Spraying robot scanning safety control and reset method and system

Abstract

The application discloses a spraying robot scanning safety control and reset method and system, comprising: determining a variable transverse arrangement threshold based on the convexity of a carrier danger envelope towards a workpiece side, the possible convexity of the workpiece and the transverse safety margin, or directly confirming the actual net gap between the danger envelope and the nearest intrusion feature of the workpiece; determining the required stop advance distance along the scanning direction based on the carrier speed, response time and braking capacity, and making the pre-observation of the space measurement unit meet the distance requirement; when the transverse geometric condition, on-the-way stop condition, boundary, occupation envelope or measurement state do not meet the safety requirement, preventing new data after triggering from entering the effective data set of the current scanning session, prohibiting the spraying gun action and controlling the carrier to stop under control; after resetting, rechecking the safety state and creating a new scanning session. The application can reduce the collision risk of limited path operation and guarantee data integrity.

Description

Technical Field

[0001] This invention relates to the field of robotic automated painting technology, specifically to a scanning safety control and reset method and system for a painting robot. Background Technology

[0002] In automated operations such as industrial spraying, mobile vehicles typically move along fixed guide paths to drive robots to scan or perform operations on target workpieces. Due to the limitations of the guide paths, vehicles cannot flexibly navigate around obstacles or avoid them laterally like autonomous mobile robots. Existing safety protection solutions mostly use fixed distance thresholds to trigger emergency stops, or control the vehicle to automatically reverse or return to its origin when an obstacle is detected. However, in confined spaces, automatic reversal may lead to secondary collision risks due to unverified blind spots behind the vehicle; at the same time, if a protective stop is triggered during scanning, the system often retains partial scanning data from before the interruption. If this discontinuous or incomplete data is directly used when resuming operations, it may lead to deviations in downstream work trajectories or quality defects. Therefore, there is an urgent need for a safety control solution that can adapt to the characteristics of operations along confined paths, effectively preventing collisions while ensuring data integrity. Summary of the Invention

[0003] The purpose of this invention is to provide a method and system for safety control and reset of a painting robot during scanning. This invention can reduce the collision risk in restricted path operations and ensure data integrity.

[0004] The technical solution of this invention: A method for scanning safety control and reset of a painting robot, applied to a painting system having a carrier moving along a guide path, a robot mounted on the carrier, and a spatial measurement unit, wherein the spatial measurement unit has a known or verifiable spatial relationship with the hazard envelope of the carrier in the scanning state, including:

[0005] Determine the warning boundary of the target workpiece towards the carrier, the workpiece occupancy envelope, and the carrier danger envelope that includes the carrier and robot;

[0006] Before scanning or at the start of scanning, determine the most protruding part of the target workpiece facing the carrier side, the most recent intrusion feature, or the equivalent workpiece occupancy envelope, and confirm that it has not crossed the warning boundary or intruded into the prohibited occupancy area; and determine the lateral arrangement threshold based on the amount of protrusion from the carrier side reference boundary to the carrier danger envelope facing the workpiece side, the possible amount of protrusion from the target workpiece body reference surface to the most recent intrusion feature, and the preset lateral safety margin, and confirm that the lateral arrangement distance or actual net clearance meets the requirements.

[0007] The effective observation position or effective field of view of the spatial measurement unit is positioned forward along the current scanning direction to the dangerous envelope of the vehicle, so as to obtain the current or predicted actual net clearance between the surface of the target workpiece and the dangerous envelope of the vehicle in the forward area before the dangerous envelope of the vehicle arrives, as well as the effective forward observation distance along the current scanning direction that can be used for controlled stopping.

[0008] The required stop advance distance along the current scanning direction is determined based on the vehicle's motion state and braking parameters;

[0009] In response to the following events: the lateral arrangement distance is less than the lateral arrangement threshold; the actual net clearance is less than the lateral safety margin; the effective advance observation distance is less than the required stop advance distance; the most protruding part or the most recent intrusion feature crosses the warning boundary; the workpiece occupancy envelope intrudes into the prohibited occupancy area; or the space measurement unit fails, the system prevents new data triggered after the event from entering the valid dataset of the current scanning session. The prevention includes at least one of the following: stopping acquisition, stopping reception, discarding, isolating, marking as invalid, or transferring to a buffer isolated from the current scanning session. The system also prohibits the spray gun action, controls the carrier to stop in a controlled manner, and outputs a warning.

[0010] After the vehicle stops, remain in place and wait, and disable the current scanning session and its downstream tasks;

[0011] In response to a reset command, the security status is rechecked, and a new scan session is created upon successful rechecking. The scan is then re-executed from a predetermined scan start point or a checkpoint with independent position and coverage integrity proofs. The independent position and coverage integrity proofs include matching the current image features with a previously saved reference feature record bound to a common reference coordinate, and generating a new checkpoint position version when feature geometric consistency, effective feature coverage, and reprojection or registration residuals meet thresholds. The new checkpoint position version does not reinstate the old scan session.

[0012] In the above method, the lateral arrangement threshold is determined by the sum of the protrusion amount from the carrier-side reference boundary to the carrier's hazard envelope toward the workpiece side, the possible protrusion amount from the target workpiece's main body reference surface to the most recent intrusion feature, and the lateral safety margin; each protrusion amount and the lateral safety margin are determined or verified based on at least one of the robot model and installation position, scanning safety posture, target workpiece type, and protrusion status.

[0013] The aforementioned method calculates the required stop advance distance along the current scanning direction using the following formula:

[0014] ;

[0015] Where, d stopThe required stop advance distance along the current scan direction, v is the absolute value of the vehicle's velocity along the current scan direction or the maximum velocity that may be reached during the response period, and t is the vehicle's velocity along the current scan direction. r a is the most unfavorable total response time from the generation of hazardous data or the satisfaction of failure criteria to the establishment of effective braking force by the braking mechanism. min is the absolute value of the minimum braking deceleration that is greater than zero and can be guaranteed under full load and the most unfavorable friction conditions; e is the upper limit of the measurement, calibration, installation and position prediction error along the current scanning direction; and m is the safety margin along the current scanning direction.

[0016] The required stop advance distance is used to verify the effective advance observation distance along the current scanning direction, and is not used as the lateral arrangement distance or actual net gap perpendicular to the current scanning direction; the lateral arrangement distance, actual net gap and required stop advance distance are determined separately.

[0017] In the above method, the spatial measurement unit has a lead amount relative to the leading edge of the vehicle's hazard envelope along the current scanning direction. The sum of the lead amount and the effective observation distance along the current scanning direction is not less than the required stop advance distance, and a detection advance time not less than the sum of the control response time and the braking time is provided.

[0018] The above-described method, which keeps the vehicle stationary after it stops and disables the current scanning session and its downstream tasks, includes:

[0019] The latch stop reason, trigger position, minimum distance, session identifier, measurement unit observation status, lifting or turning status, and affected data range;

[0020] Maintain the robot in a scanning standby posture and prevent the vehicle from automatically returning to its original position;

[0021] This invalidates the current scanning session and its downstream tasks, and a manual reset operation cannot directly restore the validity of the current scanning session or downstream tasks.

[0022] The failure is independent of any external input or remote command. External files, network messages, application programming interfaces, remote terminals or upstream control devices inputting scan tasks, coordinates of the area to be repaired, coverage, trajectory, robot tasks and continue execution instructions or completion flags cannot restore the old scan session or replace security checks, new session creation and independent location and coverage integrity proof.

[0023] The downstream tasks include coordinates, regions, coverage, trajectories, tool poses, or robot tasks generated by this system or imported from outside. External task identifiers or remote reset confirmations do not change the failure state.

