T 1696/15 (Safety controller) of 6.6.2019

Summary of Facts and Submissions

I. The present case concerns an appeal filed by the patent proprietor (henceforth, appellant) against the decision of the opposition division which held that, account being taken of the amendments made by the proprietor according to an "auxiliary request II", the patent

No. 1517203 and the invention to which it relates met the requirements of the EPC. The opposition division held that the subject-matter of the claims as granted lacked an inventive step having regard to the disclosure of documents E4 and E5 in combination, taking into account the common general knowledge of the skilled person.

II. In its statement of grounds of appeal, the appellant requested that the decision under appeal be set aside and that the patent be maintained as granted, i.e. that the opposition be rejected (main request). It argued, inter alia, that the claimed subject-matter was new and involved an inventive step with respect to the disclosure of documents E4 and E5.

Alternatively, the appellant requested that the patent be maintained in amended form in accordance with the claims of one of auxiliary requests 1 to 4 filed therewith, although, in view of the board's decision, the content of the auxiliary requests is not relevant.

III. In a letter of reply to the appeal, the opponent (henceforth, respondent) requested that the appeal be dismissed. The respondent invoked the grounds for opposition pursuant to Articles 100(a) and (b) EPC.

IV. In a communication accompanying a summons to oral proceedings, the board gave a preliminary opinion

- that the ground for opposition pursuant to Article 100(b) did not prejudice the maintenance of the patent as granted;

- that document E1 was not novelty-destroying with respect to the subject-matter of claim 1 of the patent as granted;

- that the subject-matter of claim 1 of the patent as granted appeared to involve an inventive step with respect to the disclosure of E4 taking into account E5 and/or common general knowledge and/or E8 and E11.

V. In response to the board's communication, the respondent, with respect to inventive step, introduced a new (in these appeal proceedings) argument that the subject-matter of claim 1 lacked an inventive step based on E4 combined with E6. This argument had however been put forward in the notice of opposition and was commented on briefly in the impugned decision.

VI. Oral proceedings were held on 6 June 2019.

The final requests were established to be as follows:

The appellant (patent proprietor) requested that the decision under appeal be set aside and that the opposition be rejected (main request) or, in the alternative, that the patent be maintained in amended form on the basis on one of Auxiliary Requests 1 to 4 submitted with the statement of grounds of appeal.

The respondent (opponent) requested that the appeal be dismissed.

At the conclusion of the oral proceedings, the chairman announced the board's decision.

VII. The following documents are relevant to the board's decision:

E1 = WO 2004/057430 A1

E4 = DE 10025085 A1

E5 = DE 19956271 A1

E6 = US 6104971 A

E8 = US 5416908 A

E11 = Cavalieri et al: "Fault tolerance in Interbus-S standard", Computer Standards & Interfaces 23(2001), pp. 223-235

VIII. The patent as granted includes two independent claims, i.e. claims 1 and 24.

Claim 1 as granted reads as follows (using the feature annotations 1a - 1f2 used in the impugned decision, point 2):

1a A safety controller comprising:

1b a primary (18a) and partner (18b) Independent [sic] controller communicating on a communication bus;

1c a communication interface (52) for receiving safety program information from a user to the primary controller;

1d a transfer program executable on the primary and partner controller to automatically load the safety program information received by the primary controller via the communications bus to the partner controller; and

1e a synchronization program executable by the primary and partner controller

1e1 to execute the safety program information on the primary and partner controller and

1e2 compares [sic] execution of the safety program information and

1e3 to enter a safety state when this execution differs;

characterized in that

1f the communication interface

1f1 is adapted to confirm the existence of the partner controller having the transfer and synchronization program and

1f2 is adapted to receive safety program information only when the confirmed partner controller is communicating with the primary controller on the communications bus.

Claim 24 as granted reads as follows:

"A method of operating a safety controller having a primary (18a) and partner (18b) independent controller communicating on a communication bus comprising the steps of:

a1) confirming the existence of the partner controller having a transfer and synchronization program to receive safety program information only when the confirmed partner controller is communicating with the primary controller on the communications bus [sic]

a2) receiving the safety program information from a user to the primary controller;

b) transferring the safety program information received by the primary controller via the communications bus to the partner controller; and

c) executing the safety program information on the primary and partner controller and comparing execution of the safety program information to enter a safety state when this execution differs."

