Method, system, controller and program product for providing safety in a robotic system

Abstract

A robot system (10) comprises a first set of robot controllers (12, 16, 20, 26), each robot controller comprising a safety change control unit (55, 56, 60, 64) and each robot controller being connected to at least one corresponding manipulator (14, 16, 18, 22, 24, 28), wherein one robot controller (12) is a proxy robot controller. The proxy safety change control unit (55) receives a request to manually operate at least one joint of at least one of the manipulators via a first point of manual control (MPC1) at one of the robot controllers (12) and forwards it to the other safety change control units (56, 60, 64), each safety change control unit (55, 56, 60, 64) determines a response to the request and at least one safety change control unit receives responses from the other safety change control units, investigates whether the responses and the request match and rejects the request in case at least one response does not match the request.

Description

Technical Field

[0001] This invention relates to the field of robotics. More particularly, it relates to robot systems, and methods, robot controllers, computer programs, and computer program products for providing safety within robot systems. Background Technology

[0002] A robotic system may include several robots, each of which is implemented as a robot connected to at least one manipulator.

[0003] Robot controllers typically run software that causes the manipulator to move along the robot's motion path. However, sometimes operators are interested in manually controlling the manipulator, for example, to make the manipulator move along a new or modified robot motion path. For this purpose, manual operation devices (such as teach pendants) may be connected to the robot controller.

[0004] For example, the use of manually operated devices is known from patent US 6560513B1.

[0005] US 2019 / 0121335A1 discloses a computer system in which a manually operated device is connected to a robot controller and used to command a drive device (e.g., a robot). According to the document, the robot controller can also change the operation of a target (e.g., a robot) in the event of a collision risk.

[0006] In many instances, single-point control for such manual operation in robotic systems is necessary, and in such cases, high safety is also important.

[0007] The present invention relates to the provision of safety when there is a single point of manual control for a set of robot controllers in a robot system comprising multiple robots. Summary of the Invention

[0008] Therefore, the present invention aims to provide safety in robotic systems comprising multiple robots when there is a single manual control point. According to the first aspect, this objective is achieved by a method for providing safety in a robotic system, the system comprising a first set of robot controllers, each robot controller including a safety change control unit and connected to at least one corresponding manipulator, wherein one of the robot controllers is a safety agent robot controller responsible for handling safety matters related to manual control of the manipulator, the method comprising the steps of: receiving, via a first point of manual control at one of the robot controllers, a request for manual operation of at least one joint of at least one first manipulator via the safety change control unit of the agent robot controller; forwarding the request to the safety change control units of other robot controllers via the safety change control unit of the agent robot controller; determining a response to the request in each safety change control unit; receiving the determined response to the request from the safety change control units of other robot controllers via the safety change control unit of at least one robot controller acting as a consistency investigation robot controller; investigating whether the response and the request match in the safety change control unit of the consistency investigation robot controller; and rejecting the request via the safety change control unit of the consistency investigation robot controller if at least one response does not match the request.

[0009] According to the second aspect, this objective is achieved by a robot system comprising a first set of robot controllers, each robot controller including a safety change control unit and connected to at least one corresponding manipulator, wherein one of the robot controllers is a safety agent robot controller responsible for handling safety matters related to manual control of the manipulator, the safety change control unit of the agent robot controller being configured to receive a request for manual operation of at least one joint of at least one first manipulator via a first point of manual control at one of the robot controllers, and to forward the request to the safety change control units of the other robot controllers, each safety change control unit being configured to determine a response to the request, and as a consistency investigation robot controller, the safety change control unit of at least one robot controller being configured to receive the determined response to the request from the safety change control units of the other robot controllers, investigate whether the response matches the request, and reject the request if at least one response does not match the request.

[0010] According to the third aspect, this objective is achieved by a robot controller for providing safety in a robot system comprising a first set of robot controllers, each robot controller being provided for connection to at least one corresponding manipulator, the robot controller including a safety change control unit configured to: receive a request for manual operation of at least one first joint of at least one first manipulator via a first point of manual control at one of the robot controllers, determine a response to the request, receive a response to a request determined by the safety change control units of the other robot controllers, investigate whether the response and the request match, and reject the request if at least one response does not match the request.

[0011] The first point of manual control can be connected to a first manual operating device or a point that can be connected to perform manual operations.

[0012] A request corresponding to the operator manipulator selection of at least one first joint may also originate from a manual control configuration device, which may be a first manual operation device. However, the manual control configuration device initiating the request may also be another device, such as an operator terminal in a robotic system.

[0013] A manual operating device is a device designed for manual operation, such as manual control by at least one manipulator. Such a manual operating device can also be a portable manual operating device, such as a teach pendant.

[0014] If the third-party robot controller is a proxy robot controller, and safety is responsible for handling safety related to the manual control of the manipulator, then obtaining the request includes receiving the request from the manual control configuration device, and the safety change control unit can also be configured to forward the request to the safety change control unit of other robot controllers.

