The present invention relates to a safety device that reduces the risk of injury to a user in the event of an unexpected occurrence when operating potentially dangerous apparatus, such as powered machinery.

Emergency power cut-off switches are known in the art. For example, fixed industrial machines such as lathes, boring machines, milling machines, grinding machines, etc. have power cutoff switches that can be operated manually in the event of an emergency. Such switches are typically coloured red or otherwise clearly labelled, and are positioned in easy to reach locations. Although it is possible to reach such switches in many emergency situations, there can be an undesirable delay before the switch is reached, potentially increasing the risk or extent of injury or other adverse outcome.

Some emergencies result in electrical shorts (e.g. accidentally cutting through a power cable) or other unexpected changes in the electrical properties of a device. Such changes can be detected electrically and used to trigger a safety response, such as cutting off a power supply. However, not all emergency situations cause changes in electrical properties that can be detected in this way.

US7401131B2 discloses a power tool movement monitoring system that is capable of generating a warning signal, or of cutting off power, when the monitored acceleration or velocity of a power tool exceeds a predetermined acceleration or velocity limit for a respective axis. The monitoring system thus allows uncontrolled operation of the power tool to be detected and uses the detection to trigger a safety response (warning or power cut off). The system improves safety but has limited sensitivity in many situations. The inertia of the power tool limits how much acceleration can be applied to the power tool by the user, which reduces sensitivity of detection of dangerous situations. Some dangerous situations may be not be detected quickly enough to prevent injury or may not be detected at all. The approach is also not applicable to stationary devices, such as the fixed industrial machines mentioned above.

It is an object of the present invention to at least partially address one or more of the problems with the prior art mentioned above.

According to an aspect of the invention, there is provided a safety system, comprising: a sensor unit configured to be worn by a user while the user is operating an apparatus; and a control unit in communication with the sensor unit, wherein: the control unit is configured to change an operation state of the apparatus from a normal operation state to a safety operation state in response to detection of a characteristic acceleration profile of the sensor unit by the sensor unit.

Thus, an arrangement is provided in which acceleration of a part of the anatomy of a user of potentially dangerous apparatus is monitored directly, rather than the apparatus itself, in order to switch the apparatus to a safety operation state in response to an emergency situation. In contrast to systems such as that disclosed in US7401131B1 discussed above, the present invention is able to provide protection when working with a variety of different apparatus, without fundamental modification of the safety system. Furthermore, the inventor has found that monitoring the anatomy of the user directly provides greater sensitivity to characteristic indicators of an emergency situation, such as flinch reflex. The invention is thus able to respond more quickly and/or reliably to emergencies than prior art systems.

In an embodiment, the safety system is configured to allow a user to adjust the characteristic acceleration profile. This allows a user to adjust a sensitivity of the safety device, for example so as to be appropriate for the particular activities the user has planned and/or to be appropriate to the location of the sensor unit. The user can thereby achieve a high level of protection while minimising the risk of false positive events (where the safety system causes the apparatus to enter the safety operation state when it is not necessary).

In an embodiment, the sensor unit is configured to allow a user to indicate where the sensor unit is being worn and the control unit is configured to select a characteristic acceleration profile as a function of where the sensor unit is being worn. The safety system is thus able to be used flexibly (e.g. attached to garments in various locations) without having excessively high or low sensitivity to relevant events (such as flinch reflexes) and without significantly compromising convenience.

In an embodiment, the control unit is configured to change the operation state of the apparatus from the normal operation state to the safety operation state by cutting off power to at least a portion of the apparatus. The control unit may for example act as a power relay between a power source and the apparatus, the control unit allowing power to pass through the control unit when the characteristic acceleration profile has not been detected and to not allow power to pass though the control unit when the characteristic acceleration profile has been detected. Embodiments of this type can easily be applied to controlling safety of a wide variety of apparatus simply by connecting the control unit between a power source and the apparatus.

In one particular embodiment of this type the control unit comprises a control unit socket and a control unit plug; the control unit plug is configured to engage with a power socket; and the control unit socket has the same form as the power socket. Thus, the control unit can simply be plugged into a standard power socket and any apparatus connected to the control unit socket will function in the same way as if it were connected directly to the standard power socket except that in the event that the characteristic acceleration profile is detected (e.g. due to a flinch reflex from a user), the control unit will cause the apparatus to enter the safety operation state (e.g. by cutting power to the device).

