Configurable safety system for implementation on industrial system and method of implementing same

CROSS-REFERENCE TO RELATED APPLICATIONS

0001This application claims the benefit of U.S. provisional patent application No. 60/394,976, which was filed on Jul. 9, 2002, and also claims the benefit of U.S. provisional patent application No. 60/442,847, which was filed on Jan. 24, 2003.

FIELD OF THE INVENTION

0002The present invention relates to industrial systems that employ industrial controllers, safety interlocks and other components to provide for high reliability and safety-enhanced operation of the industrial systems.

BACKGROUND OF THE INVENTION

0003Industrial systems commonly include multiple subsystems and components such as power motion devices (e.g., robots), maintenance access interfaces/points (e.g., gateboxes), operator access points (e.g., operator stations), etc., which can be arranged in one or more stations of the overall system to perform industrial processes. Industrial systems can be highly productive when operating properly, but also typically include hazards that have the potential to cause damage to equipment or product losses and to create safety risks. Such hazards can include, for example, motion-related hazards, thermal hazards, chemical hazards or radiation hazards. Consequently, it is desirable that industrial systems be operated properly and, in particular, that industrial systems be designed and operated in manners that reduce or limit the exposure of persons, equipment, products and the environment to such hazards.

0004For the above reasons, industrial systems often include precautionary or “safety” systems that control or guide the industrial systems to operate in manners that reduce the risks of equipment damage, product losses, and exposure of operators to safety hazards, that enhance the reliability of the industrial systems, and that assist in identifying the failures when they occur. Often, such safety systems are designed to continue to operate properly even with a system failure, such that the industrial systems (or at least the safety systems themselves) continue to operate in safety-enhanced modes.

0005To attain these goals of safety-enhancement, reliability, easy failure detection, and robustness of the safety systems in spite of failures, the safety systems employed in modern industrial systems often employ a variety of safety-related components. In particular, the safety systems commonly include safety-enhancing devices such as safety interlocks (e.g., emergency-stop buttons, light curtains, etc.). One or more such safety interlocks or other safety-enhancing devices can be implemented on the individual system components within the industrial system to form safety subsystems of the industrial system. Additionally, the safety systems often include complicated hardware controls (e.g., relay circuits) or software programs that are executed on system control devices, which control and monitor the operation of the safety systems.

0006Industrial systems often employ one or more standard industrial controllers such as programmable logic controllers (PLCs) to perform control, monitoring and diagnostic functions. While it is commonly the case that industrial systems include a central or main industrial controller that is in communication with other system components, other industrial systems employ multiple industrial controllers that can (but need not) be located within various system components, among which various functions are distributed. Regardless of their location within industrial systems, industrial controllers can be designed or programmed to perform specifically safety-related control and monitoring functions. The industrial controllers also can be in communication with one or more human/machine interfaces (HMIs) such as computer screens, by which safety-related and other status and operational information can be communicated to a human operator and by which the operator can provide commands to the system.

0007A typical industrial controller includes a microprocessor sequentially executing instructions of a control program stored in electronic memory to read and write control values to an input/output (I/O) table. The basic functions of the microprocessor in executing the control program and scanning the I/O table are performed by an operating system (OS) program. Industrial controllers can be programmed in a variety of computer languages, including “relay ladder language” or “ladder logic format” in which instructions are represented graphically by rungs composed of “normally-open” or “normally-closed” contacts connected in series or parallel to “coils” of relays (another computer language that can be employed, for example, is function block language). The contacts represent inputs from the controlled process and the coils represent outputs to the controlled process. This graphical language mirrors early industrial control systems which used actual relays to provide the control logic needed to control machinery or a factory.

0008Although industrial controllers are effective in providing reliability and safety, it is often difficult and costly to implement safety systems by way of industrial controllers within industrial systems. Industrial systems, and the stations within those systems, can vary significantly in terms of the numbers and types of system components and safety-enhancing devices, including safety subsystems and safety interlocks, that are employed. Given this variety in the features of industrial systems, the safety control programs for industrial controllers typically must be custom-written for the particular industrial systems within which the industrial controllers are intended to operate. This custom-writing of safety control programs can become expensive as new safety control programs are repeatedly written for new industrial systems.

0009Additionally, the safety control programs for the industrial controllers of an industrial system generally increase in complexity with the complexity of the industrial systems for which the control programs are intended, which depends upon (among other things) the number of safety-enhancing devices employed in the industrial systems and the number of different types of safety-enhancing devices that are employed. In particular, the safety control program(s) for a main industrial controller, which typically is in communication with all or most of the other components of an industrial system, can be particularly complicated to write so that proper control, monitoring, diagnostics, etc. of the industrial system and its safety-enhancing devices are performed and so that appropriate safety status information is made available to operators. The complexity of the safety control programs further exacerbates the costs associated with writing those programs and implementing safety systems using such programs.

0010Therefore, it would be advantageous if a new system could be developed, for implementation as part of an industrial system, for controlling and monitoring the components of the industrial system in a reliable, safety-enhanced manner, where the new system was relatively easy and inexpensive to implement. In particular, it would be advantageous if the new system was capable of being easily and inexpensively implemented in a variety of industrial systems having different numbers and types of safety-enhancing devices that are employed to manage or reduce the risks associated with various hazards such as motion-related hazards, thermal hazards, chemical hazards or radiation hazards. Further, it would be advantageous if the new system facilitated the communication of safety status information to operators and other systems and was capable of being implemented largely through the use of, and in conjunction with, standard components.

BRIEF SUMMARY OF THE INVENTION

0011The present inventor has recognized that, although many industrial systems vary significantly in terms of the numbers and types of safety-enhancing devices employed by the systems, it is nevertheless often possible to identify a generic industrial system having maximum or “worst case” numbers of safety-enhancing devices of most (if not all) types of such devices. Therefore, it is also possible to create a master safety control program for the main industrial controller of such a generic industrial system, which would be capable of operating the generic industrial system in a reliable, safety-enhanced manner. Further, once such a master safety control program has been developed, the program can be configured for operation with respect to a specific industrial system by loading that program onto an industrial controller that has operator-settable (or automatically-settable) configuration inputs by which an operator (or automatic system) can indicate the absence (or presence) of particular safety-enhancing devices from the specific industrial system.

