Patent Application
20240399581
The present invention relates to a safety system for a robot arm where the safety system during operation of the robot arm is configured to monitor the robot arm and bring the robot arm into a safe state if the robot arm is brought into an unsafe mode of operation.
Robot arms comprising a plurality of robot joints and robot links where actuators can rotate or translate part of the robot arm in relation to each other are known in the field of robotics. The robot arm can comprise rotational joints where an actuator is configured to rotate a part of the robot arm, and/or prismatic joints where an actuator is configured to translate one part of the robot arm. Typically, the robot arm comprises a robot base which serves as a mounting base for the robot arm; and a robot tool flange where to various tools can be attached, and where a number of robot joints and robot links connects the robot base and the robot tool flange. A robot controller is configured to control the robot joints in order to move the robot tool flange in relation to the base. For instance, in order to instruct the robot arm to carry out a number of working instructions.
Typically, the robot controller is configured to control the robot joints based on a dynamic model of the robot arm, where the dynamic model defines a relationship between the forces acting on the robot arm and the resulting accelerations of the robot arm. Often, the dynamic model comprises a kinematic model of the robot arm, knowledge about inertia of the robot arm and other parameters influencing the movements of the robot arm. The kinematic model defines a relationship between the different parts of the robot arm, and may comprise information of the robot arm such as, length, size of the joints and links and can for instance be described by Denavit-Hartenberg parameters or like. The dynamic model makes it possible for the controller to determine which torques the joint motors shall provide in order to move the robot joints for instance at specified velocity, acceleration or in order to hold the robot arm in a static posture.
Typically, it is possible to attach various end effectors to the robot tool flange, such as grippers, vacuum grippers, magnetic grippers, screwing machines, welding equipment, dispensing systems, visual systems, force/torque sensors, which can be used together with the robot arm in order to perform various tasks. The robot arm needs to be programmed by a user or a robot integrator which defines various instructions for the robot arm, such as predefined moving patterns and working instructions such as gripping, waiting, releasing, inspection, screwing instructions. A software extension to the robot control software may be provided in order to be able to program an end effector mounted to the robot arm and the end effector provider may provide such software extension together with the end effector. For instance, the robot arm may be configured to carry out the method for extending end user programming of an industrial robot with third party contributions as disclosed in WO 2017/005272 incorporated herein by reference.
Additionally, the instruction can be based on various sensors or input signals which typically provide a triggering signal used to stop or start a given instruction. The triggering signals can be provided by various indicators, such as safety curtains, vision systems, position indicators, etc.
Robot arms are increasingly being used along and near humans and to increase the variety of work processes where robots can help humans an increased focus on safety, price and flexibility of the robots is demanded. The robot arms are thus provided with a safety system which monitors the operation of the robot arm and is configured to bring the robot arm into a safe stop upon hazardous situations where humans potentially can get hurt. The safety system is provided on different hardware than the robot controller and is configured to monitor various sensor signals related to the robot arm and to carry out a number of basic safety functions (for instance as described in WO 2015/131904 incorporated herein by reference) of the robot arm upon which the safety system brings the robot into a safe state if an unsafe state if registered. The known safety systems monitor the operation of the robot arm independently of eventual end effectors consequently the safety system can not bring the robot arm into a safe state if for instance an end effector is in an unsafe state. Additionally, the safety functions are provided by the robot arm manufacture which limits the safety functions to those provided by the robot arm manufactures.
The object of the present invention is to address the above described limitations with the prior art or other problems of the prior art. This is achieved by the robot and method according to the independent claims; where a robot controller is configured to
This makes it possible to set up user-defined safety functions which can be executed by a non-safety rated system like a robot controller and where a safety rated safety system can be configured to monitor the outcome of the user-defined safety functions and bring the robot arm to a safe state in case the user-defined safety parameter does not comply with the user-defined safety parameter range. As a result, it is possible to extend the safety functions of a robot system without need for modifying the safety rated safety system, and consequently the safety rated safety system does not need to be re-certified. Additionally, this makes it possible for third party providers to provide their own safety functions, for instance user-defined safety functions associated with external components such as end effectors or other safety components. For instance, the user-defined safety functions may be provided as safety rated user-defined safety functions executed at a non-safety rated robot controller, however due to the monitoring of the user-defined safety parameters by the safety rated safety system the overall safety rating of the robot system can be improved. The dependent claims describe possible embodiments of the robot and methods according to the present invention. The advantages and benefits of the present invention are described in the detailed description of the invention.