[0024] The above method further includes:

[0025] After the scan is completed or after protection is triggered, confirm the protection position status of the space measurement unit;

[0026] The protected position status is estimated by the retraction command and the calibrated parameterized action time, or directly confirmed by the position sensor, end sensor, air pressure, flow rate, drive feedback or a combination thereof.

[0027] When the estimated state is formed using the parameterized action time, if a timeout or state inconsistency occurs, the robot action is prohibited.

[0028] The method described above further includes: during scanning, controlling the robot to be in a scanning safe posture or a set of scanning safe postures that has been verified to limit or reduce the hazard envelope of the vehicle, and confirming the validity of the current posture based on the robot joint position, end-effector position, hazard envelope check value or a combination thereof; the validity of the current posture is a condition for starting or continuing scanning.

[0029] A safety control and reset system for a painting robot scanning system includes:

[0030] Allows the placement of area and warning boundary definition units;

[0031] A vehicle moving along a guide path;

[0032] Robots mounted on the vehicle;

[0033] A spatial measurement unit is set at at least one of a vehicle, robot, fixed support or distributed measurement node, and has a known or verifiable spatial relationship with the vehicle's hazard envelope in the scanning state, and its effective observation position or effective field of view can be placed in front of the vehicle's hazard envelope along the current scanning direction;

[0034] The security controller is configured to perform the methods described above and intercept external tasks and remote commands associated with failure scan sessions or incomplete security resets;

[0035] Warning devices; and

[0036] Intentionally reset the input device.

[0037] A control device includes a processor and a memory, wherein instructions in the memory, when executed by the processor, cause the control device to perform the methods described above.

[0038] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, causes the processor to perform the method as described above.

[0039] Compared with existing technologies, this invention separately determines and judges the lateral arrangement distance and actual net clearance perpendicular to the scanning direction, and the required stop advance distance along the scanning direction: the former is determined based on the protrusion of the carrier and robot towards the workpiece, the potential protrusion of the target workpiece, and the lateral safety margin, to prevent lateral collisions of the structure; the latter is determined based on the carrier speed, response time, and braking capability, and is provided by the advance observation distance, to ensure that the carrier can be controlled to stop before the danger envelope reaches the potential collision position. This avoids directly comparing distances in different directions and with different physical meanings, and can adapt to changes in robot model, installation position, target workpiece protrusion status, and operating speed.

[0040] Furthermore, when safety protection is triggered, the vehicle remains stationary instead of automatically returning to its origin, avoiding the risk of secondary collisions caused by unverified rear environments in confined spaces such as guide paths. Simultaneously, the current scanning session and its downstream tasks are forcibly invalidated, requiring a new session to be created and rescanned after a reset. This prevents incomplete or discontinuous pose data generated during the interruption from flowing into subsequent operations from a data management perspective, helping to ensure the trajectory accuracy and process consistency of the painting operation. In addition, the system maintains the unrecoverability of failed scanning sessions independently of any external input or remote commands. Any externally issued tasks, coordinates, trajectories, or continue execution commands cannot bypass safety checks, new session creation, and position integrity verification to resume the old operation, thus eliminating secondary risks caused by remote misoperation or data reuse at the control chain level. Attached Figure Description

[0041] Figure 1 This is a schematic diagram of the roof view layout and front configuration of the visual module of the spray booth according to an embodiment of the present invention;

[0042] Figure 2 This is a schematic diagram illustrating the separation relationship between the lateral arrangement distance, the actual net gap, and the stop advance distance along the scanning direction in an embodiment of the present invention.

[0043] Figure 3 This is a flowchart of the scanning safety control state machine of the painting robot according to an embodiment of the present invention. Detailed Implementation

[0044] The present invention will be further described below with reference to the accompanying drawings and embodiments, but this should not be construed as limiting the present invention.

[0045] Example 1: This example provides a method for scanning safety control and reset of a painting robot, applied to a painting system having a carrier moving along a guide path, a robot mounted on the carrier, and a spatial measurement unit. Preferably, the spatial measurement unit is independent of the robot and is located at the front of the carrier; in alternative embodiments, it can be located in a robot-locked scanning standby structure, a fixed bracket, or a distributed node, as long as a known or verifiable spatial relationship with the carrier's hazard envelope can be obtained during scanning. Figure 1 and Figure 3 As shown, this method establishes a dual protection mechanism combining static boundary pre-detection and dynamic proactive sensing, and implements a strict data and session isolation strategy when protection is triggered to ensure the safety of operations and the validity of data under restricted paths. Specifically, the method includes the following steps:

[0046] Step 1: Determine the warning boundary of the target workpiece facing the carrier, the workpiece occupancy envelope, and the carrier hazard envelope including the carrier and robot. In this step, [the following is combined with...] Figure 1 As shown, the warning boundary defines the safety limit of the target workpiece facing the carrier, constraining the extreme position of the target workpiece in that direction. The workpiece occupancy envelope characterizes the actual spatial range occupied by the target workpiece, which can be determined based on the overall contour and local protruding structures of the target workpiece. Specifically, it can be established through ground markings, physical references, laser projection, positioning points, electronic maps, or point cloud data obtained by spatial measurement units. The carrier hazard envelope refers to the combined spatial envelope formed by the carrier body, the robot in a scanning safe posture, the spatial measurement unit, and the corresponding mechanical errors and sway margins during the scanning motion. It should be understood that the carrier hazard envelope is not a fixed geometry, but a safety boundary that dynamically changes with the robot's posture, carrier load, and motion state. Before scanning starts, the robot should be in a scanning safe posture that reduces the envelope volume to ensure an initial safety margin.

[0047] Step 2: Before or at the start of the scan, determine the most protruding part of the target workpiece facing the carrier, the most recent intrusion feature, or the equivalent workpiece occupancy envelope, confirming that it has not crossed the warning boundary or intruded into the prohibited occupancy area. This step also determines the carrier-side reference boundary, the outermost edge of the carrier danger envelope facing the workpiece, the target workpiece body reference surface, and the most recent intrusion feature of the target workpiece facing the carrier. The lateral arrangement threshold can be expressed as D. layout =P r +P w +M z , where P r P is the amount of protrusion from the reference boundary on the carrier side to the outermost edge of the carrier's danger envelope towards the workpiece side. w M represents the possible protrusion from the reference surface of the target workpiece body to the nearest intruding feature. zThis is to allow for a required lateral safety margin. Taking a specific prototype and an embodiment with the vehicle's rearview mirror not removed as an example, the robot's first joint may protrude approximately 200 mm relative to the +Z side reference boundary of the vehicle, and the vehicle's rearview mirror may protrude approximately 200 mm relative to the side of the vehicle body. With an additional lateral safety margin of approximately 200 mm, the exemplary lateral distance from the +Z side reference boundary of the vehicle to the side of the vehicle body can be approximately 600 mm. This 600 mm is only used to illustrate the reason for the formation of the above distance and is not a fixed parameter, nor is it a limitation on the scope of protection of this invention; when changing the robot model, changing the installation position or scanning safety posture, removing or folding the rearview mirror, changing the target workpiece type or the state of the protrusion, or adjusting the required safety margin, P... r P w M z and D layout All will change accordingly. If the actual net clearance between the most recent intrusion feature of the target workpiece and the outermost edge of the dangerous envelope of the carrier is directly measured, then the actual net clearance should be no less than M. z As a safety requirement, 600 mm should not be used again as the net clearance requirement between the two.