0012Upon receiving such configuration information, the industrial controller can validate that the configuration information is correct by communicating with the specific safety-enhancing devices of the industrial system to verify the supposed differences between the specific industrial system and the generic industrial system. The industrial controller then can automatically configure or tailor the master safety control program into a configured master safety control program for operating the specific industrial system in a reliable, safety-enhanced manner. The configuration typically involves relatively minor adjustments to the master safety control program, such as modifying certain data used by the master safety control program, modifying the status of certain status indicators (e.g., bits or contacts) in the program, etc. Once the master safety control program has been configured, the configured master safety control program can be enabled to operate the specific industrial system and, further, the features of and information generated by the configured master safety control program regarding the statuses of the various safety-enhancing devices can be the basis for monitoring, diagnostic, visualization and other information displayed on a human/machine interface (HMI).

0013In particular, the present invention relates to a control system in an industrial system having a first safety subsystem. The control system includes at least one control device capable of controlling operation of at least a portion of the industrial system including the first safety subsystem, where the at least one control device includes a memory in which is stored a configured safety control program, and at least one input mechanism by which the at least one control device has received a configuration input. The configured safety control program is based upon a master safety control program that has been configured in response to the configuration input. Further, the safety controller operates based upon the configured safety control program after the configuration input has been validated.

0014Additionally, the present invention relates to a safety system including means for providing safety control with respect to at least one safety subsystem of an industrial system. The means for providing safety control is capable of communication with the at least one safety subsystem of the industrial system. Additionally, the means for providing safety control includes a memory on which is stored a safety control program. Further, the means for providing safety control includes a configuration mechanism in response to which a master safety control program was configured to become the configured safety control program. Additionally, the means for providing safety control began operation in accordance with the safety control program only after the means for providing safety control validated information provided by the configuration mechanism with respect to the at least one safety subsystem.

0015Further, the present invention relates to a method of configuring an industrial control system to operate a particular industrial system having a plurality of safety subsystems in a safe manner. The method includes storing, onto a safety controller, a master safety control program capable of being used to operate a generalized industrial system having a maximum number of safety subsystems of a first type. The method additionally includes receiving, at the safety controller, at least one configuration input indicative of at least one of a presence and an absence of a safety subsystem of the first type and validating, by way of a communication between the safety controller and another component of the industrial system, information indicated by the at least one configuration input. The method further includes automatically modifying the master safety control program to generate a configured master safety control program capable of being used to operate the particular industrial system in a safety-enhanced manner, and activating the safety controller for operation in accordance with the configured master safety control program.

BRIEF DESCRIPTION OF THE DRAWINGS

0016<figref idref="DRAWINGS">FIG. 1</figref> is a schematic diagram showing an exemplary generic industrial system that includes a configurable safety system in accordance with an embodiment of the present invention;

0017<figref idref="DRAWINGS">FIG. 2</figref> is a flow chart showing exemplary steps for implementing a configurable safety system in relation to a specific industrial system that falls within the bounds of a generic industrial system such as that shown in <figref idref="DRAWINGS">FIG. 1</figref>;

0018<figref idref="DRAWINGS">FIG. 3</figref> is an exemplary control module having exemplary configuration mechanisms, which is employed to implement a configurable safety system in accordance with an embodiment of the present invention;

0019<figref idref="DRAWINGS">FIG. 4</figref> is a signal flow diagram showing the communication of information during operation of one embodiment of a configurable safety system of the type discussed with reference to <figref idref="DRAWINGS">FIGS. 1-3</figref>;

0020<figref idref="DRAWINGS">FIG. 5</figref> shows in schematic form the operation of a control device (for example, the safety controller of <figref idref="DRAWINGS">FIG. 1</figref>) in validating configuration information and, upon validating such information, providing commands to configure a master safety control program in accordance with the validated configuration information;

0021<figref idref="DRAWINGS">FIG. 6</figref> shows portions of an exemplary master safety control program in ladder logic format that, in one embodiment of the present invention, could be used to implement a configurable safety system in relation to an exemplary set of industrial systems, where the master safety control program includes exemplary features by which the master safety control program can be configured to become one or more configured master safety control programs in response to commands such as those of <figref idref="DRAWINGS">FIG. 5</figref>; and

0022<figref idref="DRAWINGS">FIGS. 7</figref>, <b>8</b> and <b>9</b> are exemplary screens of a human/machine interface (HMI) of an exemplary industrial system, which display information relating to a configurable safety system implemented with respect to the industrial system.

DETAILED DESCRIPTION OF THE INVENTION

0023Referring to <figref idref="DRAWINGS">FIG. 1</figref>, an exemplary station or area <b>10</b> of an exemplary industrial system <b>5</b> includes a main control panel <b>20</b> that is coupled to and in communication with a plurality of safety subsystems <b>30</b> as well as a human/machine interface (HMI) <b>40</b>. Additionally, as shown, the main control panel <b>20</b> can be (but need not be) coupled to other stations of the industrial system such as a previous station <b>50</b> and a next station <b>60</b>, as well as to an overall plant information system <b>70</b>. The particular safety subsystems <b>30</b> of station <b>10</b> are shown to include robots <b>80</b>, gateboxes <b>90</b>, and operator stations <b>100</b>, although in alternate embodiments the types of safety subsystems could vary from those shown. For example, the robots <b>80</b> are representative of a variety of different types of power motion devices such as motors, conveyors, etc., the gateboxes <b>90</b> are representative of a variety of different types of maintenance access interfaces/points, and the operator stations <b>100</b> are representative of a variety of different types of operator access points, any of which could constitute safety subsystems <b>30</b>. Additionally, in certain embodiments, the safety subsystems <b>30</b> can be higher-level combinations of lower-level safety subsystems, for example, one of the robots <b>80</b> in combination with one of the gateboxes <b>90</b>. Also, in alternate embodiments, the main control panel <b>20</b> can be coupled to other system components (not shown) that are not safety subsystems.