Reasons for the Decision

1. Ground for opposition pursuant to Article 100(b) EPC

1.1 The ground for opposition pursuant to Article 100(b) EPC corresponds to the provisions of Article 83 EPC. In accordance with case law, the essential requirements for compliance with Article 83 EPC are that at least one way of carrying out the invention should be disclosed and that it should be possible to carry out the invention over the whole ambit of the claims.

1.2 In accordance with the impugned decision (cf. point 4 of the reasons), claim 1 can be interpreted in either of two ways A or B, whereby under interpretation A, the communication interface in claim 1 is interface 52 of Fig. 2, whereas under interpretation B, it is interface 50. The opposition division argued essentially that as one way was disclosed of carrying out the invention in accordance with interpretation B, the invention was sufficiently disclosed.

1.3 The respondent in the statement of grounds of appeal argues however that no embodiment in accordance with interpretation A is disclosed, so that the requirement of sufficiency of disclosure is not met.

1.4 Claim 1 refers to "a communication interface (52) for receiving safety program information from a user to the primary controller". This interface 52 is shown in Fig. 2 as being connected to communication port 30, which leads to programming terminal 32 (cf. Fig. 1), as well as to internal bus 54 which leads to processor 58. In addition, a further interface 50 is connected to the interface 52 and the processor 58 via an internal bus, and is also connected via the backplane 26 to the partner controller 18b.

1.5 It is further stated in col. 7, lines 1 to 8, that "Either interface circuits 50 or 52 may be used to receive programming information from the programming terminal 32 as shown in Fig. 1 and interface circuit 50 may be used to communicate between primary controller 18a and partner controller 18b or any of the other modules for the communication of safety data, safety program information or other signals ...". This corresponds to the opposition division's interpretation B.

1.6 It is not stated in the description whether in the case that the interface circuit 50 receives programming information from the programming terminal, the interface circuit 52 is intended to be dispensed with and a connection made directly to the programming terminal from interface circuit 50, or whether the interface circuit 50 would communicate with the programming terminal via the interface circuit 52. However, in the board's view, the skilled person using common general knowledge would be able to implement either of these embodiments without any undue difficulty.

1.7 As to the opposition division's interpretation A, by which the interface circuit 52 is adapted to communicate with the partner controller in the manner defined in the characterising part of claim 1, the board notes that this could plausibly be done either by directly connecting interface circuit 52 to the backplane or by communicating from interface 52 via the interface 50. Although it is clear from paragraph [0050] that neither of these scenarios is the intended way of carrying out the invention, the board does not see any particular technical difficulty for the skilled person who wishes to carry out the invention in this manner. In this respect, the required interface functions could apparently be sited in either of the interface circuits as appropriate and hardware and communications protocols adapted accordingly.

1.8 It follows that the description discloses one way of carrying out the invention (interpretation B), and also that the invention can be carried out over the whole breadth of the claim covering interpretations A and B. Consequently, the board concludes that the ground for opposition pursuant to Article 100(b) EPC does not prejudice the maintenance of the patent.

2. Ground for opposition pursuant to Article 100(a) EPC

2.1 Claim 1 - novelty with respect to E1 (Article 54(3) EPC)

2.1.1 E1 forms part of the state of the art pursuant to Article 54(3) EPC and is therefore to be taken into account when examining for novelty.

2.1.2 The respondent firstly argues that features 1f1 and 1f2 cannot be carried out and therefore cannot be taken into account when examining for novelty.

2.1.3 The respondent's argument raises the question as to whether a feature which cannot be carried out may be disregarded when examining for novelty. Although the board sees no reason why this should be the case, given the board's conclusion above with respect to Article 100(b) EPC, it follows that this argument is in any case moot.

2.1.4 The respondent further argues that E1 discloses features 1e, 1e1, 1e2 and 1e3 of claim 1, referring to E1, page 9, line 30 ff., according to which the safety-hardware unit may comprise a first and a second module in a redundant configuration.

2.1.5 However, the board notes that according to this embodiment, the second module takes over from the first module if a failure of the first module is detected. This is different to the comparing concept expressed in features 1e, 1e1, 1e2 and 1e3 of claim 1.