[0015] According to the fourth aspect, the above objective is achieved by providing a secure computer program in a robot system comprising a first set of robot controllers, each robot controller being provided for connection to at least one corresponding manipulator, the computer program comprising computer program code that, when executed by the processor of the robot controller, implements a safety change control unit configured to: obtain a request for manual operation of at least one first joint of at least one first manipulator via a first point of manual control at one of the robot controllers; determine a response to the request; receive a response to the request determined by the safety change control unit of the other robot controllers; investigate whether the response and the request match; and reject the request if at least one response does not match the request.

[0016] According to the fifth aspect, this objective is achieved by a computer program product for providing safety in a robotic system, the computer program product comprising a data carrier having computer program code according to the fourth aspect.

[0017] Therefore, the connection point between the first manual operating device and one of the robot controllers in the first group can be the first point for manual control of the robot controllers in the first group. This point is also a single manual control point for at least one first joint.

[0018] A consistency survey robot controller is a robot controller that investigates the consistency of responses to requests. It investigates whether the responses are consistent with each other. Each robot controller can be a consistency survey robot controller. Therefore, investigations into whether responses match requests can be conducted in all safety change control units of the robot controller.

[0019] In a variation of the first aspect, the method may include distributing the determined response to other robot controller safety change control units via each safety change control unit.

[0020] In a corresponding variation of the second aspect, each safety change control unit can be configured to distribute the determined response to the safety change control units of other robot controllers.

[0021] In a corresponding variant of the third aspect, the safety change control unit is configured to distribute the determined response to the safety change control units of other robot controllers.

[0022] In this scenario, if at least one security change control unit detects at least one response that does not match the request, a request rejection can be executed. The investigation into whether the response and request match may also include investigating whether the response is a response to the same request.

[0023] Each robot controller also includes a safety configuration, and the safety configurations in different robot controllers can be the same.

[0024] In this case, the response to the request can be determined based on the settings of at least one first manipulator in the security configuration.

[0025] Therefore, this response can be based on an investigation of the safety configuration within the robot controller. Each robot controller's safety change control unit can investigate the local safety configuration within the robot controller, potentially relating to information about the robot controller at the first point where manual control is provided.

[0026] Furthermore, the safety configuration investigation may be an investigation into whether at least one first joint or at least one first manipulator is permitted to be manually operated. Therefore, the safety configuration may include settings that allow or disallow manual operation. If manual operation is permitted, conditions that permit manual operation may additionally exist. Thus, the investigation may additionally include an investigation into the existence of a manipulator associated with at least one first manipulator, wherein the associated manipulator has requested or permitted an operational state to allow the requested at least one first manipulator to be manually operated. The aforementioned settings may additionally specify the requested or permitted operational states of the joints of the associated manipulators corresponding to the at least one first manipulator. It is also possible that the associated manipulator varies depending on the location of the single point of control. For example, it is possible that the associated manipulator having the requested or permitted state is a manipulator connected to a robot controller with a first point of manual control or a manipulator close to the first point of manual control, such as a manipulator between a manipulator permitted for manual operation and the first point of manual control.

[0027] Therefore, the response can be based on the settings of the permitted or required operating states of the relevant manipulators in the security configuration. It can also be based on the current operating state of these relevant manipulators. More specifically, the response can be based on a comparison of the settings of the permitted or required operating states defined in the security configuration with the current operating state.

[0028] At least one first joint may be allowed or therefore not allowed, which can be reflected in the response. The response to the at least one first joint that is allowed then matches the request, while the response to the at least one first joint that is not allowed does not match the request.

[0029] This setting may additionally include settings regarding how the robot system responds to manual operations of at least one first joint as requested in the request. In this case, at least one safety change control unit of the robot controller may also monitor the operation of the robot system according to this setting.

[0030] Furthermore, the safety change control unit that denies the request can also implement a protective stop on all manipulators.

[0031] As previously stated, the request may correspond to an operator manipulator selection for at least one first joint. If no safety change control unit detects at least one response that does not match the request, each safety change control unit of each robot controller may further infer that a match exists and may subsequently lock the operator manipulator selection.

[0032] This means that if all security change control units perform an investigation and find a match between all responses and the request, a lock-up can be established.

[0033] Therefore, the safety change control unit of the robot controller can be configured to lock the operator manipulator selection if no safety change control unit has determined that at least one response does not match the request.

[0034] After locking, the agent robot controller's safety change control unit forwards information about the request and all responses to the manual control configuration device, and if a confirmation is received, confirms the validity of the lock, wherein manual operation of at least one first joint is permitted after the validity of the lock has been confirmed.

[0035] The lock may be valid until the safety change control unit of the agent robot controller receives a request to stop manual operation of at least one first joint. The request to stop manual operation of at least one first joint may be received from the first manual operation device or from the manual control configuration device.

[0036] As an alternative, the lock can remain in effect until the system is powered off, until a request to stop manual operation of at least one of the first joints is received.

[0037] Perform manual operation on at least one first joint in manual mode. Alternatively, locking may be effective until at least one first joint changes mode from manual to automatic.

[0038] The manual control configuration device may include a safety investigation unit for communicating with the safety change control unit of the agent robot controller.

[0039] In this scenario, the safety change control unit of the agent robot controller may receive the request from the safety investigation unit of the manual control configuration device. Similarly, the safety change control unit of the agent robot controller may forward information about the request and all responses to the safety investigation unit of the manual control configuration device. In this case, it may also receive confirmation and a request to stop manual operation of at least one first joint from the safety investigation unit.

