CONTACTLESS PROTECTION AT A COOPERATION AREA OF A MACHINE

Description

[0001] The invention relates to a method and a monitoring device for contactless protection of a cooperation area of ​​a machine according to the preamble of claims 1 and 15 respectively.

[0002] In non-contact monitoring to safeguard against hazards such as those posed by machines in industrial environments, optoelectronic sensors with protective field monitoring are frequently used. A protective field is a configured section of the monitoring area that operating personnel are prohibited from entering while the machine is in operation. If an unauthorized intrusion into the protective field is detected, such as an operator's leg, the machine is transferred to a safe state by outputting a safety-related signal at a safe output (OSSD, Output Signal Switching Device).

[0003] Sensors used in safety technology must operate with exceptional reliability and therefore meet stringent safety requirements, such as the EN13849 standard for machinery safety and the EN61496 device standard for electro-sensitive protective equipment (ESPE). To comply with these safety standards, a number of measures must be taken, such as safe electronic evaluation through redundant, diverse electronics or various function monitoring systems, especially monitoring for contamination of optical components, including a front screen. Safety levels are defined for such safe sensors or the safety applications implemented with them, for example, SIL1 to SIL4 (safety level) or PLA to PLD (performance level).

[0004] For security purposes, the machine is partially structurally blocked, for example with fences, and a remaining access area is secured with sensors. A particular challenge arises when access to the secured machine is required repeatedly during regular operation. Examples include robot cells in which industrial robots carry out production or logistics steps that require occasional support. This could involve the supply or collection of materials, for example. In practice, such areas are still regularly secured with fences and light curtains. A person entering the machine area is detected and the machine is switched off. After the supporting work steps on the machine have been completed and the person has left the machine area, a manual restart is required, for example by the person pressing a button located outside the secured area.This is necessary because the sensors cannot reliably detect whether the person has actually left again. A light curtain only detects the passage itself, but cannot determine which side the person is on afterwards. The protective field of a laser scanner cannot always cover the entire area in front of the machine, for example because otherwise the machine would trigger the protective field during operation. Furthermore, the person could step onto a fixed object such as a base of the machine and thus become invisible to the laser scanner. Therefore, a person must traditionally be responsible for ensuring that the machine does not endanger anyone when it restarts.

[0005] Recently, safety laser scanners and security cameras have become known that evaluate multiple protective fields simultaneously. Simultaneous evaluation is very computationally intensive, and only a limited number of parallel protective fields are provided. Multiple protective fields do not solve the problems described above per se; the flexibility they provide is not yet utilized in most existing security applications, and their potential is far from being fully exploited.

[0006] EP 3 470 879 A1 configures at least partially overlapping monitoring fields in a laser scanner. This creates monitoring segments that differ from one another in the overlapping monitoring fields. The number of monitoring fields provided by the hardware is thus refined to the monitoring segments. This effectively provides a larger number of possible protective fields, although this does not automatically mean that they are intelligently configured.

[0007] EP 3 709 106 A1 proposes a safety system that validates complex, non-safe evaluations with less complex, safe evaluations. In one embodiment, objects are localized in a non-safe manner using scan point clouds. On the other hand, a grid of protective fields is used. The non-safely determined fine position is validated with the safe grid position.

[0008] EP 3 153 885 A1 discloses an optoelectronic protective device that monitors which of several protective zones is violated by an object (protective zone violation) and which protective zone the object has left (protective zone release). If a predetermined sequence of protective zone violations and protective zone releases occurs, system operation is automatically enabled.

[0009] EP 3 575 666 A1 presents a device for safeguarding a hazardous area of ​​a system. It monitors a protected area adapted to the hazardous area. The movement sequence of the object leaving the protected area is recorded, and upon detection of a valid movement sequence, an enable signal is generated that reactivates the hazardous operation of the system.

[0010] DE 10 2019 206012 A1 discloses a method and system for operating a robot, in which the robot is decelerated when an obstacle is closer than a first minimum distance and decelerated even more when an obstacle is closer than an even smaller second minimum distance. The distance to the obstacle is determined by dividing the space into areas in which the presence of the robot or obstacle is detected.

[0011] The EP4 431 787 A1 monitors the area in front of the machine with protective fields in a lower layer and an upper layer in order to distinguish an approaching person from a vehicle.