0024In accordance with an embodiment of the present invention, the main control panel <b>20</b> includes a standard controller <b>110</b> that is coupled to and in communication with a safety controller <b>120</b> by any communication mechanism (for example, a serial communication link). The safety controller <b>120</b> in turn is coupled to and in communication with the various safety subsystems <b>30</b> as well as with the other stations <b>50</b>,<b>60</b> and the plant information system <b>70</b>. The standard controller <b>110</b> is also coupled to the safety subsystems <b>30</b>, stations <b>50</b>,<b>60</b> and system <b>70</b> by way of the safety controller <b>120</b>. The safety controller <b>120</b> can be in communication with the safety subsystems <b>30</b>, stations <b>50</b>,<b>60</b> and information system <b>70</b> (and any other relevant components) by way of any communication protocol and/or mechanism including, for example, the Ethernet and a conventional signal router or discrete wiring to safety I/O. Additionally, the standard controller <b>110</b> is coupled to and in communication with the HMI <b>40</b>. The standard controller <b>110</b>, as well as other programmable electronic devices of the industrial system <b>5</b> can also be referred to as programmable electronic systems (“PES”), and the safety controller <b>120</b> can also be referred to as a safety programmable electronic system (“safety PES” or “SPES”).

0025The safety controller <b>120</b> is designed to assist the standard controller <b>110</b> in controlling and monitoring the operation of the industrial station <b>10</b>/system <b>5</b>. Specifically, the safety controller <b>120</b> operates in conjunction with the standard controller <b>110</b>, the safety subsystems <b>30</b> and the HMI <b>40</b> (and potentially other components of the system <b>5</b> as well) to form a safety system that operates to enhance the overall safety of the industrial station <b>10</b>/system <b>5</b>. The safety system is designed to operate the industrial station <b>10</b> in a manner that reduces or limits the exposure of persons, equipment, products and the environment to hazards that are present in the industrial station.

0026In a typical manufacturing safety system, the safety system is further designed so that the safety-enhancing operations and features of the safety system continue to operate properly even in the event of a system failure, such that the safety system is fault tolerant and robust (in other safety environments, different degrees of fault tolerance can be appropriate). Further, the safety system generally serves to enhance the reliability of the industrial station <b>10</b>/system <b>5</b> and assists the standard controller <b>110</b> in identifying or capturing faults/failures. In some systems, the safety system also may assist the standard controller <b>110</b> in controlling the overall industrial station <b>10</b>/system <b>5</b> in a maimer that is fault tolerant.

0027Despite the above, the use of the terms, “safety”, “safety system”, “safety controller”, and other related terms as used herein is not a representation that the present invention will make an industrial process safe or that other systems will produce unsafe operation. Safety in an industrial process depends on a wide variety of factors outside of the scope of the present invention including, for example: design of the safety system; installation and maintenance of the components of the safety system; the cooperation and training of individuals using the safety system; and consideration of the failure modes of the other components being utilized. Although the present invention is intended to be highly reliable, all physical systems are susceptible to failure and provision must be made for such failure.

0028In one embodiment, as shown in <figref idref="DRAWINGS">FIG. 1</figref>, the safety controller <b>120</b> can be a programmable logic controller (PLC) such as the GuardPLC, and the standard controller <b>110</b> can be a PLC such as the ControlLogix PLC, both of which are manufactured by Rockwell Automation of Milwaukee, Wisconsin. The standard controller <b>110</b> can be in communication with the HMI device <b>40</b> by way of any particular communication protocol including, for example, the ControlNet communication protocol commonly used by the aforementioned PLCs, also offered by Rockwell Automation. Also, the HMI <b>40</b> can be a PanelView HMI, further manufactured by Rockwell Automation. The controllers <b>110</b> and <b>120</b> can be, in addition to PLCs, any type of appropriate control device including microprocessors, microcomputers, programmable logic devices (PLDs), etc.

0029In some alternate embodiments, the functions of the safety controller <b>120</b> and the standard controller <b>10</b> can be performed by a single control device, including a control device that is not located at a “central” station but rather is located at a “peripheral” component such as one of the safety subsystems <b>30</b>. Although in the present embodiment the programs controlling the functions of the safety controller and standard controller <b>110</b> are separate and distinct, it is possible for the programs to be integrated (or largely integrated) with one another in alternate embodiments. Further, in some alternate embodiments, the functions of the safety controller <b>120</b> and the standard controller <b>110</b> can be performed by multiple (even more than two) control devices at multiple locations, and/or their functions can be distributed around multiple control devices, which themselves can be (but need not be) autonomous devices.

0030The industrial system <b>5</b> of <figref idref="DRAWINGS">FIG. 1</figref> is intended to show an exemplary generic industrial system having multiple stations or areas, although any given industrial system could have one or more such stations or areas. Also, the station <b>10</b> of <figref idref="DRAWINGS">FIG. 1</figref> is intended to show an exemplary generic station or area of the generic industrial system <b>5</b>. The station <b>10</b>, in the embodiment shown, only includes safety subsystems <b>30</b> of the types shown, where the number of each type of safety subsystem in the station is within the bounds prescribed by the station. That is, the station <b>10</b> is a generic station having a main control panel <b>20</b> that is in communication with up to n robots <b>80</b>, m gateboxes <b>90</b>, and p operator stations <b>100</b>. Thus, the station <b>10</b> is intended to represent not only a station that has n robots, m gateboxes and p operator stations, but also a station that includes, for example, only a single robot and no other safety subsystems.

0031By safety subsystems <b>30</b>, in particular, it is meant that the various subsystems have particular devices that are designed to provide safety-enhancing functionality, including functionality that improves system reliability, fault identification and robustness, and that may also include fault tolerance depending upon the application requirements. Such functionality can include, for example, functionality causing the industrial station <b>10</b>/system <b>5</b> to operate in a manner that reduces the exposure of an operator, equipment, products or the environment to hazards. For example, a safety subsystem could be configured to enter a safe mode of operation (e.g., shut down operation of relevant hazards) if it was determined that an operator had moved out of a specific safe region (as determined by a light screen or other safety interlock). Also, the functionality can relate to maintaining or adjusting the functionality of the safety system upon the occurrence of a system fault or failure. For example, a safety subsystem might provide a safety indication light or noise or HMI indication upon determining that a safety subsystem component was no longer operating within its normal operating range.

