SAFETY SYSTEM FOR INDUSTRIAL ROBOT

[0001] The present invention relates to robotic safety systems. More specifically the present invention is directed to an industrial robot implementing a safety system via predefined safety functions.

[0002] Robots are extensively used in the industry for applications such as electronic circuit board assembly and other automated assembly tasks. The particularly high popularity of modern robots is attributed to their simple construction, low cost, low maintenance, light weight, high accuracy, high speed and compliance characteristics.

[0003] Generally, the programming of robots used in industry requires specialized knowledge and can only be performed by persons skilled in the art, often referred to as system integrators. In connection with multi-purpose robots for use in industry or even at home some important safety issues still remain unsolved.

[0004] A conventional robot system is provided with a collision detection function which detects collision of a robot with its surroundings based on abnormal torque generated at the manipulator part of the robot. If collision is detected by this collision detection function, control is performed to stop the operation of the robot or otherwise lighten the collision force. Due to this, the damage to the robot and the devices provided at the robot as well as surrounding equipment is kept to a minimum.

[0005] However, when using a collision detection function for detecting collision between a human and a robot, it is necessary to raise the sensitivity to collision in order to ensure safety of the human. For this reason, it is sought to precisely estimate the frictional torque of the gears or speed reducers etc. provided at the different parts of a robot. In this regard, the frictional torque fluctuates depending on the outside air temperature and the operating state of the robot, so estimating the frictional torque with a high precision is difficult. Therefore, it was difficult to precisely detect collision between a human and a robot from the torques of the manipulator part of a robot and prevent harm to the human.

[0006] However, when a human directly contacts a robot without a carried object interposed between them, the force which occurs between the human and the robot is not detected. Further, even if attaching a force sensor for detecting force between the arm and hand of a robot etc., it is not possible to detect contact of the human at the arm portion of the robot which the sensor cannot detect. For this reason, in the prior art, it was not possible to provide a robot system which enabled safe interactive work when there was a possibility of a human and a robot coming into direct contact.

[0007] Capacitive sensors have been used to measure capacitance changes, which are caused in the electric field of the capacitor formed by the sensor as a result of the approach of an object. In addition to all electrically good conducting materials, capacitive sensors only detect those materials having an adequately high permittivity. Capacitive sensors are not useful as a safety device in the case of rapidly moving apparatuses with solid parts moved freely in space. In this connection a complete system is desirable, which permits a reliable human-machine cooperation.

[0008] A robot is a physical machine which can potentially be dangerous and cause harm to humans by colliding with them. In case of hardware or software defects, the robot might even do unexpected motions, which were not anticipated by the system integrator (the person responsible for the safety when setting up the robot). For this reason, it can be very desirable for a robot to have an improved safety system.

[0009] US2010/0324733 discloses a robot with a safety system comprising a joint, a first torque sensor and a second torque sensor mounted at each joint. Torque sensors (such as straing gagues) are not applicable for obtaining a reliable safety control system. Moreover, the sensors in US2010/0324733 are connected to two computing units S1, S2 in the form of integrated circuits (ICs), which have microcontrollers, within a transmitter unit S. Thus, US2010/0324733 does not have all sensor circuits placed on the same component, which renders it less applicable for safety control.

[0010] The problem of the invention is to provide a safety device for the operation of apparatuses with parts freely movable in space, which permits the reliable and safe operation of such apparatuses without complicated and costly peripherals and which also ensures that collisions between apparatus parts and humans or objects are detected reliably at an early stage, so that in addition to avoiding planning and production costs there is a considerably reduced space requirement for such installations, so that in future people and machines can jointly use working areas.

[0011] The above and other objects are according to the present invention attained by a programmable robot system having a special safety control system.

[0012] It is specifically an object of the present invention to provide a programmable robot system which can be programmed in a simple and easy manner without this requiring specialized knowledge, i.e. which can be performed for instance by an operator or technician in industry or even by a private person for instance at home. Specifically the safety control system utilizes two position sensors in each robot joint to achieve desired safety functions as will be explained in more detail below. The position sensors are used for sensing the angular or linear position on the input or output side of the gear or similar transmission device. If any violations of operational limits or errors in hardware or software is discovered by any of the safety functions, the robot will be brought to a safe state.

[0013] In accordance with the present invention the system is designed so that no single failure in either software or hardware can cause the robot to become dangerous. A common way of realizing this is to have two separate systems (branches) for performing the safety functions. Both of these systems can independently shut off power to the robot. Each of these systems can monitor the desired safety parameters.