[0048] The determination of the most protruding part can also be achieved by the target workpiece occupying the grid, the three-dimensional bounding volume, the distance field, the nearest intrusion feature, or the predicted collision time. As long as it is used to determine whether the target workpiece has crossed the warning boundary, intruded into the prohibited area, or made the minimum gap insufficient, it will not deviate from the boundary pre-inspection due to the lack of explicit calculation of a single most protruding point.

[0049] Step 3 involves positioning the effective observation position or effective field of view of the spatial measurement unit forward along the current scanning direction within the vehicle's hazard envelope. This allows for the acquisition of the current or predicted actual net clearance between the target workpiece surface and the vehicle's hazard envelope within the forward region before the vehicle's hazard envelope arrives, as well as the effective forward observation distance along the current scanning direction suitable for controlled stopping. In this step, the actual net clearance represents the geometric safety factor perpendicular to or across the scanning path; the effective forward observation distance represents the motion safety factor along the current scanning direction. Both are established and verified separately. The spatial measurement unit can be physically mounted at the front of the vehicle or functionally positioned forward using a reflected light path, a steerable field of view, distributed sensors, or direction-dependent biasing. When the scanning direction changes, the system switches the corresponding measurement unit, field of view, or extrinsic parameter version to maintain the effective forward observation relationship along the current scanning direction.

[0050] Step 4: Determine the required stopping advance distance along the current scanning direction based on the vehicle's motion state and braking parameters. In this step, the distance required for the vehicle to come to a complete stop from detecting a hazard is determined based on the vehicle's maximum possible speed during the period from triggering to braking establishment, the most unfavorable total response time, the absolute value of the minimum braking deceleration that can be guaranteed under full load and most unfavorable friction conditions, as well as the upper limit of measurement and position prediction errors and safety margins along the scanning direction. This required stopping advance distance does not replace the lateral arrangement threshold or actual net clearance conditions.

[0051] Step 5: In response to the following conditions: the lateral arrangement distance is less than the lateral arrangement threshold, the actual net clearance is less than the lateral safety margin, the effective forward observation distance along the current scanning direction is less than the required stop advance distance, the most protruding part or the most recently intruding feature crosses the warning boundary, the workpiece occupancy envelope intrudes into the prohibited occupancy area, or the spatial measurement unit fails, new data after triggering is prevented from entering the valid dataset of the current scanning session, the spray gun action is prohibited, the carrier is controlled to stop, and a warning is output. The lateral condition is used to prevent lateral collisions between the robot, carrier, or workpiece protruding structures; the along-path condition is used to ensure that there is still sufficient distance to complete the response and braking after triggering. Failure to meet either condition results in a physical safety failure state.

[0052] Step 6: After the vehicle stops, it remains stationary and waits, invalidating the current scanning session and its downstream tasks. Unlike existing technologies that automatically return to the origin upon encountering an obstacle, this embodiment controls the vehicle to remain stationary at its current position after triggering protection. This is because in confined spaces such as guide paths, the environment behind the vehicle is often not verified in real time, and blindly reversing can easily lead to secondary collisions with obstacles or unevacuated personnel. The stationary waiting strategy limits safety risks to a known range, awaiting manual intervention for confirmation. Simultaneously, the system marks the current scanning session and its associated downstream tasks (such as trajectory planning and painting operations) as invalid. Here, "invalid" means that some data collected before the interruption no longer participates in subsequent surface model construction or task generation; even manual reset cannot directly restore the validity of the old session. This mechanism effectively prevents the transmission of pose discontinuities or incomplete coverage caused by data interruption to downstream processes, avoiding quality defects or equipment damage that may result from performing operations based on incomplete data.

[0053] Step 7: In response to the reset command, the safety status is rechecked, and a new scan session is created after the check passes. The scan is re-executed from the predetermined scan start point or a checkpoint with independent location and coverage integrity proof. The checkpoint with independent location and coverage integrity proof can be established by matching the current image features after the reset with reference feature records that are persistently stored outside the previous scan session and bound to common reference coordinates. During matching, at least two of the following are considered: guide path, direction of movement, geometric relationship between features, number of effective features, spatial coverage, and reprojection or registration residuals. A new checkpoint position version and a new scan session are generated only when the confidence level and error threshold are met. This process only proves the starting position of the new session and the known coverage boundary, and does not directly restore or reactivate the old scan session that has failed. When there are multiple solutions for coordinate recovery, insufficient reference feature coverage, inconsistent versions, or the coverage continuity from the checkpoint to the subsequent area cannot be independently proven, the system keeps the spray gun disabled and downstream tasks invalid, and rescans from the predetermined scan start point. Thus, the coordinate recovery function and the safety reset function work together but are mutually gated to avoid crossing the safety rescan requirement based on a single image similarity. In this step, after the operator troubleshoots, adjusts the target workpiece position, or confirms environmental safety, a reset command can be issued via the intentional reset input device. Upon receiving the reset command, the system does not directly resume the old task but instead performs a complete safety status check, including but not limited to reconfirming whether the target workpiece is within the permissible layout area, whether the spatial measurement unit is functioning normally, and whether the vehicle braking status is good. Only after all safety checks are passed will the system create a completely new scanning session and restart the scanning operation from a predetermined scanning start point or an independently verified checkpoint. When the reason for stopping includes the loss or unreliability of position coordinates along the guide path, the position service can use images or geometric features saved from the first scan or previously valid scans to match the current observation with the reference observation and form a new, verified position version. However, this position recovery result does not directly restore the failed scanning session; the controller still needs to re-check the permissible layout boundaries, warning boundaries, hazard envelopes, measurement unit status, and field reset conditions, create a new session, and re-acquire data that meets integrity requirements according to the new position version. This "reset equals rescan" logic ensures that each operation is based on complete and valid safety premises and data foundations, further improving system reliability and process consistency.

[0054] This invention extends safe stop and reset gating to externally imported or remotely issued scan tasks, coordinates of areas to be repaired, coverage, trajectories, and robot tasks. Even if the external task file comes from an approved upstream system, already contains robot coordinates, or carries a continue / complete flag, the old scan session cannot be resumed; the task is only allowed to be reissued after the current physical hazard envelope, safe attitude, measurement unit protection position, and independent position and coverage integrity verification of the new session have all passed.

[0055] The "preventing new data from entering the valid dataset of the current scanning session" as described in this invention does not require physically stopping all sensors or communication links. When fault diagnosis requires continued data acquisition, subsequent data can be discarded, isolated, marked as invalid, or written to an independent diagnostic cache, as long as it cannot continue the valid coverage of the old session and cannot drive downstream tasks. The scanning safety posture can be a single fixed posture, or a set of postures or a restricted posture range verified offline or online envelope check. Intentional reset inputs should originate from manual operation, key / authorization confirmation, monitored authorized control, or a combination thereof, and should not be automatically generated solely due to the disappearance of fault signals, restoration of communication, or power-on; the reset input itself does not restore the validity of the old scanning session or old downstream tasks.

[0056] Through the execution closed loop formed by steps 1 to 7 above, this embodiment achieves full-process control from pre-operation boundary pre-inspection, pre-operation dynamic protection, to post-abnormality safety isolation and reset. In particular, by coordinating the lateral placement of thresholds or actual net clearance verification with the stop advance distance verification along the current scanning direction, lateral geometric collision risk and braking risk along the process are controlled respectively; by combining in-place waiting and forced session failure, the risk of automatic backtracking under restricted paths is avoided and the integrity of the data link is ensured.

[0057] As a preferred option, such as Figure 2 As shown, the system establishes lateral geometric constraints and along-travel braking constraints separately. The lateral layout threshold D_layout is determined by the sum of the protrusion P_r of the robot or carrier towards the workpiece, the possible protrusion P_w of the target workpiece towards the carrier, and the lateral safety margin M_z, i.e., D_layout = P_r + P_w + M_z; the required stop advance distance d_stop along the current scanning direction is calculated based on the carrier speed, the worst-case total response time, the minimum guaranteed braking deceleration, the upper limit of the along-travel error, and the along-travel safety margin.

