PROCEDURES FOR THE SAFE OPERATION OF A MOBILE MACHINE

Abstract

A mobile machine comprises a mobile base, a movable machine part arranged on the mobile base with a hazard section and a safety device arranged on the movable machine part with one or more sensors.A method for the safe operation of the mobile machine comprises: the mobile machine being operated either in a working mode in which the movable machine part carries out working movements while the mobile base is stationary, or in a driving mode in which the mobile base carries out driving movements while the movable machine part assumes a defined driving position; in each case the same said safety device monitors a respective protective volume which, in the working mode, corresponds to a defined environment of the hazardous section and, in the driving mode, corresponds to a defined environment of the mobile base, wherein, in the event of an object interfering with the respective protective volume, a safety-related reaction is triggered which, in the working mode, comprises an adaptation of the working movement and, in the driving mode, an adaptation of the driving movement.

Description

[0001] The invention relates to a method for the safe operation of a machine, in particular in the context of a human-robot interaction, wherein the machine comprises a mobile base, a movable machine part arranged on the mobile base with a hazard section and a safety device arranged on the movable machine part with one or more sensors.

[0002] Robots or similar machines are used, particularly in industrial environments, to perform specific tasks. This particularly applies to tasks that require the exertion of particularly large forces and / or that must be performed with high speed and precision, especially if the task in question has to be carried out in the same way very frequently. However, there are also tasks that can be performed better by a human than by a machine. This particularly applies to tasks that are difficult to automate, for example because they require experience and / or a high level of adaptability. In processes that include both one type of work and another, it can therefore be expedient for humans and machines to work together in order to combine their respective strengths as efficiently as possible.

[0003] The type of collaboration can vary. For example, the work areas of a robot and a human may merely overlap, with no direct interaction between the robot and the human taking place, or interaction may only occur when the robot is stationary. This type of collaboration is also referred to as human-robot collaboration. However, the collaboration can also go so far that direct interaction even leads to planned contact between a human and a robot, for example, when the human and the robot work on a workpiece simultaneously or the robot is manually guided. This type of collaboration is also referred to as human-robot collaboration.With regard to the present invention, human-robot interaction should be understood in a rather broad sense and encompass all of the aforementioned forms of cooperation, in particular both human-robot collaboration and human-robot cooperation.

[0004] Human-robot interaction places high demands on the safety of those involved, as the machines involved can pose a danger to people, particularly due to their power and speed. The hazardous section is a section of the moving machine part from which, or from whose structure, a particular risk to a person working with the machine arises. However, the machine as a whole can also pose a danger to people in its vicinity. This is all the more true if the machine is not a stationary machine, where essentially only the moving part is movable, but a mobile machine, which can change its entire position because its base is movable.

[0005] Precautions must therefore be taken to prevent injury to people wherever possible. Such precautions include both passive measures, for example avoiding hard or sharp edges on the outside of the machine and providing soft and / or rounded surfaces, and active safety mechanisms that trigger a specific safety-related reaction in the event of a danger to a person in order to avert this danger. Passive measures cannot always be implemented comprehensively. For example, a tool (e.g. a gripper or a dispenser) may be provided on the free end of a robot arm. This tool is used to process a workpiece, whereby the tool tip must be designed in a way to fulfil its function that could be dangerous for a person working with the machine, for example because they could injure themselves on the tool.In order to exclude any danger as far as possible in such a case, it may be advisable as an active measure to ensure that the tool can only be operated at a certain safety distance from persons present.

[0006] When, as part of a human-robot collaboration, robots or similar machines, such as AGVs (Automated Guided Vehicles), AGCs (Automated Guided Containers), or drones, work together with people in a defined work environment without being permanently separated by a physical barrier, a danger to a person involved in the collaboration can arise, particularly if a collision occurs between the machine and the person. This danger can be counteracted in various ways.

[0007] One possibility is for the machine to be operated only under the direct control of a person, who can then ensure that neither they nor other people are endangered by the machine. If, on the other hand, the machine is controlled automatically or even works autonomously, the safety of the people working with the machine can be ensured according to an additional safety concept by limiting the movements of the machine, in particular its force and speed, so that in the event of a collision, there is a high probability that it will neither be painful for the person concerned nor lead to injuries. However, a safety concept based on limiting the machine is only possible if the work for which the machine is used does not require high forces or speeds.In addition, there may be sections of the machine that pose a hazard even at low forces and speeds, for example because they are pointed, sharp or hot.

[0008] According to an alternative safety concept, the aim is to prevent a collision between a person and the machine from occurring in the first place. To this end, it is ensured that the machine can only be started up when no one is in a defined environment around the machine or at least in a respective hazardous section of the machine, and that it is immediately braked or stopped as soon as a person enters the defined environment. The environment can be defined in particular by a safety distance from the machine or the hazardous section and can be static or, if the environment is defined relative to a moving element of the machine, also dynamic. The respective environment is continuously monitored so that the presence of a person in the environment can be responded to immediately with a suitable safety measure.

[0009] The technology used for such safety concepts must be particularly reliable and therefore meet high safety requirements. For example, a mobile machine may be required to comply with the EN ISO 3691-4:2020 standard for driverless industrial trucks. Furthermore, the sensors used may be required to comply with the EN ISO 13849-1:2015 and EN ISO 13849-2:2012 standards for machinery safety and the EN IEC 61496-1:2020 and EN IEC 61496-2:2020 device standards for electro-sensitive protective equipment (ESPE). To achieve this, a number of measures must be taken, such as reliable electronic evaluation through redundant, diverse electronics and functional monitoring or monitoring of contamination of optical components.