[0014] The present inventors have found that placing position sensors on both sides of the gear certain safety issues relating to industrial robots can be solved in a simple manner. In the robot joint the sensors are placed so that one position sensor sits on the input side of the gear (motor side) and one sits on the output side of the gear (robot arm side). Importantly, the control unit processes information from the two sensors to realize one or more safety functions by having all sensor circuits placed on the same component (in contrast to US2010/0324733 that uses separate components for the sensor circuits). The safety system executes a multitude of safety functions, based on the two sensors. Each safety function compares its used values with second branch, and in case of disagreement, brings the robot to the safe state. In order to prevent failures due to safety violations, most of the safety functions also limit the parameters. They can for instance limit the velocity of the robot arm movement in order to avoid momentum violation. The safety functions are herein defined as:

[0015] Joint Position Limit Safety Function:

[0016] In the first system, the output side position sensor directly monitors the angle of the robot joint, and detects if it goes outside the limit defined by the safety settings. In the second system, the input side position sensor calculates the corresponding output side position, by taking the number of full revolutions and the gear ratio into account.

[0017] Joint Speed Limit Safety Function:

[0018] The speed of the robot joint can be approximated by the difference in position over a time interval (numerical differentiation). In case of high resolution position sensors and a good time measurement, this can be fairly accurate. Hereby a speed safety function in each of the two safety system branches is realized.

[0019] Joint Torque Limit Safety Function:

[0020] By knowing the position and speed of each robot joint, and the distribution of mass in the robot arm, the expected torque exerted in each robot joint can be calculated (output side). The motor currents are also measured to estimate the motor side torque on the joint (input side). These two systems can be used to verify that the torque is within a given limit.

[0021] Tool Position Limit Safety Function:

[0022] Where the two sensors are used in combination with software models of the robots kinematics to deduce the position of the robot arm end effector, and make sure that this position is within some user-defined limits.

[0023] Tool Orientation Limit Safety Function:

[0024] Where the two sensors are used in combination with software models of the robots kinematics to deduce the orientation of the robot arm end effector, and make sure that this orientation is within some specified angular limits.

[0025] Tool Speed Limit Safety Function:

[0026] Numerical differentiation of the position can be used to estimate the speed of the Tool, similar to the “Joint Speed Limit Safety Function” and “Tool Pose Limit Safety Function”.

[0027] Tool Force Limit Safety Function:

[0028] The expected torque mentioned in the “Joint Torque Limit Safety Function” can be projected into Cartesian space, to realize a force limiting function.

[0029] Momentum Limit Safety Function:

[0030] The position and speed of the robot joints can be used to calculate and limit the momentum of the robot and the payload at any given point in time, using a model of the distribution of mass in the robot arm and the payload.

[0031] Emergency Stop Safety Function:

[0032] When emergency stop is pressed, the redundant speed measurement is used to check that the robot is actually decelerating, whereby the robot decelerates actively and within the programs trajectory, in a fail safe way.

[0033] Safeguard Stop Safety Function:

[0034] The speed estimation can also be used to control and ensure a redundant deceleration of the robot when a safeguard input is active.

[0035] Power Limit Safety Function:

[0036] By reducing the torque produced by the joints, based on the speeds of the joints, is used for making sure that the total mechanical work produced by the robot is kept within a certain limit.

[0037] Robot Moving Digital Output Safety Function:

[0038] The two sensors can each detect whether the robot joints are moving, and set the output accordingly.

[0039] Robot Not Stopping Digital Output Safety Function:

[0040] The two sensors can in combination with the current consumption in the joints each detect if the robot is not actively braking or stopped, and set an output accordingly.

[0041] Reduced Mode Zone Safety Function:

[0042] The two sensors can be used to monitor where the robot is in its workspace, and change the safety parameters accordingly. E.g. the robot moves faster inside the CNC machine than outside, because the risk of hitting a person is much smaller inside the CNC machine.

[0043] The Tool-based safety function consider a point on the Tool, such as the TCP (Tool Centre Point) or a point on a flange on the robot.

