The present invention relates to a safety controller for failsafe control of safety-critical processes, and more particularly to a safety controller for failsafe disconnection of a machine or machine system. The invention also relates to a method for loading or transferring a new operating program onto such a safety controller.
For the purposes of the present invention, a safety controller is a device or combination of devices connected to each another, which receive process signals from sensors of a machine or machine system and which use these signals to produce output signals by means of logic operations and, if appropriate, by means of further signal or data processing steps. The output signals are supplied as control signals to actuators which carry out specific actions or reactions in the machine or machine system. One preferred field of application for safety controllers is in the field of machine safety, namely monitoring of emergency stop buttons, two-hand controllers, guard doors, light curtains, stationary or rotary condition monitors and the like. Sensors such as these are used, for example, in order to safeguard a machine which otherwise might cause a hazard to the operator. When the guard door is opened or when the emergency stop button is operated, a process signal is produced which is supplied as an input signal to the safety controller. In response to the input signal, the safety controller switches off the dangerous part of the machine in a failsafe manner, by means of a connected actuator.
A characteristic feature of a safety controller in contrast to a “normal” controller is that the safety controller must always ensure that the process (such as the dangerous machine) being controlled is in a safe state. This requirement even applies when a malfunction occurs within the safety controller or in a device which is connected to it. Safety controllers are therefore subject to extremely stringent requirements for their own failsafety, which results in considerable additional effort during development and manufacture. Generally, safety controllers require special licensing from responsible supervisory authorities before they are used, such as, in Germany for example, from the professional societies dealing with work safety or from a technical supervisory association. The safety controller must comply with specific safety standards which are defined, such as defined in European Standard EN 954-1. The present invention takes account of these special requirements. The expression “safety controller” therefore in this case relates only to a device or a combination of devices which are approved for the control of machines, machine systems and the like in accordance with at least Category 3 of the above-mentioned European Standard.
A programmable safety controller offers the user the capability of individually defining, in accordance with his requirements, the logical operations on the input signals with the aid of software, specifically the so-called user program. A programmable safety controller thus replaces the previously normal wiring to the individual sensors with the aid of logic switching elements. In order to make it possible to carry out this function, a programmable safety controller has an operating program which is separate from the user program and which defines the basic functional scope of the safety controller. In particular, the operating program contains program code by means of which the hardware components of the safety controller are addressed directly and are thus “brought to life”.
Furthermore, safety control rules are also generally implemented in the operating program, which the user program calls up as prepared functional modules and which the user can configure by means of input and output signals at any given time. For example, prepared functional modules for failsafe evaluation of a two-channel emergency-stop button or of a two-channel guard door might be contained in the operating program. In the user program, the user can now only define how the provided modules, i.e. the emergency stop button and the guard door, should be logically linked to one another.
For safety reasons, the user has no access to the operating program, i.e. he can neither replace nor modify the operating program. In the art, the operating program is often referred to as firmware.
WO 98/44399 discloses a method for programming a safety controller in which the safety control rules are stored in the safety controller in the form of functional modules. By means of his user program, the user can select the functional modules, he can configure them and he can logically link them to one another. This is done by means of a programmer, with which the commands for selection, configuration and logic operations on the functional modules are transferred to the safety controller. As explained above, however, it is impossible for the user to access the safety control rules implemented in the functional modules, i.e. he can neither replace them nor modify them.
The inhibited access to the operating program corresponds to the well accepted practice for safety controllers, since the operating program in conjunction with the hardware of the safety controller are subject to licensing by the responsible supervisory authorities. If it were possible for the user to access the combination of hardware and operating program, the manufacturer of the safety controller would not be able to guarantee the failsafety in accordance with the verified certification, according to the general opinion.
However, the common practice has the disadvantage that a functional change in the operating program of the safety controller can be carried out only by the manufacturer of the safety controller himself. If a functional change or an update is desired in the operating program, the user must either send the safety controller to the manufacturer or must request specialist or approved servicing personnel from the manufacturer. This is inconvenient and expensive and, furthermore, may also be disadvantageous in terms of shutdown times for the machine system in which the safety controller is used.
When no safety factors are involved, such as in the case of commercially available personal computers, it is common practice that a user can carry out software updates on his own responsibility by obtaining new software from the manufacturer and loading it onto the personal computer, possibly after instruction. This also applies to so-called operating systems which represent an operating program in the sense of the present invention. According to well established opinion, however, such a procedure is not feasible for safety applications because this would result in the manufacturer of the safety controller losing sole control over the combination of hardware and operating program. In consequence, unchecked combinations of hardware and operating programs would be possible, which would represent a safety risk.