The present invention is described in view of exemplary embodiments only intended to illustrate the principles of the present invention. The skilled person will be able to provide several embodiments within the scope of the claims. Throughout the description, the reference numbers of similar elements providing similar effects have the same last two digits. Further it is to be understood that in the case that an embodiment comprises a plurality of the same features then only some of the features may be labeled by a reference number.
In the illustrated embodiment the joints comprise an output flange rotatable in relation to a robot joint body and the output flange is connected to a neighbor robot joint either directly or via an arm section as known in the art. The robot joint comprises a joint motor configured to rotate the output flange, for instance via a gearing or directly connected to the motor shaft. In embodiments with prismatic joints the output flange is translational in relation to the robot joint body and a joint motor configured to translate the robot output flange in relation to the robot joint body. Additionally, the robot joint comprises at least one joint sensor providing a sensor signal indicative of at least one of the following parameters: an angular position of the output flange, an angular position of the motor shaft of the joint motor, a motor current of the joint motor or an external force trying to rotate the output flange or motor shaft. For instance, the angular position of the output flange can be indicated by an output encoder such as optical encoders, magnetic encoders which can indicate the angular position of the output flange in relation to the robot joint. Similarly, the angular position of the joint motor shaft can be provided by an input encoder such as optical encoders, magnetic encoders which can indicate the angular position of the motor shaft in relation to the robot joint. It is noted that both output encoders indicating the angular position of the output flange and input encoders indicating the angular position of the motor shaft can be provided, which in embodiments where a gearing have been provided makes it possible to determine a relationship between the input and output side of the gearing. The joint sensor can also be provided as a current sensor indicating the current through the joint motor and thus be used to obtain the torque provided by the motor. For instance, in connection with a multiphase motor, a plurality of current sensors can be provided in order to obtain the current through each of the phases of the multiphase motor.
The robot arm comprises at least one robot controller arrange in a robot control box 109 and is configured to control the robot joints by controlling the motor torque provided to the joint motors based on a dynamic model of the robot arm, the direction of gravity acting 112 and the joint sensor signal. The robot controller can be provided as a computer comprising in interface device 104 enabling a user to communicate with the robot, for instance to control and program the robot arm. The controller can be provided as an external device for instance arranged in a robot control box 109 as illustrated in
The robot controller 202 comprises a processer 220 and memory 221 and is configured to control the joint motors of the robot joints by providing motor control signals 223a, 223b, 223f to the joint motors. The motor control signals 223a, 223b, 223f are indicative of the motor torque Tmotor,a, Tmotor,b, and Tmotor,f that each joint motor shall provide to the output flanges, and the robot controller is configured to determine the motor torque based on a dynamic model of the robot arm as known in the prior art. The dynamic model makes it possible for the controller to calculate which torque the joint motors shall provide to each of the joint motors to make the robot arm perform a desired movement. The dynamic model of the robot arm can be stored in the memory 221 and be adjusted based on the joint sensor parameters Jsensor,a, Jsensor,b, Jsensor,f For instance, the joint motors can be provided as multiphase electromotors and the robot controller can be configured to adjust to motor torque provided by the joint motors by regulating the current through the phases of the multiphase motors as known in the art of motor regulation.