[0044] Accordingly, the present invention provides in a first aspect an industrial robot having a safety system comprising:

• • [0045] a joint connecting two robot arm sections of a robot arm and equipped with a gear or similar transmission device for transmission of force or torque from one arm section to the other;
  • [0046] a first position sensor for sensing the position on the input side of the transmission;
  • [0047] a second position sensor for sensing the position on the output side of the transmission;
  • [0048] control unit for implementing a software model of the physical robot arm, including kinematics and dynamics calculations;
  • [0049] user interface means comprising means for programming the robot, said user interface means being either provided externally to the robot, as an integral part of the robot or as a combination hereof;
  • [0050] storage means co-operating with said user interface means and said control unit for storing information related to the movement and further operations of the robot; wherein the control unit processes information from the two position sensors to realize one or more safety functions, such as 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, or 19 of the following safety functions:
  • [0051] Joint Position Limit Safety Function, wherein the second position sensor directly monitors the angle of the robot joint, and detects if the angle is beyond a predefined angle range, whereas the first position sensor calculates the corresponding output side position based on the number of full revolutions and gear ratio;
  • [0052] Joint Speed Limit Safety Function, wherein the speed of the robot joint is determined by the difference in position over a time interval;
  • [0053] Joint Torque Limit Safety Function, wherein the position and speed of the robot joint in conjunction with the distribution of mass in the robot arm is used to calculate the expected torque exerted in the robot joint;
  • [0054] Tool Speed Limit Safety Function, wherein numerical differentiation of the position is used to estimate the speed of the Tool;
  • [0055] Tool Force Limit Safety Function, wherein expected torque calculated in said Joint Torque Limit Safety Function is projected into Cartesian space, to obtain a force limiting function;
  • [0056] Momentum Limit Safety Function, wherein the position and speed of the robot joints can be used to calculate and limit the momentum of the robot and the payload at any given point in time, using a model of the distribution of mass in the robot arm and the payload;
  • [0057] Emergency Stop Safety Function, wherein emergency stop is activated, the redundant speed measurement is used to check that the robot is actually decelerating, whereby the robot decelerates actively and within the programs trajectory, in a fail safe way;
  • [0058] Safeguard Stop Safety Function, wherein the dual-sensor based speed estimation is used to control a redundant deceleration of the robot when a safeguard input is active;
  • [0059] Power Limit Safety Function, wherein the position and speed of the robot joints, combined with kinematics and dynamics models of the arm constantly monitor whether the total mechanical work produced by the robot arm is kept within a certain limit;
  • [0060] Robot Moving Digital Output Safety Function, wherein the two sensors each detect whether the robot joints are moving, and set an output accordingly;
  • [0061] Robot Not Stopping Digital Output Safety Function, wherein the two sensors each detect if the robot is not actively braking or stopped and set an output accordingly;
  • [0062] Reduced Mode Zone Safety Function, wherein the two sensors are used to monitor, whether the robot is in its workspace, and change the safety parameters accordingly;
  • [0063] Tool Position Limit Safety Function, wherein the two sensors are used in combination with software models of the robots kinematics to calculate the position of the robot arm end effector, and make sure that this position is within some user-defined limits; and
  • [0064] Tool Orientation Limit Safety Function, wherein the two sensors are used in combination with software models of the robots kinematics to calculate the orientation of the robot arm end effector, and make sure that this orientation is within some specified angular limits.

[0065] In a preferred embodiment of the present invention the sensors sense angular or linear position. Preferably the first position sensor senses the position on the input side of the gear, whereas the second position sensor senses the position on the output side of the gear.

[0066] In a preferred embodiment of the present invention the control unit uses information from the two sensors to realize at least the following safety functions:

• • [0067] Joint Position Limit Safety Function;
  • [0068] Joint Speed Limit Safety Function; and
  • [0069] Joint Torque Limit Safety Function.

[0070] In another aspect of the present invention there is provided a method for safety control of an industrial robot, which method performs the above recited safety functions.

[0072] In accordance with the present invention the system is designed so that no single failure in either software or hardware can cause the robot to become dangerous.

[0073] A common way of realizing this is to have two separate systems for performing the safety functions. Both of these systems can independently shut off power to the robot. Each of these systems can monitor the desired safety parameters. The two systems should be as diverse as possible to avoid common cause failures. These failures could be compiler errors, methodology errors, software bugs, electronics glitches. To overcome this, the two branches of the safety system software is made by two independent teams of programmers, the source code is compiled by different compilers, and run on different microprocessors. The two branches use different hardware to measure the angular positions, and two different ways of cutting off the power supply in case of a failure.

[0074] Since the safety control system utilizes two sensors in each robot joint to achieve desired safety functions defined above a more detailed description of such a modified robot joint is provided below.

