阅读说明：本技术 具有可在运行时适配的安全限值的机器人臂安全系统 (Robot arm safety system with safety limit values that can be adapted during operation ) 是由 安德斯·比莱索·贝克 大卫·勃兰特 雅各布·舒尔茨·奥姆霍吉 斯特凡诺斯·纳西奥普洛斯 于 2020-04-01 设计创作，主要内容包括：本发明公开了一种机器人系统,该机器人系统包括机器人臂和安全控制器,该机器人臂由过程控制器根据基本软件和过程软件的组合控制,该安全控制器被配置为监测和评估机器人臂的操作。该基本软件与具有限制机器人臂的操作的正常值的安全限值相关联。该过程软件与具有不同于正常值的过程值的至少一个安全限值相关联。安全限值的值被配置为在该机器人系统处于运行时模式时通过该过程值更新,并且该机器人安全控制器被配置为基于操作参数的评估结果、该至少一个安全限值的正常值和过程值来使该机器人臂进入违规停止模式。(A robotic system includes a robotic arm controlled by a process controller according to a combination of basic software and process software, and a safety controller configured to monitor and evaluate operation of the robotic arm. The base software is associated with safety limits having normal values that limit the operation of the robotic arm. The process software is associated with at least one safety limit having a process value different from the normal value. The value of the safety limit is configured to be updated by the process value when the robotic system is in a runtime mode, and the robot safety controller is configured to cause the robotic arm to enter an offending stop mode based on the result of the evaluation of the operational parameter, the normal value of the at least one safety limit, and the process value.)

1. A robotic system, comprising:

-a robotic arm (101) comprising a plurality of robotic joints (103a to 103f) connecting a robotic base (105) and a robotic tool flange (107);

a robotic process controller (202) configured to control operation of the robotic arm in accordance with a combination of basic control software and process control software,

a robot safety controller configured to monitor and evaluate operation of the robot arm,

wherein the basic control software is associated with a set of safety limits, each safety limit having a normal value that limits operation of the robotic arm when controlled by the robotic process controller in accordance with the basic control software,

wherein the process control software is associated with at least one safety limit of the set of safety limits having a process value different from at least one of the normal values,

wherein the process value of at least one safety limit is configured to change when the robotic system is in a runtime mode, and

wherein the robot safety controller is configured to cause the robot arm to enter an offending stop mode if the evaluation of one or more operating parameters results in a violation of a more restrictive one of the normal value and the process value of the at least one safety limit.

2. The robotic system of claim 1, wherein the safety process controller is configured to compare the normal value of a safety limit to a process value of the same safety limit to establish the more restrictive value of the two.

3. The robotic system of any one of claims 1-2, wherein the robotic process controller is configured to place the robotic arm in a protection stop mode if the robotic process controller estimates that an operating parameter violates the more restrictive of the normal and process values for the at least one safety limit.

4. The robotic system of any one of claims 1-3, wherein the robotic process controller is configured to cause the robotic arm to enter a protected stop mode if the evaluation of one or more operating parameters by the robotic process controller results in violation of the normal value minus an offset and the process value minus the more restrictive value of offsets of the at least one safety limit.

5. The robotic system of any one of claims 1-4, wherein the robotic process controller is configured to cause the robotic arm to enter the violation stopping mode if the evaluation of one or more operating parameters by the robotic process controller results in the normal value minus an offset and the process value minus the more restrictive value of offsets that violate the at least one safety limit.

6. The robotic system of any one of claims 1-5, wherein the robotic process controller is configured to compare the normal value of a safety limit to a process value of the same safety limit to establish the more restrictive value of the two.

7. The robotic system of any one of claims 1-6, wherein the robotic process controller is configured to control the robotic arm in a reduced mode of operation based on a reduced normal value of one or more safety limits.

8. The robotic system according to any one of claims 1 to 7, wherein the value of a safety limit is updated by a process value when process software is uploaded to a memory from which the robotic process controller is able to execute basic control software and process control software.

9. The robotic system of any one of claims 1-8, wherein the set of safety limits are stored on a safe memory.

10. The robotic system of any one of claims 1-9, wherein the safety limit is selected from a list comprising: tool center point velocity, tool center point force, elbow velocity, elbow force, joint velocity, joint position, stopping distance, stopping time, power limit, torque limit, and tool direction.

11. The robotic system of any one of claims 1-10, wherein at least one of the controllers including the list of robotic process controllers, robotic safety controllers, and joint controllers is configured to perform the evaluation of one or more operating parameters.

12. The robotic system of any one of claims 1-11, wherein the evaluation of one or more operating parameters includes establishing values for the one or more operating parameters and comparing the established values to at least one associated safety limit.

13. The robotic system of any one of claims 1-12, wherein a security rating of the robotic safety controller is higher than a security rating of the robotic process controller.

14. The robotic system of any one of claims 1-13, wherein the robotic safety controller is configured to provide an acknowledgement to the robotic process controller, wherein the acknowledgement indicates that the robotic safety controller has received the process value for the at least one safety limit.

15. The robotic system of any one of claims 1-14, wherein the robotic system comprises at least two independent robotic safety controllers disposed on different hardware, wherein each independent robotic safety controller is configured to cause the robotic arm to enter the violation stopping mode if the evaluation of one or more operating parameters by one of the at least two robotic safety controllers results in a violation of the normal value of the at least one safety limit and the more restrictive value of the process values.

16. The robotic system of any one of claims 1-15, wherein the robotic system includes a user interface enabling a user to communicate with the robotic system, wherein the user interface includes a user interface device for changing a value of at least one of the process values or at least one of the safety limits while the robotic arm is in a runtime mode.

17. The robotic system of any one of claims 1-16, wherein the value of the operating parameter is established by a sensor providing input to the robotic system.

18. A method of monitoring a robotic system, wherein the robotic system comprises:

-a robotic arm (101) comprising a plurality of robotic joints (103a to 103f) connecting a robotic base (105) and a robotic tool flange (107);

a robotic process controller (202) configured to operate the robotic arm according to basic control software, wherein the operation of the robotic arm according to the basic control software is limited by normal values of safety limits for each of a plurality of operating parameters, and

a robot safety controller configured to monitor and evaluate operation of the robot arm,

wherein the robot process controller and the robot safety controller are arranged on different hardware, characterized in that the method comprises the steps of:

establishing, via a data processing unit, process control software and associated process values for at least one of the safety limits for the plurality of operating parameters,

storing the process control software comprising the at least one process value on a robot system memory,

controlling, by the robotic process controller, operation of the robotic arm based on a combination of the basic control software and the process control software,

establishing real-time values of at least one operational parameter during operation of the robot arm, and

-entering, by the robot safety controller, the robot arm into an illegal stop mode if the evaluation of the real-time value of the at least one operating parameter violates the normal value of the safety limit value of the at least one operating parameter and the more restricted value of the process values.

19. The method of claim 18, wherein the method includes the step of comparing the normal value of a safety limit to a process value of the same safety limit to establish the more restrictive value of the two.

20. The method according to any one of claims 18 to 19, wherein the method comprises the step of evaluating whether the real-time value of the at least one operating parameter violates the normal value of the safety limit value of the at least one operating parameter and the more restricted value of the process values.

21. The method of claim 20, wherein the step of evaluating whether the real-time value of the at least one operating parameter violates the normal value of the safe limit value for the at least one operating parameter and the more limited of the process values comprises the step of comparing the at least one operating parameter with the normal value of the safe limit value for the at least one operating parameter and the more limited of the process values.