2.1.6 The respondent further argues that these features are implicitly disclosed in E1, page 9, lines 9 to 11.

2.1.7 However, the board notes that this passage relates to an entirely different embodiment to that of page 9, lines 30 ff., since the former passage refers to an embodiment in which the safety-hardware unit 11 supervises the controller, and the latter passage concerns a duplication of the safety-hardware unit 11. In order to be novelty-destroying, all features must be disclosed as part of the same embodiment. Consequently, the respondent's argument is unconvincing.

2.1.8 Hence, the subject-matter of claim 1 is new with respect to the disclosure of E1 (Article 54(3) EPC).

2.2 Claim 1 - inventive step starting out from E4

2.2.1 It is common ground that E4 represents the closest prior art.

2.2.2 E4 discloses a safety controller comprising a primary and partner independent controller communicating on a communication bus, and a communication interface for receiving safety program information from a user to the primary controller (i.e. features 1a, 1b and 1c of claim 1). The processors 3, 4 either carry out the same program redundantly or check each other's results (cf. paragraph [0011]).

2.2.3 In agreement with the impugned decision, E4 does not disclose features 1d, 1f, 1f1 and 1f2 (cf. point 6.4 of the reasons), i.e.:

1d: a transfer program executable on the primary and partner controller to automatically load the safety program information received by the primary controller via the communications bus to the partner controller;

1f: the communication interface

1f1: is adapted to confirm the existence of the partner controller having the transfer and synchronization program, and

1f2: is adapted to receive safety program information only when the confirmed partner controller is communicating with the primary controller on the communications bus.

2.2.4 The opposition division and the respondent argue that these features do not contribute to an inventive step. The board does not agree for the following reasons.

2.2.5 The board firstly disagrees with the opposition division's comment that claim 1 relates to three "independent aspects" I, II and III (cf. point 6.1 of the reasons), since the identified features mutually interact, as reflected by the wording of features 1d, 1f, 1f1 and 1f2. In this respect, data, i.e. safety program information, is only transferred to the primary controller (aspect I) in dependence on confirming the existence of the partner controller having the transfer and synchronisation programs (aspect II). It follows that only then is the program data loaded to the partner controller (aspect II), and executed on the primary and partner controllers (aspect III). Inventive step therefore has to be considered in the light of the totality of the combination of features of claim 1.

2.2.6 With respect to features 1d, 1f, 1f1 and 1f2, the opposition division then considers that the problem to be solved is "how to further improve the safety of the system in relation with [sic] the redundancy of the safety controller of E4". It argues that in the light of E5, which allegedly discloses these features, the skilled person would solve this problem without exercising inventive skill. Furthermore, it is argued that features 1f, 1f1 and 1f2 are common general knowledge, as illustrated by documents E8 and E11.

2.2.7 The respondent argues mainly that there is no inventive step on the basis of E4 combined with common general knowledge, or E4 combined with E5, or E4 combined with E6. Leaving aside the combination of E4 and E6, which is dealt with below (point 2.2.13), the respondent broadly argues that features 1f1 and 1f2 must be disregarded as being insufficiently disclosed. That only leaves feature 1d, which it argues belongs to common general knowledge, or is obvious in the light of E5.

Further, even if features 1f1 and 1f2 were to be taken into consideration for inventive step, the respondent argues that they are obvious in the light of E5, E8 or E11.

2.2.8 The board is however not convinced by either the reasoning of the opposition division or the arguments of the respondent.

2.2.9 The problem to be solved starting out from E4 can be specified more precisely than merely as how to further improve the safety of the system in relation to the redundancy of the safety controller, namely as how to implement a system having a duplicate program memory (as suggested by E4, paragraph [0013]) and efficiently download safety program information to each memory.

