Adjusting fail-safe monitoring in industrial automation facilities

Abstract

The invention relates to a method for adjusting a fail-safe monitoring in an industrial automation installation and to a safety system for a mobile component of an industrial automation installation. Here, the position and orientation of a mobile component relative to other components of the industrial automation installation are derived in a fail-safe manner by means of sensors of the mobile component, a communication-capable and fail-safe coupling is established between the mobile component and the other components, and in the case of a successful coupling, the monitoring area of the mobile component is adjusted. In the design variant, the monitoring area of the other components is also adjusted.

Description

Technical Field

[0001] This invention relates to a method for adjusting fail-safe monitoring in industrial automation facilities and a safety system for moving parts of industrial automation facilities. Background Technology

[0002] In modern manufacturing facilities, traditional assembly lines are increasingly being replaced by mobile transport components known as FTS (Driverless Transport Systems) or AGVs (Automated Guided Vehicles). These vehicles typically move along pre-defined paths, guided by color-coded markers on the floor or trajectory guidance devices with inductors or capacitors embedded in the floor. Modern vehicles can also navigate with sensor assistance, making the path somewhat virtual and the vehicle oriented by various sensors in the environment. Conversely, vehicles that can navigate freely, dynamically avoiding obstacles, even with trajectory guidance, are called AMRs (Autonomous Mobile Robots).

[0003] The preferred sensing mechanism for AGVs or AMRs is a laser scanner, which measures the environment by measuring the propagation time of a laser beam and, in rare cases, by phase shift. The laser beam is rotated by a rotating mirror, creating a large detection range, typically 180 degrees or even 270 degrees. Laser scanners are primarily used as safety devices because they are internally fail-safe. For this purpose, a defined area is provided for the scanner, which monitors for violations within that area and transmits the information to a higher-level, equally fail-safe controller via fail-safe output signals or fail-safe communication.

[0004] Figure 1 This illustration shows a typical application of laser scanners in AGVs. On the left is a rectangular AGV 101, which also requires side monitoring. On the right is a rotationally symmetrical AGV 102. Rotationally symmetrical AGVs, for example, can only move forward or backward and can rotate in place due to their differential kinematics, thus eliminating the need for comprehensive protection of all sides. Areas 110 and 120 that can be monitored by the corresponding laser scanners 130 are plotted as points, representing, for example, the maximum monitorable area.

[0005] exist Figure 1 The lower part is drawn in shaded form to indicate the possible monitoring or safety areas 111, 121 that could cause the corresponding AGV to slow down or even stop.

[0006] In addition to use at moving vehicles, laser scanners are also used at static machines to fault-safely identify, for example, a person approaching, and to shut down the machine completely or partially to avoid danger. Therefore, laser scanners can replace mechanical barriers with fault-safe door contacts, much like light curtains or gratings.

[0007] Figure 2 This illustrates the use of laser scanners and light curtains in machines in the prior art. Here, three sides are protected by mechanical solution 201, and a fourth side is protected by laser scanner 233 or light curtain 211, thereby enabling the insertion or removal of materials or products into or from the machine. When using a light curtain, it is additionally necessary to ensure that the machine shuts down quickly enough in the event of damage to the light curtain. Therefore, a combination of these two described optical safety devices is used in part to detect human approach using a laser scanner, decelerate the machine, such as a robot, to a safe speed, and achieve final closure using a light curtain, since the previous deceleration is also fast enough to achieve final closure.

[0008] In the event that the laser scanner is damaged by someone walking past the machine, the machine only slows down and does not have to stop production.

[0009] In the modern production facilities mentioned at the beginning, these two uses are often combined: machines detect human approach via laser scanners, and AGVs supply materials or production goods to the machines. Whether it's trajectory guidance or free navigation is less important for further observation.

[0010] To date, AGVs have triggered safety devices on other (especially static) machines, particularly laser scanners and / or light curtains, much like humans would, causing the machine to slow down or shut down completely. If, for example, a workpiece should be processed without transferring it from the AGV to the machine, a blockage occurs because the machine cannot operate due to the safety devices being compromised when the AGV is in front of or within it.

[0011] Therefore, today, machines without contactless safety devices such as laser scanners or gratings are used. Instead, mechanical barriers or gates are employed, which are opened for the AGV to enter and exit but must be closed during processing. Here, additional sensing mechanisms or measures must be used to ensure that no human is entering the machine alongside the AGV or is able to enter the machine. This is complex and particularly difficult to implement because humans must be identified as potential interfering parties in a certified fail-safe manner.

[0012] Furthermore, the processing steps have so far been implemented by transferring the workpiece from the AGV to the machine, allowing the AGV to then remove itself from the detection range of the machine's laser scanner. However, this requires corresponding mechanical devices within the machine and, on the other hand, extends production time because the machine must remain stationary during the transfer. Similarly, according to the mechanical implementation, it must also be ensured that no human enters the machine with the AGV, but does not leave again.

[0013] An AGV with a mechanism to avoid collisions in a confined space (e.g., a warehouse) is known from US2020 / 010101971A1. For position determination, communication is provided with a controller (e.g., for controlling a crane) and with other AGVs. Summary of the Invention

[0014] In this context, the object of the present invention is to provide improved safety monitoring for automated tasks distributed among components of industrial automation facilities.

