Safety circuit with automatic recovery

The electronic control system of 10, wherein said plurality of operating states further comprises a standby (DISABLED) state, wherein said safety circuit further comprises

• (a) a third sensing means to determine whether said motion control system is ready to effect said controlled motion of each axis, wherein said states further qualify operation so that
• (b) said DISABLED state is a standby state, wherein said emergency-stop circuit is energized, wherein said bulk power flows, wherein said motion control system is not ready, wherein said state machine means further otherwise transitions to
• (c) said DISABLED state when said hazard severity level is hazard is not present, said bulk power is flowing as sensed by said first sensing means, and said third sensing means determines motion control system is not ready, or
• (d) said ACTIVE state when said hazard severity level is hazard is not present and said bulk power is flowing as sensed by said first sensing means, and said third sensing means determines motion control system is ready;
• wherein said motion control system utilizes said data packet to report whether said motion control system is ready to effect controlled motion, wherein said third sensing means utilizes said data packet to determine whether said motion control system is ready to effect said controlled motion of each axis.

A safety circuit for machinery for preventing hazardous situations comprising:

• connections to a motion control system of said machinery, wherein said motion control system comprises means to effect controlled motion of each axis of said machinery, wherein said motion control system carries out the task of said machinery;
• connections to an emergency-stop circuit of said machinery, wherein said emergency-stop circuit comprises means for controlling the flow of bulk power, wherein presence of said flow of bulk power empowers said motion control system to effect controlled motion for said each axis, wherein absence of said flow of bulk power prevents uncontrolled motion of said each axis, wherein said means for controlling said flow of bulk power is responsive to the command of an operator;
• connections to at least one hazard sensor, wherein each hazard sensor provides at least one hazard sensor value;
• wherein said safety circuit receives from at least one of said at least one hazard sensor at least one of said at least one hazard sensor value;
• wherein said safety circuit further comprises a risk assessment means that generates at least one hazard assessment, each of which is a sensed degree of hazard present for at least one of said at least one of said at least one hazard sensor value, wherein said risk assessment means further determines the most severe of said at least one hazard assessment which sets the hazard severity level for said safety circuit, whereby said hazard severity level is assigned one of at least three severity levels
• (a) hazard is not present,
• (b) hazard is present but not dangerous, or
• (c) hazard is dangerous;
• wherein said safety circuit further comprises
• (d) a first control means to variably restrict operation of said motion control system,
• (e) a second control means to stop or keep stopped said flow of bulk power by way of said emergency-stop circuit, wherein said second control means when activated overrides the command of an operator to start said flow of bulk power, and
• (f) a first sensing means to determine whether said bulk power flows or whether said emergency-stop circuit is energized,
• wherein said safety circuit further controls operation of said machinery in a plurality of operating states, wherein said operating states comprise unrestricted operation (ACTIVE), partially restricted operation (HALT), and totally restricted operation (KILLED), wherein said states qualify operation so that
• (g) said ACTIVE state does not restrict operation,
• (h) said HALT state restricts motion for each affected axis through said motion control system wherein said first control means is used, and
• (i) said KILLED state stops motion for each affected axis through said motion control system wherein said first control means is used and stops said flow of bulk power to said machinery through said emergency-stop circuit wherein said second control means is used and keeps stopped said flow of bulk power wherein said second control means is continuously used as long as said hazard severity level is hazard is dangerous, wherein said safety circuit further comprises a state machine means to maintain state or change state so that said safety circuit maintains
• (j) said KILLED state when said hazard severity level is hazard is dangerous, and otherwise transitions to
• (k) said KILLED state when power is first applied to logic of said safety circuit or when said first sensing means to sense said flow of bulk power determines said bulk power has stopped flowing or when said hazard severity level is hazard is dangerous, or
• (l) said HALT state when said hazard severity level is hazard is present but not dangerous and said bulk power flows as sensed by said first sensing means, or
• (m) said ACTIVE state when said hazard severity level is hazard is not present and said bulk power flows as sensed by said first sensing means.

A method for preventing hazardous situations in machinery wherein at least one hazard sensor is used, wherein each hazard sensor reports at least one hazard sensor value that identifies a potential for hazard, wherein a risk assessment means is used that

• (1) conducts at least one hazard assessment for the hazard sensor values provided by the hazard sensors,
• (2) generates a hazard severity level from the said at least one hazard assessment, which identifies said hazard severity level as the most severe hazard assessment, and
• (3) assigns said hazard severity level one of
• (a) hazard is not present,
• (b) hazard is present but not dangerous, or
• (c) hazard is dangerous,
• wherein a motion control system is used comprising means to effect controlled motion of each axis of said machinery, wherein said motion control system carries out the task of said machinery,
• wherein an emergency-stop circuit is used comprising means for controlling the flow of bulk power, wherein presence of said flow of bulk power empowers said motion control system to effect controlled motion for said each axis, wherein absence of said flow of bulk power prevents uncontrolled motion of said each axis, wherein said means for controlling said flow of bulk power is responsive to the command of an operator,
• wherein a first control means is used to variably restrict operation of said motion control system, wherein a second control means is to stop or keep stopped said flow of bulk power by way of said emergency-stop circuit, wherein said second control means when activated overrides the command of an operator to start said flow of bulk power, wherein a first sensing means is used to determine whether said bulk power flows or whether said emergency-stop circuit is energized,
• wherein said method utilizes various operating states to define said method, wherein said operating states comprise unrestricted operation (ACTIVE), partially restricted operation (HALT), and totally restricted operation (KILLED), wherein said operating states qualify operation so that
• (a) said ACTIVE state does not restrict operation,
• (b) said HALT state restricts motion for each affected axis through said motion control system wherein said first control means is used, and
• (c) said KILLED state stops motion for each affected axis through said motion control system wherein said first control means is used and stops said flow of bulk power to said machinery through said emergency-stop circuit wherein said second control means is used and keeps stopped said flow of bulk power wherein said second control means is continuously used as long as said hazard severity level is hazard is dangerous,
• wherein said method comprises the steps of:
• 1) Start in the KILLED state,
• 2) Use risk assessment means to conduct a hazard assessment for the hazard sensor values, find the most severe hazard assessment, and assign the hazard severity level,
• 3) If hazard severity level is hazard is dangerous, then
• (a) use second control means,
• (b) stay in the KILLED state, and
• (c) go back to step 2,
• 4) If hazard severity level is hazard is present but not dangerous present and first sensing means determines said bulk power flows, then
• (a) use first control means,
• (b) transition to HALT state, and
• (c) go to step 10,
• 5) If hazard severity level is hazard is not present and first sensing means determines said bulk power flows, then
• (a) transition into ACTIVE state, and
• (b) go to step 6,
• 6) In ACTIVE state, repeat step 2 here,
• 7) If hazard severity level is hazard is dangerous or said first sensing means determines said bulk power has stopped flowing, then
• (a) use both first and second control means,
• (b) transition into the KILLED state, and
• (c) go back to step 2,
• 8) If hazard severity level is hazard is present but not dangerous, then
• (a) use first control means,
• (b) transition to HALT state, and
• (c) go to step 10,
• 9) Otherwise stay in ACTIVE state and go back to step 6,
• 10) In HALT state, repeat step 2 here,
• 11) Do step 7 here,
• 12) Otherwise, do step 5 here, and
• 13) Otherwise, continue first control means and return to step 10.