22. The method according to any one of claims 18 to 21, wherein the method comprises the steps of:

-entering, by the robotic process controller, the robotic arm into a protection stop mode if the evaluation of the real-time value of the at least one operating parameter violates the normal value of the safety limit value of the at least one operating parameter and the more restricted value of the process values.

23. The method according to any one of claims 18 to 22, wherein the method comprises the steps of:

-entering, by the robotic process controller, the robotic arm into a protection stop mode if the evaluation of the real-time value of the at least one operating parameter violates the more restrictive value of the normal value minus offset and the process value minus offset of the safety limit of the at least one operating parameter.

24. The method according to any one of claims 18 to 23, wherein the method comprises the steps of:

-entering, by the robotic process controller, the robotic arm into the violation mode if the evaluation of the real-time value of the at least one operating parameter violates the more limited value of the normal value minus offset and the process value minus offset of the safety limit of the at least one operating parameter.

25. The method according to any one of claims 18 to 24, wherein the method comprises the steps of:

establishing, by one or more joint controllers, said real-time values of said at least one operating parameter.

26. The method according to any one of claims 18 to 25, wherein the method comprises the steps of:

establishing the real-time values of the at least one operating parameter by a sensor providing input to the robotic system.

27. The method of any one of claims 18 to 26, wherein the evaluating is performed by one or more joint controllers.

28. The method of any of claims 18 to 27, wherein a signal indicative of the result of the evaluation is provided to at least one of the process controller and the safety controller, and based thereon, at least one of the process controller and the safety controller determines whether a change in an operating mode of the robotic arm is required.

29. The method of any of claims 18 to 28, wherein the method further comprises the step of adjusting process values while the robotic system is in a runtime mode.

30. The method of any of claims 18 to 29, wherein the process control software is established via an external data processing unit.

Technical Field

The present invention relates to a safety system for a robotic arm, wherein the safety system is configured to monitor the robotic arm during operation of the robotic arm and to cause the robotic arm to enter a safe state if the robotic arm enters an unsafe operating mode.

Background

Robotic arms comprising a plurality of robotic joints and robotic linkages, wherein an actuator may rotate or translate a portion of the robotic arm relative to each other, are known. The robotic arm may include a rotational joint in which the actuator is configured to rotate a portion of the robotic arm and/or a translational joint in which the actuator is configured to translate a portion of the robotic arm. Generally, a robot arm includes: a robot base serving as a mounting base of the robot arm; and a robotic tool flange to which various tools may be attached, and wherein the plurality of robotic joints and robotic links connect the robotic base and the robotic tool flange. The robot controller is configured to control the robot joint to move the robot tool flange relative to the base. For example, to instruct the robotic arm to perform a plurality of work orders.

Typically, the robot controller is configured to control the robot joints based on a dynamic model of the robot arm, wherein the dynamic model defines a relationship between forces acting on the robot arm and resulting accelerations of the robot arm. Typically, the dynamic model includes a kinematic model of the robotic arm, knowledge about the inertia of the robotic arm, and other parameters that affect the movement of the robotic arm. The kinematic model defines the relationships between the different components of the robotic arm and may include information of the robotic arm (such as the length, dimensions of the joints and links) and may be described, for example, by Denavit-Hartenberg parameters and the like. The dynamic model allows the controller to determine which torques the joint motors will provide in order to, for example, move the robotic joints at a specified speed, acceleration, or to hold the robotic arm in a static pose.

In general, various end effectors may be attached to the robotic tool flange, such as grippers, vacuum grippers, magnetic grippers, threading machines, welding equipment, dispensing systems, vision systems, force/torque sensors, which may be used with the robotic arm to perform various tasks. The robotic arm needs to be programmed by a user or robotic integrator that defines various instructions for the robotic arm, such as predefined movement patterns and work instructions, such as gripping, waiting, releasing, checking, threading instructions. Software extensions to robot control software may be provided to enable programming of end effectors mounted to a robotic arm, and end effector providers may provide such software extensions with end effectors. For example, the robot arm may be configured to perform a method for extending end-user programming of an industrial robot with third party contributions, as disclosed in WO 2017/005272, which is incorporated herein by reference.

Additionally, the instructions may be based on various sensors or input signals that typically provide a trigger signal for stopping or starting a given instruction. The trigger signal may be provided by various indicators, such as a safety curtain, a vision system, a position indicator, and the like.

The use of robot arms with and near humans has increased and in order to increase the diversity of workflows that robots can assist humans, there is a need to pay more attention to the safety, price and flexibility of robots. Thus, the robotic arm is provided with a safety system that monitors the operation of the robotic arm and is configured to put the robotic arm into a safe stop mode before a dangerous situation occurs in which a human may be injured. For increased safety, the robot safety controller and the robot process controller are arranged on different hardware. The robot safety controller is configured to monitor various sensor signals associated with the robot arm and perform a number of safety functions of the robot arm (e.g. as described in WO 2015/131904 incorporated herein by reference), the safety system bringing the robot into a safe state if an unsafe state is exhibited. Known safety systems monitor the operation of the robotic arm independently of the final end effector, so if, for example, the end effector is in an unsafe state, the safety system cannot bring the robotic arm into a safe state.

Disclosure of Invention

The present invention is directed to solving the above-mentioned limitations and other problems with the prior art. This is achieved by a robot system comprising:

a robotic arm comprising a plurality of robotic joints connecting a robotic base and a robotic tool flange,

a robotic process controller configured to control operation of the robotic arm in accordance with a combination of basic control software and process control software,

a robot safety controller configured to monitor and evaluate operation of the robot arm,

wherein the base control software is associated with a set of safety limits, each safety limit having a normal value that limits operation of the robotic arm when controlled by the robotic process controller in accordance with the base control software, wherein the process control software is associated with at least one safety limit of the set of safety limits having a process value different from the normal value, wherein the process value of at least one safety limit is configured to change when the robotic system is in a runtime mode, and wherein the robotic safety controller is configured to cause the robotic arm to enter an illegal stop mode if evaluation of one or more operating parameters results in violation of the normal value of the at least one safety limit and a more restricted value of the process values. This is advantageous because it has the following effects: the safety limits may be changed and evaluated when the robotic process controller and the robotic safety controller are in a run-time mode, i.e. during operation of the robotic arm. This is further advantageous in that it has the effect that the value of the safety limit value can be updated without compromising the safety of the robot system, since it always limits the more restricted values of the normal and process values of the robot arm operation. Thus, additional authentication or re-authentication of the robotic system may be avoided. This is further advantageous because it has the following effect: allowing a user of the robotic arm and/or a provider of process control software to change the safety limits and thereby providing additional flexibility to the control and operation of the robotic arm.

A robotic process controller is to be understood as a controller controlling the operation of a robotic arm and may be implemented as any processing device, such as a PLC (programmable logic controller), a CPU (central processing unit), a plurality of processing units, a microcontroller, etc.

A robot safety controller is to be understood as a controller that monitors the operation of a robot arm and puts the robot arm in an illegal stop mode if the value of a defined monitored operating parameter exceeds a defined threshold value, such as a safety limit value. The robot safety controller may be implemented as any processing device, such as a PLC (programmable logic controller), a CPU (central processing unit), a plurality of processing units, a microcontroller, or the like.

Basic control software is to be understood as software with which the process controller controls the movement of the robot arm, i.e. the movement of the individual joints, and thus the movement of the robot flange and any robot tool attached thereto. Basic control software is typically developed based on a mathematical model of the robotic arm and delivered with the robotic arm. Thus, a user of the robotic arm may move the robotic arm without any particular programming skills. It should be mentioned that the basic control software defines default values for different safety limits. The default value may also be referred to as a normal value and may only be changed within a predefined range if the robotic arm is powered off.