[0015] The present invention relates to a method for adjusting fail-safe monitoring in an industrial automation facility, wherein the attitude of the moving part relative to other parts of the industrial automation facility is determined in a fail-safe manner by means of sensors of the moving part of the industrial automation facility, wherein a communication and fail-safe coupling connection is established between the moving part and other parts, and wherein, in the case of a successful coupling connection, the monitoring area of ​​the moving part is adjusted.

[0016] In this application, the term fail-safe is understood to mean compliance with requirements given for functionally safe systems, particularly integrated manufacturing systems. Such functional safety requirements are defined, for example, in industrial environments by the provisions of the standard series EN 61508 for safety-related electrical, electronic, and programmable electronic systems. Various mechanisms, such as redundant data processing, are known to comply with functional safety requirements. DIN EN ISO 11161, "Machine safety, basic requirements for integrated manufacturing systems," contains safety aspects important for the safety-related connections of machines. The terms fail-safe and safety-oriented are used synonymously.

[0017] Moving parts within the facility, particularly AGVs or AMRs, can work together with other parts, especially other moving or static parts, to solve automation tasks, such as machining workpieces, by means of the methods described, thereby meeting fail-safe requirements and thus ensuring the protection of people remaining in the facility, such as in a factory or workshop, in accordance with standards.

[0018] Moving parts and other components, especially as integrated manufacturing systems, are connected to each other through communication and fail-safe coupling, for example via industrial WLANs or alternatively via other wireless or wired communication connections. As a prerequisite for this coupling, the attitude of the moving parts relative to other parts is determined in a fail-safe manner. For this purpose, information about the attitude of the moving parts relative to other parts or relative to reference parts or reference markers is obtained, for example, without error.

[0019] Currently, the term attitude is understood to involve information about position and orientation. Fault-safe determination of the attitude of a moving part ensures that the moving part knows how to assess its position and orientation relative to other parts with sufficient safety. For example, attitude is determined directly relative to other parts or indirectly with the aid of reference values. For example, the moving part derives its position absolutely or relative to other parts or a reference part. Depending on the degrees of freedom of the moving part, position determination is sufficient to determine its attitude in three-dimensional space. For example, the moving part derives its orientation absolutely or relative to other parts or a reference part. Particularly preferably, the moving part determines its attitude based on pre-set and / or pre-defined information that provides information about the relationship between the moving part and other parts. Preferably, the attitude of the moving part is determined using pre-set accuracy.

[0020] Therefore, it can be guaranteed that the monitoring area of ​​the moving part can be adjusted, for example, expanded, reduced, or changed, without creating the risk of gaps in monitoring, such as in which a person could be injured by one of the involved parts. In particular, in addition to the security area to be monitored by the moving part based on its monitoring, a security area to be monitored based on another part is advantageously monitored at least in part by the moving part.

[0021] Therefore, in particular, it enables safe and defined changes, especially expansions, of the monitoring area, also known as the protected space, for moving parts. This, for example, allows the operation of a gripper arm on a mobile robot, since its position is fixed. Furthermore, for example, it allows other parts to interact with the AGV, as the AGV takes over the protection of dangerous locations of other parts.

[0022] Successful communication and fail-safe coupling enable the sharing of safety information between moving parts and other parts. Examples of shared safety information include: moving parts using their own safety sensors to monitor areas that other parts cannot monitor due to the moving parts themselves, such as areas covered by AGVs. Also examples of shared safety information include: moving part sensors taking over the tasks of other parts' sensors. This can also include switching on and off of safety sensor configurations.

[0023] The sharing of safety information can also include safety functions related to other components, such as the initiation of a stopping process for a multi-axis robot that is triggered by a moving component. Thus, for example, sensors on the moving component can detect intrusions into a controlled safety area and trigger safety functions in the actuators of other components.

[0024] For example, the emergency stop switch in an AGV acts on the robot carrying other components of the AGV.

[0025] In industrial functional safety systems, the degree of hazard and the resulting hardware and software requirements are described by performance levels (PL). The corresponding safety level to be followed, according to the international standards IEC 61508 / IEC 61511, is also referred to as the safety level or safety integrity level, or SIL for short. To ensure that the required safety function performance level d (PLd) is maintained, for example in a robotic arm, the monitoring area of ​​the moving parts is adjusted only after successful coupling with other components, and this is contingent upon the safe identification of the position and orientation of other moving parts.

[0026] Therefore, it can be ensured that the transmission of safety-guided signals from moving parts and their processing in other parts are performed at least on PLd. Thus, fail-safe signals can be used across the system in a coupled connection state.

[0027] This allows facility operators to use mobile components (such as AGVs) in conjunction with other components (such as static robots) in production in an inconsistent manner. This significantly increases the feasibility of flexibly using machines in production operations, thereby improving the overall productivity of the facility.

[0028] According to a design scheme, the monitoring areas of other components are also adjusted. A successful coupling connection then has, for example, the effect of matching the monitoring areas of other components to the state of coupling with the moving component. Thus, from the perspective of other components, it is possible to consider newly formed and altered hazards due to interaction with the moving component. For example, areas that are no longer accessible to the safety sensors of other components due to the moving component are no longer monitored by those safety sensors, but by the safety sensors of the moving component. Previously monitored areas of other components no longer need to be monitored, for example, due to the expansion of the moving component, because the moving component itself does not spatially cover these areas.