[0010] For example, at the distal (free) end of a robot arm having an end effector (e.g., a tool or a tool holder for a tool) that generally poses a hazard to a person working with the robot arm, a safety device can be provided that safeguards against the hazard emanating from this hazardous section of the robot arm by monitoring a protective volume surrounding the hazardous section. The protective volume can be implemented using multiple sensors that can determine whether or not an object is interfering with the protective volume. If an intrusion into the protective volume is detected, a safety-related response can be initiated, in particular by braking or stopping the movement of the robot arm.

[0011] Such safety devices are not only useful for a moving machine part (e.g., a robot arm), but can also be useful for the entire machine in the case of a mobile machine. For this purpose, as for the moving machine part, it can be provided that at least part of the surroundings of the mobile base of the mobile machine is monitored and, in the event of an intervention in the thus defined protective volume, a safety-related response is initiated, in particular by braking or stopping the movement of the mobile machine. To monitor the surroundings of the mobile base, sensors are again required to scan the surroundings. Typically, safety devices with a plurality of sensors are arranged on at least that side of the mobile base that corresponds to the direction in which the mobile machine can move forward.For example, sensors can be provided in the middle of this side and / or at both ends of this side (corners of the mobile base), particularly to ensure reliable detection of essentially the entire area in the direction of travel in front of the mobile base, even when cornering. For mobile machines that can also reverse, one or more corresponding safety devices are also provided on the opposite side of the mobile base.

[0012] However, such a large number of safety devices, each of which may include multiple sensors, negatively impacts the cost of the mobile machine. Furthermore, with each additional component, the weight of the mobile machine increases, requiring more powerful motors (especially for propulsion) than would be the case with a lighter weight. Furthermore, the power consumption of the mobile machine also increases, as the safety devices must be powered. This requires the provision of more powerful batteries, which further increase the weight of the mobile machine and also take longer to charge, thus worsening the ratio between working time and charging time of the mobile machine.Finally, each additional component also negatively impacts functional safety metrics, such as the MTTF (Mean Time To Dangerous Failure) value, since each additional cabling represents an additional potential source of failure. It is the object of the invention to avoid these disadvantages.

[0013] The object is achieved by a method for the safe operation of a mobile machine having the features of claim 1 and by a mobile machine having the features of claim 15.

[0014] The method according to the invention is preferably suitable for human-robot interaction, in particular for human-robot collaboration, and serves for the safe operation of a mobile machine comprising a mobile base, a movable machine part arranged on the mobile base with a hazardous area, and a safety device arranged on the movable machine part with one or more sensors. The mobile machine can be, for example, a mobile manipulator.

[0015] The mobile base can, for example, comprise at least a chassis and a drive for generating a driving movement of the chassis. The drivability of the base is not to be understood as passive; it is therefore not limited to the ability to drive the base, but can also include the ability of the base itself (by means of the aforementioned drive), in particular autonomously. For example, the mobile base can be designed in the manner of a driverless transport system.

[0016] The mobile base can, for example, have wheels that allow it to roll along a surface (e.g., a floor or rails), or, like a tracked vehicle, have a chain or belt that allows it to roll along the surface. The aforementioned mobility of the base is not limited to a specific mode of locomotion.

[0017] The movable machine part is arranged, on the one hand, preferably directly, on the mobile base and, on the other hand, is movable (relative to the mobile base). For example, the movable machine part can have an elongated, particularly arm-like, profile, one end of which (proximal end) is firmly connected to the mobile base and thus stationary relative to the mobile base, and the other end of which (distal end) is movable, preferably at least largely freely, at least between different positions.

[0018] Mobility is not to be understood as merely basic mobility in the sense that the movable machine part can only be moved passively, for example, by a user (bent, pivoted, or otherwise realigned); rather, the movable machine part is designed to move itself under power. For this purpose, the mobile machine can comprise one or more corresponding drives, which can be part of the movable machine part or the mobile base and can be controlled to move the movable machine part.

[0019] The movable machine part is preferably designed as a manipulator, in particular as a manipulator arm or robot arm. In this respect, the mobile machine can be a mobile robot. At its free (distal) end, the movable machine part can have a gripper, a tool, a tool holder, or another end effector, so that a specific task can be performed by means of the movable machine part. The movable machine part is not necessarily limited to a single specific task, but can ideally be used flexibly for various tasks. This can be achieved, for example, by the movable machine part comprising several tools and / or a tool holder for holding various tools.

[0020] The moving machine part has a hazard section. The moving machine part is not limited to exactly one hazard section, but can also have several (similar or different) hazard sections. The (at least one) hazard section can, in principle, be any section of the moving machine part for which it is necessary to ensure that persons working with the mobile machine are protected. In this respect, a section that poses a hazard to specific persons, for example due to its structure or function, is particularly considered a hazard section.

[0021] For example, the hazardous section can comprise the aforementioned end effector and, if applicable, adjacent areas of the movable machine part. Particularly if the movable machine part is elongated or arm-like, the hazardous section can be arranged at the aforementioned free end of the movable machine part (distal with respect to the mobile base). Due to the mobility of the movable machine part, the hazardous section is also movable, particularly relative to the mobile base.

[0022] The safety device is provided to protect the area surrounding the moving machine part from hazards posed by the hazardous section. The safety device comprises one or more sensors and is preferably arranged directly on the moving machine part. In particular, the safety device is arranged entirely on the moving machine part and can therefore be considered part of the moving machine part. In this respect, the safety device moves with the moving machine part when it moves. In particular, the safety device does not comprise any sensors that are not arranged on the moving machine part. The safety device and its sensors are expediently arranged in the immediate vicinity of the hazardous section in order to be able to monitor the area surrounding the hazardous section as comprehensively as possible.

[0023] The sensors of the security device are preferably optoelectronic sensors, for example, distance sensors that measure distances according to the time-of-flight principle based on the time-of-flight difference between emitted and received radiation. Alternatively, the sensors of the security device can also be radar sensors, for example. In principle, all types of sensors that enable the detection of an object entering a protected volume monitored by the sensors are suitable.