Process control software is to be understood as software provided to the robotic system from an external source, such as a data processing unit, a server, a computer or a tablet, such process control software being stored or developed on the external source. The process control software may also be provided by direct programming of the robotic system via a user interface. The process control software may be simple coordinates in a three-dimensional cartesian coordinate system defining waypoints for movement of the robot arm, program code defining operation of a robotic tool attached to a robotic flange, higher mathematical operations for determining points in the cartesian coordinate system, optimizing accuracy in, for example, movements, sensor systems, etc. Thus, the process controller controls the movement of the robotic arm and tool based on a combination of process control software and basic control software, wherein the process control software provides process values to at least one safety limit defined by the basic control software.

The values of the operating parameters used in the basic and process control software reflect the limits of position, movement, force, distance, time, e.g. power or torque, direction, etc. associated with the operation of the robotic arm. Thus, for example, velocities, accelerations, forces, etc. measured or derived from measurements of, for example, a robot joint are examples of operating parameters.

The safety limit is understood to be a limit value for the operating parameter. An example of a safety limit may be a robot joint speed, which may be a value in the operating window starting from 0 and ending with 400 degrees/second, typically a maximum value (safety limit) between 15 to 360 degrees/second for the wrist joint and 15 to 120 degrees for the base/shoulder/elbow joint; a tool flange speed, which may be a value in the operating window starting from 0 and ending with 5m/s, typically a maximum value (safety limit) between 1m/s and 2 m/s; power consumption of the robotic arm, which may be a value in the operating window starting at 10w and ending at 1000 w; a stop time, which may be a value in the window of operation starting at 1/4s and ending at 1 s; the stopping distance, which may be a value in the operating window starting from 1cm and ending with 2 m. The real-time values of the operational parameters are established based on calculations or measurements, such as direct measurements performed at the robot joints or measurements derivable therefrom.

Process values of safety limits are provided to optimize a given process performed by the robotic arm. The process values will generally reduce the operating window of the robotic arm compared to the operating window defined by normal values. Typically, this will cause the robotic arm to move more slowly, more precisely, produce less motor torque, and so on.

By default, the robot arm may be controlled according to normal values of safety limits. However, if the value of one or more safety limits is updated or changed to a process value, the more restrictive of these limits is used as a control parameter. In fact, the process control software may specify a range of user-adjustable process values when the robotic arm is in the runtime mode. Being able to change the value of the safety limit during operation (i.e. when the robot is in operation, for example when the robot is moving) is advantageous because it has the following effect: implementation and operation of the robotic arm in the field may become faster compared to prior art robotic systems that provide changes in safety limits only when the robotic arm is powered down. Furthermore, since the values can be changed without power interruption (dynamic safety limit adjustment), the cycle time can be reduced and the stimulus is not at least removed due to the dynamic adjustment.

An illegal stop mode is to be understood as a safety stop arrangement that is automatically applied if the evaluation results in violation of one of the safety limits, i.e. if the robot system automatically detects that something is incorrect in the robot system. Typically, robotic process controllers predict that there is a risk of violating safety limits, which will place the robotic arm in a protection mode. If this has not occurred within the stop time, the safety controller will put the robot arm in an offending stop mode. The illegal stop mode caused by violating safety limits is similar to the emergency stop mode caused by manually activating the emergency stop button. In both the violation stop mode and the emergency stop mode, the mechanical brakes of the respective joints are activated and the robotic arm is de-energized. Resetting of both violation stops and emergency stops requires manual resetting at a physical emergency button or via process and/or safety control software.

An evaluation is understood to be an evaluation of real-time operating values relative to safety limits, such as the value of the safety limit (normal and/or process). The evaluation may be performed fully or partially by the robot safety controller or by the robot process controller. The evaluation may be a simple comparison between the safety limit and the real-time value of the associated operating parameter.

In one embodiment, the robotic system is configured to place the robotic arm in the protection stop mode if the robotic process controller estimates that the operating parameter violates a more restrictive one of the normal value and the process value of the at least one safety limit. This is advantageous because it has the following effects: in the event of a violation or expected violation of safety limits, the robotic arm enters a soft stop mode that does not include a power outage and mechanical brake activation. Thus, the reset and continuous operation of the robotic arm may continue after a simple reset or a simple restart of the execution of the basic/process control software. It should be mentioned that the estimation of violations of safety limits may be based on predictions, where the process controller calculates future operations based on the current state (speed, direction, force, etc.), and whether this violates any safety limits. Alternatively, it may be based on the measurement results or values derived therefrom, which are then compared with the values of the safety limits. Finally, it should be mentioned that in the exemplary embodiment the value of the safety limit minus the offset is evaluated/compared.

The process controller is configured to cause the robotic arm to enter the violation stop mode if the evaluation of the one or more operating parameters by the robotic process controller results in a normal value minus the offset and a process value minus a more limited value of the offset that violates the at least one safety limit. This is advantageous because it has the effect that both the robot safety controller and the process controller can put the robot arm in an illegal stop mode. An offset is understood to be a value subtracted from the nominal value of the safety limit. In this way, the robotic process controller and the robotic safety controller have different values for the same safety limit, and therefore no conflict occurs between the two controllers on which the stop mode is first activated (such as an offending stop). The value of the offset may be set as close as possible to the nominal value of the safety limit to ensure a complete operating window of the robotic arm. With such said factors, hysteresis in practice, such as sensors, contactors, transistors, etc., defines the offset value. Thus, the offset value may be a predetermined percentage of the nominal value of the safety limit, or the offset value may be determined separately for one or more safety limits. It should be mentioned that the robotic process controller may also be used to bring the robotic arm into the violation stop mode if the evaluation results in violation of the normal value and a more restrictive value in the process value without first subtracting the offset.

In one embodiment of the robotic system, the robotic process controller is configured to compare a normal value of the safety limit to a process value of the same safety limit to establish a more restricted value of the two. This is advantageous because it has the following effects: the value of the safety limit used during the control of the robot arm and thus which limit of the safety limit that should be used for controlling the robot arm is identified, for example in order to put the robot arm in an illegal stop mode.

In one embodiment of the robotic system, the robotic process controller is configured to control the robotic arm in a reduced mode of operation based on a reduced normal value of the one or more safety limits. This is advantageous because it has the following effects: for example, the limit value relating to the speed for moving the robot flange may be reduced depending on where the robot arm is positioned or where a person or a fragile object is positioned relative to the robot arm.

In one embodiment of the robotic system, the values of the safety limits are updated by process values when the process software is uploaded to a memory from which the robotic process controller can execute the basic control software and the process control software. After the process control software is available to the safety controller and the process controller, the process values may be adjusted at runtime without requiring any software updates and without powering down the robotic arm.

In one embodiment of the robotic system, the set of safety limits is stored on a safety memory. In this case, the robot safety controller provides access to or provides a set of safety limits to the robot process controller.

In one embodiment of the robotic system, the safety limit is selected from the list comprising: tool center point velocity, tool center point force, elbow velocity, elbow force, joint velocity, joint position, stopping distance, stopping time, power limit, torque limit, and tool direction.

In one embodiment of the robotic system, evaluating includes establishing values for one or more operating parameters and comparing the established values to associated safety limits. The values of the operating parameters may be established by: the sensors provide input to the robotic process/safety controller or the robotic process/safety controller reads input from the sensors. Alternatively, the value of the operating parameter may be derived from measurements of two or more different operating parameters. The evaluation may include comparing the results of the calculations/measurements of the operational values calculated or measured from two independent controllers/sensors performing redundant calculations or measurements. At least a portion of the evaluation may be performed, for example, by suitable equipment located in each joint. An example of this may be redundant calculations/measurements in a joint performed by at least two processors and/or sensors.