[0029] According to one design scheme, an infringement on the monitoring area of ​​a moving part necessitates the use of safety functions, particularly safety functions for the moving part and / or other components. For example, the monitoring area can consist of multiple zones, each monitored by a safety sensing mechanism of the moving part. Different safety functions can be preset for each zone infringed upon. Here, for example, different safety functions are provided for different zones, with each function acting differently at the actuator of the moving part or at different actuators of the moving part, and / or different zones are provided for different safety functions, each function acting on both the actuator of the moving part and the actuators of other components.

[0030] According to one design scheme, an infringement on the monitoring area of ​​other components necessitates the adoption of security functions, particularly security functions for moving parts and / or other components. Through successful coupling, advantageously, security information, such as information regarding the monitoring area of ​​other components being infringed upon, is available at the moving parts, or security functions derived from that information are adopted or implemented at the moving parts, particularly at their drives, where the monitoring area is also being adjusted.

[0031] This advantageously enables the sharing of safety information between mobile device components and other components in both directions, as well as the cross-system use of fail-safe signals.

[0032] According to one design scheme, the monitoring area of ​​the moving part is adjusted based on the activation of other parts up to the safe area of ​​the coupling connection, or based on the safe area required by other parts due to the coupling connection.

[0033] Other components, for example, can be equipped with their own safety sensors designed to monitor a pre-defined area. This area, up to the coupling connection, is monitored as a monitoring zone. This includes, for example, the area surrounding a fixed component, such as in a machining station with a robot or manipulator. The previously monitored area is considered when adjusting the monitoring via the moving component.

[0034] In the case of other moving components, the monitoring area before coupling connection can, for example, be formed by a field widened in the direction of travel, for which different functions are employed depending on the distance from the moving component, such as warning signal output or deceleration.

[0035] Similarly, different monitoring zones with associated safety functions (e.g., stopping a robot mounted on another component or disconnecting it from the power supply) can be provided for other moving components that are stationary. After coupling two moving components, the previously monitored zones are also considered when adjusting the monitoring of the moving, and especially the corresponding, other moving components. In particular, the two monitoring zones are adjusted by considering new hazardous situations. The adjusted monitoring zones are designed according to the application or situation. For example, the circular monitoring zone of an uncoupled, stationary component is adjusted such that the component predefines the outer envelope of the area to be monitored within the adjusted monitoring zone. The adjusted monitoring zones take into account, for example, new hazards arising from the coupling connection and monitoring that is no longer needed or required due to the coupling connection.

[0036] Furthermore, the safety sensing mechanism of the moving component can monitor a safety area that becomes necessary due to the coupling connection, an area that exists for the entire coupled system due to the function of other components and their coupling connection. For example, a portion of the monitoring area that the moving component monitors after coupling by passing through the required safety area was not previously monitored by other components, particularly because it does not have its own safety sensing mechanism. Therefore, in the coupled state, areas that were not previously necessary to monitor are monitored, for example, because the robot can only move in the coupled state.

[0037] According to one design scheme, the monitoring area of ​​a moving component is adjusted in the following way: areas previously monitored by other components are now monitored by the moving component due to coupling. For example, portions of the monitoring area, particularly individual field areas, can be taken over by the moving component after coupling. For instance, switching monitoring modes allows the moving component's safety sensing mechanism to partially or completely take over the monitoring areas of other components. Similarly, even with coupling, areas can remain monitored by other components. For example, it is not necessary to take over the entire monitoring area of ​​other components, but only the area around the moving component in the coupled state.

[0038] According to one design scheme, the monitoring area of ​​the moving part is adjusted in the following ways: at least a certain share of the monitoring area is adjusted, especially for areas overlapping with the monitoring areas of other parts that are monitored up to the coupled connection; in particular, the monitoring mode is supplemented or switched; and in particular, safety functions are implemented. For example, therefore, in addition to adjusting the monitoring area in terms of spatial expansion of the area, i.e., the monitoring area, it is also possible to adjust the logic for using it to implement safety functions. For example, after successful coupling, two safety functions are triggered in the event of an intrusion into the monitoring area of ​​the moving part, especially the monitored area: on the one hand, a safety speed limit state (SLS) for the actuators of other parts, especially the actuators of the gripping robot mounted on it; and on the other hand, a so-called safety torque shutdown (STO) for the gripping robot mounted on the moving part. In this case, the robots of other parts, such as the stationary parts, decelerate, and the robot of the moving part is disconnected from the power supply.

[0039] According to one design scheme, the monitoring area of ​​other components is adjusted in such a way that the area is removed from the monitoring of other components based on the position of the moving component. This enables, for example, the moving component itself not to be identified as a dangerous object, and in particular, the moving component or the robot mounted on the moving component can stay or move before or within other components, while the monitoring of other components does not employ safety functions, such as continuously or persistently reporting intrusions and then stopping or implementing other safety measures.

[0040] According to one design, the monitoring area of ​​other components is adjusted by disabling safety devices between the moving component and other components. Especially in the case of other components constructed as fixed processing stations, safety devices, such as laser gratings, light curtains, or other optical devices, are typically provided to prevent human intervention or entry. When the coupling connection is successful, these safety devices are disabled, and the entire coupled system is monitored simultaneously, such that gaps in monitoring are compensated by adjusting the monitoring area of ​​the moving component and, preferably, also the monitoring areas of other components, which are created by disabling the safety devices. In the case of moving components in moving processing stations, for example, those constructed with mechanical safety devices (such as glass plates), only a sub-area of ​​the grating is disabled, where the safety devices of the static components overlap with those of the moving component. Therefore, the robot of the moving component can interact with other components, and particularly enter areas of other components otherwise protected by gratings, without triggering an emergency stop of the gratings and, in particular, the robot arm of the other components. This is permissible according to standards because the moving component itself blocks the relevant area through mechanical components (such as its base, profile, and glass plate).