The robot system comprises a safety system 225 monitoring the robot arm and comprises a safety processer 227 and safety memory 228. The safety system is configured to bring the robot arm into a safe state 226 based on at least one basic safety function evaluated by the safety system. The safe state is illustrated by a STOP sign indicating that one safe mode can be a mode where the robot arm is brought into a standstill, for instance by activating a brake system configured to brake the moving parts of the robot arm, by turning off power to the robot arm, etc. However, it is to be understood that the safe mode can be any mode of operation where the robot arm is considered safe in relation to a human, for instance the robot may be instructed to move at a reduced speed, to provide an indication signal (visible, audial, haptic etc. or combinations thereof) warning a human that an error has occurred. A basic safety function is a safety function provided to the safety controller and which is programmed and stored on the safety memory and which can not be edited or modified by an end-user. Typically, the basic safety functions are coded by the provider of the robot safety system. In some embodiments the user may at initiation of the robot system provide and modify the safety limits of which the basic safety functions applies.
The robot controller 202 and the safety system 225 are provided on different hardware for instance in form of different computer mother boards, microcontrollers, processors, computer servers and/or integrated circuits.
The robot controller is configured to provide at least one user-defined safety parameter range; where the user-defined safety parameter range defines a value or parameter that needs to be fulfilled during operation of the robot arm. The user-defined safety parameter range can for instance be defined by
The robot controller is configured to provide at least one user-defined safety parameter; where the user-defined safety parameter is provided based on a user-defined safety function. The user-defined safety function can be any function capable of providing a value indicating a safety state of the robot arm or an external device co-operating with the robot arm, for instance a value or parameter indicating if the robot arm is operating in a safe mode. The user-defined safety parameter can for instance be a value provided based on a number of sensor values indicating various properties of the robot arm or the environment, an end effector and/or any other external device connected to the robot system. The user-defined safety parameter can also be provided as trigger/pulse signal indicating the operational state of the robot arm. The user-defined safety parameter range can for instance be provided by a user-defined safety software code configured 229 to be executed by the robot controller processor, where the user-defined safety software code can be installed on the robot controller software. The robot controller is configured to provide the user-defined safety parameter to the safety system via a user-defined safety parameter signal 232. In one embodiment the safety system can optionally be configured to provide a confirmation signal 233 confirming receipt and configuration of the user-defined safety parameter by the safety system.
The safety system comprises a safety range monitoring safety function configured to monitor the robot controller by evaluating if the at least one user-defined safety parameter is within the user-defined safety range. This can be achieved via a number of logic tests comparing the user-defined safety parameter with the user-defined safety parameter range. If the user-defined safety parameter is outside the user-defined safety parameter range, then the safety system will bring the robot arm into a safe mode as described in paragraph [0015].
For instance, in an embodiment the user-defined safety parameter range can define an interval of values wherein the user-defined safety parameter must be in order for the robot arm to be in a safe mode and the logic test can test if the user-defined safety parameter is within the interval of values and provide an indication of whether or not the robot is operating in safe mode. The safety system can then bring the robot arm to a safe state if the logic test indicate that the robot arm is not operating in safe mode.
In another embodiment the user-defined safety parameter range can define a time interval within or without which the user-defined safety parameter must be sent to the safety system in order for the robot arm to be in a safe mode and the logic test can test if the user-defined safety parameter have been received within the defined time interval and provide an indication of whether or not the robot is operating in safe mode. The safety system can then bring the robot arm to a safe state if the logic test indicate that the robot arm is not operating in safe mode.
In another embodiment the user-defined safety parameter range can define checksum that needs to be fulfilled by the user-defined safety parameter in order for the robot arm to be in a safe mode and the logic test can test if the user-defined safety parameter fulfills the checksum and provide an indication of whether or not the robot arm is operating in safe mode. The safety system can then bring the robot arm to a safe state if the logic test indicate that the robot arm is not operating in safe mode.
In one embodiment the safety system is configured to provide a confirmation to the robot controller, where the confirmation indicates that the safety system has received the user-defined safety parameter range. This makes it possible to provide a control function as a part of the robot controller which ensures that the user-defined safety parameter range have been properly configured by the safety system. For instance, the robot controller can provide an indication to a user that the user-defined safety function is not functioning correctly.