0032The specific safety-enhancing devices of a safety subsystem can include, for example, safety-related interlocks such as emergency-stop (“e-stop”) interlocks, perimeter guarding interlocks and zero speed interlocks, among others. That is, for example, each of the robots <b>80</b> could include an emergency-stop button that, if pressed by an operator, would prevent the robot from continuing to operate, and each of the operator stations <b>100</b> could include a light screen, such that if the operator is detected to have left the particular station, the station would be shut down. (Any given system component such as a robot also can have more than one safety-enhancing device or interlock.) Typically, the safety subsystems <b>30</b> also include their own individual safety-type control devices such as PLCs and/or I/O devices that are in communication with the main control panel <b>20</b>.

0033The present invention in particular relates to a configurable safety system that can be implemented with respect to a variety of specific stations of specific industrial systems, so long as those specific stations fall within the bounds of a particular generic station/industrial system. That is, for example, the present invention relates to a configurable safety system that could be implemented with respect to various specific stations/industrial systems within a class of stations/systems as represented by the generic station <b>10</b>/system <b>5</b> shown in FIG. <b>1</b>. In certain embodiments, the configurable safety system is based on a programmable electronic system that includes the safety controller <b>120</b> of a specific industrial system and one or more programs that are designed for applicability to a generic station/industrial system that encompasses the specific industrial system on which the program(s) are being implemented. Once loaded onto the safety controller <b>120</b>, the program(s) can be specifically configured to operate in conjunction with the specific safety-enhancing devices of that specific station/industrial system.

0034Referring to <figref idref="DRAWINGS">FIG. 2</figref>, exemplary steps for implementing such a configurable safety system with respect to a specific industrial system/station are shown. First, at step <b>200</b>, a master safety control program is designed. This step <b>200</b> involves the creation of a generalized program (or programs) that is applicable to a class of possible specific industrial systems/stations, all of which fall within the bounds of a particular generic industrial system/station, for example the system <b>5</b>/station <b>10</b> of FIG. <b>1</b>. The design of the master safety control program in particular includes a first substep <b>202</b>, in which the particular classes of safety subsystems that can occur within the generic industrial system/station are identified.

0035For example, the specific industrial systems represented by the generic station <b>10</b> of <figref idref="DRAWINGS">FIG. 1</figref> can include robots <b>80</b>, gateboxes <b>90</b>, or operator stations <b>100</b> as safety subsystems <b>30</b>. In other situations, different types of safety subsystems could be present such as motor controllers, operator load stations, maintenance entry points, mechanical handling systems or transfer systems (not shown). Also, there can be two or more classes of safety subsystems for systems that are nevertheless quite similar. In particular, every member of a given class of safety subsystem must share in common the same safety-enhancing devices/safety interlocks and, to the extent that two similar safety subsystems do not share the same safety-enhancing devices/safety interlocks, those two subsystems fall into different classes. For example, a robot having only an e-stop button would be in a different class of safety subsystem than a robot having both an e-stop button (input) and a contactor (output).

0036Next at a second substep <b>204</b>, the particular safety-enhancing devices or safety interlocks that can exist within/be produced by each of the safety subsystems are identified. As shown in substep <b>204</b>, the safety-enhancing devices typically are safety-related interlocks, for example, e-stop interlocks, perimeter guarding interlocks, and zero speed interlocks. However, other types of safety-related interlocks and other types of safety-enhancing devices are also possible, and each safety subsystem <b>30</b> or system component within a given safety subsystem (e.g., a single robot) can employ one or more of such safety-enhancing devices. Every safety subsystem has at least one safety-enhancing device/safety interlock, and every safety subsystem of a given class has the same safety-enhancing device(s)/interlock(s) as every other safety subsystem of that class. The safety-enhancing device(s)/interlock(s) can also be understood as safety input/output information.

0037Next, at a third substep <b>206</b>, maximum quantities of the identified safety subsystems <b>30</b> (and/or, in alternate embodiments, maximum quantities of the identified safety-enhancing devices) that could occur in the accordance with the generic industrial system/station are determined. With such information, limits are set on the complexity of the industrial systems/stations to which the master safety control program is applicable, and thus bounds are set on the complexity of the master safety control program itself. For example, with respect again to <figref idref="DRAWINGS">FIG. 1</figref>, the maximum number of robots <b>80</b> that could be included within a specific industrial station falling within the class determined by the generic station <b>10</b> is n, the maximum number of gateboxes <b>90</b> that could be included within a specific industrial station falling within the class determined by the generic station is m, and the maximum number of operator stations <b>100</b> that could be included within a specific industrial station falling within the class determined by the generic station is p.

0038Then, at a fourth substep <b>208</b>, safety system configuration mechanism or mechanisms are specified. These mechanism(s) are the hardware and/or software switches or inputs that can be set by an end user (or set automatically) when the master safety control program is implemented (or “instantiated”) at a specific industrial station. Such safety system configuration mechanisms can include hardwired jumpers on one or more of the controllers of the industrial system/station, key switches wired to components of the industrial system/station, software operations, configuration files, programs or appropriate configuration setting mechanisms. In some embodiments, the safety system configuration mechanisms are coded, to reduce the overall number of configuration inputs that are required in order to configure the system-that is, instead of employing a given number x of configuration mechanisms to provide x configuration inputs representing the status of x safety subsystems, a lesser number y of configuration mechanisms could be used, where the y configuration mechanisms were indicative of the statuses of the x safety subsystems. For example, instead of employing 7 uncoded hardwired jumpers to indicate of the statuses of 7 robots, three coded hardwired jumpers could be used, where the Boolean value of the three configuration inputs provided by the three jumpers would be representative of how many of the 7 robots were present (e.g., a value of 011 would indicate that three robots were present).