[0012] Against this background, the object of the invention is to improve the security of a cooperation area of ​​a machine.

[0013] This object is achieved by a method and a monitoring device for contactless safeguarding of a cooperation area of ​​a machine according to claim 1 and 15, respectively. The machine is preferably at least one robot. A cooperation area is an area that the worker and the machine use jointly, for example to transfer a workpiece or material in one direction or the other, to carry out a manual or machine-assisted assembly step, and the like. However, this joint access must not occur simultaneously during a machine movement, as otherwise unwanted contact or accident could occur, and preventing this is the purpose of the safeguarding.

[0014] The cooperation area is accessible from a first side via an access area for the worker, and from a second side for the machine from its work area. Preferably, the first side is opposite the second side, and the machine is then located behind the cooperation area from the worker's perspective. Otherwise, the work area is preferably closed, i.e., mechanically secured by fences and the like, although there may be further access areas that are also secured according to the invention. One example is a closed robot cell as a work area.

[0015] In the vicinity of the cooperation area, several protective fields are monitored for protective field intrusions by at least one optoelectronic sensor. The protective fields are each individually configurable sub-areas of the sensor's detection range and bear the historically determined name "protective field", although in reality, depending on the sensor type, they can be a three-dimensional spatial area. At least two of the protective fields are arranged in a first sequence, starting from the first side. A worker approaching the cooperation area therefore triggers protective field intrusions in these protective fields one after the other. Unlike a conventional protective field, a protective field intrusion by no means immediately triggers protection. Rather, there are permissible and impermissible combinations of protective field intrusions, and the machine is only protected if an impermissible combination occurs.

[0016] The invention is based on the basic idea of ​​supplementing the operator-side sequence monitoring with machine-side sequence monitoring. At least two of the protective fields are therefore arranged in a second sequence from the second side, so that the machine approaching the cooperation area triggers protective field interventions one after the other in the second sequence. Geometric considerations alone dictate that the protective fields of the two sequences are different protective fields, i.e. the operator-side protective fields of the first sequence must be distinguished from the machine-side protective fields of the second sequence. The two sequences meet at the cooperation area; here, as an exception, a protective field with a dual function can belong to both sequences. The evaluation for permissible and impermissible combinations of protective field interventions now includes the second sequence.Whether a worker is allowed to approach while the machine continues to operate or whether the machine needs to be secured depends on the behavior of both the worker and the machine.

[0017] In principle, the machine can intervene in the first sequence from its second side beyond the cooperation area. This does not necessarily constitute an impermissible combination of protective field interventions, but can of course be specifically prohibited as an impermissible combination. Conversely, this also generally applies to the worker and their interventions in protective fields of the second sequence. However, this is preferably prohibited, thus ensuring protection against stepping behind the machine. Overall, the principle that the worker and the machine should always remain on their side during operation has proven to be effective, even if the invention is capable of ensuring safety under defined conditions.

[0018] The at least one optoelectronic sensor is preferably a safe sensor, which accordingly provides safe protective field monitoring. As used throughout the description, "safe" and "safety" mean that measures have been taken to control errors up to a specified safety level or to comply with the provisions of a relevant safety standard for machinery safety or electro-sensitive protective devices, some of which are mentioned in the introduction. "Unsafe" is the opposite of "safe"; for unsafe devices, transmission paths, evaluation systems, and the like, the specified fail-safety requirements are therefore not met.

[0019] The process is a computer-implemented procedure that runs, for example, in a processing unit of the optoelectronic sensor and / or a connected processing unit. The configuration of the protective fields precedes the non-contact protection; due to the complex safety aspects involved, this is typically performed manually by a safety expert. However, automatic support is possible, such as suggestions for protective fields and a configuration program with graphical support, for example, similar to a CAD program, with which geometric objects as parts of protective fields are inserted into images of the machine's surroundings.

[0020] The invention has the advantage that collaborative safety can be ensured with comparatively simple means. The protective fields can even be spanned by a single optoelectronic sensor. To gain additional perspectives or achieve a higher level of safety through redundancy, two or more sensors can preferably be used. In any case, this is significantly less than the conventional arrangement of numerous light grids.