In an aspect of the invention, there is provided a safety control method, comprising: using a sensor unit worn by a user to monitor a condition of the user while the user is operating an apparatus; and changing an operation state of the apparatus from a normal operation state to a safety operation state in response to detection by the sensor unit of a characteristic acceleration profile of the sensor unit. Embodiments of the invention will now be described, by way of example only, with reference to the accompanying drawings in which corresponding reference symbols indicate corresponding parts, and in which:

Figure 1 schematically depicts a safety system according to an embodiment;

Figure 2 schematically depicts an example control unit of the safety system of Figure 1 ;

Figure 3 is a front perspective view of a control unit of the type depicted in Figure 2 configured to engage with a power socket;

Figure 4 is a rear perspective view of the control unit of Figure 3; and

Figure 5 depicts a sensor unit of a safety system configured to be worn on a user's wrist.

Embodiments of a safety system are described below.

According to various embodiments, one example of which is depicted in Figure 1, the safety system comprises a sensor unit 2. The sensor unit 2 is configured to be worn by a user while the user is operating an apparatus 6. The sensor unit 2 may for example form part of, or be configured to be attached to, a garment 8 that can be worn by a user.

The sensor unit 2 can be configured to be worn in various ways. The sensor unit 2 can be configured to be worn on the head, for example as a headband, hat, or eyewear such as glasses or goggles. Figure 1 depicts an embodiment of this type, in which the sensor unit 2 is attached to a garment 8 consisting of a pair of glasses. In other embodiments the sensor unit 2 is configured to be worn on the wrist of a user. Figure 5 depicts an embodiment of this type, in which the sensor unit 2 comprises a wrist strap. The sensor unit 2 thus forms part of a garment 8 configured to be worn on the wrist, in the manner of a watch. The sensor unit 2 may be provided by a suitably programmed smart watch, for example, or may be attached to a watch, a watch strap, or a bracelet.

In an embodiment, the sensor unit 2 comprises one or more accelerometers. In an embodiment, the sensor unit 2 comprises an accelerometer unit 28, as depicted schematically in Figure 5, comprising plural accelerometers that simultaneously provide information about acceleration along each of three mutually orthogonal axes. The accelerometer unit 28 is thus able to determine a magnitude of acceleration in any direction. A flinch reflex causing an abrupt acceleration in any direction can thus be detected. The device can also be attached to the user in any orientation. In some embodiments, the acceleration along one or more of the orthogonal axes is sampled regularly (e.g. 50 times per second) and an acceleration reading for each axis is compared in real time with an immediately preceding reading. In an embodiment, if the difference in readings exceeds a first predetermined threshold for an axis, a counter for that axis may be incremented. If the difference in readings continues to exceed the first predetermined threshold for subsequent readings, the counter continues to be progressively incremented. If the counter exceeds a predetermined counter threshold, indicating a prolonged state of relatively rapidly changing acceleration, the control unit 4 changes the operation state of the apparatus to the safety operation state. Alternatively or additionally, in some embodiments, each reading may be compared with a second predetermined threshold. When the second predetermined threshold is exceeded, even once, the apparatus is immediately switched to the safety operation state. Where both of the first and second predetermined thresholds are used, the second predetermined threshold (which may be for example above LOG, optionally above 1.2G, optionally above 1.4G, where G represents the acceleration of gravity) may be higher than the first predetermined threshold (which may be for example between 0.1G and 0.5G, optionally between 0.2G and 0.4G, optionally around 0.3G).

In an embodiment, the sensor unit 2 additionally or alternatively comprises one or more gyroscopic sensors. In an embodiment, each gyroscopic sensor measures an angular position and/or an angular velocity relative to one or more axes. Rotation of the sensor unit 2 is associated with a change in linear velocity (i.e. an acceleration) of points that are off-axis relative to an axis of the rotation. Thus, the one or more gyroscopic sensors can provide information about acceleration of the sensor unit 2. In some embodiments, the one or more gyroscopic sensors are provided within the accelerometer unit 28. In an embodiment, the angular position or angular velocity along the one or more axes is sampled regularly (e.g. 10 times per second). Each reading is compared with a predetermined threshold. If the reading exceeds the predetermined threshold, the apparatus is immediately switched to the safety operation state.