[0040] In addition, more manual control is possible in the manipulators connected to the first set of robot controllers.

[0041] Therefore, the request could be a request to manually operate at least one second joint of at least one second manipulator via a second point manually controlled at another robot controller. Thus, unlike the robot controller that provides the first point of manual control, the second point of manual control can be provided by another robot controller.

[0042] This invention offers numerous advantages. It allows for the selection and safe manual control of all or a subset of robots. It provides scalability. It reduces the cost of robot systems associated with more than one manual operating device. It offers ease of use by having only one connection point for the first manual operating device. The single connection point additionally allows for a single control point for one or more robots in a robot system.

[0043] It should be emphasized that the term "including / comprises" as used in this specification is used to specify the presence of a feature, integer, step, or component, but does not exclude the presence or addition of one or more other features, integers, steps, components, or groups thereof. Attached Figure Description

[0044] The invention will now be described in more detail with reference to the accompanying drawings, in which:

[0045] Figure 1 The robot system is schematically shown, which includes a first set of robot controllers and several manipulators;

[0046] Figure 2 One implementation of the first robot controller in the first group is illustrated schematically;

[0047] Figure 3 A front view of the manually controlled configuration device is shown;

[0048] Figure 4 Several components in a manually controlled configuration device are schematically shown;

[0049] Figure 5 The communication between the first manual operating device and the first robot controller, as well as between the robot controllers of the robot system, is illustrated schematically.

[0050] Figure 6 A flowchart illustrating several steps in a method for providing safety in a robotic system is shown;

[0051] Figure 7 A computer program product in the form of a CD-ROM is schematically shown, which includes computer program code for implementing a safety change control unit for a robot controller. Detailed Implementation

[0052] In the following description, specific details, such as particular architectures, interfaces, technologies, etc., are set forth for purposes of explanation and not limitation, in order to provide a thorough understanding of the invention. However, it will be apparent to those skilled in the art that the invention may be practiced in other embodiments departing from these specific details. In other instances, detailed descriptions of well-known devices, circuits, and methods have been omitted so as not to obscure the description of the invention with unnecessary detail.

[0053] Figure 1 A robot system 10 is schematically illustrated. The robot system 10 comprises n robots, where n ≥ 2, and each robot is a combination of a robot controller and one or more manipulators. For example, a robot controller can be combined with up to four manipulators. In this example, there is a first robot composed of a first robot controller 12 and a first manipulator 14, a second robot composed of a second robot controller 16 and a second manipulator 18, and a third robot composed of a third robot controller 20, a main third manipulator 22, and a secondary third manipulator 24. Finally, there is an nth robot composed of an nth robot controller 26 and an nth manipulator 28. Each manipulator may include several joints, and the robot controller can control the movement of the manipulator by controlling its joints. Figure 1 The image shows one such joint 15 of the first manipulator 14.

[0054] The robot controller includes at least one memory with robot control software and a processor for controlling the robot using the robot control software. Figure 2 An example of such a processor PR 30 having a program memory M 32 in the first robot controller 12 is shown.

[0055] According to aspects of this disclosure, the memory 32 also includes software or computer program code 34 for implementing the first safety change control unit SCCU1, and optionally also implements the first safety configuration SCFG136.

[0056] It should be recognized here that, as an alternative, the safety change control unit can be implemented as a separate piece of hardware, such as an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a safety change control board that includes such circuitry.

[0057] As is also known, operators can manually operate robots using so-called manual operating devices (such as teach pendants or robot control mates). These manual operating devices are also typically portable.

[0058] Figure 3A front view of a manual control configuration device (i.e., a device configured for manual control) is schematically shown. The manual control configuration device is provided herein in the form of a first manual operating device 40. The manual control configuration device includes a display 42 and several user input units, such as keys or buttons 44 and a joystick 46. The keys 44 can be used to select between various options, which, if the manual control configuration device is a manual operating device, may be options such as emergency stop, manual mode, and automatic mode, while the joystick 46 can be used to control the actuator in manual mode. If the manual control configuration device is a manual operating device, it may also include a three-position enable input unit (not shown). The device may also be equipped with an accelerometer for motion sensing and a pointing unit using light or radio frequency identification (RFID), such as a camera-based pointing unit.

[0059] Figure 4 Various components of a manual control configuration device implemented as a first manual operation device 40 are schematically shown. This includes a processor PR 50, a memory M 52, and a user interface UI 48 consisting of the aforementioned display 42, buttons 44, joystick 46, a three-position enable unit, and possibly an accelerometer and / or pointing unit. Furthermore, the memory 52 includes computer program code providing a safety investigation unit SIU 54.

[0060] Figure 5 The diagram schematically illustrates a first manually operated device 40 including a safety investigation unit 54. Figure 1 The robots. Robot controllers 12, 16, 20, and 26 each include a safety change control unit and a safety configuration. Thus, the first robot controller 12 includes a first safety change control unit SCCU 155 and a first safety configuration SCFG 136, the second robot controller 16 includes a second safety change control unit SCCU 256 and a second safety configuration SCFG 258, the third robot controller 20 includes a third safety change control unit SCCU 360 and a third safety configuration SCFG 362, and the nth robot controller 26 includes an nth safety change control unit SCCU Un 64 and an nth safety configuration SCFGn 66.

