When the drive control 50 detects an error, this message is sent directly to the safety controller 38 or a pulse block is activated in the drive control 50, i.e. the transmission of actual value information is stopped. Since the safety controller 38 has a time expectancy circuit towards actual value signals, the lacking of these actual value signals leads to the fact that the main contactors K1 and K2 are turned off by the safety controller, thus transferring the system into a safe condition.

Generation of the actual value occurs by feeding the resolver 48 a reference signal via the input 142. The reference signal is generated in the reference frequency generator 140, which is selected by the control element 138. A central timer, which generates pulses for a counting step and a status generator connected to it, is integrated in the control element 138. At the peak of the reference voltage the SOC (start of conversion) signal for the analog-to-digital converters 114, 136 can be found. Apart from a coil that is fed the reference signal, the resolver 48 is equipped with two additional coils, which are preferably coupled with the motor shaft and where a sine and a cosine current can be found.

The reference coil is specified the reference signal, which is coupled inductively onto the sine and cosine coils. Depending on the position of the sine/cosine coil, a sine/cosine signal is obtained at the outputs 144, 146 with constant amplitude and frequency. Depending on the position of the rotor, a phase displacement (0 . . . 360.degree.) occurs between the reference signal and the sine or cosine signals. At the peak of the reference signal or reference voltage, the sine and cosine signals are scanned, and an actual position is calculated from the ratio of the two amplitudes within one resolver revolution. A rotation angle .phi. of 0 to 360.degree. corresponds to an actual value of 0 to 4096 increments for a resolution of 12 bit. The resolver 48 must be adjusted synchronously to the motor phase in order to provide maximum torque. This means that the phase angle .phi.=0 is to be set. When the phase angle becomes larger, the torque of the motor decreases continuously and is exactly zero at .phi.=+90.degree. and .phi.=-90.degree.. When the phase angle exceeds .phi.=.+-.90.degree., a pole reversal of the direction occurs, i.e. a positive speed specification has the effect that the motor turns in the negative direction. This would turn the control circuit into an unstable condition, and the motor could no longer be controlled.

In order to recognize such a pole reversal in the direction, the motor control should be provided with speed plausibility check. Here, the sign of the target speed or status value is constantly compared to the sign of the actual speed or status value.

If both signs are contrary over a defined period of time, one can proceed on the assumption that a reversal in the direction exists. Observation over a defined period of time is necessary to keep the monitoring process from not responding in the case of operational control fluctuations.

The sine or cosine signals that exist at the outputs 144, 148 of the resolver 48 are fed to the analog-to-digital converters 140, 136. Once the conversion has occurred, the analog-to-digital converter 136 provides an EOC (end of conversion) signal, which starts the operational system cycle of the signal processor 120. It is only when the operating system cycle runs properly that the appropriate actual status values are forwarded via the DPRAM 126 to the signal processor 128, which transfers them via the driver 132, the CAN controller 38 and the transceiver 134 to the bus CAN_B, via which the actual values are transferred to the safety controller 38. Should the operating system cycle not be triggered properly, a "STOP-0" signal, i.e. safe stop of operation, is sent to the safety controller 38 via the bus CAN_B. The error message "STOP-0" affects a stopping of the system by immediately turning off power supply to the drive units, which is also called uncontrolled stopping.

Upon successful conversion of the input signals, the analog-to-digital converter 114 supplies an EOC signal (end of conversion), which is sent into an interrupt input of the micro-computer 102 via the timer 118. Internally, the time between two received EOC interrupts is measured in order to check for a deviation of the reference frequency from the frequency standard, preferably 7.5 kH, or complete non-existence of the reference frequency, e.g. when the central timer fails. In this case a pulse block is activated, and a signal "STOP-0" is sent to the safety controller 38 via the bus CAN_A.

As soon as the signal processor 122 receives the EOC signal an internal timer is triggered, which is decremented in a cyclical administrative part of the operating system and responds when the counter reaches zero, i.e. when the EOC signal fails. In this case the pulse block is activated as well. The pulse block switches the motor to the "torque-free" status. When the watchdog is selected, a hardware test is triggered and the safety controller 38 transfers the system 12 into a safe condition.

Additionally, the invention provides for a variety of measures for error recognition and error treatment. In order to check the analog-to-digital converters 114, 136 of the reference frequency generator 140 as well as the outputs 144, 146 of the resolver 48, a plausibility check is conducted. The plausibility check occurs through the two amplitudes of the sine/cosine signals of the resolver 48 in such a way that the sum of the amplitude squares (sin .phi.).sup.2 +(COS .phi.).sup.2 is ideally the sum x with x in the range of 0.9.ltoreq..times..ltoreq.1.1, preferably x=1. In order to suppress a selection of the plausibility check due to disruptions such as noise in the signal lines, the sum x is assigned a defined tolerance window. A prerequisite for the plausibility check is the standardization of the sine/cosine signals, which are established once and are not changed thereafter.

