System architecture for safety applications

Abstract

Control systems for industrial machinery (e.g., robots) or other devices such as medical devices utilize a safety processor (SP) designed for integration into safety applications and computational components that are not necessarily safety-rated. The SP monitors performance of the non-safety computational components, including latency checks and verification of identical outputs. One or more sensors send data to the non-safety computational components for sophisticated processing and analysis that the SP cannot not perform, but the results of this processing are sent to the SP, which then generates safety-rated signals to the machinery or device being controlled by the SP. As a result, the system may qualify for a safety rating despite the ability to perform complex operations beyond the scope of safety-rated components.

What is claimed is: 
     
         1 .- 26 . (canceled) 
     
     
         27 . A control system comprising:
 a sensor configured to produce a sensor output;   one or more non-safety computation modules each including a processor responsive to the sensor output and executing a safety analysis, each non-safety computation module producing control signals in response to detection of a safety condition by the safety analysis; and   a safety processor configured to receive the control signals from the one or more non-safety computation modules and generate therefrom safety-rated signals for controlling a device,   wherein the safety processor is incapable of executing the safety analysis.   
     
     
         28 . The control system of  claim 27 , wherein the safety processor is further configured to monitor performance of the one or more non-safety computation modules including latency checks and verification of identical outputs. 
     
     
         29 . The control system of  claim 27 , wherein the safety processor is further configured to monitor intermediate results or data structures and error-correcting codes thereof. 
     
     
         30 . The control system of  claim 27 , wherein the safety analysis includes execution of an algorithm with non-deterministic or varying run times. 
     
     
         31 . The control system of  claim 27 , wherein the sensor is a 3D time-of-flight camera. 
     
     
         32 . The control system of  claim 31 , wherein the one or more non-safety computation modules are configured to perform image capture from the time-of-flight camera data, identification, and classification in real time with low latency. 
     
     
         33 . The control system of  claim 31 , wherein the one or more non-safety computation modules are configured to analyze occupancy and occlusion of a monitored space by:
 generating a three-dimensional representation of the monitored space as a plurality of volumes;   for each sensor pixel having an intensity level above a threshold value, preliminarily marking as unoccupied volumes intercepted by a line-of-sight ray path through the pixel and terminating at an estimated distance from the sensor of an occlusion, marking as occupied the volumes corresponding to a terminus of the ray path, and marking as unknown any volumes beyond the occlusion along the ray path;   for each sensor pixel having an intensity level below the threshold value, preliminarily marking as unknown all voxels intercepted by a line-of-sight ray path through the pixel and terminating at a boundary of the monitored space; and   finally marking as unoccupied volumes that have been preliminarily marked at least once as unoccupied.   
     
     
         34 . The control system of  claim 31 , wherein the one or more non-safety computation modules are configured to evaluate safety conditions in a monitored space by:
 generating a three-dimensional representation of the monitored space as a plurality of volumes; and   generating a volumetric representation of all points reachable by movable machinery in the workspace within a specified time period.   
     
     
         35 . The control system of  claim 27 , wherein the device is at least one robot. 
     
     
         36 . The control system of  claim 27 , wherein each non-safety computation module is a dual-processor non-safety computation module. 
     
     
         37 . The control system of  claim 27 , wherein the one or more non-safety computation modules are configured to generate a 3D representation of a workcell monitored by the sensor. 
     
     
         38 . The control system of  claim 27 , wherein the safety analysis comprises speed and separation monitoring in accordance with at least one of ISO/TS 15066 or ISO 10218-2. 
     
     
         39 . The control system of  claim 27 , wherein the safety analysis comprises protective separation distance monitoring in accordance with at least one of ISO/TS 15066 or ISO 10218-2. 
     
     
         40 . The control system of  claim 27 , wherein the one or more non-safety computation modules are configured to receive latency tags issued by the safety processor. 
     
     
         41 . The control system of  claim 27 , wherein the safety processor is configured to generate and transmit latency tags to the sensor for return to the one or more non-safety computation modules with sensor outputs. 
     
     
         42 . The control system of  claim 41 , wherein the safety processor is configured to receive and analyze latency tags returned by the one or more non-safety computation modules to determine whether a duration associated with processing by the one or more non-safety computation modules exceeds a predetermined maximum interval. 
     
     
         43 . The control system of  claim 27 , wherein the safety processor is configured to receive and analyze intermediate values returned by the one or more non-safety computation modules to determine whether a processing error by the one or more non-safety computation modules has occurred. 
     
     
         44 . The control system of  claim 27 , wherein the one or more non-safety computation modules are not designed to comply with a safety standard. 
     
     
         45 . The control system of  claim 27 , wherein the control system qualifies for a safety rating despite comprising the one or more non-safety computation modules. 
     
     
         46 . The control system of  claim 27 , wherein the safety processor is configured to (a) transmit the safety-rated signals to a device controller configured to control the device and (b) receive state information from the device controller. 
     
     
         47 . The control system of  claim 46 , wherein the one or more non-safety computation modules are configured to transmit only non-safety-rated signals to the device controller. 
     
     
         48 . The control system of  claim 27 , wherein the safety processor is configured to transmit the safety-rated signals to a device controller configured to control the device, and the one or more non-safety computation modules are configured to transmit only non-safety-rated signals to the device controller. 
     
     
         49 . The control system of  claim 27 , wherein the one or more non-safety computation modules comprise a plurality of non-safety computation modules. 
     
     
         50 . The control system of  claim 49 , wherein each non-safety computation module is configured to process a separate sensor channel.