[0061] The robot controllers 12, 16, 20, and 26 shown are all part of a first group of robot controllers, and one of the robot controllers in the first group is connected to a first manual operating device 40. In this example, this is the first robot controller 12. Thus, the first manual operating device 40 is also connected to the first robot controller 12, and it is connected to the first robot controller 12 via a connection that can be wired, such as via a cable. In other instances, the connection can be wireless, such as a short-range wireless connection, such as a Bluetooth connection or a WiFi connection. This connection is the only connection from the first manual operating device 40 to the robot system 10. It is also possible that no other manual operating devices are connected to the first group of robot controllers. Alternatively, more manual operating devices can be connected to the first group of robot controllers. However, in order to form a single manual control point for that joint of the manipulator, only one of them may be allowed to form a manual control point for a certain joint of a certain manipulator. However, it should be understood that this single manual control point can be changed. The manual operating device via which manual control is performed can also be changed. In some cases, the first manual operating device 40 may also be connected to other robot controllers in the robot system 10 or to another manual operating device connected to the first robot controller.

[0062] Each robot controller is also connected to the manipulator it controls. The first robot controller 12 is connected to the first manipulator 14, the second robot controller 16 is connected to the second manipulator 18, the third robot controller 20 is connected to the main third manipulator 22 and the auxiliary third manipulator 24, and the nth robot controller 26 is connected to the nth manipulator 28.

[0063] Therefore, the robot system includes a first set of robot controllers and several manipulators, wherein each robot controller in the first set includes a safety change control unit and is connected to at least one corresponding manipulator among the manipulators. It should be recognized that other sets of robot controllers may exist in the robot system and may be implemented differently, connected to other manipulators.

[0064] Furthermore, the first set of robot controllers is interconnected via a communication network (e.g., star, daisy chain, or ring network). Figure 5 In this context, control communication exists between robot controllers and between robot controllers and manipulators. Control communication between robot controllers typically uses a communication network, while robot controllers can communicate with manipulators via a dedicated direct communication link. This control communication... Figure 5 The arrow is indicated by a solid line.

[0065] There is also safety communication performed between the safety inspection unit 54 and the first safety change control unit 55 using the connection between the first manual operation device 40 and the first robot controller 12. There is also safety communication performed between different safety change control units using a communication network, and reading the safety configuration internal to the robot controller via the safety change control unit. This safety communication and reading of the safety configuration are... Figure 5 The dashed arrows are used to indicate this.

[0066] The robots in robot system 10 are typically operated autonomously, with the robot controller controlling each manipulator connected to it to follow the robot's motion path. However, operators are sometimes interested in manually operating one or more robots at a manual control point using a manual manipulation device, such as operating one or more robots via a first manual control point MPC1 using a first manual manipulation device 40. This may be necessary if the operator wants to change or update the robot's motion path. It is important that such changes to manual operation are performed safely. Therefore, aspects of this disclosure point to implementing measures for safely introducing manual operation into robot system 10 via such a first manual control point.

[0067] When an operator wants to interact with the robots in the robotic system 10, it is not necessary for all robots to be under the operator's control. Various aspects of this disclosure provide solutions on how to select and safely consent to robots in a robotic system that will be under human control and those that will not.

[0068] Now refer to Figure 6 To describe how to achieve this, Figure 6 A flowchart of several method steps in providing safety in the robot system 10 is shown.

[0069] like Figure 5 As shown, each robot controller includes a safety change control unit and a safety configuration. The safety change control unit may be part of the robot controller upon delivery. However, the safety configuration is typically implemented afterwards. The safety configuration can be placed in the robot controller in different ways. It can be placed offline by the operator before the robot controller is connected to the communication network, or it can be downloaded online to the robot controller when it is connected to the communication network.

[0070] More specifically, the safety configuration can be the same across different robot controllers. The safety configuration can therefore be identical, and can be used as an example to specify a first group of robot controllers in robot system 10 that can be used in the manual control of corresponding manipulators, which can be all or a subset of the robot controllers in the robot system. The first group of robot controllers can therefore be all or a subset of the robot controllers in the robot system. The safety configuration can then specify which robots in the first group can be manually operated. For manipulators that are allowed to be manually operated, it can additionally identify the required or permitted states of one or more other manipulators, such as whether the other manipulators must also be simultaneously manually operated, idle, or disabled, or whether they can be in an automatic state in which they can run along the robot's motion path. Therefore, these other manipulators are the manipulators associated with the manipulators that are allowed to be manually operated. The safety configuration can additionally specify the joints of the manipulators that are allowed to be manipulated and the joints of the associated manipulators to which these settings apply. It is also possible that the associated manipulators will differ depending on the location of the first point providing manual control. For example, the associated manipulator with the required or permitted state may be a manipulator connected to a robot controller with a first point of manual control or a manipulator close to the first point of manual control, for example, between a manipulator that is permitted to be manually operated and the first point of manual control.