[0024] The method according to the invention comprises operating the mobile machine selectively in a work mode or in a drive mode. The mobile machine can therefore, in principle, be operated in either mode, but not in both modes simultaneously. Decisions about when the mobile machine is operated in which mode can be made by a human depending on the situation, can be specified based on a fixed or dynamic schedule, or can be made autonomously. In particular, the work mode and drive mode can alternate depending on the situation. The mobile machine is therefore operated alternately in the work mode and drive mode.For example, the method may include operating the mobile machine in work mode for a first period of time and in drive mode for a second period of time different from the first period of time, wherein the first and second periods preferably, but not necessarily, follow one another at least substantially directly. In a third period of time, the mobile machine may then be operated in work mode again, etc.

[0025] The method according to the invention further comprises: that in the working mode the mobile base is stationary, the movable machine part carries out working movements and the safety device is moved along in such a way that it monitors a protective volume by means of the one or more sensors which corresponds to a defined environment of the hazardous section, wherein in the event of an object (detected due to the monitoring) interfering with the protective volume a safety-related reaction is triggered which comprises an adaptation of the (currently executed) working movement;and that in the travel mode, the mobile base executes travel movements, the movable machine part assumes a defined travel position and the safety device is aligned (as a result of the alignment of the movable machine part in the defined travel position) such that it monitors, by means of the one or more sensors, a protective volume which corresponds to a defined environment of the mobile base, wherein in the event of an object (detected due to the monitoring) interfering with the protective volume, a safety-related reaction is triggered which comprises an adaptation of the (currently executed) travel movement.

[0026] The working mode and the driving mode differ in particular in which part of the mobile machine is moving: In working mode, the moving machine part carries out working movements while the mobile base is stationary (not moving); in driving mode, however, the mobile base carries out driving movements (moves), while the moving machine part inevitably moves with the mobile base because it is arranged on it, but assumes a defined driving position relative to the mobile base. Several different driving positions can also be defined, one of which the moving machine part assumes in driving mode, in particular depending on the respective driving movement of the mobile base, as will be explained further below. Preferably, however, the driving position does not change as long as the driving movement does not change (i.e.in particular, at least neither in terms of its speed nor in terms of its direction). In drive mode, the moving machine part not only does not perform any working movements, but is at least essentially stationary (relative to the mobile base).

[0027] The aforementioned working movements of the movable machine part occur relative to the stationary mobile base, while the aforementioned travel movements of the mobile base occur relative to the surroundings of the mobile machine, for example relative to a workshop in which the mobile machine is operated. The working movements are mentioned in the plural because the movable machine part can perform several different working movements, for example one or more sequences of several individual working movements. At any given time, however, the movable machine part only performs a single one of the total working movements performed. When a working movement is mentioned in the singular, this therefore means the working movement of the movable machine part currently being performed at a given time.Accordingly, the mobile base can perform several different movements, each of which it executes at a given point in time. When a movement is referred to in the singular, this refers to the movement currently being performed by the mobile base at a given point in time.

[0028] The respective movement can be defined, in particular, by its speed (travel speed) and, if the mobile base can travel in different directions (e.g., forward and backward and, if necessary, curves), additionally by its direction (travel direction). In particular, a respective movement can be completely determined by its speed and direction.

[0029] In both work mode and drive mode, the same safety device monitors a respective protection volume using its sensors. The protection volume in work mode corresponds to a defined environment of the hazardous section, and in drive mode, it corresponds to a defined environment of the mobile base. In particular, the same sensors are used to monitor the respective protection volume in both work mode and drive mode. To distinguish the protection volume monitored in work mode from the protection volume monitored in drive mode, these protection volumes could also be referred to as the first protection volume or second protection volume, or as the work protection volume or drive protection volume.

[0030] Monitoring is carried out specifically with regard to intrusions into the respective protected volume. Monitoring therefore detects whether an object (e.g., a body part of a person interacting / collaborating with the mobile machine) intrudes into the respective protected volume, which is not intended to be intruded upon. In this context, the intrusion is to be understood as relative; it is irrelevant whether the object or the protected volume is moving. Different thresholds can be defined, corresponding to different degrees of intrusion, allowing for different responses depending on the degree.

[0031] Monitoring may include the acquisition of (distance) data using sensors within a detection range of the respective sensor and the evaluation of this data to determine whether an intrusion into the protected volume has occurred. For this purpose, the data may be compared, for example, with a threshold value (one of possibly several threshold values). The evaluation may take place in the safety device or outside the safety device, for example, in a control device for the moving machine part or for the mobile base, as described in more detail below.

[0032] For monitoring purposes, it is not necessary to record data (distances) across the entire protected volume. It may be sufficient for the sensors to detect the edges of the protected volume that are (or must be) penetrated by an object entering the protected volume.

[0033] Since the protective volume is arranged relative to the hazardous section in working mode and relative to the mobile base in driving mode, it is not spatially stationary, but moves with the hazardous section during working movements and with the mobile base during driving movements. This is achieved by the safety device being arranged on the movable machine part and therefore moving with the movable machine part during working movements of the movable machine part in working mode (in particular, all sensors of the safety device also move with the movable machine part, preferably specifically with the hazardous section of the movable machine part); in driving mode, the movable machine part assumes the aforementioned driving position, whereby the safety device moves with the movable base in an arrangement corresponding to the driving position relative to the mobile base.In this way, the protection volume can be defined in working mode relative to the hazardous section (namely as the defined environment of the hazardous section) and in driving mode relative to the mobile base (namely as the defined environment of the mobile base).

