EN ISO 10218 'Safety requirements for industrial robots' from 2011 is valid for all industrial robots with regard to safety. In section '4.2 - Layout design', it states that the robot should be controlled manually from outside the protected area. This is defined as the "space limited by the external technical protective devices". Such a separation of human and robot as well as the protected and unprotected areas by a safety fence can be found in all traditional robot applications. If, for example, the door to the robot's fenced working area is opened and the protected area is breached, this activates the robot's safety stop. If it is nevertheless to be moved at this moment, for example for programming, this requires an additional protective measure. This is where the three-stage enabling switch comes into play: robot movement is only possible if the switch is held in its middle position. Releasing or pressing the button immediately stops the robot.

Robot arm with safety level (in blue) and light grid.

© Universal Robots

But what is the situation with collaborative applications in which humans and robots share a workspace? Here, the enabling switch is more of a hindrance in an application for which it is not required as a safety function and causes additional costs. The question therefore arises as to the conditions under which it can be dispensed with.

In practice, most HRC applications use force and power limitation or safety-related, monitored stops. In contrast to traditional robot applications, there are no fences separating the protected from the unprotected area. In order to decide whether an enabling switch is required, these two areas must therefore first be defined for the respective HRC application. In the case of force and power limitation, the measurement of clamping and free collision required for risk assessment also poses a particular challenge. However, there are two practical ways for integrators to simplify the risk assessment with additional safety measures.

The safety-rated monitored stop

In the variant of the safety-rated monitored stop, the robot stops as soon as a person enters its working area. As a rule, a laser scanner or a safety mat is used to act as a barrier and separate the protected and unprotected areas. For example, the laser scanner or the sensors on the safety mat detect a person approaching and switch the safe outputs to LOW if the distance falls below a certain level. This output is then usually routed to the robot's safety stop input. In this way, the safety mat or scanner replaces the safety fence and the monitored door inside it.

If the programmer has to stand closer to the robot than the safety mat or scanner allows during the safety-rated monitored stop for manual movements, it is necessary to monitor the movement of the robot using another safety function, temporarily release it and stop it again in an emergency. The three-stage enabling switch is therefore required here.

In the case of power and force limitation through inherent design or control, humans and machines work directly next to or with each other in the production process, for example at the same workbench. Only this variant of HRC is a collaboration in the true sense of the word: there is no protected area secured by an external periphery.

The force and power limiter

Safety is ensured by the force and power limitation of the robot and is therefore initially not location-dependent. However, according to EN ISO 10218-2, the so-called collaboration space, in which robots and humans meet and physical contact can occur, must be examined as part of a risk assessment. This verifies that there is no risk to humans in this area.

For the risk assessment, it is necessary to consider all possible collision scenarios of humans and robots, such as clamping or free collision in the collaboration space. As part of the risk assessment, measurements (in the case of clamping) or calculations (in the case of free impact) must be used to determine that the forces and pressures of a collision will not cause any injuries. If there is a successful risk assessment in accordance with ISO TS 15066, which came into force in 2016, and the safety functions confirmed in the risk assessment are active at all times, the enabling switch is not necessary for the collaborative system in this case.

Wiring diagram for safety inputs and outputs when divided into normal area and collaboration room.

© Universal Robots

Potential pinch and shear points are particularly dangerous for humans in collaborative applications with force and power limitation: The tissue of the affected body part must absorb the entire kinetic energy of the robot, as it is not possible to move back, for example if a hand lying on the table is trapped between the table and the robot. Therefore, when integrating a robot with force and power limitation, care should be taken to minimize potential pinch points as much as possible. As this is often difficult to achieve in practice, the use of additional safety settings for the robot is recommended. There are two options for this:

1. divide the collaboration room into two areas

A good way to avoid as many potential pinch and shear points as possible is to divide the workspace into two areas - the 'normal area' and the 'collaboration area'. In the former, normal safety parameters apply. The robot can work at higher speeds and the cut-off does not have to be set to a highly sensitive level, as there is normally no person in this area. In the collaboration area, however, the values of the safety parameters (speed, force, power, etc.) are reduced. The robot operates at a reduced speed and the shutdown is highly sensitive as soon as the robot detects a collision. Robot arms, such as those from Universal Robots, allow these two areas to be separated by external sensors - such as a light curtain - and by defined safety levels, which trigger the switchover from one area to the other when the robot passes through.

The collaboration space between man and machine can therefore be limited to the area in front of the light grid used for the robot. In this area, all pinch points and collision possibilities must therefore be examined to ensure that no injuries can occur in the event of physical contact. If this can be verified, no enabling switch is required here.

In this case, the area behind the grid - i.e. the normal area - is defined as a protected area in the conventional sense. If manual movements have to be carried out in this sector, a three-stage enabling switch is required, as no reduced safety parameters are used here and the clamping and collision situations in this area have probably not been investigated in detail.

Using the example of UR robots, the table summarizes the applications in which the enabling switch is generally required or not required.

© Image: Computer&AUTOMATION, Source: Universal Robots

This example shows that a level must be configured for the separation into a normal and a collaborative area. This is predefined in the safety settings using the "Trigger reduced mode" function. At the same time, the safety inputs and outputs must be electrically connected in such a case in order to combine the light curtain and the safety level. One safety output is configured as "non-reduced mode". This output has a low signal when the robot is operating in the normal range and a high signal when the robot passes through the level and thus moves into the collaboration space. This output is used to bridge the safety light barrier via an external circuit. The safety light barrier itself switches the safety stop input of the robot.

2. limit the robot's range of movement

Cell with several virtual boundaries that limit the movement space of the robot arm.

© Universal Robots

Another way to reduce the number of necessary measurements of force and pressure within the collaboration space of an application is to limit the possible movement space of the robot to the necessary minimum. This is particularly suitable for applications that do not use the entire working area of the robot. Safety levels that limit the tool center point (TCP) can also be used for this purpose. The robot cannot move outside these safety levels. Additionally or alternatively, the movement range of the individual joints can be restricted.

Without these additional restrictions, a robot could theoretically move very far. The entire possible range of movement would then have to be considered as a collaboration space and evaluated as part of a risk assessment with regard to entrapment and free collision. In practice, however, in most cases the robot performs its movements in a very reduced space. Therefore, as a general rule, the collaboration space should be kept as large as necessary but as small as possible. The inclusion of various safety levels therefore considerably simplifies the risk assessment, as only the potential clamping and collision points in the area released for the robot need to be checked by measurement or calculation.

As the safety levels used are effective in both automatic and programming mode and all danger points could be assessed thanks to the reduced movement space, the robot is now safe in both operating modes. An enabling switch is not necessary for programming work in this area!

Author:
Andreas Schunkert is Head of Technical Support Western Europe at Universal Robots.