In the case of non-plausible amplitudes for the sine and cosine signals, each channel 52, 54 sends the "STOP-0" signal separately to the safety controller 38. Formation of the actual value and the plausibility check are conducted redundantly in the micro-computers 102, 120, with the micro-computer 102 working at a reduced recording rate. Recording every 32 periods corresponds to 32.times.132 .mu.s=4.2 ms (10 ms/Rev at 6,000 RPM max). The micro-computer 102 sends its actual values via the bus CAN_A, and the micro-computer 120 sends its actual values via the signal processor and the bus CAN_B to the safety controller 38, which checks the received values and acts as a safe comparison element. At the same time, the micro-computers 102 and 120, 128 conduct an internal cross-comparison via the DPRAM 130 and react in the case of errors by actuating the motor brake, activating the pulse block and sending the signal "STOP-0" via the buses CAN_A and CAN_B. It should be noted here that activation of the pulse blocks stops the motor more quickly than the safety controller 38.

In order to monitor the statistical offset between the transmitter and the engine shaft or to monitor a mis-adjustment of the resolver 48 as well as to monitor a dynamically controlled slippage between the resolver 48 and the engine shaft 148, a speed plausibility check is conducted. The speed plausibility check is also conducted redundantly in the micro-computers 102, 120. Both micro-computers 102, 120 send independently from each other the signal "STOP-0" to the safety controller 38 via the buses CAN_A or CAN_B in case of a responsive monitoring process. The speed plausibility check can only work properly if the status and speed control is active, i.e. during normal operation when the drive mechanism are turned on.

In a so-called "power down mode," i.e. the drive mechanisms have no operating voltage, a standstill check is conducted by the micro-computers 102, 120, by recording the actual values of the drive mechanisms. If a change to the actual values occurs that is beyond a set tolerance limit, a marker "machine asynchronous" is set in the micro-computers. The two asynchronous markers are sent to the safety controller 38 upon restarting and compared there.

Furthermore, a speed plausibility check is conducted in order to recognize a pole reversal in the direction on the drive mechanism. The sign of the target speed or status value is constantly compared with the sign of the actual speed or status value. If both signs are contrary over a defined period of time, one can proceed on the assumption that a reversed direction exists. Observation over a defined period of time is necessary to prevent that the monitoring process responds in the case of operational control fluctuations. The permissible control fluctuation must be defined.

In the case of a phase offset between the resolver 48 and the engine shaft 148 that is smaller than .+-.90.degree. as well as in the case of a dynamically uncontrolled slippage of the resolver on the motor shaft 148, a two-channel towing distance monitoring phase is triggered in the signal processor 128 as well as the micro-computer 102. At first, the actual status value is subtracted from the target status value (control deviation). After that, it is checked whether the determined control deviation is within the tolerance setting. When the tolerance range is exceeded, the micro-computer 102 and the signal processor 128 request the signal "STOP-0" from the safety controller 38. The towing distance examination is conducted in every status control cycle, which is preferably 2 ms.

Furthermore, internal error detection mechanisms are triggered in the micro-computer 102 and the micro-computer 120. The EOC signal of the analog-to-digital converter 114 is sent to the micro-computer 102 via two interrupt inputs 152, 154. The input 152 is fed the EOC signal directly, while the input 154 receives the EOC signal after it has passed the programmable divider 118, preferably at a division ratio of 1:32. During normal operation, only the input 154 is active. In the "power down mode" only the interrupt input 152 is active since the divider component 118 is idle in the "power down mode." During normal operation, the time between two operating system runs is preferably 2 ms, smaller than the time between two EOC signals, preferably 4 ms. If an EOC signal exists on the interrupt input 154, an interrupt routine is triggered, in which the following operations are conducted: First an interrupt marker is set, then a counter (value range 0 . . . 2000 ms) is read and memorized, and then the digital value that is fed via the bus 112 is read and stored. The operating system checks the interrupt marker in every run in order to see whether an interrupt had occurred before that. If no interrupt occurred, only an operating system cycle counter is incremented. If an interrupt occurred, however, the exact time between two EOC signals and thus the frequency is determined from the difference between the timer counter (up-to-date) minus timer counter (predecessor) and from the number of operating system cycles. Furthermore, the stored converted digital value is processed, and the operating system cycle counter, as well as the interrupt marker, are set to zero. If after a defined number of operating system runs no interrupt is recorded, one can proceed on the assumption that a hardware error exists in the central timer 138.

No frequency examination of the EOC signal occurs in the micro-computer 120, only the existence of the EOC signal is checked with a software watchdog. When the EOC signal arrives at the micro-computer 120, an interrupt occurs, thus winding an internal timer, which is decremented in a cyclical administrative part (waiting for interrupt) of the operating system and responds when the timer is at zero, i.e. when the EOC signal has failed. In this case, the pulse block is activated.

When the pulse block is activated, a control input of an IGBT part is taken back, thus making the drive mechanism "moment-free." For this control input, the driver signals of channel 52 and channel