In one embodiment of the robotic system, the safety rating of the robotic safety controller is higher than the safety rating of the robotic process controller. This is advantageous because it has the following effects: by using such a safety-rated controller, the likelihood of a dangerous situation is reduced, since the robotic safety controller complies with the requirements for a safety integrity level (SIL; safety integrity level) 2 or level 3 and/or complies with the functional safety standard (IEC 61508).

In one embodiment of the robot system, the robot safety controller is configured to provide an acknowledgement to the robot process controller, wherein the acknowledgement indicates that the robot safety controller has received the process value for the at least one safety limit.

In one embodiment of the robot system, the robot system comprises at least two independent robot safety controllers arranged on different hardware, wherein each independent robot safety controller is configured to cause the robot arm to enter the violation stopping mode if an evaluation of one or more operating parameters by one of the at least two robot safety controllers results in a violation of a more restricted one of the normal values and the process values of the at least one safety limit. This is advantageous as it has the effect of increasing the safety associated with operating the robot arm, as if one of the two robot safety controllers fails, the robot arm may continue to operate based on the remaining robot safety controllers. In addition, the remaining robot safety controllers may be configured to cause the robot arm to enter an offending stop mode if another robot safety controller fails, which increases the safety level of the robot system.

In an embodiment of the robotic system, the robotic system comprises a user interface enabling a user to communicate with the robotic system, wherein the user interface comprises user interface means for changing the value of the process value of the one or more safety limits when the robotic arm is in the runtime mode. This is advantageous because no additional hardware is required to update or change the value of the safety limit value by the process value. The user interface means may for example be arranged on the display as a graphical user interface through which a user can communicate with the robot system. For example, the adjustment may be established by touching a slider on the display.

In addition, the object of the invention is also solved by a method of monitoring a robotic system, the method comprising:

a robotic arm comprising a plurality of robotic joints connecting a robotic base (105) and a robotic tool flange,

a robotic process controller configured to operate the robotic arm according to basic control software, wherein the operation of the robotic arm according to the basic control software is limited by normal values of safety limits for each of a plurality of operating parameters, and

a robot safety controller configured to monitor and evaluate operation of the robot arm,

wherein the robot process controller and the robot safety controller are provided on different hardware, wherein the method comprises the steps of:

establishing, via the data processing unit, process control software and an associated process value for at least one of the plurality of safety limits,

storing the process control software comprising the at least one process value on a robot system memory,

controlling, by the robotic process controller, operation of the robotic arm based on a combination of the basic control software and the process control software,

establishing real-time values of at least one operational parameter during operation of the robot arm, and

-entering, by the robot safety controller, the robot arm into an illegal stop mode if the evaluation of the real-time value of the at least one operating parameter violates the normal value of the safety limit value of the at least one operating parameter and the more restricted value of the process values.

A data processing unit is to be understood as a software development tool or a storage means for such software, for example the robot controller itself or an external data processing unit. Thus, whether the process control software is a set of parameters or a program capable of integrating and controlling robotic tools (including sensors) attached to the robotic arm, the process control software is developed external to the robotic process controller and, when uploaded to robotic system memory associated with the robotic process controller or robotic safety controller, is accessible by these controllers and thus at least partially usable for controlling the robotic arm and its tools.

In one embodiment of the method, a real-time value of at least one operating parameter is established by one or more joint controllers.

In one embodiment of the method, the evaluation is performed by one or more joint controllers. This is advantageous as it has the effect of obtaining a faster system response to errors. Furthermore, the process and safety controller do not need to use processor power in this evaluation. Instead, a signal is simply provided from the joint controller to the process and/or safety controller. Alternatively, the evaluation is performed by a robotic process controller or by a robotic safety controller.

In one embodiment of the method, a signal indicative of the result of the evaluation is provided to the process controller and/or the safety controller, and based thereon the process controller and/or the safety controller determines whether a change of the operating mode of the robot arm is required.

In one embodiment of the method, the method further comprises the step of adjusting the process values while the robotic system is in a runtime mode.

In one embodiment of the method, the robotic process controller enters the robotic arm into an offending stop mode if the evaluation of the one or more operating parameters by the robotic process controller results in a normal value minus the offset and a process value minus a more limited value of the offset that violates the at least one safety limit. Alternatively, the robotic process controller puts the robotic arm in a protective stop mode.

Drawings

Figure 1 shows a robot system according to the invention;

figures 2 to 3 show simplified block diagrams of a robotic system of a robotic arm according to the invention;

FIG. 4 shows a velocity profile according to an exemplary embodiment of the present invention;

fig. 5 shows a flowchart of a method of monitoring a robotic system according to an exemplary embodiment of the present invention.

Detailed Description

The present invention has been described in terms of exemplary embodiments intended only to illustrate the principles of the invention. The skilled person will be able to provide several embodiments within the scope of the claims. Throughout the specification, reference numerals for similar elements providing similar effects have the same last two digits. Furthermore, it should be understood that where an embodiment includes a plurality of identical features, only some of the features may be labeled with a reference numeral.

Fig. 1 shows a robotic arm 101 comprising a plurality of robotic joints 103a, 103b, 103c, 103d, 103e, 103f connecting a robot base 105 and a robot tool flange 107. Base joint 103a is configured to rotate the robotic arm about a base axis 111a (shown in dashed lines), as indicated by rotational arrow 113 a; the shoulder joint 103b is configured to rotate the robotic arm about a shoulder axis 111b (shown as a cross to the indicated axis), as indicated by rotational arrow 113 b; elbow joint 103c is configured to rotate the robotic arm about elbow axis 111c (shown as a cross indicating an axis), as indicated by rotational arrow 113c, first wrist joint 103d is configured to rotate the robotic arm about first wrist axis 111d (shown as a cross indicating an axis), as indicated by rotational arrow 113d, and second wrist joint 103e is configured to rotate the robotic arm about second wrist axis 111e (shown in dashed lines), as indicated by rotational arrow 113 e. The robot joint 103f is a tool joint comprising a robot tool flange 107 which is rotatable about a tool axis 111f (shown in dotted lines), as indicated by a rotation arrow 113 f. Thus, the illustrated robotic arm is a six-axis robotic arm having six degrees of freedom, however, it should be noted that the present invention may be provided in robotic arms that include fewer or more robotic joints, and it should further be understood that the robotic joints may also include translational joints or a combination of rotational and translational joints.

Each joint includes an output flange that is rotatable relative to the robotic joint and the output flange is connected to an adjacent robotic joint either directly or via an arm portion as is known in the art. The robotic joint includes a joint motor configured to rotate an output flange, e.g., via a transmission or directly connected to a motor shaft. Further, the robot joint comprises at least one joint sensor providing a sensor signal indicative of at least one of the following parameters: an angular position of the output flange, an angular position of a motor shaft of the joint motor, a motor current of the joint motor, or an external force attempting to rotate the output flange or the motor shaft. For example, the angular position of the output flange may be indicated by output encoders, such as optical encoders, magnetic encoders, which may indicate the angular position of the output flange relative to the robotic joint. Similarly, the angular position of the joint motor shaft may be provided by input encoders, such as optical encoders, magnetic encoders, which may indicate the angular position of the motor shaft relative to the robot joint. It should be noted that both an output encoder indicating the angular position of the output flange and an input encoder indicating the angular position of the motor shaft may be provided, which in embodiments where a transmission has been provided makes it possible to determine the relationship between the input side and the output side of the transmission. The joint sensor may also be provided as a current sensor indicating the current through the joint motor and thus be used to obtain the torque provided by the motor. For example, in connection with a multi-phase motor, a plurality of current sensors may be provided to obtain the current through each phase of the multi-phase motor.