[0058] ;

[0059] Where, d stopThis represents the lead time required for the vehicle to come to a complete stop along the current scanning direction from the generation of hazardous data or the fulfillment of failure criteria; v is the absolute value of the vehicle's velocity along the current scanning direction, and if further acceleration is possible during the response period, the maximum velocity that may be reached during the response period is used; t r This includes the most unfavorable total delay for measurement sampling and processing, communication bus, safety controller operations, I / O response, and the braking mechanism to establish effective braking force; a min is the absolute value of the minimum braking deceleration that is greater than zero and can be guaranteed under full load and the most unfavorable friction conditions; e is the upper limit of the measurement, calibration, installation and position prediction error along the current scanning direction; m is the additional safety margin along the current scanning direction.

[0060] The lateral arrangement threshold and the required stop advance distance must not be confused. The aforementioned approximately 600 mm is only for a specific prototype configuration. layout Example values, whose source can be P r Approximately 200 mm, P w Approximately 200 mm and M z The sum of approximately 200 mm; this value does not belong to d stop The fixed minimum distance in the formula does not mean that a 600 mm net clearance must be maintained between the nearest intrusion feature of the target workpiece and the vehicle's hazard envelope. When the robot model, installation location, or scanning safety posture changes, or the vehicle's rearview mirrors are removed or folded, or other protrusion dimensions and safety margins of the target workpiece change, the corresponding P should be redefined. r P w M z and D layout The lateral arrangement threshold can also be determined through direct geometric calculations of the danger envelope and the workpiece occupancy envelope, distance field, occupancy grid, or on-site calibration results. The required stop advance distance can be determined using the above formulas, measured or calibrated dynamic distances, speed classification lookup tables, estimated collision time, stop distance, or speed-related safety envelopes.

[0061] Furthermore, the spatial measurement unit has a leading amount L relative to the leading edge of the vehicle's hazard envelope along the current scanning direction. lead And has an effective observation distance L along the current scanning direction. obs Both should satisfy L lead +L obs Not less than d stop And ensure that the detection lead time is not less than the sum of the worst-case total response time and braking time. This relationship is used to ensure that the vehicle completes a controlled stop before reaching the detected danger position along the scanning direction, and is related to the D direction in the Z direction. layoutThe actual net clearance is determined separately. For bidirectional scanning or complex path scenes, the forward observation requirements in the corresponding direction can be met through bidirectional measurement units, steerable fields of view, or multiple overlapping fields of view.

[0062] In a current prototype's coordinate system, the spatial measurement unit employs a D455 class depth camera, vertically mounted at the front of the vehicle along the +X axis, positioned on the -Z axis side relative to the vehicle's centerline, with its field of view facing the +Z axis. The vision module only moves back and forth along the X-axis with the vehicle to complete a side scan, without moving along the Y or Z axes; the images are stitched together only along the X-axis. It should be understood that the aforementioned coordinate orientation represents only one installation embodiment. The protective function of the spatial measurement unit is determined by the functional relationship of "obtaining effective distance information before the vehicle's hazard envelope in the current scanning direction," and is not limited by a fixed coordinate axis or a unique mounting hole position. This functional relationship can be achieved through physical front-mounting, front-mounting of the field of view formed by reflected light paths, selection of distributed measurement units, or switching of the front measurement unit when the scanning direction changes.

[0063] Furthermore, forward sensing does not necessarily require the spatial measurement unit to be independently installed at the front of the vehicle. The spatial measurement unit can be installed on the vehicle, the robot structure in a confirmed scanning standby posture, the fixed structure of the paint booth, or multiple distributed nodes. Forward observation can also be formed through reflected light paths or steerable fields of view. The necessary condition is that, in the current scanning direction, it can output the current or predicted distance related to the hazard envelope before the vehicle's hazard envelope reaches the potential collision location, and the installation change, standby posture, or node extrinsic parameters are in valid versions. Changing the sensor mounting carrier or fusing the results of multiple sensors does not change the safety closed loop of forward sensing, dynamic stopping, session failure, and new session reset.

[0064] Preferably, after the vehicle stops, it remains stationary and waits, and the current scanning session and its downstream tasks are disabled. Specifically, this includes: latching the stop reason, trigger position, minimum distance, session identifier, measurement unit observation status, lifting or turning status, and affected data range; maintaining the robot's scanning standby posture and preventing the vehicle from automatically returning to its origin; keeping the current scanning session and its downstream tasks invalid, and ensuring that manual reset operations cannot directly restore the validity of the current scanning session or downstream tasks. This invalidation is independent of any external input or remote command. Scanning tasks, coordinates of the area to be repaired, coverage, trajectory, robot tasks, and continue execution instructions or completion flags input from external files, network messages, application programming interfaces, remote terminals, or upstream control devices cannot restore the old scanning session or replace safety checks, new session creation, or independent position and coverage integrity verification. The downstream tasks include coordinates, areas, coverage, trajectories, tool poses, or robot tasks generated by this system or imported externally; external task identifiers or remote reset confirmations do not change the invalidation state. In a distributed implementation, safety triggering, motion stopping, spraying medium prohibition, and session failure can be executed by different controllers, but each controller shares an irreversible session identifier, stop reason code, and reset status. In the event of communication interruption, inconsistent status versions, or any missing necessary confirmation, the system remains in a state of prohibiting new data reception and prohibiting spraying. Specifically, the aforementioned latching operation is not a simple alarm recording, but rather constructs a snapshot of the fault scene containing multi-dimensional information. The stop reason is used to distinguish different trigger sources such as too close a distance, boundary crossing, or sensor failure; the trigger position and minimum distance record the precise spatiotemporal coordinates when the hazard occurred, providing quantitative evidence for subsequent analysis of whether it was a workpiece parking deviation or a system false alarm; the measurement unit observation status and lifting or turning status record the working state and mechanical configuration of the spatial measurement unit when the protection is triggered, helping to determine whether the fault originated from the measurement unit itself; the session identifier and affected data range clearly define which collected data has been contaminated or interrupted, preventing the incorrect reuse of these incomplete data during reset and rescanning. Maintaining the robot in a scanning standby posture is to maintain a minimum carrier hazard envelope volume, avoiding the expansion of the risk area due to accidental robot extension. The prohibition against vehicles automatically reversing to their origin is based on the physical characteristics of the confined space of the guidance path. Without independent verification of the environment behind, automatic reversal is very likely to cause secondary collisions with obstacles or unevacuated personnel.

[0065] As an optional implementation, controlled evacuation is permitted only when the system is equipped with a backward measurement device, the entire evacuation path has been independently verified, and explicit authorization has been received from personnel. This controlled evacuation is an optional function and does not replace the primary implementation of waiting in place. During the evacuation, the vehicle continues to move at a controlled speed and continuously monitors the safety status of the rear environment. Making the current scanning session and its downstream tasks invalid means that the system forcibly cuts off the flow of data before the interruption at the data link level. Even if the operator performs a reset operation, the system will not attempt to repair or resume the old session but must create a completely new session to start anew. This design effectively avoids spray trajectory deviations or quality defects caused by data splicing, ensuring the integrity and consistency of operational data.

[0066] Furthermore, to ensure the physical safety of the space measurement unit in its non-operational state, this invention also introduces a protection position confirmation mechanism. Preferably, the protection position status of the space measurement unit is confirmed after scanning or after protection is triggered. The method for confirming the protection position status can be flexibly selected according to the explosion-proof level, cost constraints, and reliability requirements of the application scenario, mainly including the following two parallel implementation paths.