[0071] Furthermore, the safety configuration in all robots can be identical. Therefore, each robot controller can have its own copy of the common safety configuration of all robot controllers in its group and the manipulators connected to them. The authenticity of each copy can also be verified, for example, by signature by a trusted entity.

[0072] In addition, secure communication between the first manual operating device 40 and the first safety change control unit 55 and / or secure communication between the safety change control units 55, 56, 60 and 64 of the robot controllers 12, 16, 20 and 26 may also be encrypted.

[0073] like Figure 5 As shown, a first manual operating device 40 is connected to a first robot controller 12. According to aspects of this disclosure, one of the robot controllers in the first group is responsible for handling safety related to the manual control of the manipulators connected to the first group of robot controllers. In the example presented here, the first robot controller 12 has this responsibility. For this purpose, the first robot controller 12 is also referred to as a proxy robot controller. Alternatively, another robot controller (e.g., a third robot controller 20) may also be a proxy robot controller.

[0074] The method begins when an operator of a manual control configuration device (e.g., the operator of the first manual operation device 40 or an operator terminal connected to a communication network) desires to allow manual operation of at least one first joint of at least one first manipulator via a first point of manual control, MPC1. Thus, the first point of manual control is a single manual control point for at least one first joint of at least one first manipulator. The first point of manual control can be a point on any robot controller to which the manual operation device in the first group can be connected. Furthermore, the at least one first manipulator can be any manipulator connected to the first group of robot controllers. Therefore, the operator selects at least one first joint of at least one first manipulator among the manipulators connected to the first group of robot controllers, and he or she desires to allow manual operation of at least one first joint of at least one first manipulator via the corresponding first point of manual control. In this example, the first point of manual control, MPC1, is the connection point between the first manual operation device 40 and the first robot controller 12. If the first manual operation device 40 is a manual control configuration device, the first point of manual control may additionally be known or automatically selected.

[0075] For example, in the first manual operation device 40, the safety investigation unit 54 of the manual control configuration device detects that the operator has selected or wishes to manually operate at least one first joint of at least one of the manipulators via the first point of manual control MPC1. Then, the safety investigation unit 54 sends a request REQ for manual control of at least one first joint of at least one of the manipulators via the first point of manual control MPC1. The request REQ is sent to the first safety change control unit 55 in the first robot controller 12, wherein the request is therefore a request to allow manual control of at least one first joint of at least one of the manipulators via the manual control point.

[0076] Furthermore, the request could be a request to manually operate at least one first joint of at least one first manipulator via a first point of manual control that allows the use of a first point of manual control that can be connected to a first point of manual control, in which case the manual control device is a first manual control device 40 connected to the first robot controller 12. If the request is sent from the first manual control device 40, the request to use the first manual control device via the first point of manual control can be automatic.

[0077] Thus, the first safety change control unit 55 of the agent robot controller receives (S100) a request REQ from the safety investigation unit 54 of the manual control configuration device, wherein the request REQ corresponds to the operator's manipulator selection, and thereby identifies the manipulator and possible joints of these manipulators that the operator wants to manually operate via the first point MPC1 of manual control, which may be only one manipulator and even only one joint of a single manipulator.

[0078] Then, the first safety change control unit 55 forwards the REQ request (S110) to the safety change control units of the other robot controllers in the first group. Therefore, the first safety change control unit 55 forwards the REQ request to the second safety change control unit 56, the third safety change control unit 60, and the nth safety change control unit 64. It can also forward information about which robot controller is the agent robot controller for the first point of manual control.

[0079] The forwarding described above is performed in a ring network. If the communication network is a star or daisy-chain network, then methods suitable for these types of networks will, of course, be used alternatively.

[0080] Subsequently, each safety change control unit determines (S120) a response RES to the request REQ. Therefore, the first safety change control unit 55, the second safety change control unit 56, the third safety change control unit 60, and the nth safety change control unit 64 each determine a response RES to the request, wherein the response may include confirmation that the operator wishes to manually operate the manipulator (e.g., using the first manual operation device 40) via a manually controlled first point MPC1 and possibly its joints. The response RES may also include a reply as to whether operation of the operator-selected manipulator and / or joint from the manually controlled first point MPC1 is permitted. The permitted manipulator and / or joint can be determined by the safety change control unit investigating its local safety configuration, possibly related to information from the robot controller providing the manually controlled first point. Thus, the response to the request may also be based on investigating the settings in the safety configuration regarding at least one first manipulator, e.g., whether a joint or manipulator is permitted or not permitted to be manually operated according to the manually controlled first point. The response may additionally be based on an investigation of whether a manipulator is associated with the requested at least one first manipulator. Which manipulator is the relevant manipulator, for the first manipulator selected by the operator, may depend on the position of the manually controlled first manipulator. The associated manipulators may additionally have required or permitted operating states to allow at least one first manipulator of the request to be manually operated. Examples of such required or permitted operating states are that, when the first manipulator selected by the operator is manually operated via a first point of manual control, the associated manipulators must be manually operated, idled, or disabled, or if they can be in automatic mode. The aforementioned investigation may additionally include an investigation of the required or permitted operating states of the joints of the associated manipulators corresponding to the at least one first manipulator of the request. Thus, permission for manual operation may depend on the required and / or permitted operating states of the associated manipulators.