[0075] With reference to FIG. 1 there is shown a cross sectional view through a joint according to an embodiment of the invention. The joint comprises mechanical, electro-mechanical, electronic and optical elements that are mutually interconnected, either directly via electrical connectors or via wireless, for instance optical, coupling to other elements. In order to ensure the most simple and straightforward mounting and connection of these elements it is advantageous if as many as possible of these elements are provided on one printed circuit board 131 (PCB). A cross sectional view through an embodiment of a joint, which can be used in six-axis robots, but it is understood that this joint could also be used in connection with other robots.

[0076] In the shown embodiment position sensors 132, 133 are used and a safety brake 134, 135 is implemented. The brake is designed such that the solenoid 134 can activate and deactivate the brake with a very limited force.

[0077] The sensor 133 used for determining the position (angular orientation of the axle/rotor) of the motor (angular orientation) is mounted at the rear surface of the PCB 131. The motor shown in FIG. 1 comprises a stator part 136 and a rotor part 137.

[0078] The sensor 132 used for determining the angular orientation of the output axle 138 or output flange 139 of the joint is mounted on the front surface of the PCB or in a socket on the front surface of the PCB 131. Preferably a high resolution sensor is used and the short distance between the hollow axle 138 and the sensor is important in order to attain a proper positioning of sensor and encoder disc relative to each other. In order to be able to sense the movement (rotation) of the output flange 139 at the PCB 131 through the joint the encoder disc 140 is mounted on the hollow axle 138 through which electrical and pneumatical connections 141 are guided through the joint and the hollow axle 138 is connected to the output flange 139.

[0079] The safety brake 134 and 135, which stops the robot 137 for instance at power drop-out, is formed as an integral part with the PCB 131. The solenoid 134, which in the event of power drop-out displaces a ratchet 142 into engagement with an annular member 135 mounted on the motor axle 143, is mounted directly on the PCB 131. This annular member 135 (friction ring) can rotate relative to the motor axle, but there is a high friction between the annular member and the motor axle 143. This ensures a controlled halt of the joint but without halting the joint so abruptly that the robot arm becomes overloaded. In the figure, friction between the annular member 135 and the motor axle 143 is ensured by O-rings 144 tightly fitted between the motor axle 143 and the annular member 135 (friction ring).

[0080] Furthermore, the joint according to this embodiment of the invention is designed such that adjacent joints can be attached to each other without use of further elements. Attachment of the joint to an adjacent joint or connecting member (for instance a thin-walled tube) takes place via the output flange 139 and the connecting portion 145 on the housing 146 of the joint. Apart from this, robot joints according to the invention can be coupled together by suitable members, for instance thin-walled tubes, which constitutes a preferred choice due to their optimal rigidity/weight ratio. Furthermore, the joint according to this embodiment of the invention comprises a seal 147 between the housing 146 and the output flange 139, main bearings 148 resting against inclined inner surface portions (bearing surfaces) 155 provided in the housing 146, sealed bearings 149, transmission 150, at least one passage 151 for connections from an adjacent joint or connecting member, an area/space (152) for a slip ring and for twisting wires 141, when the output members 138, 139 rotate, further bearings 153 and a plate 154, for instance of aluminium or other suitable material, for mounting the PCB 131 and also for acting as a heat sink for power electronics in the joint.

[0081] Instead of a pair of thrust angular-contact needle bearings shown in the figure as the main bearing arrangement in the joint, a single four point of contact ball bearing or a single crossed roller bearing or a pair of angular contact ball bearings could be used.

[0082] Furthermore, instead of the shown eccentric gear arrangement with a single eccentric pinion, an eccentric gear arrangement with 2 pinions, phaseshifted 180 degrees, or 3 pinions, phase shifted 120 degrees could be used. Alternatively, a harmonic drive gear can be used in the unit, either with or without an integrated output bearing.

[0083] Although a number of specific embodiments have been shown and described above, it is understood that the present invention, both the robot itself, the user interface means used for programming and controlling the robot and the entire control system as such may be implemented in a number of different ways. Thus, for instance numerous alternative menu pages on the user interface may be designed. The scope of the invention is thus defined by the appended claims including technical equivalents of these. It is furthermore understood that the user interface means of the invention may also be used in connection with other robots than those shown, described and claimed in the present application and that this also applies to the electro-mechanical elements of the robot, such as the joints with drive means, encoders, etc.