In an exemplary embodiment, the one or more joints each include two sensors and two joint controllers. In this way joint specific calculations and measurements can be established without affecting the robot controller, thereby reducing the risk of failure thereof, increasing the system response time between the joint and the robot controller and typically by data communication through the execution of distributed measurements and processes. Furthermore, the redundancy in the joints reduces the risk of failure, i.e. if one sensor or joint controller fails, there are additional sensors or joint controllers that can be used.

The robot arm comprises at least one robot controller arranged in a robot control box 109 and configured to control the robot joints by controlling the motor torque provided to the joint motors based on a dynamical model of the robot arm, the gravity work direction 112 and the joint sensor signals. The robot controller may be provided as a computer including an interface device 104 that enables a user to communicate with the robot, such as to control and program the robot arm. The controller may be provided as an external device, for example arranged in the robot control box 109 as shown in fig. 1, as a device integrated into the robot arm, or as a combination thereof. The interface device may be provided, for example, as a teach pendant known in the field of industrial robots, which teach pendant may communicate with the robot controller via a wired or wireless communication protocol. The interface device may, for example, include a display 106 and a plurality of input devices 108, such as buttons, sliders, touch pads, joysticks, trackballs, gesture recognition devices, keyboards, and the like. The display may be provided as a touch screen that acts as both a display and an input device.

Fig. 2 shows a simplified block diagram of the robot arm shown in fig. 1. The robot joints 103a, 103b and 103f have been shown in structural form, and for simplicity of the drawing, the robot joints 103c, 103d, 103e have been omitted. Furthermore, the robot joint is shown as a separate element; it should be understood, however, that they are interconnected as shown in fig. 1. The robot joint comprises an output flange 216a, 216b, 216f and a joint motor 217a, 217b, 217f, wherein the output flange 216a, 216b, 216f is rotatable relative to the robot joint and the joint motor 217a, 217b, 217f is configured to rotate the output flange via an output shaft 218a, 218b, 218 f. In this embodiment, the output flange 216f of the tool joint 103f comprises the tool flange 107. At least one joint sensor 219a, 219b, 219f provides sensor signals 222a, 222b, 222f which are indicative of at least one joint sensor parameter J of the respective joint_{Sensor, a}、J_{Sensor, b}、J_{Sensor, f}. The joint sensor parameters (also commonly referred to as operating parameters) are indicative of at least one of the pose parameters, which is indicative of the position and orientation of the output flange relative to the robot joint, for example: angular position of the output flange, angular position of the shaft of the joint motor, motor current of the joint motor. For example, the angular position of the output flange may be determined by an output encoderSuch as optical encoders, magnetic encoder indicators, which may indicate the angular position of the output flange relative to the robot joint. Similarly, the angular position of the joint motor shaft may be provided by input encoders, such as optical encoders, magnetic encoders, which may indicate the angular position of the motor shaft flange relative to the robot joint.

The robot controller 202 (also referred to as a robot process controller) comprises a controller processor 220 and a controller memory 221 and is configured to control the joint motors of the robot joints by providing motor control signals 223a, 223b, 223f to the joint motors. The motor control signals 223a, 223b, 223f indicate the motor torque T that each joint motor should provide to the output flange_{Motor, a}、T_{Motor, b}And T_{Motor, f}And the robot controller is configured to determine the motor torque based on a dynamic model of the robot arm as known in the art. The dynamic model allows the controller to calculate that for the robotic arm to perform the desired movements, the joint motors should provide the torque of the joint motors to each of the joint motors. The dynamic model of the robotic arm may be stored in the controller memory 221 and may be based on the joint sensor parameter J_{Sensor, a}、J_{Sensor, b}、J_{Sensor, f}And (6) carrying out adjustment. For example, the joint motor may be provided in the form of a multi-phase electric motor, and the robot controller may be configured to adjust the motor torque provided by the joint motor by adjusting the current through the phases of the multi-phase electric motor, as is known in the art of motor adjustment.

The robotic system includes a security system 225 that monitors the robotic arm and includes a security processor 227 (also referred to as a robotic security controller) and a security memory 228. The safety system is configured to enter the robotic arm into a safe state 226 based on at least one safety function evaluated by the safety system. The safety state is shown by a STOP (STOP) flag indicating that one safety mode may be a mode in which the robot arm enters a stationary state, e.g. by activating a braking system configured to brake a moving part of the robot arm, by turning off power to the robot arm, etc. However, it should be understood that the safe mode may be any operational mode in which the robot arm is considered safe with respect to a human, for example, the robot may be instructed to move at a low speed to provide an indication signal (visual, audible, tactile, etc., or combinations thereof) that alerts the human that an error has occurred.

As mentioned, the robot arm can be put in several different stop modes. The primary purpose of the robot safety controller is to monitor the operation of the robot arm and to put the robot arm in a safe mode if a violation of one or more safety limits occurs and the robot process controller does not handle this. If this happens and is not handled by the process controller, one of the safety modes that the safety controller is able to put the robotic arm in is the so-called violation stop mode. An illegal stop is comparable to an emergency stop, because the brakes in the joints are activated and the power supply to the joints of the robot is cut off. However, the emergency stop may be triggered externally via I/O via a button and internally by sending a software command to the process controller. When the process controller stops the robotic arm, the robotic arm may be stopped by instructing the joint motor to hold the robotic arm in a fixed position, by powering the joint motor, and/or engaging a mechanical brake. However, the safety controller is still operating in normal mode, and the user can quickly restart the robotic arm again and continue to use the robotic arm. This is in contrast to violation stops that are internally triggered by the security controller when the security controller detects a violation of a security limit (e.g., if the speed of the TCP (TCP; tool center point) is higher than the security limit "TCP speed"). The process controller then stops the robotic arm, the robotic arm is powered off, the mechanical brake is engaged, and the safety controller is now in violation mode, and the user must reset the safety controller (done through the GUI) before the user can power on the robotic arm again, as described below.

It should be noted that the security system 225 may also communicate directly with the interface device 104. Such communication may include updates to security limits, status signals, and the like.

Further, it should be noted that to increase security, the robotic security processor 227 of the security system 225 may be implemented as two separate security processors. At least a subset of the tasks of such two independent safety controllers may be identical, i.e. redundancy in the safety system is obtained. A more specific exemplary embodiment of the present invention having two independent safety controllers is explained with reference to fig. 3.

The robot controller 202 and the security system 225 are provided on different hardware, for example in the form of different computer motherboards, microcontrollers, processors, computer servers and/or integrated circuits.

An exemplary embodiment of the present invention will now be described with reference to fig. 3. Fig. 3 shows a robotic arm 301 as described above with reference to fig. 1 and 2, and similar elements and features bear the same reference numerals as in fig. 1 and 2 and will not be described further.

In fig. 3, the robot arm 301 is equipped with a robot tool 314 attached to the robot tool flange 107. The robotic tool 314 may include various actuators and sensors 315 configured to perform predetermined tasks. It should be noted that in an exemplary embodiment, the robotic tool 315 may be a standalone sensor, i.e., not necessarily physically interacting with an object.