The safety system can be used in conjunction with a wide range of different types of apparatus 6. Non-limiting examples include: a power tool (including a hand held power tool), a fixed industrial machine, a lathe, a boring machine, a milling machine, a grinding machine (both hand held and bench mounted), a plane, a router, a sander, a drill (hand held or heavy industrial), a saw

(including hand held tools such as hand held jigsaws and chop saws, and fixed appliances such as band saws and circular saws), a printing press, an arc welder, a machine in an automated production environment (e.g. robotics apparatus or arrangements involving powered conveyor belts), a food sheer (e.g. for meats or cheeses), and a food processor (e.g. for mixing, mincing or grinding food). The safety system can be used with apparatus 6 that is configured to be stationary in use (e.g. apparatus 6 that is fixed to the floor or too heavy to lift) or with apparatus 6 that is configured to be portable (such as a portable hand tool).

As depicted in Figure 1, the safety system further comprises a control unit 4. The control unit 4 is in communication with the sensor unit 2 (e.g. via a wireless data connection, indicated by the broken line connection in Figure 1). The control unit 4 is configured to change an operation state of the apparatus 6 from a normal operation state to a safety operation state in response to detection of a characteristic acceleration profile of the sensor unit 2 by the sensor unit 2. The change in the operation state of the apparatus 6 is not particularly limited and will depend on the particular characteristics of the apparatus 6 being controlled. In various embodiments, the change in the operation state of the apparatus 6 comprises one or more of the following: cutting power to the apparatus, reducing the speed of a moving component, stopping a moving component, closing a valve (e.g. where a valve provides a potentially dangerous flow), shielding a component of the apparatus from the user. The change in the operation state 6 may be triggered by the control unit 4 sending a suitable signal to the apparatus 6 or, alternatively, the control unit 4 may be configured to take more direct action such as cutting off a power supply connection directly.

Figure 1 depicts an embodiment in which the control unit 4 is configured to change the operation state of the apparatus from the normal operation state to the safety operation state by cutting off power to at least a portion of the apparatus 6. This functionality is achieved in the particular embodiment shown by arranging for the control unit 4 to act as a power relay between a power source 10 and the apparatus 6. The control unit 4 allows power to pass through the control unit 4 to the apparatus 6 (arrows 21 and 22) in the normal operation state of the apparatus 6 (when the

characteristic acceleration profile has not been detected) and does not allow power to pass through the control unit 4 to the apparatus 6 in the safety operation state of the apparatus 6 (when the

characteristic acceleration profile has been detected).

Figures 2-4 depict an example configuration for the control unit 4. Figure 2 schematically depicts components of the control unit 4 and their interconnections. Figures 3 and 4 indicate how an example control unit 4 might look from the exterior.

The control unit 4 comprises a control unit socket 24 and a control unit plug 26. The control unit plug 26 is configured to engage with a power socket. The control unit socket 24 has the same form as the power socket. Figures 3 and 4 depict a control unit 4 configured to engage with a domestic UK power socket, but it will be understood that the concept is applicable to any type of domestic or industrial power socket or power connection.

The control unit 4 shown comprises a processing unit 12, a user interface 14, a display 16, a communications module 18, and a power interruption module 20. The user interface 14 may for example comprise a reset switch allowing a user to reset the safety system after the safety system has switched the apparatus 6 into the safety operation state. Alternatively or additionally the user interface 14 may be configured to allow a user to modify control settings of the safety system, such as a sensitivity setting (see below). The user interface 14 provides a control signal to the processing unit 12. The display 16 displays information to the user. The information may for example indicate whether the safety system is turned on, what a battery level of the safety system is (if applicable), or a state of connection (e.g. signal strength) between the control unit 4 and the sensor unit 2 (if applicable). In some embodiments, the sensor unit 2 is additionally provided with a visual display device (e.g. an LED or small display) to indicate (e.g. via an appropriately flashing or constant light of an appropriate colour, for example green) when the safety system is active. A communications module 18 handles communications between the control unit 4 and the sensor unit 2, and between the control unit 4 and any other device which may be configured to communicate with the control unit 4 (e.g. a remote computer). In an embodiment, the sensor unit 2 can be paired with the control unit 4 by interacting with both devices in a predetermined way (e.g. by holding down particular buttons on each device at the same time). The power interruption module 20 controls a power connection being relayed by the control unit 4 (arrows 21 and 22). The processing unit 12 controls the power interruption module 20. In the embodiment shown, the power interruption module 20 cuts the power connection to the apparatus 6 in response to detection of the characteristic acceleration profile by the sensor unit 2.