0039In certain embodiments such as that shown in <figref idref="DRAWINGS">FIG. 1</figref>, the primary hardware component of the configurable safety system is the safety controller <b>120</b>. As shown in <figref idref="DRAWINGS">FIG. 3</figref>, certain embodiments of the safety controller <b>120</b> such as those employing the GuardPLC controller are configurable by way of hardwired junipers such as jumpers <b>212</b>,<b>214</b> and <b>216</b>, which in the embodiment shown in <figref idref="DRAWINGS">FIGS. 1 and 3</figref> respectively are jumpers corresponding to one of the robots <b>80</b>, one of the gateboxes <b>90</b>, and one of the operator stations <b>100</b>. By connecting (or not connecting) such jumpers between appropriate terminals on the safety controller <b>120</b>, indications are provided to the safety controller as to what safety subsystems <b>30</b> (or safety-enhancing devices) are supposedly included within the specific industrial system/station on which the configurable safety system is being implemented. Depending upon the embodiment, the hardwired jumpers <b>212</b>,<b>214</b> and <b>216</b> can be coded hardwired jumpers (as discussed above) or uncoded hardwired jumpers.

0040Further, the step <b>200</b> includes a fifth substep <b>210</b> in which a validation mechanism (or multiple validation mechanisms) for the safety configurations are identified. The validation mechanism(s) will determine if the configurations that are specified in fact match the safety subsystems (or safety-enhancing devices) that are present in the specific industrial system/station on which the configurable safety system is being implemented. That is, once the master safety control program created in step <b>200</b> is implemented in a specific industrial system/station, the configurations are checked or validated before the industrial system/station is allowed to operate, and before the master safety control program is configured to become a configured master safety control program tailored to the specific industrial system/station. Possible validation mechanisms include, but are not limited to, comparisons of configuration requests with existent safety subsystems via active I/O, receipt of appropriate “active”, “exists” or “alive” signals from the existent safety subsystems, or other authentication or detection mechanisms.

0041Once the substeps <b>202</b>-<b>210</b> have been performed, the characteristic features and limitations of the generic industrial system/station are known, and thus a master safety control program can be created. Depending upon the application, the master safety control program can exist in any of a variety of formats, such as ladder logic format, as discussed below with reference to FIG. <b>5</b>. Given such a master safety control program for a given generic industrial system/station, the master safety control program can then be implemented in a variety of specific industrial systems/stations that fall within the class of industrial systems/stations determined by the generic industrial system/station.

0042Referring still to <figref idref="DRAWINGS">FIG. 2</figref>, the subsequent steps of the process relate to implementation of the configurable safety system in a specific industrial system/station. At step <b>220</b>, a specific design of a specific industrial system/station is determined by either a machinery/process designer or a manufacturing operation/maintenance manager or engineer. This typically occurs either as part of the design of a new industrial facility or the modification of an existing industrial facility. Once the particular design of the specific industrial system/station has been determined, then that system/station can be built at step <b>230</b> and, upon its completion, started up at step <b>240</b>. In alternate embodiments, steps <b>220</b> and <b>230</b> associated with the designing and building of a specific industrial system/station need not be performed, e.g., in cases where existing systems are simply being upgraded.

0043Upon the specific industrial system/station being started up at step <b>240</b>, the master safety control program is loaded onto (stored within memory of) the safety controller <b>120</b>. Then, at step <b>250</b>, the particular design of the specific industrial system/station is confirmed by initial operation of the master safety control program. Confirmation involves two substeps <b>252</b> and <b>254</b> of configuration and validation, respectively. Thus, at substep <b>252</b>, the appropriate safety system configuration mechanisms (e.g., jumpers <b>212</b>, <b>214</b>, <b>216</b>) are actuated to conform to the attributes of the specific industrial system/station. Further, at substep <b>254</b> of step <b>250</b>, the particular configuration is validated. As discussed above, typically the master safety control program will have been designed for implementation by way of particular configuration and validation mechanisms, although in alternate embodiments these need not be specified during the master design (step <b>200</b>).

0044Finally, at step <b>260</b>, the safety controller <b>120</b> automatically configures the master safety control program in accordance with the validated configuration information to produce the configured master safety control program. Once configuration has taken place, the safety controller <b>120</b> can appropriately operate the configured master safety control program with respect to the specific industrial system/station, which in turn also results in modifications to the HMI <b>40</b> and/or to other relevant monitoring, diagnostic and visualization systems. Thus, at this time, the overall industrial system/station with its newly-configured safety system is ready for operation.

0045In the embodiment of <figref idref="DRAWINGS">FIG. 1</figref>, overall control and monitoring of the specific industrial system/station during operation will be exercised by the standard controller <b>110</b>. At the same time, the safety controller <b>120</b> provides a more active role along with the standard controller <b>110</b> in providing control and monitoring relating to the operation of the safety system. Further, regardless of the degree of actual control exercised by the safety controller <b>120</b>, the configured master safety control program provides information that is used by the standard controller <b>110</b> and the HMI <b>40</b> for the purposes of monitoring, controlling and interacting with the various safety subsystems <b>30</b> and other system components. As discussed above, in alternate embodiments, the control/monitoring functionality of the standard controller <b>110</b> and safety controller <b>120</b> can be performed by a single controller or distributed over multiple controllers other than strictly the controllers <b>110</b>,<b>120</b>.

0046The framework of the configured master safety control program can be used by the standard controller <b>110</b> as a framework by which it in turn provides communication signals to the HMI <b>40</b> for the display of information concerning the operation of the industrial system/station. Indeed, the configuration of the HMI <b>40</b> itself (as well as that of other relevant monitoring, diagnostic and visualization devices) is based upon the configured master safety control program. In particular, the safety subsystems <b>30</b> (or safety-enhancing devices) of the industrial system/station and the safety statuses of those safety subsystems (or safety-enhancing devices) can be easily displayed by the HMI <b>40</b>. Thus, monitoring, diagnostic and visualization information is available to operators or other users, who based upon that information can also then input control commands at the HMI <b>40</b> in response thereto.

0047The communication of safety-related information within a specific industrial station falling within the class of the generic industrial station <b>10</b> of <figref idref="DRAWINGS">FIG. 1</figref> (or similar industrial systems or stations) in at least some embodiments occurs as shown in FIG. <b>4</b>. As shown, the initial safety-related information is configuration information provided by configuration mechanism(s) <b>350</b>, that is, information that various configuration mechanisms have been actuated, e.g., that certain jumpers activating configuration inputs have been connected to the safety controller <b>120</b>, or other maintenance-only configuration inputs such as trapped key, software tools, etc. have been activated. This information is supplied by the physical or software inputs provided by an operator or a system as the configuration mechanism(s), and is provided directly to the safety controller <b>120</b> (although in alternate embodiments this information can be provided indirectly, or to other control devices).