[0034] The aforementioned surroundings of the hazardous section and the aforementioned surroundings of the mobile base can be defined in particular with regard to their respective dimensions, preferably with regard to their respective direction-dependent extension away from the hazardous section or the mobile base. For this purpose, it is expedient if the sensors of the safety device are arranged adjacent to the hazardous section and, in the travel mode in the travel position of the movable machine part, are arranged comparatively close to (a side encompassed by the monitored surroundings) the mobile base. In principle, it is expedient for the surroundings of the hazardous section, which are monitored in work mode, to be directly adjacent to the hazardous section, or for the surroundings of the mobile base, which are monitored in travel mode, to be directly adjacent to the mobile base.

[0035] The direction-dependent extent of the respective environment can be determined, for example, by distance thresholds (which are different for the different sensors) for distances detected by the sensors, whereby the distance thresholds relevant in driving mode differ from the distance thresholds relevant in working mode.

[0036] The environment of the hazardous section monitored in work mode and the environment of the mobile base monitored in travel mode can also each be dynamic, meaning their respective dimensions can be situation-dependent. For example, the environment of the hazardous section monitored in work mode can be temporarily reduced, for example, to allow the operator to approach a workpiece being machined, and / or the environment of the mobile base monitored in travel mode can depend on the speed of the respective travel movement.

[0037] In both work mode and drive mode, if an object intervenes in the respective protected volume, a respective safety-related reaction is triggered. The safety-related reaction that may be triggered in work mode and includes an adjustment of the (currently executed) work movement can also be referred to as a work safety-related reaction; the safety-related reaction that may be triggered in drive mode and includes an adjustment of the (currently executed) travel movement can also be referred to as a travel safety-related reaction. For example, an intervention in the protected volume can be considered to have occurred if at least one of the sensors of the safety device measures a distance value that falls below a distance threshold corresponding to the currently relevant protected volume.

[0038] As a safety-related response to a detected intervention, the respective currently executed movement (working movement of the moving machine part or travel movement of the mobile base) is adapted. The adaptation can, in particular, comprise a change in the respective movement (particularly with regard to its direction and / or speed), which ideally leads to a reduction in the hazard posed to the surroundings of the mobile machine by the hazardous section or by the mobile machine as a whole. For example, the adaptation can comprise the moving machine part in work mode or the mobile base in travel mode avoiding the respective object and / or being braked or coming to a complete stop.

[0039] A particular advantage of the present invention arises from the fact that the same sensors of the same safety device that are used in work mode to monitor the surroundings of the hazardous section as a safety volume are used in drive mode to monitor the surroundings of the mobile base as a safety volume. In particular, it can also be provided that the mobile machine, in drive mode, monitors the aforementioned surroundings of the mobile base exclusively by means of (the sensors) of the safety device arranged on the movable machine part. This makes it possible to dispense with additional safety devices arranged on the mobile base in addition to the aforementioned safety device. The mobile machine can therefore advantageously have fewer components, a lower weight, and a reduced power consumption.This allows the mobile machine to be more cost-effective and also offer improved functional safety.

[0040] According to an advantageous embodiment, the safety device extends around the hazardous section. For example, the sensors (in particular all sensors) of the safety device can be distributed around the hazardous section, for example in a ring-shaped arrangement. This allows the environment of the hazardous section monitored in operating mode to surround or enclose the hazardous section accordingly. Ideally, the monitored environment has no interruptions along its perimeter around the hazardous section. However, narrow gaps can be acceptable, especially if they are smaller than the objects to be protected.

[0041] According to a further advantageous embodiment, the aforementioned surroundings of the hazardous section, which are monitored in operating mode, extend around the hazardous section in at least one spatial plane such that the hazardous section is accessible from the outside, at least in directions parallel to the spatial plane, only through this surroundings. Ideally, the monitored environment extends around the hazardous section such that the hazardous section is accessible from all spatial directions only through the surroundings. Since this can be difficult or impossible depending on the arrangement of the sensors, it is expedient to cover at least a plurality of spatial directions, in particular an approach to the hazardous section in horizontal directions. In this way, it can be at least largely ruled out that an object comes into contact with the hazardous section without being detected by the safety device.

[0042] In principle, it may be expedient for the sensors of the security device to be contactless distance sensors designed to detect the distance of a respective object from the respective sensor in a respective detection direction (i.e., the detection direction of the respective sensor) (provided an object is within the range of the respective sensor in its detection direction). The sensors can be designed, for example, as time-of-flight or radar sensors. Such sensors can be used relatively easily in a conventional manner to monitor the edges of a protective volume for intrusion into the protective volume.

[0043] According to an advantageous embodiment, the extent of the protective volume along a respective detection direction (i.e., the detection direction of a respective sensor of the safety device) is defined by a respective threshold value, wherein for at least some of the sensors, in particular all sensors, of the safety device, the respective threshold value is different, in particular greater, in driving mode than in working mode. In this way, the protective volume in working mode can be limited to a comparatively small immediate area surrounding the hazardous section, while in driving mode the protective volume can extend from the safety device over a comparatively large area, for example, to a floor on which the mobile base travels.

[0044] According to a further advantageous embodiment, the mobile base has a surface, wherein in travel mode those sensors whose detection direction crosses the surface of the mobile base are deactivated. The surface can in particular be a work surface that is oriented at least substantially horizontally and / or at least substantially vertically upwards. The work surface can, for example, serve to support one or more workpieces for transport or for processing by an end effector provided on the mobile machine part (directly or optionally via a holder provided on the work surface). Preferably, the mobile machine part is connected to the mobile base on that side on which the work surface is also provided.

[0045] Depending on the orientation of the safety device in the travel position, part of the mobile base may extend into the detection range of one or more of the safety device's sensors. Since these detection ranges are generally not relevant for the safe operation of the mobile machine in travel mode, and to prevent the mobile base from being interpreted as an object encroaching into the protected volume and consequently triggering the safety-related reaction, it is advisable to deactivate the corresponding sensors.