[0081] Therefore, the response can be based on whether manual operation of at least one joint of at least one manipulator is permitted, and if permitted, the response can additionally be based on the settings of the permissible or required operating states of the associated manipulator in the safety configuration. The response can additionally be based on the current operating state of these associated manipulators and / or joints. The response can be more specifically based on a comparison of the settings of the permissible or required operating states with the current operating state.

[0082] The determined response is then sent to the safety change control unit of at least one consistency-investigating robot controller in the first group, where the consistency-investigating robot controller is a robot controller that investigates the consistency of responses to the request. It investigates whether different responses are consistent with each other. It is possible for only one robot controller in the first group to be such a consistency-investigating robot controller. However, it is also possible for several robot controllers to act as consistency-investigating robot controllers. In this example, each robot controller in the first group is a consistency-investigating robot controller.

[0083] In this scenario, each safety change control unit distributes its determined response RES (S130) to the safety change control units of the other robot controllers in the first group. Therefore, the first safety change control unit 55 sends its determined response to the second safety change control unit 56, the third safety change control unit 60, and the nth safety change control unit 64; the second safety change control unit 56 sends its determined response to the first safety change control unit 55, the third safety change control unit 60, and the nth safety change control unit 64; the third safety change control unit 60 sends its determined response to the first safety change control unit 55, the second safety change control unit 56, and the nth safety change control unit 64; and the nth safety change control unit 64 sends its determined response to the first safety change control unit 55, the second safety change control unit 56, and the third safety change control unit 60.

[0084] Then, the determined response is received by the safety change control unit of each conformance survey robot controller. Since each robot controller in this example is a conformance survey robot controller, each safety change control unit receives a response from the other safety change control units (S135).

[0085] Then, the safety change control unit of each consistency survey robot controller investigates whether the response and request match. If there is only one consistency survey robot controller, then only one safety change control unit may investigate whether the response and request match. In this case, it is also possible that a proxy robot controller acts as the consistency survey robot controller. In this example, all robot controllers in the first group act as consistency survey robot controllers. Therefore, each safety change control unit investigates (S140) whether the response and request match.

[0086] A match exists if all responses are the same response to the same request. Therefore, a match exists if the responses involve the same manipulators from the same manual control points as in the original request, and possibly also involve manual operation of their joints, and if manual operation is permitted by consideration of settings in the security configuration and possibly the current operating state of the relevant manipulators.

[0087] If at least one safety change control unit detects at least one response that does not match the request (S150), then the safety change control unit rejects the REQ request (S160), which may include manual operation of the manipulator that is not permitted to request. Therefore, if at least one safety change control unit detects at least one response that does not match the request, the request is rejected. Following the rejection of the request, a protective stop in the robot system 10 may be additionally executed (S170). This protective stop may be executed for all robots. Consequently, all manipulators connected to the robot controllers of the first group will stop moving.

[0088] However, if no safety change control unit finds a mismatch, i.e., if all responses match the request (S150), then each safety change control unit infers (S180) that a match exists. Thus, each robot controller also knows how to respond to commands input by the operator via the first manually controlled point MPC1, for example, commands input using the first manual operating device 40. Then, each safety change control unit locks (S190) the selection, i.e., it locks the operator selection of the manipulator and / or joint. Therefore, if all safety change control units perform investigations and find matches between all responses and requests, locking occurs.

[0089] Then, the first safety change control unit 55 of the agent robot controller forwards (S200) information about the request and all responses to the safety investigation unit 54 of the manual control configuration device, and then waits for a reply.

[0090] Then, the safety check unit 54 of the manual control configuration device 40 displays the received information on the display 42. It displays the request REQ and various responses, then awaits confirmation from the operator, which can be input by the operator using one or more keys 44 and / or joysticks 46. If the manual control configuration device is a first manual operating device 40 equipped with an accelerometer and / or pointing unit, the confirmation can be detected via the accelerometer or pointing unit, where a specific movement and / or orientation of the manual operating device or the pointing of a pointing unit with a specific point or code (e.g., barcode, QR code, or RFID code) corresponds to the confirmation. After receiving the confirmation, the safety check unit 54 then sends the confirmation ACK to the first safety change control unit 55 in the agent robot controller.

[0091] After receiving the ACK confirmation, the first safety change control unit 55 confirms (S210) the validity of the lock, and then allows (S220) manual control of the manipulators and joints defined in the request in the robot system via all safety change control units. The lock then remains until the manual operation of the manipulators and joints in question is cancelled, possibly in combination with a new selection, and / or the robot system is powered off. Thus, the lock can be effective until a request to stop manual operation of at least one first joint of at least one first manipulator is received from the first manual operation device or manual control configuration device via the safety change control unit of the agent robot controller. Alternatively, the lock can be released by powering off the system.

[0092] As an alternative, locking can be effective until at least one joint of at least one actuator changes from manual mode to automatic mode. However, from a safety perspective, this alternative may be less appealing.