[0041] According to a design scheme, attitude is determined by means of contour recognition. Advantageously, the position and orientation of a moving part relative to other parts can be reliably determined by means of contour recognition, in which the environment is recorded, for example, at a specific height above the ground. For example, a laser scanner with a fail-safe construction of the moving part is used to perform contour recognition in a fail-safe manner. For example, a specific contour can be preset for the moving part, and upon recognition of the contour, the moving part can classify its position and orientation relative to other parts. Typically, multiple contours can be applied at the laser scanner of the moving part.

[0042] According to a design scheme, the contour recognition method is used to identify the contours of other parts.

[0043] For example, the profile to be identified is placed on a surface; this is called positive application to the existing surface. Similarly, the profile can be machined into the surface, thus better protecting it from mechanical impact. This is then called negative application to the surface. Here, the risk of the profile to be identified colliding with people or machines in the facility is reduced, ensuring that the profile is not unintentionally damaged or deformed, thus rendering it unrecognizable.

[0044] When multiple contours are created within a moving component, multiple other components with corresponding contours can be coupled together. The use of safety-oriented contours enables fail-safe coupling connections, ultimately achieving compliance with current standards.

[0045] According to a design scheme, a uniform safety level, particularly a certified safety level, is used when determining the attitude of moving parts, establishing communication and fail-safe coupling connections, and adjusting monitoring areas. Specifically, the safety level is determined by the degree of hazard posed by the robot mounted on the part and the feasibility of interaction with human users within the facility. Therefore, the safety level to be used is based on emerging hazardous situations.

[0046] According to one design scheme, a uniform security level is used even when a secure state is adopted due to intrusion into the monitored area. Therefore, it is advantageously ensured that the required security level is met continuously from signal detection to output security measures.

[0047] Based on a design scheme, dynamically build and terminate communication and fault-safe coupling connections between moving parts and other parts.

[0048] To establish a coupled communication and fail-safe connection, such as wireless yet fail-safe communication via WLAN, wired communication connections are also feasible. For example, mobile components can dynamically log in and out of communication partners as participants in the established communication. Thus, mobile components can advantageously establish connections with various machines while performing overall tasks. Alternatively, a central fail-safe controller can establish communication with one of several mobile components, and then the mobile component can establish temporary fail-safe communication with other components with which it happens to be working.

[0049] The present invention also relates to a safety unit for a moving part of an industrial automation facility, comprising: an interface to a sensor for fault-safely determining the attitude of the moving part relative to other parts; a coupling interface for establishing a communication and fault-safe coupling connection between the moving part and other parts; and a monitoring unit for adjusting the monitoring area of ​​the moving part in the event of a successful coupling connection.

[0050] A sensor can be understood as part of a safety device for a moving part constructed in a fail-safe manner. The operating mode or sensor principle of the sensor used is preferably matched to the application. Depending on the application, 3D sensors can also be advantageously used.

[0051] The monitoring unit is constructed as part of the controller, particularly as part of a fail-safe controller, or as a controller for moving parts. Therefore, in a design, the safety system can be incorporated into the controller, or in other words, the controller for moving parts, particularly a PLC, can be a safety controller.

[0052] According to one design scheme, the security unit also includes a signal output unit, which is used to establish a security status, particularly the security status of moving parts and / or other components, in the event of an intrusion into the monitored area.

[0053] The present invention also relates to a security system having a security unit as described above, wherein the security system further includes at least one sensor, particularly at least one 2D sensor, 3D sensor or laser scanner.

[0054] According to a design scheme, other components are other moving parts. Moving parts and other moving parts can be AGVs or AMRs. Generally, moving parts can be understood as all moving units of a production facility with the described safety system, as well as structures that can be dynamically added or removed.

[0055] According to one design scheme, the other components are static components. Here, the static components can be equipped with their own safety units. For example, the static component may have its own safety sensing mechanism, or a safety device in the form of a safety controller may be incorporated within the static component. The safety controller drives, in a safety-guided manner, typically controllable movable parts, such as those in or at the location of the static component, and holds them, for example, in a stopped position until a successful coupling connection with the moving part is established. For example, the static component may not have a safety sensing mechanism, nor may it have an interface to a corresponding sensing mechanism.

[0056] The present invention also relates to a method for adjusting fail-safe monitoring in an industrial automation facility, wherein the monitoring area of ​​a moving part is adjusted by means of communication and fail-safe coupling between a moving part of the industrial automation facility and other parts of the industrial automation facility, such that a safe area based on the monitoring of other parts is monitored at least in part by means of the moving part.