[0046] According to a further advantageous embodiment, the aforementioned surroundings of the mobile base, which are monitored in travel mode, extend beyond the mobile base at least in the direction of the respective (currently executed) travel movement. The protective volume monitored in travel mode is thus located (at least among other things) in front of the mobile base in the direction of travel. In this way, hazards that arise from the mobile machine driving towards an object can be avoided. The monitored surroundings preferably border directly on the mobile base, at least in the respective direction of travel. Furthermore, the monitored surroundings preferably extend at least over the entire side of the mobile base oriented in the respective direction of travel.

[0047] According to a further advantageous embodiment, the travel position assumed by the movable machine part in travel mode depends on the speed and / or direction of the respective (currently executed) travel movement. This allows the orientation of the protective volume monitored by the sensor device to be suitably adapted to the respective travel movement for reliable protection of the mobile machine. Advantageously, no additional actuators are required to adapt the protective volume to a change in the travel movement, since this can be achieved by a movement of the already movable machine part, namely by a change in the travel position of the movable machine part, which also changes the orientation of the sensor device.However, as long as the travel movement does not change, the travel position of the moving machine part preferably does not change either, so that the protective volume (relative to the mobile base) remains constant.

[0048] In particular, it can be provided that the movable machine part in the travel mode assumes a first travel position during a travel movement of the mobile base in a first direction, in which the safety device is oriented such that the monitored protective volume corresponds to a first environment of the mobile base which extends in the first direction beyond the mobile base, and assumes a second travel position during a travel movement of the mobile base in a second direction which is different from the first direction, in particular opposite to the first direction, in which the safety device is oriented such that the monitored protective volume corresponds to a second environment of the mobile base which extends in the second direction beyond the mobile base.In this way, the safety device can always look in the respective direction of travel and thus always monitor the area towards which the mobile machine is driving.

[0049] Alternatively or additionally, it can further be provided that the movable machine part in the travel mode assumes a first travel position when the mobile base is moving at a first speed, in which the safety device is oriented such that the monitored protective volume corresponds to a first environment of the mobile base that extends beyond the mobile base in the direction of the travel movement, and when the mobile base is moving at a second speed that is greater than the first speed, the movable machine part assumes a second travel position in which the safety device is oriented such that the monitored protective volume corresponds to a second environment of the mobile base that extends further than the first environment in the direction of the (respective) travel movement beyond the mobile base.The respective monitored environment therefore extends further in the direction of travel at the second, higher speed than at the first speed, so that objects can advantageously be detected from a greater distance at a higher travel speed of the mobile machine. The travel movement at the first speed and the travel movement at the second speed can, in particular, have the same direction.

[0050] The described enlargement of the monitored environment at higher speeds can be achieved in particular by the safety device being displaced upwards in the second driving position compared to the first driving position, being displaced forwards in the direction of travel and / or being tilted upwards about a horizontal axis.

[0051] To control the movable machine part and the mobile base to perform working movements or travel movements, corresponding control units can be provided. In particular, the mobile machine can comprise a travel control unit for controlling the mobile base and a work control unit for controlling the movable machine part.

[0052] According to an advantageous embodiment, the safety device evaluates data acquired by the sensors with regard to an intervention in the respective protected volume and, in the event of an intervention, outputs a corresponding signal (i.e., a signal corresponding to an intervention in the respective protected volume) to the respective control unit (namely, in working mode, at least to the working control unit and in driving mode, at least to the driving control unit), wherein the respective control unit, upon receiving the corresponding signal, triggers the respective safety-related reaction. The data can, in particular, be continuously acquired by the sensors and likewise continuously evaluated by the safety device.When the work control unit receives the signal corresponding to an intervention in the protective volume in work mode, it triggers the (work) safety-related response, which includes an adjustment of the (currently executed) work movement. When the travel control unit receives the signal corresponding to an intervention in the protective volume in travel mode, it triggers the (travel) safety-related response, which includes an adjustment of the (currently executed) travel movement.

[0053] In a fundamentally similar, but alternative embodiment, the safety device outputs data acquired by the sensors to the work control unit and / or to the travel control unit. The travel control unit and / or the work control unit, provided the respective control unit has received the data from the safety device, evaluates / evaluates this data with a view to intervening in the respective protected volume and, in the event of an intervention, triggers / triggers the respective safety-related reaction. Such an embodiment differs from the above embodiment essentially in that the safety device does not evaluate the acquired data, but outputs it directly to at least one of the control units. The evaluation then only takes place in the respective control unit.There are different possibilities as to which mode each control unit uses to receive and evaluate the data.

[0054] For example, it can be provided that the safety device outputs the data detected by the sensors only to the work control unit in work mode and only to the travel control unit in travel mode, wherein the respective control unit then evaluates the data with regard to an intervention in the respective protection volume and, in the event of an intervention, triggers the respective safety-related reaction (i.e. adapts the work movements or the travel movements and controls the movable machine part or the mobile base accordingly).

[0055] Alternatively, it can be provided that the safety device outputs the data recorded by the sensors in both modes only to one of the two control units, which then evaluates the received data with regard to an intervention in the respective protection volume (corresponding to the current mode) and, in the event of an intervention in the respective protection volume, depending on the mode in which the mobile machine is currently being operated, either triggers the respective safety-related reaction itself or outputs a signal corresponding to the intervention in the protection volume to the other control unit, which then triggers the respective safety-related reaction.

[0056] Furthermore, it is also conceivable that the safety device outputs the data recorded by the sensors to both control units in both modes, whereby in the working mode the working control unit and in the driving mode the driving control unit evaluate the received data with regard to an intervention in the respective protected volume and, in the event of an intervention, triggers the safety-related reaction, while the other control unit can ignore the received data.