In one embodiment the safety system is configured to monitoring receipt of the user-defined safety parameter and bringing the robot arm into a safe mode in case the user-defined safety parameter has not been received. This makes it possible to ensure that the safety system brings the robot arm into safe mode of operation in case the user-defined safety parameter have not been provided by the robot controller. Which provides further safety.
In one embodiment the robot controller is configured to receive at least one sensor signal indicating at least one of:
In one embodiment the robot system comprises a user interface enabling a user to communicate with the robot system and the user interface comprises an user interface for specifying at least one of the user-defined safety functions and/or the user-defined safety parameter. The user interface can for instance be provided as a graphical user interface where the user can enter and program the user-defined safety functions, define the user-defined safety parameter range.
In one embodiment the user interface for specifying at least one of the user-defined safety functions and the user-defined safety parameter range comprises means for providing user-defined safety software code to the robot controller and means for installing the user-defined safety software code at the robot controller, wherein the user-defined safety software code comprises instructions instructing the robot controller to:
For instance, the user-defined safety software code may be provided as part of a process control software or basic control software for the robot arm. Basic control software should be understood as software which is used by the robot controller to control movement of the robot arm i.e. of the individual joints and thereby of the robot flange and any robot tool attached thereto. The basic control software is typically developed based on a mathematical model of the robot arm and is delivered together with the robot arm. So that the user of the robot arm can move the robot arm without any particular programming skills. Process control software should be understood as software provided to the robot system from an external source such as a data processing unit, server, computer or tablet on which such process control software is stored or developed. The process control software can also be programmed directly on the robot system for instance by using a user interface device. Process control software can be simple coordinates in a three-dimensional Cartesian coordinate system defining waypoints for movement of the robot arm, program code defining the operation of a robot tool attached to the robot flange, advanced math for determine points in the Cartesian coordinate system, optimize precision e.g. in movements, sensors systems, etc. Hence, the robot controller controls the movement of the robot arm and tool based on a combination of process and basic control software, where the process control software provides at least one user-defined safety function defining a user-defined safety parameter and/or a user-defined safety parameter range.
In one embodiment the robot controller is provided as a non-safety rated robot control system, meaning that the robot controller does not fulfill the safety standard relating to robot systems. This has the advantage that the robot controller software can be provided as a partial open system where users can install user-defined software components.
In one embodiment the safety system is provided as a safety rated robot safety system meaning that the safety system fulfills the safety standards in relation to robot systems and thus can be used to monitor the robot system in a safe and reliable way.
The first safety controller comprises a first safety processor 327a and a first safety memory 328a which communicates and monitors the robot controller based on a first user-defined safety range signal 330a, a first confirmation signal 331a confirming receipt of the user-defined safety parameter range, a first user-defined safety parameter signal 332a and a first confirmation signal 333a confirming receipt of the user-defined safety parameter.
The second safety controller comprises a second safety processor 327b and a second safety memory 328b which communicates and monitors the robot controller based on a second user-defined safety range signal 330b, a second confirmation signal 331b confirming receipt of the user-defined safety parameter range, a second user-defined safety parameter signal 332b and a second confirmation signal 333b confirming receipt of the user-defined safety parameter.
The safety controller(s) is in an exemplary embodiment certified safety controller(s) meaning, that the safety level hereof is higher than the safety level of the robot controller 220. Reference to safety level may refer to average probability of failure of the hardware i.e. of the controllers. Hence, a high level safety controller has a lower average probability of failure than a robot controller. High level safety system which may include both hardware and software may be categorized according to SIL (SIL; Safety Integrity Levels) level 1-4 where 4 is highest.
Both the first safety controller and the second safety controller monitor the robot controller as described in
At least one of the robot controllers and/or the safety controllers is configured as a sending controller and at least another one of the robot controllers and/or the safety controllers is configured as a receiving controller. The sending controller is configured for sending a safety signal via the safety signal path to one or more receiving controllers.