[0067] The first approach is to establish an estimated state based on the retraction command and a calibrated parameterized action time. This method is particularly suitable for flammable and explosive environments such as paint booths, where it is difficult to install electrical position sensors in hazardous areas, so the system uses a purely pneumatic or hydraulic drive circuit. Specifically, the safety controller sends a control signal to the actuator that drives the space measurement unit to retract, and simultaneously starts a preset time window timer. This time window is calibrated based on historical statistical data of the actuator completing its full stroke under standard operating conditions, and allows sufficient margin for mechanical wear and air pressure fluctuations. When the calibrated parameterized action time expires and no abnormality is detected, the system assumes that the space measurement unit has reached the protected position. However, as a safety fallback, if a timeout or inconsistency occurs when using parameterized action time to establish the estimated state, the robot's movement remains prohibited. For example, if a valid estimated state is not established within the maximum allowed action time, or if an indirect abnormal signal such as an abnormal drop in air pressure is detected during execution, the system will determine that the protected position confirmation has failed and lock the robot's start permission until manual intervention is required. This soft estimation mechanism meets the basic safety requirements in explosion-proof environments with low system complexity, while making up for the uncertainty caused by the lack of direct feedback through strict timeout and anomaly monitoring logic.

[0068] The second approach involves direct confirmation of the status using position sensors, end position sensors, air pressure, flow rate, drive feedback, or a combination thereof. This method is suitable for environments with higher safety requirements or non-explosion-proof operating conditions. Specifically, a mechanical or magnetic induction end position switch can be installed at the retraction endpoint of the spatial measurement unit to directly output a position signal; alternatively, the pressure change curve or flow meter reading in the air path can be monitored to determine whether the actuator has completed the expected work process; for electric actuators, encoder feedback or current waveforms of the motor can also be read to confirm the actual displacement. These direct feedback signals can be used individually or in combination to improve the confidence of the confirmation. For example, the position signal from the end position switch can be logically ANDed with the signal indicating that the air pressure has reached a stable threshold; only when both conditions are met is the protection position confirmation considered successful. This hard feedback mechanism provides deterministic status evidence and can effectively identify fault modes that are difficult to detect with soft estimation, such as mechanical jamming, linkage breakage, or sensor drift.

[0069] It should be understood that the two confirmation paths mentioned above are not mutually exclusive and can be used in combination or dynamically switched according to configuration in actual systems. Regardless of the method used, the core function is to ensure that the spatial measurement unit is reliably stored in a safe area before entering the spraying operation or other non-scanning state, thereby avoiding the risks of paint mist contamination, mechanical impact, or static electricity accumulation in subsequent processes.

[0070] Preferably, the most protruding part of the target workpiece facing the carrier is determined before or at the start of the scan, and it is confirmed that the most protruding part has not crossed the warning boundary. This includes identifying the most protruding part or the most recent intrusion feature of the target workpiece facing the carrier. The protrusion may be a car rearview mirror, fender edge, external spare tire, temporary clamp, or other local structure; its possible protrusion amount can be obtained through spatial measurement, CAD model, vehicle model or workpiece parameters, manual input, or on-site calibration. When the rearview mirror is removed, folded, or the state of the protrusion changes, the system recalibrates using the updated protrusion amount, occupancy envelope, or directly measured actual net clearance, instead of continuing to use the example value of the previous state. Thus, lateral safety determination relies on verifiable geometry, not on a fixed vehicle model, a fixed robot model, or a fixed 600 mm parameter.

[0071] Furthermore, to maintain a stable and controlled range of safety risks during scanning, this invention also sets forth specific requirements for the robot's operational readiness state. Preferably, during scanning, the robot is controlled to be in a scanning safe posture or set of scanning safe postures that have been verified to limit or reduce the hazard envelope of the carrier, and the validity of the current posture is confirmed based on the robot's joint positions, end effector positions, hazard envelope verification values, or a combination thereof; the validity of the current posture is a condition for starting or continuing scanning. The scanning safe posture can be a single configuration where all joints are within a preset safe angle range and the end effector is retracted to the vicinity of the carrier, or it can be multiple configurations verified by offline envelope calculation, or a restricted posture range jointly defined by online joint positions, end effector positions, and hazard envelope verification values. For example, the robot's upper and lower arms can be folded to a vertically downward or horizontally close to the top of the carrier posture, reducing the projected area of ​​the robotic arm; alternatively, the posture can be allowed to change within a restricted range without expanding the verified hazard envelope. Upon receiving a scan start or continue command, the safety controller reads the encoder, end-effector position, or envelope verification results for each axis of the robot to verify whether the current configuration belongs to a valid scan safety posture. If the verification fails, the controller prohibits the vehicle from moving, prohibits the creation or continuation of a scan session, and outputs a status prompt. Thus, the protection gating relies on a verifiable danger envelope, rather than on a unique fixed posture name or a single joint angle template.

[0072] Example 2: This example provides a scanning safety control and reset system for a painting robot. This system maps the logical steps in the aforementioned method examples to specific physical entity architectures to achieve operational safety protection under restricted paths. The system includes a unit for defining the permitted deployment area and warning boundaries, a vehicle that moves along a guide path, a robot mounted on the vehicle, a spatial measurement unit, a safety controller, a warning device, and an intentional reset input device.

[0073] Specifically, the carrier is configured to carry the robot and spatial measurement unit, moving reciprocally along a preset guide path. The guide path can be a rigid guide rail laid on the ground, a magnetic strip navigation path, or a laser projection path, which restricts the carrier's lateral freedom, allowing it to travel only in a specific direction. The robot is fixedly mounted above or to the side of the carrier to perform scanning or painting operations on the target workpiece. In scanning mode, the robot maintains a scanning safety posture that minimizes the dangerous envelope volume of the carrier, reducing the collision risk area during movement.

[0074] In a preferred embodiment, the spatial measurement unit is set up independently of the robot, and its effective observation position or effective field of view can be positioned forward along the current scanning direction within the vehicle's hazard envelope. In this embodiment, "set up independently" means that the spatial measurement unit is not mounted on the robot's end flange or robotic arm linkage, but is directly mounted on the vehicle body via an independent bracket, slide, or fixed base, or mounted on an external auxiliary structure that moves synchronously with the vehicle.

[0075] In a preferred physical layout, the spatial measurement unit is located at the front end of the vehicle along the current scanning direction (e.g., the +X axis direction), and its installation height and angle are calibrated so that its effective field of view covers the surface of the target workpiece in front of the vehicle. This physically-forward layout ensures that the detection point of the spatial measurement unit is always spatially ahead of the leading edge of the vehicle's hazard envelope, thus providing the necessary distance information before physical contact occurs. It should be understood that in other embodiments, the field of view can also be forward-positioned by changing the optical path through an optical mirror assembly, or sensors can be placed at both ends of the vehicle to accommodate bidirectional scanning requirements, as long as the effective observation position or field of view is functionally forward-positioned within the vehicle's hazard envelope. This structural design enables the system to independently acquire environmental safety information without relying on the robot's own movement.