0048The information from the configuration mechanism(s) <b>350</b> is used internally by the safety controller <b>120</b> as part of its validation mechanism(s) <b>360</b>. The validation mechanism(s) <b>360</b> of the safety controller <b>120</b>, in addition to receiving the configuration mechanism information, also receive information back from the safety subsystems <b>30</b> and determine whether the supposedly-active nodes indicated by the configuration mechanism(s) <b>350</b> in fact match the active nodes of the safety subsystems <b>30</b>. Additionally, information can be provided to the safety subsystems <b>30</b> from the validation mechanism, and in particular the resolved configuration (confirmation of the configuration information) defines execution of safety controller code on those safety subsystems <b>30</b> and the enablement of those subsystems. Further, the resolved configuration can be supplied (by way of a schematic pathway <b>365</b>) to the standard controller <b>110</b>, the HMI <b>40</b> and other system devices (e.g., the plant information system <b>70</b>) so that monitoring, diagnostics and visualization tools <b>380</b>, <b>390</b> and <b>400</b>, respectively, are automatically configured to reflect the features of the specific industrial system.

0049Once the validation mechanism(s) <b>360</b> are satisfied that the configuration mechanism(s) <b>350</b> properly reflect which of the safety subsystems <b>30</b> exist and are in operation, that information is provided to a master safety system <b>370</b>, which is the master safety control program as it first enters operation upon the starting-up of the specific industrial system/station. The master safety system <b>370</b> from this point onward is in communication with the safety subsystems <b>30</b> as the industrial system/station operates. Upon the configuration information being validated, the master safety system <b>370</b> configures the master safety control program to arrive at the configured master safety control program, which is tailored to the specific industrial system/station. The configuration process typically requires only minor modifications of the master safety control program (e.g., changing the status of certain data or reference points to which the program refers), rather than a more involved rewriting of significant portions of the program code or recompiling of the code. This can include a single point configuration reference such as indexed addressing or other technologies. In the form of the configured master safety control program, the master safety system <b>370</b> then interacts with the other system devices. In particular, the master safety system <b>370</b> interacts with the safety subsystems <b>30</b> for the purposes of, for example, obtaining safety status information and sending control signals to those subsystems. Also, the master safety system <b>370</b> interacts (by way of a pathway <b>375</b>) with the standard controller <b>110</b>, the HMI <b>40</b> and other system devices (e.g., the plant information system <b>70</b>) to generate the monitoring, diagnostics and visualization tools <b>380</b>,<b>390</b> and <b>400</b>, respectively, which reflect the validated configuration of the configured safety system. In this way, relevant safety-related information is provided to an operator on the HMI <b>40</b> (see <figref idref="DRAWINGS">FIG. 1</figref>) via generated screens, as well as provided to other persons/systems such as the plant information system <b>70</b>.

0050The master safety system <b>370</b> can utilize pre-engineered standardized program code within the safety controller, where the code is tightly integrated with that of the standard controller <b>110</b>. Predefined data table space is populated automatically within the standard controller <b>10</b> when the safety system has been validated and begins execution. The data table space then defines the behavior of the HMI <b>40</b>, such that the safety system configuration defines the HMI behavior. Similarly, the safety system configuration is capable of defining the behavior of other systems such as the plant information system <b>70</b> with respect to the monitoring, diagnostic and visualization (or other reporting) information. That is, the safety system configuration propagates upwards to other relevant systems and configures those systems in the same or a similar manner as described with reference to <figref idref="DRAWINGS">FIG. 4</figref> (as well as <figref idref="DRAWINGS">FIGS. 5-6</figref> discussed below) with respect to the generating of the configured master safety control program.

0051Turning to <figref idref="DRAWINGS">FIGS. 5 and 6</figref>, exemplary operation of the master safety system <b>370</b> to configure portions of an exemplary master safety control program <b>300</b> (see <figref idref="DRAWINGS">FIG. 6</figref>) into a configured master safety control program is shown in a schematic fashion. With respect to <figref idref="DRAWINGS">FIG. 6</figref>, the master safety control program <b>300</b> is an example of a master safety control program that could be designed for a generic industrial system having up to n robots and m gateboxes (but not having any operator stations, in contrast to the generic industrial station of FIG. <b>1</b>). The design of the exemplary master safety control program <b>300</b> further indicates that, during design of the master safety control program, the robot class of safety subsystems was defined such that each robot includes two safety interlocks, an e-stop button and a contactor, while the gatebox class of safety subsystems was defined such that each gatebox only includes a single safety interlock, an e-stop button.

0052As shown, the exemplary master safety control program <b>300</b> includes first and second rungs <b>331</b> and <b>333</b>, each of which includes a coil <b>345</b> and one or more contact pairs <b>332</b> that are connected in series. Each of the contact pairs <b>332</b> includes a respective normally-open contact <b>335</b> coupled in parallel with a respective normally-closed contact <b>340</b>. Each of the coils <b>345</b> represents a safety system status of interest and, often (though not necessarily), a given coil represents the safety system status of an overall group of similar safety-enhancing devices/safety interlocks. Consequently, in this example, the coil <b>345</b> of the upper rung <b>331</b> of the program <b>300</b> is indicative of whether any e-stop button of any of the safety subsystems of interest (e.g., within the industrial station) has been pressed, and the coil <b>345</b> of the lower rung <b>333</b> of the program is indicative of whether any contactor of any of the robot safety subsystems (the only class of safety subsystems containing such contactors) is on. The coils <b>345</b>, and signals provided by the coils <b>345</b> can be used in a variety of ways depending upon the embodiment. For example, the coils <b>345</b> can be used to drive contactors that enable or inhibit robots, or can provide signals that are used internally as precursors for further decision making.