2.2.10 Considering this problem in the light of common general knowledge, the board notes that the two processors 3, 4 in E4 are part of the same module which both read the program stored in memory 11 (cf. paragraph [0010]), and that both processors are directly connected to the bus interface 5. The skilled person therefore would have no obvious requirement to transfer program data from the first processor 3 to the partner processor 4. Even if it is stated in D4 that the program memory 11 could be duplicated (cf. paragraph [0013]), this does not mean that one memory 11 would be associated with the processor 3 and the other with the processor 4, or that a program in the first memory 11 would be transferred to the duplicated memory via the bus linking the two processors. On the contrary, given that in E4 the reason for the duplicate program memory would be apparently to provide a backup, since the other alternative proposed is to "regularly check ... [the program memory] for correctness", it appears logical that each processor would be provided with a connection to both the main memory and the duplicate memory. Consequently, feature 1d in the context of E4 is not obvious. The board further does not agree that features 1f1 and 1f2 should be disregarded when examining for inventive step due to insufficient disclosure, since these features are sufficiently disclosed (see above point 1). Finally, with respect to feature 1f2, the board sees no reason in E4 to make reception of safety program data from the user, i.e. loading of the program into memory 11, dependent on whether or not communications are taking place between the two processors 3 and 4, since either processor can receive data from the bus interface 5 and load it directly to the memory 11 and this would also plausibly be the case with a duplicated memory.

2.2.11 As regards the combination with E5, the board notes that E5 concerns a system in which controllers are located in different modules ("Geräte") individually connectable to a bus system (cf. Fig. 1 and col. 3, lines 23-27), whereas in E4 both processors 3 and 4 are sited in the same module with direct access to the same program memory 11. The "Aufdatverfahren" feature of E5, by which program data are transferred from a "primary" module to a redundant partner module, is therefore not obviously applicable to E4 and can only be applied with the benefit of hindsight. Furthermore, there is no disclosure in E5 that data is downloaded from a user only in the circumstances defined in features 1f1 and 1f2, since E5 apparently does not mention data download via an interface from a user to the primary controller module.

2.2.12 With respect to the combination of E4 with either E8 or E11, the board notes that E8 and E11 merely disclose that it is checked that the communications interface between processors is operating correctly before data are exchanged. However, in order to anticipate features 1f1 and 1f2 in the context of E4, data would have to be transferred from the user (i.e. via link 6 or 7) only once the connection between the two processors 3 and 4 were established to be operational. This aspect would not result from combining E4 with E8 or E11, since memory 11 can be loaded with program data without reference to the connection between the two processors.

2.2.13 With respect to the combination of E4 and E6, the respondent essentially argues that starting out from E4 the skilled person, when providing a duplicate program memory 11 in accordance with the hint in paragraph [0013], would, as an obvious step, provide each processor independently with its own memory. He would then recognise that E6 has the same structure as E4, modified in this way. This similarity would lead the skilled person to adopt the idea disclosed in E6 of providing a single connection from the user to the first processor/controller and a transfer program for transferring programming data from the first to the second processor. The remaining difference that reception of the safety program by the first processor/controller takes place only when the communication is taking place with the partner processor instead of, as disclosed in E6, receiving and buffering the program and transferring it to the partner processor at a suitable time point (cf. E6, col. 5, line 63 ff.) is a mere organisational difference obvious to the skilled person, or even non-technical in nature.

2.2.14 The board however already indicated in point 2.2.10 above that the first step of this argument, i.e. the association of one memory to each processor/controller, is not a step which would be obvious to the skilled person based on common general knowledge. Consequently, the appellant's attack based on E4 combined with E6 fails for the same reason, since the skilled person is required to take this same non-obvious step before combining with E6. Furthermore, combining E4 and E6 in any case does not arrive at the claimed subject-matter, since at least feature 1f2 would still not be present. In this respect, in E6, there is no indication that safety program information would only be received in dependence on communication between the two processors, since, as already stated, program data is apparently received without reference to the second processor and then buffered. Consequently, the skilled person has to take a further step to arrive at the subject-matter of claim 1. The requirement to take an additional (third) undisclosed step further supports the finding of non-obviousness.

2.2.15 The board concludes that the subject-matter of claim 1 as granted involves an inventive step when starting out from E4 (Articles 52(1) and 56 EPC).

3. Claim 24

The above conclusions apply, mutatis mutandis, to independent method claim 24.

4. Conclusion

The grounds for opposition pursuant respectively to Articles 100(a) and (b) EPC do not prejudice the maintenance of the patent as granted. It follows that the impugned decision must be set aside and that the opposition is to be rejected.

Order

For these reasons it is decided that:

The decision under appeal is set aside.

The opposition is rejected.