[0057] According to one design scheme, communication and fault-safe coupling connections are performed based on determining the attitude of moving parts relative to other parts in a fault-safe manner. Attached Figure Description

[0058] The invention will now be explained in more detail with reference to the accompanying drawings and embodiments. The drawings show:

[0059] Figure 1 A schematic diagram of an AGV with a safety sensing mechanism according to the prior art is shown;

[0060] Figure 2 A schematic diagram of a fixed processing station with a safety sensing mechanism according to the prior art is shown;

[0061] Figure 3A schematic diagram of a system comprising a moving part and other parts according to a first embodiment of the present invention is shown;

[0062] Figure 4 A schematic diagram showing a visualization of a computer program for contour recognition according to a first embodiment of the present invention;

[0063] Figure 5 A schematic diagram illustrating the monitoring of adjustments according to a first embodiment of the present invention is shown;

[0064] Figure 6 A schematic diagram showing other components according to a second embodiment of the present invention is provided;

[0065] Figure 7 A schematic diagram illustrating the monitoring of adjustments according to a second embodiment of the present invention is shown;

[0066] Figure 8 A schematic diagram showing the monitoring area of ​​a moving part during navigation according to the prior art;

[0067] Figure 9 A schematic diagram of a moving part and other moving parts according to a third embodiment of the present invention is shown;

[0068] Figure 10 A schematic perspective view of the moving parts is shown;

[0069] Figure 11 A schematic diagram illustrating the monitoring of adjustments according to a third embodiment of the present invention is shown;

[0070] Figure 12 A schematic diagram of a safety system for a moving part according to any of the mentioned embodiments is shown.

[0071] In the accompanying drawings, unless otherwise specified, elements with the same function are given the same reference numerals. Detailed Implementation

[0072] according to Figure 3 The first embodiment of the present invention is explained below. Figure 3 A portion of a flexible manufacturing system 300 is schematically shown, in which modules 320 and 321 dynamically dock and detach. Here, a robotic arm 311 is statically mounted at the center of a hexagon surrounding it. Each production module 320, 321 can, for example, dock at five of the six sides of the hexagon. Three of these five sides are shown exemplarily. A sixth side is equipped with a conveyor belt and does not provide the feasibility of coupling (not shown).

[0073] Modules may be, for example, AGV 320 or mobile, particularly displaceable, processing station 321 with its own safety sensing mechanism. The interaction between the AGV 320 as a mobile component and the static manufacturing station 300 as other components will be observed in more detail below.

[0074] The side of the static manufacturing station 300, where the module can dock, should be able to allow interaction between the robot arm 311 and the module, and in particular, the manipulator 321 located on the AGV 320 should be able to enter the hexagon, for example, to introduce tools or manufacturing parts for the robot arm 311 or to extract workpiece carriers from the conveyor belt within the hexagon.

[0075] The static manufacturing station 300 is equipped with a safety laser scanner 330 at the corner of a hexagon and a grating 331 along its side (shown as an example only on one side). The safety laser scanner 330 is capable of performing the following function: when the monitored area 340 of the laser scanner 330 is violated, the robotic arm 311 operates at a reduced speed, i.e., it employs a safety-guided reduced speed or safety speed limit (SLS) function. The monitored area 340 is violated only when the AGV 320 is at least partially within the monitored area 340.

[0076] The grating 331 ensures that in the event of a violation of the grating, the robotic arm will be safely guided and monitored to a stop, i.e., a safe torque shut-off function, abbreviated as STO.

[0077] If the AGV 320 now approaches the static manufacturing station 300 along the moving path 350, the robotic arm 311 slows down because the AGV 320 encroaches on the monitored area 340 of the laser scanner 330 with its outer envelope.

[0078] After the AGV 320 reaches the docking section 304 on one side, its posture must be determined in a safe-guided manner to achieve coupling connection with the static manufacturing station 300. The safe guidance of the mobile robot's posture is determined through the safety function "safety-guided contour recognition" of the AGV 320's laser scanner 333. Contours 360 and 361 are provided at each location where fault-tolerant identification is required due to the presence of hexagons. These contours are uniquely designed so that the laser scanner can only identify the corresponding contours 360 and 361 and eliminate confusion. Contours are statically set in the laser scanner configuration, such as in standard monitoring areas or safety zones, and can then be evaluated and logically processed in binary form. Specifically, contour 360 can be provided as a template to the AGV 320's laser scanner 333, and the surrounding environment scanned by the laser scanner 333 is compared with the stored contour 360.

[0079] Here, as the AMR changes its position and orientation, the contour detected by the laser scanner is displaced relative to the AMR. Therefore, in the case of a contour identified and verified according to a stored template, a matching pose is ensured. In other words, only one valid pose of the AMR exists relative to the contour that produces the matching one.

[0080] exist Figure 4 The image shows a screenshot 410 of the computer program "SICK Safety Designer," with the outline 360 ​​on the left side of the scan as it approaches the static manufacturing station 300.

[0081] By utilizing the laser scanner 333 to identify the safety-related guidance of the contour 360° according to PLd, a fail-safe switching between the sensing mechanism and the coupled connection system can be achieved. Here, all participating sensors conform to the safety level PLd obtained through hazard identification and thus preset.

[0082] When the AGV reaches the expected posture, where the previously stored profile has been identified by a laser scanner and the laser scanner outputs a binary signal to verify the posture, a coupling connection is used between the AGV 320 and the static manufacturing station 300. As described above, a safety guidance method based on the PLd is also used for this purpose. In the example described, the profile is fixedly mounted at the static machine. Therefore, it is also possible to consider converting its own position and / or orientation to the world coordinate system via its position relative to the static component or via its position in the world. This calculation can also be performed in the F-PLC, thus enabling fail-safe operation.