[0057] The mobile machine according to the invention, which can in particular be a mobile robot, comprises a mobile base, a travel control unit for controlling the mobile base, a movable machine part arranged on the mobile base, in particular a robot arm, with a hazard section, a work control unit for controlling the movable machine part and a safety device arranged on the movable machine part with one or more sensors, in particular one or more contactless distance sensors.The mobile machine can be operated either in a working mode, in which the movable machine part is controlled by the work control unit to perform working movements while the mobile base is stationary, or in a driving mode, in which the mobile base is controlled by the driving control unit to perform driving movements while the movable machine part assumes a defined driving position. According to the invention, the safety device (the same safety device in both working mode and driving mode) is designed to monitor a respective protective volume with regard to an intervention in the protective volume, wherein the protective volume corresponds to a defined environment of the hazardous section in working mode and to a defined environment of the mobile base in driving mode.The work control unit is designed to adapt at least the (currently executed) work movement as a safety-related reaction in the case of an object interfering with the respective protection volume in the work mode, while the travel control unit is designed to adapt at least the (currently executed) travel movement as a safety-related reaction in the case of an object interfering with the respective protection volume in the travel mode.

[0058] Preferably, the mobile machine as a whole is designed to be operated according to the inventive method for the safe operation of a mobile machine. The mobile machine can be operated in particular according to one of the above-described embodiments of the inventive method. The features and advantages described for these methods also apply accordingly to the mobile machine operated according to the respective embodiment.

[0059] According to an advantageous embodiment, the mobile base of the mobile machine does not have any sensors for monitoring the aforementioned surroundings of the mobile base. In particular, no such sensors are arranged on the mobile base. Such sensors are not required, since the monitoring of the surroundings of the mobile base in travel mode is preferably carried out exclusively by means of the safety device provided on the movable machine part. In this way, no further safety devices need to be provided in addition to the safety device for the safe operation of the mobile machine in travel mode.

[0060] The invention is explained further below by way of example only with reference to the figures. Fig. 1 shows an embodiment of a mobile machine according to the invention in a highly simplified schematic representation in a view from above, with the mobile machine being operated in working mode. Fig. 2 shows the same embodiment as the Fig. 1 in a corresponding illustration, wherein the mobile machine is operated in driving mode. Fig. 3 shows the same embodiment as the Fig. 1 and 2 in a slightly more detailed simplified schematic representation in a view from the side, with the mobile machine as in Fig. 2 is operated in driving mode.

[0061] The figures illustrate an embodiment of a mobile machine 11 according to the invention, which is designed to be operated according to at least one embodiment of the method according to the invention. The mobile machine 11 is designed as a mobile manipulator and comprises a mobile base 13 and a movable machine part 15.

[0062] The mobile base 13 comprises a chassis 17 with wheels 19, a drive 21 for driving the wheels 19 and a drive control unit 23 (these elements are partly only shown in Fig. 3 shown). The driving control unit 23 is designed to control the mobile base 13. This includes the fact that the driving control unit 23 can control the mobile base 13 to perform driving movements, in particular by controlling the drive 21 and, if appropriate, a steering system (not shown) of the wheels 19.

[0063] The movable machine part 15 is arranged on the mobile base 13 and designed as a robot arm. A first end 25 of the movable machine part 15 (proximal with respect to the mobile base 13) is fixedly connected to the mobile base 13 at an upper side of the mobile base 13, which is part of a surface 27 of the mobile base 13 and functions as a work surface. An end effector 31 for machining a respective workpiece (not shown) is provided at an opposite second end 29 of the movable machine part 15 (distal with respect to the mobile base 13). Due to its structure and / or function, the end effector 31 generally poses a hazard to persons interacting / collaborating with the mobile machine 11. The end effector 31 therefore represents a hazardous section 33 of the movable machine part 15.

[0064] The movable machine part 15 comprises joints 35 and drives (not shown) as well as a work control unit 37 (cf. Fig. 3 ), which is designed to control the movable machine part 15. This includes the fact that the work control unit 37 can control the movable machine part 15 to perform work movements, in particular by controlling the aforementioned drives and the end effector 31. As work movements, the movable machine part 15 can, for example, grip a workpiece, place it on the aforementioned work surface on the top side of the mobile base 13, and / or process it there.

[0065] The mobile machine 11 further comprises a safety device 39, which comprises a plurality of sensors (not shown) arranged in a ring around the end effector 31. The sensors are designed as contactless distance sensors, which are designed to detect the distance of an object from the respective sensor in a respective detection direction according to the time-of-flight principle. The sensors of the safety device 39 are arranged such that their detection areas as a whole at least substantially enclose a respective protective volume 41. As a result, the respective protective volume 41 can be monitored by means of the safety device 39 with regard to whether an object is encroaching into the respective protective volume 41. The boundaries of the respective protective volume 41 are represented in the figures by dashed lines.

[0066] Due to the arrangement of the safety device 39 on the movable machine part 15, the position and orientation of the respective protective volume 41 depends on the respective position of the movable machine part 15. Furthermore, by setting one or more threshold values for the sensors, up to which a detected distance of an object is to be considered an intrusion into the protective volume 41, the extent of the protective volume 41 in the direction away from the safety device 39 can be adjusted.

[0067] The mobile machine 11 can be operated either in a work mode or in a travel mode. In work mode, the movable machine part 15 is controlled by the work control unit 37 to perform work movements while the mobile base 13 remains stationary. In contrast, in travel mode, the mobile base 13 is controlled to perform travel movements while the movable machine part 15 assumes a defined travel position. The travel position can depend on the respective travel movement. If the speed or direction of the travel movement changes, the movable machine part 15 can therefore change its travel position. Otherwise, however, the movable machine part 15 does not move in travel mode.