[0076] The safety controller is configured to execute the painting robot scanning safety control and reset method as described in the foregoing embodiments, and to intercept external tasks and remote commands associated with failed scanning sessions or incomplete safety resets. As the core computing and decision-making unit of the system, the hardware form of the safety controller can be flexibly selected according to the actual application scenario. For example, the safety controller can be a standalone safety programmable logic controller (Safety PLC), specifically responsible for processing safety-related signals and outputting controlled stop commands; it can also be a dedicated safety board integrated inside the robot controller, utilizing the robot's own computing resources to implement safety logic; or it can be an industrial computer (IPC) deployed in a safe area, communicating with the vehicle drive system and the robot via a real-time bus. Regardless of the hardware carrier used, the safety controller establishes signal connections with components such as the space measurement unit, the vehicle drive mechanism, the robot controller, and the intentional reset input device via wired or wireless communication links to acquire input parameters such as minimum distance, vehicle speed, and boundary state in real time, and outputs control commands such as prohibition of action, controlled stop, and session failure when the protection conditions are triggered.

[0077] The permitted placement area and warning boundary definition unit is used to determine the legal parking range of the target workpiece within the paint booth and the safety boundary facing the vehicle. This can be implemented using different colored markings on the ground (e.g., white permitted parking lines and yellow warning lines), physical references, reference lines projected by a laser line projector, positioning points, electronic maps, or combinations thereof. This unit provides the safety controller with a reference for boundary judgment, enabling the system to continuously verify whether the most protruding part of the target workpiece crosses the warning boundary before and during scanning.

[0078] The warning device is connected to the safety controller and is configured to output audible and visual alarms, interface prompts or other perceptible warning signals when the safety controller determines that the protection conditions have been triggered, so as to inform the operator of the current abnormal status and the cause of the trigger, so as to facilitate timely intervention.

[0079] The intentional reset input device is signal-connected to the safety controller and configured to send a reset command to the safety controller after the operator has troubleshooted and confirmed that the environment is safe. Upon receiving the reset command, the safety controller re-executes a complete safety status check and only allows the creation of a new scan session after all checks have passed. The intentional reset input device can be a physical button, a touchscreen interface, or other safety-certified input device, and its location should ensure that the operator can perform the reset operation from within a safe area.

[0080] For the power, control signals, data, compressed air, paint, or other media required by vehicles, robots, measuring units, or tools, the accompanying supply or wiring mechanism may employ suspended chutes or cable chains, curved track cable trolleys, passive single or multi-section rotating booms, safety zone reels with universal cable guides, electrostatic conductive three-dimensional energy chains, ground or sidewall protected channels, energy or media sources located on the vehicle, or combinations of two or more of these, and may be arranged in straight lines, L-shapes, U-shapes, arcs, or other operating routes. The mechanism should meet the requirements for bending radius, tension release, electrostatic discharge, grounding, fire protection, and mechanical protection according to the actual environment. Unless otherwise explicitly specified, the supply or wiring mechanism only undertakes the functions of media transmission, cable bearing, stress release, or safe accompanying, and is not a necessary reference for vehicle positioning, navigation, or turning. This invention does not necessarily limit it to any particular wiring structure.

[0081] Example 3: This example provides a control device, including a processor and a memory. When the processor executes the instructions in the memory, the control device performs the method described in the aforementioned method examples. When the processor executes the instructions, the control device obtains the lateral arrangement distance or actual net clearance, the effective advance observation distance along the current scanning direction, and the required stop advance distance, and outputs vehicle movement permission, controlled stop, spray gun prohibition, and scanning session failure instructions based on the lateral geometry and braking conditions, thereby avoiding direct comparison of distances in different directions using the same threshold.

[0082] This embodiment also provides a computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program causes the processor to perform the methods described in the foregoing method embodiments. The specific form of this storage medium may include, but is not limited to, a disk, optical disk, semiconductor memory, USB flash drive, memory card, or persistent storage area of ​​a cloud server. The computer program stored thereon contains all the logical instructions for implementing the aforementioned painting robot scanning safety control and reset method. When the computer program is loaded and executed by a control device or other computing platform, it can drive the processor to complete a series of operations from boundary pre-inspection, forward sensing, dynamic decision-making to in-situ protection and session isolation.

[0083] In some implementations, the aforementioned scanning safety control and reset steps are executed by a safety controller, a vehicle controller, a robot controller, or a combination thereof; the program instructions may be stored in a non-transitory computer-readable storage medium. When the processor executes the program instructions, it actually controls the vehicle braking, spray gun disabling, scanning session termination, and rescan start point, thereby implementing protection before the physical hazard envelope reaches the workpiece. The final implementation of safety-related functions is still independently verified according to applicable safety integrity and functional safety requirements.

[0084] Example 4: This example provides an application scenario and a method for fault injection verification. It aims to demonstrate the actual operation effect of the aforementioned painting robot scanning safety control and reset method through a specific automotive paint repair operation scenario, and to use fault injection testing to prove the necessity of each safety technical feature.

[0085] In this automotive paint repair scenario, the target workpiece is the vehicle whose paint needs to be repaired. At the start of the operation, the safety controller forms a vehicle hazard envelope based on the current robot model and installation status, and a workpiece occupancy envelope based on the current status of protrusions such as the vehicle's rearview mirrors. It also verifies that the lateral distance from the vehicle's side reference boundary to the side of the vehicle body, or the actual net clearance from the hazard envelope to the nearest intruding feature, meets the requirements. Approximately 600 mm is only used as an example arrangement under specific prototypes, specific rearview mirror conditions, and specific safety margins. During scanning, the front-end space measurement unit monitors the actual net clearance and the effective forward observation distance along the current scanning direction. If either the lateral condition or the stop condition is not met, the system immediately disables the spray gun action, controls the vehicle to a controlled stop, and disables the current scanning session and downstream tasks.

[0086] To verify the effectiveness of the aforementioned security interlocking mechanism, this embodiment also introduces a fault injection testing method. By injecting various abnormal events into the system in a controlled manner, it verifies whether the system can correctly enter a controlled stop state and execute the session isolation policy. Specifically, fault injection testing includes, but is not limited to, the following examples:

[0087] Test Case 1: Deliberate Obstruction of the Forward Space Measurement Unit. While the vehicle is moving at a preset speed, an opaque baffle is used to momentarily obstruct the sensor's field of view, simulating sensor failure. The expected result is that the system detects the measurement unit failure, immediately triggers a protective stop, and records the trigger time, trigger speed, and measured stopping distance. The key verification point is to confirm whether the system determines a physical safety risk as soon as the preset sensor failure judgment condition is met, rather than continuing to wait after the failure judgment condition has been met, and whether the current scanning session ID is marked as invalid after stopping.

[0088] Test Case 2: Simulating Target Workpiece Crossing Boundary. During the scanning process, by modifying electronic map parameters or moving the calibration target, the system is made to mistakenly determine that the most protruding part has crossed the target-side warning boundary. The expected result is that the system immediately triggers boundary crossing protection, and the vehicle stops under control. The key verification point is to confirm that the boundary pre-inspection logic remains effective during the scanning process, and that after the protection is triggered, the robot maintains a safe scanning posture without any automatic extension or retraction.

[0089] Test Case 3: Injected Braking Response Delay. An artificial delay is added to the braking command output channel using software to simulate a slower response due to aging of the braking mechanism or airflow obstruction. The expected result is that the measured stopping distance along the scanning direction is close to or slightly greater than the originally calibrated d. stop The key to verification is confirming t. r Does it cover the worst-case total delay for measurement, communication, control, and braking force establishment, and confirm L? lead +L obs Still not less than the updated d stopThis test does not use the lateral placement threshold or the 600 mm example value to replace the stop distance along the scan direction.