[0083] After successful coupling, AGV 320 and static manufacturing station 300 form a fail-safe integrated system 500. The laser scanner 330 of static manufacturing station 300 then switches its monitoring status and no longer identifies AGV 320 as an interfering object, thus ceasing to identify and report intrusions into monitoring area 340. The monitoring area of ​​static manufacturing station 300 is adjusted such that the laser scanner 330 responsible for the face of the AGV no longer monitors the face of the now stationary module.

[0084] The laser scanner 333 of the AGV 320 also switches monitoring status and assesses the field area affecting the manipulator 321 of the AGV 320 and the robotic arm 311 in the hexagon.

[0085] Figure 5The adjusted monitoring area, security area, and raster are illustrated graphically after successful coupling. For all the monitoring areas shown, this refers to the logically stored area or field. Specifically, the schematic representation of the monitoring areas and security fields in the accompanying drawings does not represent a true visualization and simulation. However, it is advantageous to use schematic diagrams in engineering programs or simulations in simulation programs to program the monitoring areas and their adjustments.

[0086] The adjusted monitoring area SLS311, drawn as a lined area, begins at the laser scanner 330 of the fixed-position facility 300 and, in the event of an intrusion, causes the robotic arm 311 in the hexagon to reach a safe speed. The adjusted monitoring area ST0311, drawn as a grid, is evaluated by the laser scanner 333 of the AGV 320 and causes the robotic arm 311 to stop safely. This monitoring area is necessary because otherwise a human could pass through the "silent" area, i.e., through the area where the grating is released, without triggering the safe stop of the robotic arm 311. For example, at the side of the hexagonal docking section 304, the grating is deactivated only in the inner area, which the manipulator 321 can reach due to its geometry. The adjusted monitoring area STO321 causes the manipulator 321 to stop uncontrollably on the AGV 320.

[0087] The first embodiment illustrates the correlation between correct and fail-safe identification of the AGV 320's orientation. If the correlation identification is false, and the AGV 320 rotates a few degrees relative to the static facility 300 and its fixed contour 360, a gap will appear in the monitored area, allowing a human to approach the facility undetected. Furthermore, in the event of incorrect orientation and contour identification, the adjusted monitoring areas STO311 and STO321 will be triggered when the static facility encroaches on the adjusted monitoring areas, thereby either deactivating the robotic arm 311 in the hexagon and the manipulator 321 on the AGV.

[0088] Advantageously, the three-stage iterative process from DIN EN ISO 12100 for risk assessment and mitigation can be successfully completed using the technical protection measures planned according to the first embodiment.

[0089] The second embodiment describes an application example from the automotive industry. For example, automakers focus on replacing traditional assembly lines in factories with fleets of AGVs. Therefore, individual manufacturing units no longer need to be arranged sequentially, but can be placed in the workshop with a degree of freedom, where the arrangement satisfies the same relevance and sequence as before when assembling vehicles.

[0090] In this scenario, depending on the specific configuration of the vehicle, AGVs transport the car body from one manufacturing unit to the next. Figure 6 The example illustrates such a manufacturing unit 600, wherein, in a practical design, multiple manufacturing units are arranged in a factory. An AGV (Automated Guided Vehicle) travels through the manufacturing unit 600 to a certain extent, stopping in the middle, so that the unit can perform its production steps. Figure 7 The diagram shows the configuration where AGV 620 is located within manufacturing unit 600. Specifically, the AGV is stationary and does not move relative to manufacturing unit 600. For overview purposes, the representation of AGV 620 is limited to one instance, although multiple AGVs are present, particularly more than the number of manufacturing units.

[0091] like Figure 6 As shown, if there is no AGV with a vehicle body in manufacturing unit 600, all moving parts, such as robots 611 and 612, are in a safe state, especially in STO (Safety To Operate). For this purpose, for example, a controller is provided for the safe guidance of the robot actuators.

[0092] The AGV 620 is equipped with corresponding sensing mechanisms, enabling it to navigate between manufacturing units in a workshop where humans also reside. Therefore, the AGV 620 can independently monitor its movement within the manufacturing unit 600 to ensure it does not endanger humans. Once the AGV 620 is within the manufacturing unit 600 and performs safety-related position and orientation identification using a laser scanner, a secure communication connection is established with the manufacturing unit 600. The AGV 620 utilizes laser scanners 630 located at its front and rear for navigation.

[0093] Once a human approaches manufacturing cell 600 and thus approaches a hazardous area, they are identified by the laser scanner 630 of AGV 620. Human movement within the adjusted monitoring area SLS 600 is reported to the fail-safe controller of manufacturing cell 600 via a fail-safe communication connection. The controller then reduces all actuators to a safe speed according to the SLS function. Specifically, AGV 620 provides separate reports for the front and rear sides, allowing the cell controller to slow down only the directly related actuators instead of stopping the entire cell. If a person approaches manufacturing cell 600 and is identified within the adjusted monitoring area ST0 600, all robots 611 and 612 are shut down according to STO.

[0094] According to the second embodiment, the manufacturing unit 600 and the AGV 620 are advantageously coordinated in size so that only the access area of ​​the manufacturing unit 600 needs to be protected, and the access area can be monitored precisely by the sensing mechanism of the AGV 620. Depending on the application and planning, areas other than those used for navigation through the facility are used as adjustable monitoring areas SLS600 and STO600 monitored by the AGV 620.