As described above, the basic operation of the robot arm 301 is controlled by the basic control software. This means that the user may provide waypoints and movement commands to the robot controller 302 (e.g. via the interface device 104) and then, based on the input, the robot controller is able to control the joints of the robot arm based on the basic control software to move between waypoints in accordance with the provided instructions. Since the basic control software is developed to facilitate the general operation of the robot, it is not able to control, for example, the robot tool 315 connected to the robot tool flange 104. It can move such robotic tool 315 but not operate it. Thus, if the robotic tool 314 is a gripper, the gripping operation cannot be controlled by basic control software. To be able to control such tool operations, additional software is required and is referred to in this document as process control software.

The process control software may be any complement to the basic control software, from waypoint coordinates to complex software programs (including software for optimizing the accuracy of the operation of the robotic arm 301, for example, performed in accordance with the basic control software). Process control software may be developed at the external data processing unit 324 and then uploaded to both the robot control system 334 and the safety system 325 comprising the robot controller 202 for execution with the basic control software. Typically, the process control software is an additional software layer provided that utilizes functions available in the basic control software or the mentioned operational parameters (such as waypoint coordinates or limits) for operation of the robotic arm 301.

As mentioned, the control software (basic or process) controls the operation of the robot arm and thus also when the operating parameters should be evaluated according to normal or process values of safety limits. A non-limiting example of when to use which of the normal and process values is if additional safety is required, i.e. if the robot needs to be allowed to move slower or with less motor torque in the area where the person is located, e.g. when the robot arm is in a run-time mode or when the robot arm needs to handle fragile objects. A virtual wall may be established that only allows the robot to operate outside the virtual wall according to the reduced normal value. Alternatively, outside the virtual wall, in this example, the process values are used as values for safety limits for speed and torque.

In another non-limiting example, the first virtual wall may be established three meters from the robotic arm by means of the sensor, and the second virtual wall may be established one meter from the root arm by means of the sensor. The value of the safety limit value changes from a normal value to a reduced normal value when the person crosses the first virtual wall and the robot arm should stop when the person crosses the second virtual wall. Thus, when the person is outside the first virtual wall, the process control software operates the robotic arm according to the normal values of the safety limits. Between the first virtual wall and the second virtual wall, the robotic arm operates according to the most restrictive of the reduced normal and process values, and the process controller activates an emergency stop when the user crosses the second virtual wall. As mentioned, the use of process values makes the operation of the robotic arm flexible in that they can be adjusted at runtime and safe in that these values are compared with normal/normal reduced values to ensure that the robotic arm is controlled according to the most restrictive values. Thus, the safety of the robot installation is increased, as additional safety limits can be added to existing safety approved and certified safety systems, and this is not subject to the complex process of approving a system each time the safety limits change.

Whether normal, reduced normal, or process values are used, the robot controller and/or the safety controller will ensure that the robot arm is placed in an offending stop mode. An illegal stop mode is to be understood as a safety stop arrangement that is automatically applied if the evaluation results in violation of one of the safety limits, i.e. if the robotic system automatically detects that some situation is incorrect. Typically, if the process controller does not react when a safety limit is violated, the safety controller places the robotic arm in the violation mode. Furthermore, sensors or switches detecting e.g. the presence of a person exceeding a virtual wall or an emergency stop may also be triggered, causing the robot arm to enter a stop mode. For example, if the emergency stop button 335 is pressed, the robot controller should stop the movement of the robot for a specified time period, in one example, between 100ms and 1000ms, such as 200ms, 300ms, 400ms, or 500 ms. It should be noted that the stop time is user defined and therefore depends on the application of the robot arm, and therefore it may be any value within or outside this range, however preferably within 1000 ms. If the safety controller detects that the robot arm is still moving after the time period has elapsed, the safety controller will put the robot in an offending stop mode, in which it will de-energize the robot arm, causing the mechanical brake to engage.

It should be mentioned that according to the invention the activation of emergency stops (e.g. violation stops, the motor of the robot arm is de-energized and the mechanical brake is engaged) and protection stops (the robot arm stops moving but remains energized) may be triggered by basic and/or process control software based on external inputs. In general, these stop modes are referred to as binary limits, which are activated in the prior art by: the input on the I/O module is changed by pressing a button or activating a sensor. With the present invention, these stop modes, along with operation in the reduced mode, may be triggered internally by the processor, i.e., based not only on input from the I/O module. Furthermore, the values used to trigger these modes may change at runtime.

As mentioned, only the values of the process values may change in real time. In an exemplary embodiment, a distance sensor is added to the robotic arm, the distance sensor configured to determine a distance from the robotic tool to the object. The robot arm is allowed to move towards the object with a maximum speed (normal value of the safety limit), but when approaching the object (exceeding the virtual wall) the speed (reduced normal value of the safety limit) has to be reduced. For safety reasons, the user wants to reduce the speed beyond the virtual wall, but to ensure that the speed is reduced over time, the virtual wall is established at a distance (including a safety margin) from the object. In order to allow fast operation for as long a time as possible, in the process control software the user specifies that the virtual wall passes a certain distance from the object, wherein this distance is measured by the distance sensor. Because the distance is measured, there is no longer a need to add a safety margin, and thus the robotic arm is allowed to operate at a normal speed value as it comes closer to the object.

In this example, the user wants to be able to change the distance and thus the wall position. Furthermore, outside the wall, the user wants to be able to adjust the speed of the robot arm. This is allowed by the invention at run-time, since the user has programmed in the process control software the possibility of where to change the process values using e.g. a slider. To ensure that a less restricted value than the normal or normal reduced value of the safety limit is not allowed, the process value is compared with the normal value and the normal value is used by the robot controller if the user erroneously selects a less restricted process value than the normal value of the operating parameter. Thus, a more flexible control and faster cycle time of the robot arm is obtained. This is advantageous because it has the effect that the user can safely specify and adjust the process values of the safety limits without having an in-depth knowledge of the design limits of the robot arm. No dangerous situation can occur because if the course value defining the speed is, for example, higher than normal, the operation of the robot arm proceeds according to normal values.

In this document, a set of predetermined limits are designated as safety limits. The values of these limits are referred to as normal values or process values and are specified in the basic and/or process control software. Typically, the limits define maximum allowable speeds, forces, directions, distances, positions, timers, etc. Thus, the values of these safety limits limit the operation of the robot arm 301 when the robot arm 301 is operated. If the safety limits specified in the basic control software are violated, the robot control system 334 interrupts the operation of the robot arm 301 and ensures that the robot arm 301 is in a so-called violation stop mode.

However, it may be advantageous that the robot arm 301 does not end up in the offending stop mode, as this results in a power outage, braking the robot, and requiring the safety controller to be reset. The process controller is responsible for the operation of the robot and should put the robot arm into a protection stop mode if the controller estimates that safety limits will be violated. For some reason, if the robot controller processor 220 fails to observe such violations and the robot arm violates a safety limit, the robot safety system 225 takes over and ensures that the robot arm is in a safe mode, e.g., violation stop mode.

More specifically, in an exemplary embodiment, the robot controller will take its best action to comply with the safety limits. If it calculates, based on its current speed and trajectory, that it is not possible to comply with one of the safety limits, it will actively make a "protection stop" which basically only prevents the robot from moving and displays a warning to the user via the interface 104, but the motor is still energized and the brake is not engaged. If it actually violates one of the safety limits (because the protection stop failed or, for example, the robot was moved faster than expected), the robot safety controller will put the robot arm into the violation stop mode. When the robot safety controller puts the robot arm in an illegal stop mode, it informs the robot controller, and the latter will calculate a trajectory for putting the robot in a complete stop (within time limits) and issue a power-off command. If the robot controller fails to stop the robot within the limits, the robot safety controller will engage the mechanical brake, whether or not the arm is still moving.