[0093] Therefore, the locking is a lock on the operator manipulator selection defined in the original request. Thus, during the locking period, the operator can only manually operate the manipulator, and may also manually operate the joints defined in the original request. Furthermore, it is possible for this operation to originate from only one manual control point, in this case, the point where the first manual operating device is connected to the robot system, specifically the point connected to the first robot controller.

[0094] When an operator manually operates a selected manipulator, the safety change control unit can monitor the operation of the associated manipulator. Because each robot controller in the first group includes a safety configuration with settings regarding how the robot system responds to manual operation of the selected manipulator, the safety change control unit of each robot controller connected to the associated manipulator can monitor that manipulator's compliance with the settings and, if necessary, change the operation of the associated manipulator.

[0095] Providing a safe approach offers several advantages. It allows for the connection and disconnection of a first manual operating device to and from the actual robot during robot selection, and allows for the safe operation of all or a subset of the robots. It provides scalability, for example, handling robots or combinations of robots in a robot system independently of the number of robots. It avoids the need for additional safety-related hardware to select or deselect robots for manual control. It reduces the cost of robot systems with multiple manual operating devices. It provides ease of use by having only one connection point for the manual operating device to safely control the selected robot in the robot system. This single connection point additionally provides a single control point for one or more robots in the robot system.

[0096] If the robot controllers are observed independently of each other, it can be seen that the safety change control unit of the robot controllers in the first group, which acts as a consistency investigation robot controller, receives a request at the first point of manual control in the robot system to manually operate at least one first joint of at least one first manipulator using a first manual operating device, wherein the request originates from a manual control configuration device, such as the first manual operating device 40. The safety change control unit determines the response to the request and receives responses to requests determined by the safety change control units of the other robot controllers in the first group, investigates whether the responses match the requests, and rejects the request if at least one response does not match the request.

[0097] If there are more consistency survey robot controllers, the aforementioned safety change control unit additionally distributes its determined response to the safety change control units of the other consistency survey robot controllers.

[0098] If the safety change control unit of the consistency survey robot controller determines that at least one response mismatch request, the operator manipulator selection can be locked by the safety change control unit of all consistency survey robot controllers.

[0099] If the robot controller is a proxy robot controller and a consistency survey robot controller, the safety change control unit of the robot controller additionally obtains the request by receiving the request from the manual control configuration device and forwards the request to the safety change control units of other robot controllers in the first group. In the case of a lockout, the operator manipulator selection also forwards information about the request and all responses to the manual control configuration device, and confirms the validity of the lockout if a return confirmation is received.

[0100] Another possibility is to allow the use of more manually operated devices to control the manipulators that are connected to the robot controller in the first group.

[0101] For example, the request could also be a request to manually operate at least one second joint of at least one second manipulator among a plurality of manipulators of the first group of robot controllers via a manually controlled second point. The manual control via the manually controlled second point can then be performed using a second manually operated device connected to or potentially connected to another robot controller in the first group at the manually controlled second point. As an example, a third robot controller could provide the manually controlled second point.

[0102] Therefore, the request can be for allowing a first manually operated device to operate at least one first joint of at least one first manipulator via a manually controlled first point, and for allowing a second manually operated device to operate at least one second joint of at least one second manipulator via a manually controlled second point, wherein the manually controlled first point can be provided at a robot controller in a first group connected to or to be connected to the first manually operated device, and the manually controlled second point is provided at another robot controller in a first group connected to or to be connected to the second manually operated device.

[0103] It should also be recognized that the request could also be for allowing even more manually operated devices to operate the controller via more manual control points.

[0104] The safety change control unit, as described above, is provided via a processor along with computer program code in memory, which implements the safety change control unit when run by the processor. Alternatively, and as previously mentioned, the safety change control unit can be provided in the form of an application-specific integrated circuit (ASIC) or a field-programmable gate array (FPGA). The computer program code can also be provided on one or more data carriers, such as a memory stick or CD-ROM, where the program code is loaded into the robot controller to implement the safety change control unit. One such data carrier 70 has computer program code 34 in the form of a CD-ROM. Figure 7 The illustration shows that a computer program product can be provided as an alternative on the server and downloaded from the server to the processing entity. It should also be mentioned that security configurations can be provided on the same data carrier or server.

[0105] Although the invention has been described in conjunction with embodiments that are now considered to be the most practical and preferred, it should be understood that the invention is not limited to the disclosed embodiments; rather, the invention is intended to cover various modifications and equivalent arrangements. Therefore, the invention is defined only by the following claims.

Claims

1. A method for providing safety in a robot system (10), the robot system (10) comprising a first set of robot controllers (12, 16, 20, 26), each robot controller (12, 16, 20, 26) including a safety change control unit (55, 56, 60, 64) and connected to at least one corresponding manipulator (14, 18, 22, 24, 28), wherein one of the robot controllers is a proxy robot controller responsible for handling safety related to manual control of the manipulator, the method comprising the steps of: The safety change control unit (55) of the proxy robot controller receives (S100) a request (REQ) to manually operate at least one first joint of at least one first manipulator via a first point of manual control (MPC1) at one of the robot controllers. The request (REQ) is forwarded (S110) to the safety change control unit of other robot controllers via the safety change control unit (55) of the proxy robot controller. In each safety change control unit (55, 56, 60, 64), a response (RES) to the request (REQ) is determined (S120). The safety change control unit (55, 56, 60, 64) of at least one robot controller (12, 16, 20, 26) acting as a consistency investigation robot controller receives (S135) the determined response to the request from the safety change control unit of the other robot controller. In the safety change control unit of the consistency investigation robot controller, an investigation (S140) is conducted to determine whether the response and the request match, and If at least one response does not match the request (S150), the safety change control unit of the consistency investigation robot controller rejects the request (S160).