[0095] according to Figure 8 This illustrates how the navigation monitoring area of ​​the AGV 820 in driving mode would look. Three sequentially adjacent areas, SLS871, SLS872, and ST0873, are shown. When an object enters a corresponding area, the area triggers three different safety functions in an alternating manner. Specifically, it triggers the following safety functions: a safety-guided speed in SLS871 and SLS872, which have two different preset, specifically configured, target speeds, and a STO (Safety Toll Collection) in ST0873. Therefore, it is possible to achieve the following: the closer the AGV 820 gets to an object, or the closer an object gets to the AGV 820, the slower the AGV 820 moves in the direction of travel, eventually shutting down.

[0096] In Figure 7 The adjusted monitoring area and Figure 8 When comparing the navigation monitoring areas in the context of the overall system, it becomes apparent that the geometry of the monitoring areas, particularly the selection of areas to be monitored from the overall set of monitorable areas, and the discrepancies between the security functions stored in each adjusted monitoring area are all factors to consider. For performance reasons, the evaluation of monitoring areas is typically summarized in the case of monitoring several (e.g., eight) areas.

[0097] In traditional factories, each manufacturing unit must be equipped with its own safety-guided sensing mechanism to comply with current standards. Manufacturing unit 600, as another static component according to a second embodiment of the invention, is sufficient without its own expensive safety-guided sensing mechanism, resulting in significant cost savings for automobile manufacturers. Here, the overall safety level of the facility is advantageously not compromised. The example described is illustrative and can be transferred to other manufacturing industries.

[0098] According to a third embodiment of the present invention, two AMRs are coupled together. Figure 9 An AMR, AMR 920, and another AMR 900 are schematically shown moving on an open surface. For example, the two AMRs may jointly perform a joining process or exchange materials or tools with each other. For illustration, Figure 10 A side-view stereoscopic view of this type of AMR is shown.

[0099] To this end, AMRs 920 and 900 are each equipped with manipulators 921 and 901 on their platforms, respectively, and the manipulators are only allowed to move when it is ensured that the human maintains a sufficient distance from the corresponding manipulator and from the corresponding AMR. Since AMR 900 cannot, at least initially, distinguish between humans, robots, and objects through its safety sensing mechanism, it operates here by means of, for example, fail-safe identification of the contours located at AMR 900. After fail-safe identification of the contours at AMR 900 by AMR 920, AMR 920 can determine that it is the desired AMR 900, such as an adjacent AMR 900 in a flexible manufacturing facility or a supplied AMR located in a flexible manufacturing process.

[0100] This allows the safety features of the AMR 900 and 920 to be effectively activated, enabling them to utilize the safety features for navigation within the facility. For example, two AMR 900s and 920s can, while in motion, [according to...] Figure 8 Assess the area as described for AGVs without operators. If an object or human is detected moving within the area, preset the speed or STO (Stop To Order) of the AMR's drive.

[0101] After the AMR 900 is fault-safely identified via the AMR 920, or vice versa, the AMRs should be close enough to each other to enable coupling and switching of the monitoring status of the sensing mechanism. Figure 11 The diagram illustrates AMRs 900 and 920 as a fail-safe integrated system 100 coupled together with a common, adjusted monitoring area STO11 and SLS111, in which AMRs 900 and 920 are capable of performing their tasks. Here, safety sensor compensation for one AMR is achieved through its area obscured from the angle of another AMR, which is necessary due to the other AMR, and vice versa.

[0102] The protected area formed by the adjusted monitoring area is further composed of various zones, the geometry of which is determined by the sensing mechanism. The number of zones that can be monitored depends on the number of installed sensors and the corresponding safety units of the AMR, such as in... Figure 11 As shown in the diagram, a circular adjustment monitoring area is obtained, or as shown in the diagram... Figure 5 More complex geometries are illustrated in the embodiments. Figure 11 The circular monitoring area shown can be achieved in particular by using multiple sensors placed at the corresponding outer edges of the AMR.

[0103] Specifically, instead of simply superimposing the monitoring areas set individually for each AMR, a common and adjusted monitoring area is designed for the overall hazardous situations obtained through the coupling connection of AMRs. It also takes into account new hazards that arise due to the coupling connection and monitoring that is no longer needed or required due to the coupling connection, such as between AMRs or within AMRs.

[0104] The design and optimization of the two AMRs in terms of expanding the monitoring area also involve adjustments to the security functions to be adopted for each monitored and intruded monitoring area.

[0105] The common internal adjustment monitoring area STO111 can, for example, trigger torque release or safety torque shutdown functions. For example, STO is configured as a safety function of the monitoring area STO111 in a stationary state and after successful coupling, because the manipulator can then move on the AMR. For example, the externally adjusted monitoring area SLS111 can, for example, have safety speed monitoring for one or both manipulators 901, 921, employing speed monitoring as a safety function when an object is detected. In variants where manipulators 901, 921 are not technically designed to support safety speed monitoring, the adjusted monitoring area can also be implemented with a warning function that triggers an output alarm signal.

[0106] The method according to the third embodiment is not limited to two participating AMRs, but can also utilize two or more units, enabling multiple AMRs to work together to handle complex tasks.