In various embodiments the characteristic acceleration profile is characteristic of a flinch reflex by the user. In such embodiments, and in other embodiments, the detection of the characteristic acceleration profile comprises detecting when a magnitude of the acceleration (either overall or of a component parallel with any of one or more predetermined axes) of the sensor unit 2 exceeds a reference acceleration threshold. A characteristic common to many flinch reflexes is an abrupt movement involving a large acceleration for a short period of time. The accelerations involved in such abrupt movements are significantly higher than accelerations encountered during normal smooth operation of apparatuses in many circumstances. Monitoring for exceedance of a reference acceleration threshold thus provides a simple and reliable way to distinguish flinch reflex movements from movements associated with normal, safe operation.

In an embodiment the reference acceleration threshold is fixed. The reference acceleration threshold may thus be set at the factory when the safety system is manufactured. This approach minimises cost and complexity.

In other embodiments, the reference acceleration threshold (and, more generally, the characteristic acceleration profile) can be adjusted by a user. Adjustment of the reference acceleration threshold effectively allows the sensitivity of the safety system to be adjusted. Thus, the safety system can be configured to switch the apparatus 6 to the safety operation state at lower or higher accelerations of the sensor unit. A user can thus adjust the safety device to provide a protection that is appropriate to the particular activity that is envisaged (e.g. for a vigorous activity the user may decide to lower the sensitivity of the safety device to avoid erroneous switching of the apparatus to the safety operation state).

In an embodiment, the sensor unit 4 allows a user to indicate where the sensor unit 4 is being worn. The control unit 4 then selects a characteristic acceleration profile as a function of where the sensor unit 4 is being worn (e.g. by selected a most appropriate one of a plurality of predefined different characteristic acceleration profiles). The inventor has recognised that the acceleration profile characteristic of a flinch reflex will be different for different parts of the body (e.g. smaller for parts of the body that are less easily moved in an abrupt fashion, or which tend to participate less in flinch reflex reactions). The safety system is thus able to be used flexibly (e.g. attached to garments in various locations) without having excessively high or low sensitivity to flinch reflexes and without significantly compromising convenience. A user simply needs to indicate where the sensor is being worn and the safety system will adjust the acceleration threshold to provide effective protection.

In an embodiment, the control unit 4 is configured to monitor a data connection (e.g. a wireless data connection) between the control unit 4 and the sensor unit 2 and change the operation of the apparatus 6 from the normal operation state to the safety operation state in response to detection of an interruption to the data connection or in response to detection of an interruption to the data connection that persists for longer than a predetermined interruption threshold time . In this way, the control unit 4 can avoid the potentially dangerous situation in which a data connection is lost without a user of an apparatus 6 realising, such that use of the apparatus 6 would be continued without protection. A data connection could be lost for various reasons, including for example where a user moves (with the sensor unit 2) out of range of the control unit 4, where a battery in the sensor unit 2 has failed, or where there is a hardware failure. The predetermined interruption threshold time may take various values depending on the specific situation and details of the apparatus 6. The control unit 4 may also be configured so that the predetermined interruption threshold time can be adjusted according to user preference. In an embodiment, the predetermined interruption threshold time is in the range ls-60s, optionally in the range 5s-40s. In some embodiments, the data connection is monitored continuously by sending a monitoring signal from the control unit 4 to the sensor unit 2 at regular intervals. If the monitoring signal is not received when expected, it may be deduced that a data connection has been broken.

In an embodiment, control unit 4 changes the operation state of the apparatus 6 from the normal operation state to the safety operation state in response to detection of an absence of any change in acceleration for longer than a predetermined inactivity threshold time. In this way, the control unit 4 can detect when a user may have taken off the sensor unit 2, or where the sensor unit 2 may have fallen off without the user realising, but where the user is still operating the apparatus 6 (unprotected). The control unit 4 can also switch the apparatus 6 into the safe state in the event that a user has lost consciousness. The predetermined inactivity threshold may take various values depending on the specific situation and/or details of the apparatus 6. The control unit 4 may also be configured so that the predetermined inactivity threshold time can be adjusted according to user preference. In an embodiment, the predetermined inactivity threshold time is in the range ls-60s, optionally in the range 5s-40s.