0053Each normally-open contact <b>335</b> of the exemplary master safety control program <b>300</b> is intended to be energized (e.g., closed) by a particular safety-enhancing device/safety interlock of a corresponding safety subsystem, and thereby represents the status of that device/interlock of that safety subsystem. More specifically, each normally-open contact is opened when its corresponding safety-enhancing device/safety interlock has been actuated, indicating that a safety issue has arisen (e.g., the pressing of an e-stop button). Additionally, each normally-closed contact <b>340</b> is intended to be energized (e.g., opened) by the activation of a corresponding one of a set of coils <b>330</b>, as discussed with reference to FIG. <b>5</b>. Activation of a respective coil occurs when, during implementation of the master safety control program <b>300</b> on a specific industrial system, the validation mechanism <b>360</b> confirms the presence of a particular safety subsystem and thus the presence of each of its respective safety-enhancing devices/safety interlocks.

0054The master safety control program <b>300</b> includes a contact pair <b>332</b> for every safety-enhancing device/safety interlock that could exist in the generic industrial system defined during the design of the master safety control program in step <b>200</b> (see FIG. <b>2</b>), that is, based upon the maximum numbers of safety subsystems <b>30</b> specified in substep <b>206</b> (see FIG. <b>2</b>), and the definitions of the different classes of safety subsystems in terms of their types and numbers of safety-enhancing devices/safety interlocks, which are specified in substeps <b>202</b> and <b>204</b> (see FIG. <b>2</b>). Therefore, if the master safety control program <b>300</b> had been designed for a generic industrial system having up to p operator stations in addition to up to n robots and up to m gateboxes, the master safety control program would have additional contact pairs <b>332</b> for whatever safety-enhancing devices/safety interlocks were defined to possibly exist on those operator stations.

0055Referring additionally to <figref idref="DRAWINGS">FIG. 5</figref>, the master safety control program <b>300</b> is configured to become a configured master safety control program for a specific industrial system/station as follows. <figref idref="DRAWINGS">FIG. 5</figref> shows that, once the master safety control program <b>300</b> is loaded (or otherwise implemented) onto the specific industrial system and the system is started up (e.g., at step <b>240</b> of FIG. <b>2</b>), configuration data <b>305</b> supplied by the configuration mechanism(s) <b>350</b> is compared by the validation mechanism <b>360</b> with system data <b>310</b> supplied by the safety subsystems <b>30</b> (or other system components) to determine whether certain program configurations <b>325</b> should be made to the master safety control program <b>300</b>. <figref idref="DRAWINGS">FIG. 5</figref> shows this process in a generalized ladder logic format, although the process could also be represented by (and/or programmed using) a variety of other formats or programming languages.

0056In particular, the configuration data <b>305</b> and system data <b>310</b> are represented by way of normally-open contacts <b>315</b> and <b>320</b>, respectively, and the validated program configurations <b>325</b> are shown as output coils <b>330</b>. That is, the supposed presence of a given safety subsystem <b>30</b> as indicated by a particular configuration mechanism (e.g., the connection of a jumper such as jumper <b>212</b> indicative of the presence of one of the robots <b>80</b>) is represented by the closing of a corresponding normally-open contact <b>315</b>. Similarly, the actual presence of that safety subsystem in the specific industrial system, as indicated by communications with that safety subsystem, is represented by the closing of a corresponding normally-open contact <b>320</b>. Based upon the status of the normally-open contacts <b>315</b> and <b>320</b>, the validation mechanism(s) <b>360</b> then determines whether the particular safety subsystem is present.

0057If such a safety subsystem is confirmed to be present, then a respective coil <b>330</b> corresponding to the particular safety subsystem is activated as shown in FIG. <b>5</b>. Referring additionally to <figref idref="DRAWINGS">FIG. 6</figref>, the activation of the coil <b>330</b> in turn causes appropriate configurations to the master safety control program <b>300</b>, in order to account for the presence of each of the safety-enhancing devices/interlocks of the confirmed safety subsystem. That is, upon validation of the configuration of the industrial system/station (e.g., determining the actual presence of supposedly-existing safety subsystems), the activation of the respective coils <b>330</b> corresponding to existing safety subsystems in rum causes the appropriate configurations to the master safety control program relating to the particular safety-enhancing devices/interlocks of the existing safety subsystems, which results in the configured master safety control program.

0058Thus, if a first robot (Robot <b>1</b>) of the specific industrial system is indicated to be present by way of the configuration data <b>305</b>, and the validation mechanism <b>360</b> confirms the presence of that robot by way of the system data <b>310</b> (that is, both of the corresponding “Robot <b>1</b>” normally-open contacts <b>315</b>,<b>320</b> are closed), then a corresponding coil <b>330</b> will be activated (namely, the “Robot <b>1</b> Present” coil). Similarly, if a first gatebox (Gatebox <b>1</b>) is confirmed to be present, then a further coil <b>330</b> (the “Gatebox <b>1</b> Present” coil) will be activated. However, if for example the other robots, e.g., the second robot through the nth robot, are not confirmed to be present, then the corresponding coils <b>330</b> (the “Robot <b>2</b> Present” coil through the “Robot n Present” coil) will not be activated.

0059Configuration of the master safety control program <b>300</b> into a configured master safety control program for a specific industrial system then occurs simply upon the opening of (or upon leaving closed) the various normally-closed contacts <b>340</b> based upon the validated configuration data. For example, if only a first robot (Robot <b>1</b>) and a first gatebox (Gatebox <b>1</b>) are determined to be present in the specific industrial system, but the other robots and gateboxes (Robots <b>2</b> through n and Gateboxes <b>2</b> through m) are determined to be absent, the normally-closed contacts <b>340</b> (“Robot <b>1</b> Present” and “Gatebox <b>1</b> Present”) corresponding to the e-stop buttons for the first robot and gatebox are opened, but the normally-closed contacts corresponding to the e-stop buttons for the other possible robots and gateboxes are left closed. Consequently, the coil <b>345</b> indicating whether any e-stop button has been pressed (“No System E-Stops”) will be activated only whenever either of the e-stop buttons of the first robot and the first gatebox is/are pressed, and this process will be unaffected by the absence of the other robots or gateboxes. Likewise, the normally-closed contact <b>340</b> (“Robot <b>1</b> Present”) corresponding to the contactor for the first robot is opened, but the normally-closed contacts corresponding to the contactors for other possible robots are left closed.