[0107] Figure 12 A safety system 200 is shown that can be used arbitrarily in the moving parts of the above embodiments. This safety system has a safety unit 150, such as a fail-safe PLC, which has an interface 160 to sensors 161, 162 for fail-safe determination of the attitude of the moving part relative to other parts. Furthermore, a coupling interface 170 is provided for establishing a fail-safe coupling connection for communication between the moving part and other parts via a WLAN communication component 190. Any of the other parts described in the above embodiments can be considered. The coupling interface 170 and the interfaces for driving other fail-safe parts, particularly the interface 160 to the sensors and the interface to the driver of the moving part, are advantageously implemented as a common interface. Parallel interfaces can also be used here, supporting, for example, wired and communication-based connections.

[0108] A monitoring unit 180 is also provided for adjusting the monitoring area of ​​the moving parts in the event of successful coupling. The safety unit 150 is, for example, a fail-safe controller with the aforementioned integrated interface and monitoring unit.

[0109] Control signals that implement safety functions in a fail-safe manner, for example in communication, are output to different fail-safe drivers 163, 164 in a fail-safe manner or via corresponding I / O modules.

[0110] The computer program product, which has a computer program, can be executed on the safety unit 150, particularly the fail-safe controller. The computer program product has components for executing the method according to one of the above-described design schemes. In particular, for this purpose, the logic area of ​​the monitoring unit cooperates with other logic areas of the controller.

[0111] Although the invention has been set forth and described in detail through preferred embodiments, it is not limited to the disclosed examples, and those skilled in the art can derive other variations therein without departing from the scope of protection of the invention.

Claims

1. A method for adjusting fail-safe monitoring in industrial automation facilities, in, The attitude of the moving part relative to other parts of the industrial automation facility is determined in a fail-safe manner using a first sensor of the moving part, the first sensor monitoring a first monitoring area of ​​the moving part. The second sensor monitors the second monitoring area of ​​the other components. Specifically, a communicative and fault-safe coupling connection is established between the moving component and the other components. Wherein, when the coupling connection is successful, the first monitoring area of ​​the moving component is adjusted, characterized in that, when the coupling connection is successful, the second monitoring area of ​​the other components is adjusted.

2. The method according to claim 1, wherein, Infringement of the adjustment of the moving part in the first monitoring area triggers the use of security functions.

3. The method according to claim 2, wherein, Infringement of the adjustment of the first monitoring area of ​​the moving part causes the use of the security functions of the moving part and / or the other parts.

4. The method according to claim 1, wherein, The second monitoring area, which infringes upon the adjustment of the other components, triggers the use of security functions.

5. The method according to claim 4, wherein, Infringement of the adjustment of the second monitoring area of ​​the other components causes the use of the security functions of the moving component and / or the other components.

6. The method according to any one of claims 1 to 5, wherein, The first monitoring area of ​​the moving component is adjusted according to the activated secure area of ​​the other components up to the coupling connection, or according to the secure area required by the other components due to the coupling connection.

7. The method according to any one of claims 1 to 5, wherein, The first monitoring area of ​​the moving component is adjusted by monitoring the area previously monitored by the second monitoring area of ​​the other components according to the coupling connection.

8. The method according to any one of claims 1 to 5, wherein, The monitoring mode is adjusted by adjusting at least a share of the monitored area, thereby adjusting the first monitoring area of ​​the moving component.

9. The method according to claim 8, wherein, The first monitoring area of ​​the moving component is adjusted by supplementing or switching safety functions for areas that overlap with the field area monitored by the second monitoring area connected to the other components up to the coupled second monitoring area.

10. The method according to any one of claims 1 to 5, wherein, The second monitoring area of ​​the other components is adjusted based on the position of the moving component from the monitoring area implemented by the other components.

11. The method according to any one of claims 1 to 5, wherein, The second monitoring area of ​​the other components is adjusted by disabling the safety device between the moving component and the other components.

12. The method according to any one of claims 1 to 5, wherein, Contour recognition is used to identify pose.

13. The method according to any one of claims 1 to 5, wherein, The contours (360°) of the other components are identified using contour recognition methods.

14. The method according to any one of claims 1 to 5, wherein, A uniform level of security is used when determining the attitude of the moving component, when establishing communicative and fault-safe coupling connections, and when adjusting the monitoring area.

15. The method according to claim 14, wherein, When determining the attitude of the moving part, when establishing communicative and fault-safe coupling connections, and when adjusting the monitoring area, a certified security level is used.

16. The method of claim 14, wherein, Even when a security status is adopted due to an infringement on the monitored area, the same security level is still used.

17. The method according to any one of claims 1 to 5, wherein, Dynamically establish and terminate communication and fail-safe coupling connections between the moving component and the other components.

18. A security system (200) having a security element (150). The security unit includes: An interface (160) to a sensor used to determine the attitude of a moving part relative to other parts in a fail-safe manner. A coupling interface (170) is used to establish a communicative and fault-safe coupling connection between the moving component and the other components; A monitoring unit (180) is configured to adjust a first monitoring area of ​​the moving component when the coupling connection is successful, and to adjust a second monitoring area of ​​the other component when the coupling connection is successful, wherein the safety system further includes at least one sensor, characterized in that the safety system has a component for performing the method according to any one of claims 1 to 17.

19. The security system (200) according to claim 18, wherein the security system has a security element (150), wherein, The other components are other moving components.

20. The security system (200) according to claim 18, wherein the security system has a security unit (150), wherein, The other components are static components.

Images