Robots are partly completed machinery in the sense of the Machinery Directive 2006/42/EC. The two standards ISO 10218 'Safety of Industrial Robots' Part 1: 'Robots' and Part 2: 'Robot systems and integration' are available for detailed safety requirements in industry. The German versions of both parts are published as EN ISO 10218-1:2011 and EN ISO 10218-2:2011 and are listed as harmonized C standards under the Machinery Directive 2006/42/EC.

In practice, however, the existing standards proved to be insufficient to safely implement actual collaboration between humans and machines, in which the respective workspaces can overlap in terms of time and space. There was a gap in the standards here, which was closed in spring 2016 with the publication of the technical specification ISO/TS 15066 'Robots and robotic devices - Collaborative industrial robots'. This document describes the four collaboration types 'safety-assessed monitored stop', 'hand guidance', 'speed and distance monitoring' and 'power and force limitation' as protection principles in more detail.

When planning an HRC application, it is important to consider which of the four methods (individually or in combination) from ISO/TS 15066 will be used. This determines which type of robot can be used: for example, sensitive - i.e. with integrated safety functions - or non-sensitive. Further criteria for the choice of robot are the required payloads and ranges.

It all starts with a risk assessment

As soon as there is an initial idea of the application, there is a basis for discussion and a risk assessment can begin. If safety considerations are only made during or after the robot application has been set up, this often results in major conversion measures. Productivity and safety cannot be reconciled in this way.

Regardless of the method chosen, when implementing a robot application, it is important to bear in mind that, according to the Machinery Directive, the robot itself is only an incomplete machine; only the gripper or the tool required for the respective application gives the robot a specific purpose and must be regarded as a complete machine. The integrator or user thus becomes the manufacturer of the machine and is responsible for CE marking, including safety checks. Corresponding guidelines for risk assessment and risk reduction are defined in EN ISO 12100 'Safety of machinery'.

The iterative process is decisive for risk assessment. This is divided into the steps of risk analysis and risk evaluation. The contents of the risk assessment include identifying the applicable harmonized standards and regulations, determining the limits of the machine, identifying all hazards within each phase of the machine's life, the actual risk assessment and evaluation and the recommended approach to reducing the risk. It is important for the risk assessment to consider each hazard individually and without protective measures. An individual safety concept and system integration are developed on the basis of the risk assessment.

The challenge with fenceless robot applications is that the boundaries between the two work areas of man and machine become blurred. In addition to the dangers posed by the robot, human movements must also be taken into account. However, these are not always calculable in terms of speed, reflexes or the sudden entry of additional people.

No protective fence - more dangers

Even if robots have safety functions and production technology has a great deal of experience in designing workstations: New questions always arise when implementing HRC applications, especially if this is implemented according to 'Method 4' (see box) and collisions - intentional or accidental - are therefore possible. The type of collision also plays a role here. There are basically two different types of collision: 'Transient contact' between humans and robots corresponds to an impact by the robot. The human is hit by the robot, but has the opportunity to retreat. They are not trapped. Quasi-static' contact between man and machine, on the other hand, corresponds to the human being being crushed. Evasion is not possible and the person may be trapped and unable to free themselves.

In contrast to machines that are enclosed, planners must also consider the near field in HRC applications. The aim is to eliminate the risk of tripping - tripping hazards caused by cables, for example. Furthermore, foreseeable misuse must be taken into account. For example, the fact that a tool required for an application can sometimes fall out of the hand.

As the number of collision scenarios increases, so does the complexity in terms of safety. Accordingly, the design of HRC applications aims to minimize collisions. In terms of design, this can mean that robot arms are also mounted on the ceiling or under the work surface. When programming the robot, it makes sense to keep the robot's workspace as small as possible. Because if the robot can't reach it, it can't touch it. In addition, the programmer should parameterize the force and speed of each joint so that unnecessarily high values are avoided. For robot arms with six or more axes, this can mean an enormous programming effort.

It depends on the validation

The collision measurement set is used to measure the force and pressure generated in the event of a collision between a human and a robot. The set is therefore suitable for validating human-robot collaborations in accordance with ISO/TS 15066.

© Mushroom

Validation is one of the most important steps on the way to CE marking. It is essential for proving that a machine complies with the safety regulations. Here, the previous steps are reflected again. In contrast to risk assessment, validation looks at each hazard point with protective measures. The robot application must be in a ready-to-deliver condition for this.

According to the standard, various methods must be used for validation, including visual inspections, practical tests and measurements. The validation includes verification of the required performance level PLr, a fault simulation, a tracking distance measurement - if the HRC application is to be safeguarded by means of speed and distance monitoring - testing of the EN ISO 10218-2 Annex G checklist and a collision measurement in the event of a power and force limitation. In total, the system integrator must validate over 200 points.

Force and pressure measurement

Ultimately, a measurement procedure must be used to determine whether the possible collisions are harmless in terms of safety. Annex A of TS ISO/TS 15066 lists a body model with 29 specific body zones divided into twelve body regions. The body zone model provides information on the respective load limit values for each body part (for example on the head, hand, arm or leg) with regard to force and pressure. The body region with the lowest permissible
permissible collision values is the face. A maximum force of 65 N and a pressure of 110 N/cm2 may be applied here. If the application remains within these limits during an encounter between humans and robots, the collision can be classified as safe. This is the basis for eliminating the safety fences.

The technical specification does specify that the limit values must be observed and which limit values apply to which parts of the body. What is not described, however, is how pressures and forces must be measured. There is currently a lack of standards here in order to obtain comparable results, regardless of who carries out the validation.

MRK requires its own methodology

Pilz has used the inspection of light barriers as a basis for setting up a corresponding measurement procedure and has developed its own methodology with corresponding specifications. It describes, for example, how collision points are determined. To ensure the reproducibility of the measurement, a measurement is always described with a start, collision and end point. Pilz has developed its own collision measurement set for special force and pressure measurement. Equipped with springs and corresponding sensors, the system precisely measures the forces and pressure acting on the human body and compares them with the limit values in accordance with ISO/TS 15066. The measuring device is installed at the positions determined during the risk assessment - between the robot arm and a rigid, unyielding base. This simulates quasi-static contact, such as the worker being crushed between the robot and the system. The collision must take place under 'worst case' conditions. This means that the maximum safe reduced speed must be used and not the speed in the application.

If the limit values are exceeded, the dynamics of the robot must be reduced or additional safety measures such as light grids or a separating protective device must be installed.

Finally, once all verification and validation steps have been carried out, the validation report is created. This contains all the details of the analyses and tests carried out in a comprehensible form. If the results are documented in detail, the validation complies with the specifications for measurement methods. These stipulate that they must be understandable, comprehensible and reproducible. This is an important part of the machine documentation of an HRC application according to method 4.

Only then can the robot application receive the CE mark. With this mark, a manufacturer documents that he has taken into account all European single market directives relevant to his product and that all applicable conformity assessment procedures have been applied.

The requirements for safety technology always depend on the respective application. Safe robot cells are only created when the robot, tool and workpiece as well as associated machines, such as conveyor technology, are considered as a whole. In practice, this means that each application requires its own in-depth safety-related consideration. ISO/TS 15066 already provides a normative framework for this, with standards for the associated validation, productivity and safety can be combined even better.

Author:
Jochen Vetter is Manager Robot Safety at Pilz.