The safety signal path may be used and implemented as part of the process or basic control software with the purpose of facilitating communication of a safety signal between the robot controller and the safety controllers (or safety controller if only one is present). The safety signal is in its simplest form a signal sent from the robot controller to each of the safety controllers, which if not received within a predetermined time from departure, will cause the safety controller to bring the robot arm in a stop mode. It should be mentioned that the signal could also be send from the safety controllers to the robot controller with the same purpose and result.
In one embodiment the sending controller is the robot controller and the one or more receiving controllers are at least one of the safety controllers. This ensure that the safety controller(s) can monitor the robot controller and bring the robot arm into a safe mode in case that a safety signal has not been received through the safety signal path as this can indicate malfunction of the robot controller.
In an exemplary embodiment, the safety signal is sent and therefore expected to be receive in a predetermined pattern or as a predetermined value. The predetermined pattern may be established as a sequence of signals separated by predetermined time periods. If not receive as expected, the receiving controller will bring the robot arm in stop mode. It should be mentioned, that an unexpected receipt of the safety signal may also include a too early receipt i.e. the expected receipt of the safety signal may be within a range specified by two endpoints. The lower endpoint may be measure in milliseconds such as 10 ms and the upper may be measured seconds such as 5 seconds or even in minutes.
The receiving controller may determine which stop mode the robot arm should be brought into. Examples are safeguard stop where the robot arm only stops but maintains powered on and violation stop where the robot arm is also powered off. The latter requires reset of controller to start up again which is not the case for the former.
The safety signal provides additional safety to the robot control system in that failure in either hardware or software can be detected, and the robot arm subsequently can be brought in a stop/safe mode.
It is noted that the user-defined safety software code facilitating a further safety feature in the form of a safety signal path between the robot controller 220 and the safety controller as illustrated in
The method comprises a step 441 of specifying a user-defined safety parameter range and a step 442 of providing the user-defined safety parameter range to the safety system. The safety system then configures a safety range monitoring safety function and sends in step 461 a confirmation to the robot controller. The robot controller evaluates whether or not the confirmation has been received from the safety system. In case the confirmation has been received indicated by thumb-up icon the robot controller continues the flow. In case the confirmation has not been received as indicated by thumb-down icon the robot controller restarts the flow or alternatively abandons the method. This ensures that the safety range monitoring safety function of the robot controller is properly configured.
The method comprises a step 444 of specifying a user-defined safety parameter and a step 445 of providing the user-defined safety parameter to the safety system. Step 444 and 445 can be performed by a user-defined safety function executed by the robot controller. The safety system then in step 462 initiates a safety range monitoring safety function and sends in step 463 a confirmation to the robot controller that the user-defined safety parameter has been received. The safety range monitoring safety function evaluates if the user-defined safety parameter is within the user-defined safety parameter range. If the evaluation is positive (indicated by a thumb-up icon) meaning that the robot arm is operating in safe mode then the operation of the robot arm can continue, and the robot controller is restarting step 444 of generating a new user-defined safety parameter. If the evaluation is negative (indicated by a thumb-down icon) meaning that the robot arm operating in un-safe mode then the operation of the robot arm is brought into a safe state of operation 226.
Additionally, the robot controller evaluates 446 whether the confirmation of the received user-defined safety parameter from the safety system have been received. In case the confirmation has been received indicated by thumb-up icon the robot controller restarts the flow. In case the confirmation has not been received as indicated by thumb-down icon the robot controller brings the robot arm into a safe mode of operation 226. This ensures that the robot arm is brought into a safe state in case the communication of the user-defined safety parameter fails or in case the safety system fails.
| Number | Date | Country | Kind |
|---|---|---|---|
| PA 2019 00407 | Apr 2019 | DK | national |
| PA 2019 01542 | Dec 2019 | DK | national |
| Number | Date | Country | |
|---|---|---|---|
| Parent | 17600677 | Oct 2021 | US |
| Child | 18807626 | US |