[0090] In the aforementioned fault injection tests, each test should record detailed information including test ID, trigger source, trigger time, trigger speed, lateral arrangement distance or actual net clearance, lateral safety margin, required stop advance distance along the scanning direction, effective advance observation distance, control command issuance time, brake establishment time, measured stop distance, protection position status, old scan session ID, new scan session ID, downstream task version, permission status transition, and cause code. This data is used to verify the lateral geometric safety conditions and the braking safety conditions along the path, and to prove that the system has indeed entered a controlled stop and the old session has failed. Simply performing interface confirmation, clearing alarms, or powering on will not directly restore the scanning or spraying effectiveness status; the system must reconfirm the protection position, measurement effectiveness, lateral geometric conditions, braking conditions along the path, and the new session status before resuming operation.

[0091] Furthermore, this embodiment specifically distinguishes between two different exception handling logics: data quality failure and physical safety failure. In automotive paint touch-up operations, exceeding the seam residual limit usually refers to the stitching error between two adjacent scans exceeding the allowable threshold of the process, which is a data quality issue. For such issues, the system only triggers a data quality prohibition state, preventing the generation of painting tasks or cross-surface operations based on the data, but it does not necessarily trigger controlled stopping or in-situ protection of the vehicle, because there is no direct physical collision risk at this time. Conversely, only when conditions such as minimum distance being too close, target crossing boundaries, or measurement unit failure are met is it considered a physical safety failure, thereby triggering the complete protection closed loop described in this invention, including controlled stopping, in-situ waiting, and forced session failure. These two failure modes are identified using different status codes and have different reset conditions: data quality failure may only require rescanning the local area or adjusting the stitching algorithm to recover; while physical safety failure must go through a complete on-site investigation, safety status re-check, and new session creation process. This distinction avoids confusing purely software-level data processing anomalies with hardware-level collision risks, prevents the accidental removal of physical security locks due to frequent data verification operations, and also avoids impacting normal operational efficiency due to overly sensitive security triggers. This tiered response mechanism enables the system to reduce safety risks to personnel and equipment while maintaining the continuity and stability of production processes.

[0092] Example 5: This example provides an implementation of a scanning-spraying isolation state machine, suitable for a painting robot's time-sharing operation mode where scanning and spraying are performed separately. In this mode, the operator manually delineates the maintenance area, and the system automatically obtains the actual surface position of the workpiece and generates operation data. The scanning measurement unit is fixed to the front of the carrier and not mounted on the robotic arm or spray gun; the carrier only moves in the scanning state, stopping and reliably braking after completing scanning, position version confirmation, and distance permission. Before entering the spraying state, the scanning measurement unit stops sampling and disconnects its non-essential power supply, and the robotic arm performs spraying while the carrier is stationary; when spraying is completed or repositioning is required, the spray gun is first turned off and the spraying permission is revoked, and then the scanning state is resumed.

[0093] The control states include at least scan preparation, scan valid, vehicle braking, paint preparation, paint valid, and failure reset. If any of the scan session, 3D task version, vehicle position version, or distance permission changes, the paint valid state immediately transitions to pending verification; manual confirmation cannot replace sensor validity and braking status checks. This state machine can receive external module states such as manual area selection, surface positioning, path, normal and spray distance, coating passes, spray gun-paint configuration, and process traceability, but it only manages their start conditions, permissions, failures, and resets. It does not generate the aforementioned task data or process data, nor does it require automatic damage identification, automatic vehicle classification, or paint application during scanning as necessary conditions for the implementation of the state machine.

[0094] Electrical, electrostatic grounding, ventilation, and spraying interlocks in hazardous locations should still be configured according to the applicable explosion-proof zoning and certification requirements of the project; this state machine provides failure prohibition and scan-spraying isolation logic, but does not replace the whole machine explosion-proof certification with software license.

[0095] Example 6: This example provides an implementation method for safety interlocking, sensor isolation and pre-spray verification, which further improves the safety assurance mechanism before scanning starts and before spraying.

[0096] Before initiating a scan, the safety control chain must at least verify the status of the spraying space door, personnel access status, ventilation permitting status, emergency stop status, and other initiation conditions required by the project; scanning must not be initiated if any condition is not met. These conditions are preferably implemented by a safety controller, interlocking circuit, or equivalent safety component determined through risk assessment. Ordinary software status or manual interface confirmation cannot replace applicable explosion-proof, mechanical, electrical, and functional safety requirements.

[0097] Once scanning is complete and painting is ready, the depth camera, laser rangefinder, or other observation devices used solely for scanning may retract their protective cases, shut off the emission source, disconnect non-essential power supplies, or enter a verified safe state, confirmed by a position switch, power feedback, or equivalent status evidence. During painting, the vehicle must remain stationary and reliably braked; painting must not commence if the spray gun permission, scanning session, observation device protection status, and safety interlock status are inconsistent.

[0098] After the task is defined, if the original scanning relationship is disrupted due to gun loading, door opening, manual entry, target workpiece movement, carrier repositioning, or other events, the original pre-spraying verification state will be changed to pending verification. Once the door is closed again and safety conditions are met, one or more surface points, edges, geometric features, or external references with repeatable positioning characteristics can be verified, and the current position or depth can be compared with the original scan record. If the deviation exceeds the limit, additional verification points are added, task permission is revoked and rescanning is required, rebinding is performed, or manual intervention is necessary. In one parametric embodiment, one feature is verified first; if the deviation exceeds 5 mm, a second feature is verified; if the deviation still exceeds the limit the second time, spraying is prohibited. This embodiment is merely an example and does not limit the types, number, or thresholds of features.

[0099] Insufficient data confidence or inconsistent location versions can lead to data quality prohibition; failure of conditions such as doors, personnel, emergency stops, ventilation, or braking can cause the safety chain to stop. Both can jointly revoke the painting permit, but the trigger source, status, reset conditions, and session version should be recorded separately to avoid replacing physical safety interlocks with data verification or restoring unverified data objects using safety resets.

[0100] Example 7: This example provides an implementation method for the sequence of safety chain actions and the prohibition of automatic forced spraying, and defines differentiated safety response strategies for failure scenarios in different operation stages.

[0101] If the safety chain fails during spraying, the controller first stops the spray gun from dispensing paint and revokes the spraying permit, then stops the dangerous movement and brakes, deactivates, and latches the cause of the failure as required by the risk assessment. If the failure occurs during vehicle movement, the vehicle is brought to a controlled stop and held in its current position. If the failure occurs during scanning, the vehicle is stopped, the monitoring device is put into a verified protection state, and the current scanning session and its downstream tasks are disabled. After the fault is cleared, a deliberate reset and necessary data, location, or feature verification must be performed. Clearing alarms or repowering does not restore the old permit.

[0102] When an interruption exceeds the interlayer, flash-dry, or material open window, the task enters a failure, rework, rescan, or manual handling state. Forced resume spraying without reassessment will not be automatically executed, and externally input continue commands or completion flags cannot restore expired task permissions. This mechanism ensures that the system will not blindly resume spraying operations when the coating process window has expired, but rather requires operators to reassess coating quality and process feasibility based on actual working conditions.

[0103] Example 8: In a distributed implementation, the space measurement node, safety controller, vehicle controller, robot controller, and external task server are independent of each other; the message contains at least two of the following: safety session identifier, checkpoint location version, stop reason, danger envelope state, reset sequence number, task identifier, and permission status. Security is maintained in the event of communication interruption, message replay, or external task version conflict.

[0104] This invention can also be implemented as a safety control device or robot system including a processor, memory, distance or envelope input interface, external task interface, safety output interface, and robot or vehicle control interface; it can also be implemented as a non-transitory computer-readable storage medium, computer program product, or distributed safety system. The program instructions cause the processor to perform lateral arrangement threshold or actual net clearance verification, required stop advance distance and effective lead observation distance verification along the scanning direction, controlled stop, session failure, reset verification, and task interception, and actually control vehicle braking, robot movement, and spray medium shut-off.