In an exemplary embodiment, the robot controller 220 receives input from sensors of the robot arm 301 and/or calculates based on measurements of current consumption operating parameters, e.g., describing real-time operation of the robot arm 301. Based on the established operating parameters, the robot controller 202 evaluates, for a given operating parameter, whether the value thereof violates the value of the associated safety limit minus an offset. The safety limit minus the offset to avoid conflict between the robot controller 220 and which of the safety processors 227 must place the robot arm in an illegal stop mode.

In an alternative exemplary embodiment, the robot controller puts the robot arm in the protection stop mode if it is evaluated or estimated whether the safety limit minus the offset is violated or will be violated.

In an alternative exemplary embodiment, the joint controllers 336a, 336b perform redundant calculations, redundant measurements, etc., and if there is not a perfect alignment between these redundant calculations/measurements, the joint controllers send a signal indicating this to the robot controller and/or the robot safety controller. Upon receiving the signal, the robot controller starts to put the robot arm in a stop mode. It should be mentioned that when the terms are used in their entirety, it should be understood that certain tolerances in the measurements are acceptable due to timing, measurement noise, sensor resolution, etc.

For the above example, it is true that if the robotic controller does not try to stop the robotic arm within a given period of time, the robotic safety controller forces the robotic arm to an offending stop based on communication directly from the robotic safety controller or via the process controller. The offending stop is achieved by releasing the mechanical brake and de-energizing the robot arm.

The use of a safety controller as a backup for the process controller is part of the certified safety system of the robotic arm, ensuring safe operation of the robotic arm, i.e. putting the robotic arm in a safe mode before a hazardous situation occurs or at least before the hazardous situation causes serious injury to the persons and goods around the robotic arm. Depending on the authentication of the safety system, it is not allowed to change any of its safety limits or any hardware configuration and restart the safety system without powering down the robot arm. Thus, users are typically not allowed to change the safety limits at runtime (i.e., during operation of the robotic arm). In the prior art, the user had to power down the robotic arm to be able to change the non-binary value, and also if this was done via uploading new process control software. It should be mentioned that in one embodiment the robot safety controller may be at least one safety level higher than the robot controller, and further to increase safety the safety controller may be implemented as two independent controllers ensuring redundancy in the safety controller tasks.

Reference to a security level may refer to the mean probability of failure of hardware (i.e., a controller). Thus, a high level safety controller has a lower mean probability of failure than a process controller. High-level security systems, which may include both hardware and software, may be classified according to SIL (safety integrity level) levels 1 through 4, with 4 being the highest.

Thus, as explained, when process control software is uploaded to the robot controller, the safety limits associated therewith are used in conjunction with the basic control software to control the robot arm. Limits specifying, for example, elbow speed or force are provided in the basic control software, but for different reasons a user of the robotic arm may want to adjust these limits to move the robotic arm slower or allow less torque. Thus, instead of allowing a speed of 2m/s of the robot tool, which is defined by the safety limits of the basic control software, the allowed speed may be reduced to 1m/s by the safety limits of the process control software.

In an exemplary embodiment, the basic control software is stored on a controller memory 221 from which the basic control software is executed by the robot controller, and from which the safety controller also accesses at least safety limits. It should be mentioned that the robot safety controller also has access to non-binary limits in order to be able to put the robot arm in a safe mode (in case the process controller is not able to do so). Alternatively or in addition, the basic control software and a portion of the process control software are located on the secure memory 228. Typically, this portion will include safety limits.

Where the process control software is controlling a robotic tool, the actuators and sensors are electrically connected to I/O ports associated with the robotic controller. When doing so and uploading the process control software to the robot controller, the robot controller is able to control the robot arm including the final robot tool based on a combination of basic control software and process control software. When uploaded, at least a portion of the operational values, including safety limits for the process control software, are changeable without changing the mode of the robotic arm to a powered down mode.

It is ensured that when the robot arm is controlled according to the safety limits of the process control software, these limits do not allow the operation of the robot arm to violate the immutable safety limits of the basic control software. This is accomplished by evaluating the established value of the operating parameter with the most restrictive value of the safe limit value for the operating parameter provided by the basic control software and the process control software. In this way it is ensured that if the value of the safety limit specified by the process control software is, for example, too high, the operation of the robot arm takes place according to the value of the safety limit specified in the basic control software. In this way, it is always ensured that the operation of the robotic arm complies with the safety requirements of a certified safety system, even if the process control software is allowed to change the values of the safety limits associated therewith.

Operating parameters such as joint velocity and force, TCP velocity and force, elbow velocity and force, stopping distance and time, power, torque, and tool direction are measured directly or derived based on the measurements. These values are evaluated against safety limits and if a safety limit is violated, the robot arm is put in violation stop mode. The actions required to bring the robot arm into a protective stop mode or an offending stop mode are performed by the robot process controller or the robot safety controller in accordance with the evaluation results. However, the evaluation may be performed, for example, at a local joint controller, such as a joint controller, and the results then sent to the process and safety controllers.

In an exemplary embodiment, the values of the operating parameters are evaluated differently in the process controller by the values of the corresponding safety limits compared to the robot controller. This is to avoid a conflict between which of the two controllers should put the robotic arm in the violation mode, if necessary. To avoid this, the process controller evaluates the established value of the operating parameter by subtracting the offset from the corresponding safety limit. The offset should be large enough to react to the process controller but still small enough to facilitate operation of the robotic arm within as large an operating window as possible. The offset depends on the type of safety limit and may be set to a fixed value or percentage of the safety limit. For example, in conjunction with joint angular velocity, the safety limit offset may be a fixed value of 12,5 rad/sec, where the safety limit may be 192 rad/sec. This produces a suitable offset in the range of 1-15% of the value of the safety limit.

In an exemplary embodiment, a user may be able to change the process values of the safety limits via the interface device 104 if permitted by the process control software. Such changes may be made while the robotic arm is in operation (i.e., moved or in a stopped mode depending on the particular process control software). Alternatively, the robotic tool or its sensors may be used to change the value of the safety limit. The safety limit for the minimum distance between the robot tool and the object may be updated by values read from the tool sensor. This may require the robotic arm to be in a teaching mode, wherein such updating of safety limits is allowed.

Fig. 4 shows a curve 451 (solid line) of the robot arm operation. The curve represents a real-time established value of an operating parameter, limited by safety limits defined by normal value 452 (long dashed line), reduced normal value 453 (two dotted lines), and process value 454 (short dashed line). The operating parameter may be force, distance, speed, etc. It should be noted that, as described above, in an exemplary embodiment, the values of the operating parameters are controlled by the robot controller to be offset 455 below the specified values of the safety limits. Thus, operation of the robotic arm continues as long as different values of the safety limits are not violated. If the value minus the offset is violated, the process controller should place the robotic arm in a stop mode, and if this does not happen, the safety controller should place the robotic arm in a violation mode.

As shown, the robot arm is controlled according to the normal values of the safety limits and the most restrictive values of the process values. The normal value 452 and the reduced normal value 453 do not change, while the value of the process value 454 changes several times during the illustrated portion of the operating cycle. In addition, the process controller is shown controlling the speed of the robotic arm to a lower offset than the activity safety limits 456 a-456 i shown by the solid line (with the shaded area above the line, which is also explained above). The robot arm starts in normal mode with process values higher than normal and therefore initially in the sequence shown in fig. 4, the process controller controls the robot arm according to the activity safety limit 456a defined by the normal values. The evaluation or comparison of the process value with the normal value and the reduced normal value is continuous during operation, triggered by a modification of the process value, a change of state in the control software, a change of the operating mode, etc.

Where curve 451 may reflect the velocity of the robotic arm, as indicated, the robotic arm operates at a normal velocity (as indicated by activity safety limit 456) until time T1.