0060The master safety control program <b>300</b> is intended to be exemplary of a variety of master safety control programs that could be designed for a variety of different generic industrial systems. The exact numbers of contact pairs <b>332</b>, coils <b>345</b> and rungs <b>331</b>,<b>333</b> will vary based upon the generic industrial system and other considerations, including the particular safety system status data that it is desired to monitor. For example, it is not necessary that the contact pairs <b>332</b> corresponding to each of the e-stop buttons for each of the safety subsystems of interest be coupled in series with one another and with a single coil <b>345</b>.

0061For example, in another embodiment, it could be of interest to have separate rungs (and separate coils) for each of the e-stop buttons for each member of a class of safety subsystems (e.g., a first rung for all of the e-stop buttons of robots, a second rung for all of the e-stop buttons of gateboxes, a third rung for all of the contactors of robots, etc.). Also, in some alternate embodiments, it is possible that the master safety control program <b>300</b> would not include contact pairs <b>332</b> for certain safety-enhancing devices/safety interlocks, particularly in circumstances where, for some reason, the statuses of those devices/interlocks is not of interest.

0062Additionally, the master safety control program <b>300</b> need not be programmed in ladder logic format, but rather could be programmed in any known computer language or format. Likewise, the master safety control program <b>300</b> need not be configured by the opening or closing of contacts, bill rather could be configured by any appropriate programming operation or data modification operation. Further, in some alternate embodiments, the configuration and validation mechanisms <b>350</b>,<b>360</b> can indicate not simply whether particular safety subsystems are present, but instead (or in addition) whether the individual safety-enhancing devices/safety interlocks are present. In such alternate embodiments, the configuration data <b>305</b> and system data <b>310</b> could relate to particular safety-enhancing devices/safety interlocks (e.g., to a “Robot <b>1</b>, E-Stop <b>1</b>” rather than simply to a “Robot <b>1</b>”). Further, in such embodiments, the coils <b>330</b> (or other outputs of the validation mechanism <b>360</b>) could particularly relate to, and result in the actuation of, contacts for particular safety-enhancing devices/safety interlocks.

0063As discussed above, the HMI <b>40</b> device or other monitoring, diagnostic, or visualization (or reporting) devices reflect the industrial system's safety configuration in the data that is displayed. The positioning and layout of data displayed on the HMI <b>40</b> typically reflects the organization and statuses of the safety subsystems and other components of the industrial system. As shown in <figref idref="DRAWINGS">FIGS. 7. 8</figref> and <b>9</b>, the HMI <b>40</b> can display multiple screens of information that display a variety of information. Specifically referring to <figref idref="DRAWINGS">FIGS. 7 and 8</figref>, exemplary first and second screens <b>410</b> and <b>440</b> respectively display information about the gateboxes and robots of specific industrial stations. In the case of the first screen <b>410</b>, the industrial station of interest is shown to include live robots (e.g., n=5) as indicated by icons <b>420</b>, one gatebox (e.g., m=1) as indicated by icons <b>430</b>, and zero operator stations (e.g., p=0). In the case of the second screen <b>440</b>, the industrial station of interest is shown to include eight robots (e.g., n=8) as indicated by icons <b>450</b>, four gateboxes (e.g., m=4) as indicated by icons <b>460</b>, and zero operator stations (e.g., p=0). The screens <b>410</b> and <b>440</b> are automatically configured, instantiated and populated based upon the validated configuration information. That is, the first screen <b>410</b> is automatically configured to have the appropriate numbers of icons <b>420</b>,<b>430</b> (and/or other labels, boxes, other icons, other information, etc.) to appropriately display information concerning five robots and one gatebox, while the second screen <b>440</b> is automatically configured to have the appropriate numbers of icons <b>450</b>,<b>460</b> (and/or other labels, boxes, other icons, other information, etc.) concerning eight robots and four gateboxes. Among the information that is displayed is annunciation data.

0064Also as shown in <figref idref="DRAWINGS">FIGS. 7 and 8</figref>, in certain embodiments, more than one interlock can be monitored for a given safety subsystem or system component. In particular, with respect to the robots <b>80</b> (as shown by icons <b>420</b> and <b>450</b>), not only are the statuses of e-stop buttons monitored, but also the statuses of a set of robot contactors are monitored. With respect to the gateboxes <b>90</b> (as shown by icons <b>430</b> and <b>460</b>), not only are zero speed interlocks (e.g., “Tool Major Motion Enabled”) monitored, but also additional e-stop buttons, gate reset switches, and additional robot and tool-related interlocks are monitored. If a safety event occurs (e.g., one of the gatebox reset interlocks has not been reset), a corresponding block changes in its display (e.g., a “Gate Reset” block, which is shown in <figref idref="DRAWINGS">FIG. 8</figref>, becomes a “Gate Not Reset” block of a brighter or otherwise different color, as shown in FIG. <b>7</b>). Further as shown in <figref idref="DRAWINGS">FIGS. 7 and 8</figref>, in some embodiments, the safety statuses of safety interlocks that are common to a given class of safety subsystem (e.g., the statuses of the e-stop buttons of multiple robots) are displayed as a single overall status (e.g., one “Robot E-Stop” indication is provided to indicate whether any e-stop button has been pressed with respect to any of the robot safety subsystems).

0065With respect to <figref idref="DRAWINGS">FIG. 9</figref>, a third exemplary screen <b>470</b> displays information specifically related to one of the safety subsystems <b>30</b>, in this case one of the gateboxes <b>90</b> and its safety interlocks. Again the screen <b>470</b> is automatically instantiated based upon the validated, configuration information. The screen <b>470</b> specifically displays several boxes that, depending upon their color or shade, indicate different statuses. For example, a medium shade (or green) box can indicate that the gateboxes <b>90</b> are active and ready for automatic operation with no faults; a light (or yellow) box can indicate that the gateboxes are active and in a valid maintenance mode, without faults, but not ready for automatic operation; and a dark (or red) box can indicate that a fault has occurred with respect to one or more of the gateboxes.

0066It is specifically intended that the present invention not be limited to the embodiments and illustrations contained herein, but that modified forms of those embodiments including portions of the embodiments and combinations of elements of different embodiments also be included as come within the scope of the following claims.