In an embodiment, the safety system may be configured so that the controlled apparatus cannot be operated before it is detected that the safely system is actively controlling the apparatus.

In an embodiment, each sensor unit 2 is configured so that it can only be paired with a single control unit 4 at any one time. This approach may be used for example where a worker in a manufacturing environment exclusively or predominantly operates a single machine. In such a scenario, the worker can approach the machine in question, complete an action to pair his sensor unit 2 with the machine, and then perform the required work. The sensor unit 2 will remain paired with the particular control unit 4 selected until the end of the work session. No other user/sensor unit 2 will be able to pair with the same control unit 4 until the paired user's session has ended (and his sensor unit 2 has been unpaired). The end of a work session may be triggered in various ways. In one example, a button on the sensor unit 2 is held down constantly for a predetermined period. In an embodiment, a plurality of the control units 4 are provided. Each control unit 4 may be configured as described above. For example, each control unit 4 may comprise a control unit socket 24 and a control unit plug 26. Each control unit 4 changes an operation state of a different respective apparatus from a normal operation state to a safety operation state in response to detection of a characteristic acceleration profile of a single common sensor unit 2 (i.e. a single sensor unit 2 that is controlled by all of the multiple control units 4) by that sensor unit 2. Such provision of multiple control units 4 may be referred to as cloning. An example scenario in which cloning may be used is now described. A sensor unit 2 is worn by a user and paired with a first control unit 4 (e.g.

comprising a control unit socket 24 connected to a first power point). The first control unit 4 is configured to communicate (e.g. wirelessly) with a second control unit 4 (e.g. comprising a control unit socket 24 connected to a second power point). When a characteristic acceleration profile of the common sensor unit 2 is detected, the first control unit 4 changes an operation state of a first apparatus from a normal operation state to a safety operation state. In response to the same detection of the characteristic acceleration profile of the common sensor unit 2, the second control unit 4 changes an operation state of a second apparatus from a normal operation state to a safety operation state. This functionality may be achieved by appropriate communication between the first control unit 4 and the second control unit 4 and/or between the sensor unit 2 and each of the first and second control units 4. This functionality may be particularly useful for example where neighbouring machines are being used in tandem by the same user. A user would pair his sensor unit 2 with control units 4 that each control one of the plural neighbouring machines and an emergency situation or technical issue (such as loss of power or data connectivity) would result in simultaneous switching of the machines into the safe state. The whole working area can thus be made safer without requiring a user to wear multiple different sensor units 2 and/or change sensor units 2 when switching from working on one machine to working on a different machine.

In an embodiment, a plurality of the sensor units 2 are provided. Each sensor unit 2 is configured to be worn by a different respective user. The control unit 4 changes an operation state of the apparatus, or of each of one or more additional apparatuses, from a normal operation state to a safety operation state in response to detection of a characteristic acceleration profile of any one of the sensor units 2 (by the sensor unit 2). Thus, an arrangement is provided which allows a working environment that is wider than just the area around one machine, and/or which encompasses multiple different workers, to be made safe in the event of an emergency situation. This would allow coworkers to quickly move to assist others in an emergency situation without machines being left running, and reduces the risk of an emergency situation leading to further emergency situations triggered by surprised co-workers reacting accidentally in a dangerous way to sudden noises or visual cues associated with an emergency situation.

In some embodiments, each sensor unit 2 is configured to remain with the user, rather than being associated rigidly with particular apparatus to be controlled by the safety system. This has the benefit of each user being responsible for good care and maintenance/recharge practices of their individual sensor unit 2. This may encourage high productivity in the workplace (e.g. by avoiding the need to stop and un-clip/change sensor units 2). This approach may facilitate good workplace hygiene (workshops can be sweaty hot places - having to share wearable devices is un-desirable in such an environment). The approach may also be practical for night shift work, etc., where an apparatus to be controlled might be in use 24 hours a day, but the wearable sensor units 2 will need to be recharged in rotation.