At time T1, the reduction mode (shown as a shaded area) is triggered by input from the robotic tool, external sensors, or by control software. Accordingly, the activity safety limit 456b changes to a reduced normal value based on which the robotic arm is controlled between times T1 and T2. The reduced normal value is also lower (more restrictive) than the process value 454 and, therefore, the robotic arm is controlled according to the activity safety limit 456b defined by the reduced normal value 453.

At time T2, the robotic arm switches back to normal mode, so the value of the activity safety limit 456c is again the normal value 452, as this is still more limited than the process value 454.

At time T3, the robotic arm is still in normal mode and the process values are modified. Evaluation of the new value of the process value 454 against the normal value 452 results in the new active safety limit 456d being more limited, and thus this serves to limit the speed between times T3 and T4.

At time T4, the process value is again updated to a new value. The result of the evaluation of the normal value 452 and the new process value 454 remains the same, and thus the robotic arm continues to control according to the process value 454, and the activity safety value 456e is updated to the new process value.

At time T5, the operating mode of the robotic arm changes to a reduced mode (shown as a shaded area), i.e. a new evaluation of the value of the safety limit is made, this time between the reduced normal value 453 and the process value 454. The result of the evaluation is that the process value 454 is the most restrictive and, therefore, the process controller continues to control based on the active safety value 456 e.

At time T6, the process value is again modified to the new value 454, the operating mode remains reduced, and the reduced normal value 453 remains unchanged. The result of the evaluation of the safety limit is still that the process value 454 is the most restrictive and, therefore, the active safety value 456f is updated to the new process value.

At time T7, the process value is again modified to a new value, the operating mode remains reduced, and the reduced normal value 453 remains unchanged. The result of the evaluation is now changing because the new process value is higher than the reduced normal value. Thus, the activity safety value 456G is updated to a reduced normal mode value.

At time T8, the operating mode changes back to normal mode, and thus the evaluation now compares the normal value with the process value. The result is that the process value is the most restrictive and, therefore, the active safety limit 546h is updated to the process value.

At time T9, the process value is again modified to a new value while the operating mode remains in the normal mode. The evaluation results now show that the normal value is more limited than the new process value, and thus the activity safety limit 546i is updated to the normal value.

At time T10, a normal value 452 is observed that violates the activity safety limit 456 i. More specifically, the violation is not observed or reacted to in time by the process controller and is therefore handled by the safety controller. This is illustrated because the value of the operating parameter shown by curve 451 increases above the normal value minus the offset. When the normal value is reached, the safety controller changes the mode to the violation stop as described above, which stops the operation of the robot arm. In this exemplary embodiment, the safety controller will immediately engage the mechanical brake and de-energize the robot. Most of the time, the process controller puts the robotic arm in a protective stop before the safety controller puts the robotic arm in an offending stop mode.

The evaluation of the value of the safety limit is a comparison between at least two values (normal value and process value or reduced normal value and process value). As mentioned, there may be several process values for one or more safety limits, so the evaluation may comprise comparing several pairs of normal/reduced normal values with the process values.

As can be seen from FIG. 4, only the process values can be modified at runtime. The normal value and the reduced normal value cannot be modified at run-time because it requires stopping the operation. As explained, the present invention solves this problem by allowing a user to introduce and then modify process values, thereby ensuring that if these process values are more restrictive than normal values and reduced normal values, respectively, the robotic arm is controlled solely according to these process values.

It should be mentioned that during one operating cycle of the robot arm, a plurality of different process control software, each having process values of its own safety limit, may be run simultaneously and/or one after the other. To illustrate this, table 1 below shows several safety limits having different values for the basic control software and different process control software.

Fig. 5 shows a flow chart of a method of monitoring a robotic system as described above, according to an exemplary embodiment of the invention. The method comprises an initial step S1 of establishing a robot arm controllable according to basic control software. The robot controller is capable of moving the robot arm in a cartesian coordinate system based on movement commands, e.g. basic control software. The sequence of movements is determined by the programmer or user of the robotic arm and is typically a repeating sequence.

At least some robotic implements require dedicated control software controlled by a robotic controller. This tool specific control software is referred to as process control software and is established in step 2S 2. The process control software may receive inputs from sensors attached to the robot and provide outputs to actuators, valves, etc. depending on the type of robot tool. Thus, based on a combination of basic and process control software, the robot controller is able to control a robot arm including a robot tool to perform a specific operation.

The process control software may be developed directly through the use of the robot controller 202 and thus stored on the controller memory 221. Alternatively, at least a portion of the process control software is developed external to the robot controller and then uploaded to the controller memory 221, from which the robot controller may access the process control software and which may also be used for the safety processor 227. Typically, if process control software is developed primarily independent of the robot controller, the robot arm needs to be integrated in its operating environment when uploaded to memory and installed. Regardless of how the process control software is developed, it is stored on the controller memory 221 in step 3S 3.

As mentioned above, the robotic arm is carried by basic control software that includes predefined safety limits to limit operations such as speed, force, stopping distance, tool direction, etc. (more examples are provided in table 1). For each safety limit, a default value, called normal value, is specified, which limits the operation of the robotic arm. These limits may need to be different from normal values depending on the operational tasks that the robotic tool and the robotic arm need to perform, and to accommodate this, the process control software introduces process values for one or more safety limits. The values of these process values may be adjusted at runtime when the robotic arm is in an operational mode, while changing normal values is only allowed when the robotic arm is powered down.

The reason that normal values can only be changed during a power outage is that these values are part of the authenticated security system of the robot, ensuring that the robot arm operates safely with respect to objects handled by the robot arm and its surroundings (including humans). Thus, whenever the normal values are changed, the robot controller needs to approve the new values to ensure that the design limits are not violated, etc. If not, the new value is accepted and the robot arm is then controlled according to the new value of the safety limit.

In step 4S4, the robotic arm is integrated and ready to operate in its local environment as indicated, and after integration it can be controlled to perform dedicated operation tasks according to a combination of basic control software and process control software (normal and process values including several safety limits).

In step 5S5, during operation of the robotic arm, the robot controller establishes real-time values of the operating parameters. The operating parameters may be provided directly from sensors of the robotic arm or derived from sensor inputs.

As mentioned, the course values may be adjusted in real time during operation of the robotic arm. This is advantageous because, for example, the integration of the robot arm can be made faster, since changes to the value of the safety limit can be adjusted in real time while the robot arm is in the operating mode.

However, since the safety limit is part of the safety system, there is a boundary on the value and, in order to avoid compromising safety by adjusting the process value outside the allowed range, its variation is compared with the normal and safest values, i.e. the most restrictive of the process and normal values is usually selected as the limit for the operation of the robotic arm. This comparison or evaluation is performed in real time by the robot controller in step 6S6, where the safety controller also monitors the operation of the robot arm. If the operating value violates a safety limit, the robot controller puts the robot arm in a stop mode for a predetermined time.

It should be mentioned that additionally or alternatively, the robot joint controller may perform an evaluation including a calculation or comparison and provide a signal reflecting this to the robot and the safety controller if, for example, the two joint controllers do not agree on a sensor input, a calculation or a comparison. Upon receiving such a signal, the robot controller should put the robot arm in a stop mode, which is again monitored by the safety controller.

The monitoring performed by the safety controller may include establishing (e.g., calculating, receiving, etc.) an operating parameter and comparing it to a value of an associated safety limit. Further, the safety controller may monitor whether the robot controller has the robot arm in the stop mode within a predetermined stop time. If this is not the case, the safety controller puts the robot arm in an offending stop mode.

Brief description of the drawings