[0068] In Fig. 1An example of a state that the mobile machine 11 can assume in work mode is shown. The movable machine part 15 performs work movements (controlled by the work control unit 37) that also move the end effector 31. In the state shown, the end effector 31 is aligned with the upper side of the surface 27 of the mobile base 13, which functions as a work surface, for example, to machine a workpiece. The sensors of the safety device 39 are therefore aligned accordingly towards the upper side and monitor an environment 43 of the end effector 31, which represents a hazardous section 33. In this state, the protective volume 41 therefore corresponds to this environment 43 of the hazardous section 33. The threshold values of the sensors are set such that the protective volume 41 does not extend significantly beyond the end effector 31. The mobile base 13 is stationary in work mode.

[0069] In the Fig. 2 and 3 , however, an example of a state of the mobile machine 11 is shown, which it can assume in the driving mode. The movable base 13 executes driving movements (controlled by the driving control unit 23), while the movable machine part 15 assumes the driving position shown, in which the safety device 39 is oriented such that at least some of its sensors monitor an environment 45 of the mobile base 13, which extends in the direction of the currently executed driving movement F (see arrow in Fig. 3) extends beyond the mobile base 13. In this state, the protective volume 41 corresponds to this environment 45 of the mobile base 13. The threshold values of the sensors are set such that the protective volume 41 extends to a floor 47 on which the mobile machine 11 travels. However, those sensors of the safety device 39 whose detection direction crosses the surface 27 of the mobile base 13 can also simply be deactivated. The corresponding edge of the protective volume 41 is in Fig. 3 therefore shown in dash-dotted lines, unlike the opposite edge of the protective volume 41 extending to the floor 47.

[0070] If the safety device 39 detects, based on data acquired by the sensors of the safety device 39, that an object has entered the respective protected volume 41 (in the environment 43 of the hazardous section 33 in work mode or in the environment 45 of the mobile base 13 in travel mode), a safety-related reaction is triggered to prevent endangering objects (in particular people) in the vicinity of the mobile machine 11. In work mode, this reaction involves adapting the currently executed work movement and, in travel mode, adapting the currently executed travel movement. In particular, the work movement or travel movement is modified. For example, the movable machine part 15 or the mobile base 13 can be controlled to avoid the respective object, braked, or even stopped completely.

[0071] As already mentioned, the travel position assumed by the movable machine part 15 in travel mode can depend on the currently executed travel movement F of the mobile base 13. In other words, it can be provided that the movable machine part 15 assumes a first defined travel position during a first travel movement of the mobile base 13 and assumes a second defined travel position different from the first defined travel position during a second travel movement of the mobile base 13 that is different from the first travel movement. The first and second travel movements can differ, for example, with regard to their respective speed and / or direction. The first and second travel positions can differ, for example (at least among other things), with regard to an angular orientation of the end effector 31 or the securing device 39.

[0072] For example, it can be provided that in the event of a change in the speed of the travel movement F, the movable machine part 15 is adjusted from its respective travel position into another travel position in such a way that the securing device 39 is tilted (at least among other things) about a horizontal axis (cf. the curved double arrow in Fig. 3 ). Tilting then changes how far the surroundings 45 of the mobile base 13, monitored by the sensors of the safety device 39, extend beyond the mobile base 13 in the direction of the travel movement F (see horizontal double arrow in Fig. 3 ). It is expedient if the monitored environment 45 extends further at a higher speed of the travel movement F than at a lower speed, so that objects in the direction of travel in front of the mobile base 13 can be detected in a timely manner.

[0073] Furthermore, in the event of a change in the direction of travel movement F, it may be expedient to adjust the movable machine part from its respective travel position to another travel position in such a way that the securing device 39 is aligned (for example, by rotating the movable machine part 15 about a vertical axis by an angle corresponding to the change in direction) such that the monitored environment 45 of the mobile base 13 extends beyond the mobile base 13 in the new direction of travel. In this way, for example, during forward travel of the mobile machine 11, an environment 45 in front of the mobile machine 11 can be monitored, and during reverse travel of the mobile machine 11, an environment 45 behind the mobile machine 11 can be monitored.

[0074] The mobile machine 11 can thus be used flexibly and operated safely, but at the same time requires comparatively few components, since the same safety device 39 is used, on the one hand, in working mode to monitor an environment 43 of the hazardous section 33 and, in the event of an intervention in the environment 43, to trigger a corresponding safety-related reaction, and, on the other hand, in driving mode to monitor an environment 45 of the mobile base 13 and, in the event of an intervention in the environment 45, to trigger a corresponding safety-related reaction. The mobile machine 11 can thus be manufactured comparatively inexpensively, be comparatively lightweight, and at the same time have a comparatively high level of functional safety. Reference symbol

[0075] 11 mobile machine 13 mobile base 15 movable machine part 17 chassis 19 wheel 21 drive 23 travel control unit 25 first end of the movable machine part 27 surface of the mobile base 29 second (free) end of the movable machine part 31 end effector 33 hazardous section 35 joint 37 work control unit 39 safety device 41 protective volume 43 surroundings of the hazardous section 45 surroundings of the mobile base 47 ground F travel movement

Claims

1. Method for the safe operation of a mobile machine (11), in particular in the context of a human-robot interaction, wherein the mobile machine (11) comprises a mobile base (13), a movable machine part (15) arranged on the mobile base (13) with a hazard section (33) and a safety device (39) arranged on the movable machine part (15) with one or more sensors, wherein the method comprises: that the mobile machine (11) is operated optionally in a working mode or in a driving mode;that in the working mode: - the mobile base (13) is stationary, - the movable machine part (15) carries out working movements, and - the safety device (39) is moved in such a way that it monitors a protective volume (41) by means of the one or more sensors, which corresponds to a defined environment (43) of the hazardous section (33), wherein in the event of an object interfering in the protective volume (41), a safety-related reaction is triggered, which comprises an adaptation of the working movement;and that in the driving mode: - the mobile base (13) carries out driving movements, - the movable machine part (15) assumes a defined driving position, and - the safety device (39) is aligned such that it monitors, by means of the one or more sensors, a protective volume (41) which corresponds to a defined environment (45) of the mobile base (13), wherein in the event of an object interfering with the protective volume (41), a safety-related reaction is triggered which comprises an adaptation of the driving movement.; 2. The method according to claim 1, wherein the mobile machine (11) is a mobile robot and the movable machine part (15) is a robot arm.