2. The method of claim 1, wherein each robot controller includes a safety configuration, and the determination of the response by each safety change control unit (55, 56, 60, 64) is based on an investigation of the corresponding safety configuration.

3. The method of claim 1 or 2, wherein each robot controller is a consistency investigation robot controller, the method further comprising distributing (S130) the determined response to the safety change control units of the other robot controllers through each safety change control unit, the investigation (S140) comprising investigating whether the response and the request match in all safety change control units, and if at least one safety change control unit of the safety change control unit finds at least one response that does not match the request, the rejection is executed.

4. The method according to claim 1 or 2, wherein investigating (S140) whether the response and the request match includes investigating whether the response is a response to the same request.

5. The method according to claim 1 or 2, further comprising, for all of the manipulators, implementing (S170) a protective stop if the request is denied.

6. The method of claim 1 or 2, wherein the request corresponds to operator manipulator selection of the at least one first joint, and further comprises: If no safety change control unit finds at least one response that does not match the request (S150), then in each safety change control unit (55, 56, 60, 64) it is inferred (S180) that a match exists, and the operator manipulator selection is locked (S190).

7. The method of claim 6, wherein the request (REQ) is received from a manual control configuration device, and further comprises: The safety change control unit (55) of the agent robot controller forwards (S200) information about the request and all responses to the manual control configuration device, and if an acknowledgment (ACK) is received, confirms (S210) the validity of the lock, wherein manual operation of the at least one first joint is permitted after the validity of the lock has been confirmed (S220).

8. The method of claim 6, wherein the locking is effective until a request to stop manual operation of the at least one joint is received by the safety change control unit (55) of the agent robot controller or the system is powered off.

9. The method according to claim 1 or 2, wherein the request is also a request to manually operate at least one second joint of at least one second manipulator via a second point manually controlled at another robot controller in the robot controller.

10. A robot system (10) comprising a first set of robot controllers (12, 16, 20, 26), each robot controller (12, 16, 20, 26) including a safety change control unit (55, 56, 60, 64) and connected to at least one corresponding manipulator (14, 18, 22, 24, 28), wherein one of the robot controllers is a proxy robot controller responsible for handling safety in relation to manual control of the manipulator. The safety change control unit (55) of the proxy robot controller is configured to receive a request (REQ) to manually operate at least one first joint of at least one first manipulator via a first point of manual control (MPC1) at one of the robot controllers, and to forward the request (REQ) to the safety change control units of other robot controllers. Each safety change control unit (55, 56, 60, 64) is configured to determine a response (RES) to the request (REQ), and The safety change control unit of at least one robot controller, which is a consistency investigation robot controller, is configured to receive the determined response to the request from the safety change control units of the other robot controllers, investigate whether the response matches the request, and reject the request if at least one response does not match the request.

11. The robot system of claim 10, wherein all robot controllers are conformance survey robot controllers, each safety change control unit is configured to distribute the determined response to the safety change control units of the other robot controllers, the survey comprising investigating whether the response and the request match in all safety change control units, and the rejection is executed if at least one of the safety change control units finds that at least one response does not match the request.

12. A robot controller for providing safety in a robot system (10), the robot system (10) comprising a first set of robot controllers (12, 16, 20, 26), each robot controller (12, 16, 20, 26) being provided for connection to at least one corresponding manipulator (14, 18, 22, 24, 28), the robot controller including a safety change control unit configured to cause the robot controller to operate as a proxy robot controller and a conformity survey robot controller according to claim 10 or 11.

13. The robot controller of claim 12, wherein the robot controller is a proxy robot controller responsible for handling safety in relation to manual control of the manipulator, receiving the request includes receiving the request (REQ) from a manual control configuration device, and the safety change control unit (55) is further configured to forward the request (REQ) to the safety change control unit of another robot controller.

14. A computer program product for providing safety in a robot system (10), the robot system (10) including a first set of robot controllers (12, 16, 20, 26), each robot controller (12, 16, 20, 26) being provided for connection to at least one corresponding manipulator (14, 18, 22, 24, 28), the computer program product including a data carrier (70) having computer program code (34) implementing a safety change control unit (55) when run by a processor (30) of the robot controller, the safety change control unit (55) being configured to: Receive a request (REQ) to manually operate at least one first joint of at least one first manipulator via a first point of manual control (MPC1) at one of the robot controllers. The request (REQ) is forwarded to the safety change control unit of other robot controllers. Determine the response (RES) to the request (REQ). Receive a response to the request as determined by the safety change control unit of the other robot controller. Investigate whether the response and request match, and If at least one response does not match the request, the request is rejected.

Images