[0105] The above processing prevents remote or external tasks from bypassing the physical safety stop and reset chain, reducing the risks of collisions, reuse of old scan data, and erroneous continuation. As a result, it directly changes the motion permission of the vehicle and robot and the state of the spray gun medium.

[0106] In summary, this invention can be implemented using existing industrial cameras, distance sensors, encoders, robot controllers, and industrial computers. It is applicable to robot painting scenarios such as automotive repair and painting, furniture, small batch parts, and other target positions, shapes, or work areas that cannot be fixed in advance. It has manufacturability, repeatability, and industrial applicability.

[0107] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the claims.

Claims

1. A method for scanning safety control and reset of a painting robot, applied to a painting system having a carrier moving along a guide path, a robot, and a spatial measurement unit, wherein the spatial measurement unit has a known or verifiable spatial relationship with the hazard envelope of the carrier in the scanning state, characterized in that, include: Determine the warning boundary of the target workpiece towards the carrier, the workpiece occupancy envelope, and the carrier danger envelope that includes the carrier and robot; Before scanning or at the start of scanning, determine the most protruding part of the target workpiece facing the carrier side, the most recent intrusion feature, or the equivalent workpiece occupancy envelope, and confirm that it has not crossed the warning boundary or intruded into the prohibited occupancy area; and determine the lateral arrangement threshold based on the amount of protrusion from the carrier side reference boundary to the carrier danger envelope facing the workpiece side, the possible amount of protrusion from the target workpiece body reference surface to the most recent intrusion feature, and the preset lateral safety margin, and confirm that the lateral arrangement distance from the carrier side reference boundary to the target workpiece body reference surface is not less than the lateral arrangement threshold, or confirm that the actual net gap between the most recent intrusion feature and the carrier danger envelope is not less than the lateral safety margin. The effective observation position or field of view of the spatial measurement unit is positioned forward along the current scanning direction to the dangerous envelope of the vehicle. Before the dangerous envelope of the vehicle arrives, the current or predicted actual net clearance between the surface of the target workpiece and the dangerous envelope of the vehicle in the forward area is obtained, as well as the effective forward observation distance that can be used for controlled stopping along the current scanning direction. The required stop advance distance along the current scanning direction is determined based on the vehicle's motion state and braking parameters; In response to the following: the lateral arrangement distance is less than the lateral arrangement threshold, the actual net clearance is less than the lateral safety margin, the effective advance observation distance is less than the required stop advance distance, the most protruding part or the most recent intrusion feature crosses the warning boundary, the workpiece occupancy envelope intrudes into the prohibited occupancy area, or the space measurement unit fails, new data after the trigger is prevented from entering the valid dataset of the current scanning session, and the spray gun action is prohibited, the control vehicle is stopped in a controlled manner, and a warning is output. Once the vehicle stops, it remains stationary and waits, disabling the current scanning session and its downstream tasks. In response to a reset command, the security status is rechecked, and a new scan session is created after the check passes. The scan is then re-scanned from a predetermined scan start point or a checkpoint with independent position and coverage integrity proof. The independent position and coverage integrity proof includes matching the current image features with prior reference features bound to common reference coordinates. After satisfying feature consistency and residual thresholds, a new checkpoint position version is generated without restoring the validity of the old scan session.

2. The method according to claim 1, characterized in that, The lateral arrangement threshold is determined by the sum of the protrusion amount from the carrier-side reference boundary to the carrier's hazard envelope towards the workpiece side, the possible protrusion amount from the target workpiece's main reference surface to the most recent intrusion feature, and the lateral safety margin; each protrusion amount and lateral safety margin is determined or verified based on at least one of the following: robot model and installation location, scanning safety posture, target workpiece type, and protrusion status.

3. The method according to claim 1, characterized in that, The required stop advance distance along the current scanning direction can be calculated using the following formula: ； Where, d stop The required stop advance distance along the current scan direction, v is the absolute value of the vehicle's velocity along the current scan direction or the maximum velocity that may be reached during the response period, and t is the vehicle's velocity along the current scan direction. r a is the most unfavorable total response time from the generation of hazardous data or the satisfaction of failure criteria to the establishment of effective braking force by the braking mechanism. min is the absolute value of the minimum braking deceleration that is greater than zero and can be guaranteed under full load and the most unfavorable friction conditions; e is the upper limit of the measurement, calibration, installation and position prediction error along the current scanning direction; and m is the safety margin along the current scanning direction. The required stop advance distance is used to verify the effective advance observation distance along the current scanning direction, and is not used as the lateral arrangement distance or actual net gap perpendicular to the current scanning direction; the lateral arrangement distance, actual net gap and required stop advance distance are determined separately.

4. The method according to claim 1, characterized in that, The spatial measurement unit has a lead amount relative to the leading edge of the vehicle's hazard envelope along the current scanning direction. The sum of the lead amount and the effective observation distance along the current scanning direction is not less than the required stop advance distance, and provides a detection advance time not less than the sum of the control response time and the braking time.

5. The method according to claim 1, characterized in that, After the vehicle stops, remain in place and wait, invalidating the current scanning session and its downstream tasks, including: The latch stop reason, trigger position, minimum distance, session identifier, measurement unit observation status, lifting or turning status, and affected data range; Maintain the robot in a scanning standby posture and prevent the vehicle from automatically returning to its original position; This invalidates the current scanning session and its downstream tasks, and a manual reset operation cannot directly restore the validity of the current scanning session or downstream tasks. The failure is independent of any external input or remote command. External files, network messages, application programming interfaces, remote terminals or upstream control devices inputting scan tasks, coordinates of the area to be repaired, coverage, trajectory, robot tasks and continue execution instructions or completion flags cannot restore the old scan session or replace security checks, new session creation and independent location and coverage integrity proof. The downstream tasks include coordinates, regions, coverage, trajectories, tool poses, or robot tasks generated by this system or imported from outside. External task identifiers or remote reset confirmations do not change the failure state.

6. The method according to claim 5, characterized in that, The method further includes: After the scan is completed or after protection is triggered, confirm the protection position status of the space measurement unit; The protected position status is estimated by the retraction command and the calibrated parameterized action time, or directly confirmed by the position sensor, end sensor, air pressure, flow rate, drive feedback or a combination thereof. When the estimated state is formed using the parameterized action time, if a timeout or state inconsistency occurs, the robot action is prohibited.

7. The method according to claim 1, characterized in that, The method further includes: during scanning, controlling the robot to be in a scanning safe posture or a set of scanning safe postures that has been verified to limit or reduce the hazard envelope of the vehicle, and confirming the validity of the current posture based on the robot joint position, end-effector position, hazard envelope check value or a combination thereof; the validity of the current posture is a condition for starting or continuing scanning.

8. A scanning safety control and reset system for a spraying robot, characterized in that, include: Allows the placement of area and warning boundary definition units; A vehicle moving along a guide path; Robots mounted on the vehicle; A spatial measurement unit is set at at least one of a vehicle, robot, fixed support or distributed measurement node, and has a known or verifiable spatial relationship with the vehicle's hazard envelope in the scanning state, and its effective observation position or effective field of view can be placed in front of the vehicle's hazard envelope along the current scanning direction; The security controller is configured to perform the method as described in any one of claims 1 to 7 and to intercept external tasks and remote commands associated with a failure scan session or an incomplete security reset; Warning devices; as well as Intentionally reset the input device.

9. A control device, comprising a processor and a memory, characterized in that, When the instructions in the memory are executed by the processor, they cause the control device to perform the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it causes the processor to perform the method as described in any one of claims 1 to 7.

Images