3. Method according to claim 2 or 3, wherein the hazardous section (33) is arranged at a free end (29) of the movable machine part (15) 4. Method according to one of the preceding claims, wherein the mobile machine (11) in the driving mode monitors said environment (45) of the mobile base (13) exclusively by means of the safety device (39) arranged on the movable machine part (15).

5. Method according to one of the preceding claims, wherein said environment (43) of the hazardous section (33) extends around the hazardous section (33) in at least one spatial plane in such a way that the hazardous section (33) is accessible from the outside only through this environment (43), at least in directions parallel to the spatial plane.

6. Method according to one of the preceding claims, wherein the sensors of the security device (39) are contactless distance sensors which are designed to detect the distance of a respective object from the respective sensor in a respective detection direction.

7. The method according to claim 6, wherein the extent of the protective volume (41) along a respective detection direction is defined by a respective threshold value, and wherein for at least some of the sensors the respective threshold value is different, in particular greater, in the driving mode than in the working mode.

8. The method according to claim 6 or 7, wherein the mobile base (13) has a surface (27), and wherein in the driving mode those sensors whose detection direction crosses the surface (27) of the mobile base (13) are deactivated.

9. Method according to one of the preceding claims, wherein said surroundings (45) of the mobile base (13) extend beyond the mobile base at least in the direction of the respective travel movement (F).

10. Method according to one of the preceding claims, wherein the driving position assumed by the movable machine part (15) in the driving mode depends on the speed and / or the direction of the respective driving movement (F).

11. Method according to one of the preceding claims, wherein the movable machine part (15) in the travel mode assumes a first travel position during a travel movement of the mobile base (13) in a first direction, in which the safety device (39) is oriented such that the monitored protective volume (41) corresponds to a first environment of the mobile base (13) which extends in the first direction beyond the mobile base (13), and assumes a second travel position during a travel movement of the mobile base (13) in a second direction different from the first direction, in which the safety device (39) is oriented such that the monitored protective volume (41) corresponds to a second environment of the mobile base (13) which extends in the second direction beyond the mobile base (13).

12. Method according to one of the preceding claims, wherein the movable machine part (15) in the travel mode assumes a first travel position during a travel movement of the mobile base (13) at a first speed, in which the safety device (39) is oriented such that the monitored protective volume (41) corresponds to a first environment of the mobile base (13) which extends beyond the mobile base (13) in the direction of the travel movement, and assumes a second travel position during a travel movement of the mobile base (13) at a second speed which is greater than the first speed, in which the safety device (39) is oriented such that the monitored protective volume (41) corresponds to a second environment of the mobile base (13) which extends further than the first environment in the direction of the travel movement beyond the mobile base (13).

13. Method according to one of the preceding claims, wherein the mobile machine (11) comprises a travel control unit (23) for controlling the mobile base (13) and a work control unit (37) for controlling the movable machine part (15), wherein the safety device (39) evaluates data detected by the sensors with regard to an intervention in the respective protective volume (41) and, in the event of an intervention, outputs a corresponding signal to the respective control unit (23 or 37), which, when it receives the corresponding signal, triggers the respective safety-related reaction.

14. The method according to one of claims 1 to 12, wherein the mobile machine (11) comprises a travel control unit (23) for controlling the mobile base (13) and a work control unit (37) for controlling the movable machine part (15), wherein the safety device (39) outputs data detected by the sensors to the work control unit (37) and / or to the travel control unit (23), and wherein the travel control unit (23) and / or the work control unit (37) evaluates / evaluates the data received from the safety device (39) with regard to an intervention in the respective protective volume (41) and triggers / triggers the respective safety-related reaction in the event of an intervention.

15. A mobile machine (11), in particular a mobile robot, comprising a mobile base (13), a travel control unit (23) for controlling the mobile base (13), a movable machine part (15), in particular a robot arm, arranged on the mobile base (13) with a hazard section (33), a work control unit (37) for controlling the movable machine part (15), and a safety device (39) arranged on the movable machine part (15) with one or more sensors, in particular one or more contactless distance sensors, wherein the mobile machine (11) is selectively operable in a work mode in which the movable machine part (15) is controlled by the work control unit (37) to perform work movements while the mobile base (13) is stationary, or in a travel mode in which the mobile base (13) is controlled by the travel control unit (23) to to perform driving movements,while the movable machine part (15) assumes a defined travel position, wherein the safety device (39) is designed to monitor a respective protective volume (41) with regard to an intervention in the protective volume (41), wherein the protective volume (41) corresponds to a defined environment (43) of the hazardous section (33) in the working mode and to a defined environment (45) of the mobile base (13) in the driving mode, wherein the work control unit (37) is designed to adapt at least the working movement as a safety-oriented reaction in the event of an object interfering with the respective protective volume (41), wherein the travel control unit (23) is designed to adapt at least the travel movement as a safety-oriented reaction in the event of an object interfering with the respective protective volume (41) in the driving mode, and wherein the mobile machine (11) is preferably designed toto be operated according to one of the above methods.,