[0021] This saves costs and installation space. For example, thanks to the intelligent protection system according to the invention, a robot cell can be constructed more compactly, resulting in further productivity and cost advantages. Securing access to the collaboration area can also act as a barrier against intrusion and support automatic restart. The machine is only slowed down or even stopped when absolutely necessary.

[0022] The optoelectronic sensor is preferably a 3D sensor, in particular a time-of-flight camera, with the protective fields being three-dimensional protective fields. This provides great flexibility in configuring protective fields and sequences of protective fields that effectively secure the environment of the cooperation area. These protective fields are three-dimensional spatial areas and thus enable even more seamless and adaptable monitoring. Despite the spatial extent, the historical term "protective field" is retained. The first safe optoelectronic sensor can alternatively be a laser scanner. However, the 3D camera is easier to mount in a suitable perspective from which the appropriate protective fields can be monitored. Another alternative is an FMCW sensor, which, through the additional determination of velocity components, can be considered even more highly dimensional than a 3D sensor, but thus specifically a 3D sensor.

[0023] Preferably, at least two optoelectronic sensors each monitor a portion of the protective fields, with at least one protective field being monitored by both optoelectronic sensors and therefore with an increased level of safety. Using multiple sensors, additional perspectives, greater overall monitoring capabilities, and a larger number of monitored protective fields are possible. Preferably, just two sensors are sufficient for this, especially if they are 3D cameras. A further advantage is the possibility of redundant monitoring of protective fields in overlapping areas between two sensors. This allows a higher level of safety to be achieved. For example, two sensors that individually only have a PLc (performance level according to ISO TS 62998) can even achieve PLd when combined.This is also interesting because bringing a device to a higher security level requires enormous effort, and only the manufacturer can achieve this through a complex development process. A combination of sensors, on the other hand, is possible on the user side with available hardware.

[0024] Preferably, a protective field encompasses the cooperation area. This protects the central area, to which both workers and machines have access, itself. This protective field is particularly preferably monitored by both optoelectronic sensors. This achieves an even higher level of safety, particularly locally in overlapping monitored areas. Additional protective fields with redundant monitoring and thus a higher level of safety can be created, particularly for protective fields that directly border the protective field of the cooperation area.

[0025] A permissible combination of protective field interventions is considered to be when protective fields of the first sequence and / or the second sequence are intervened in succession from the outside to the inside, with inside designating the cooperation zone, but a minimum number of protective fields without protective field intervention remains between the protective fields of the two sequences. The expectation for a proper process is therefore that the worker and machine approach the cooperation zone from their respective sides. To this extent, a sequence of protective field interventions can also be enforced structurally and through the configuration of the protective fields. A further required condition is that a minimum number of protective fields without protective field intervention remains between the worker and the machine. This is not just about a minimum distance, which is of course implicitly enforced.Rather, without the minimum number, it would no longer be possible to distinguish whether the worker and the machine might already be encountering each other, as explained in more detail below. The minimum number can be understood as a buffer of free protective fields between the worker and the machine.

[0026] Preferably, if a protective field of the first sequence is intervened in, the machine may no longer intervene in a protective field assigned to the protective field of the first sequence according to the minimum number, and the machine withdraws from it if it is already intervening in the assigned protective field. Thus, when the worker approaches, the machine is prohibited from entering certain protective fields into which it would be allowed to intervene in the absence of the worker, but which are too close to the worker now detected in a protective field. This means that the minimum number of protective fields between the worker and the machine is still maintained or restored without any protective field intervention. The prohibition of intervention in the assigned protective field is an instruction to the machine control system, as is the withdrawal from it if necessary. The machine control system itself is preferably not safe in order to avoid the expense of ensuring safety in accordance with standards.Protective field monitoring reliably detects whether the machine control system is following the instruction, allowing a response in the event of an error by issuing new instructions to the machine control system or, if necessary, securing the machine. The determination of which protective field is the respective assigned protective field is made manually during the protective field configuration or when setting up the safety application, for example, in the form of a state machine presented below, or, for example, the nth neighbor within the sequence is assigned, in particular with n equal to the minimum number plus / minus a constant.

[0027] If an initial minimum number is maintained, preferably two, the machine will continue to operate without limiting its operating speed. In this case, the buffer of free protective fields is large enough that no hazard is imminent. Even if the operator or machine approach each other further, with additional intervention in the protective field, a free protective field would still remain between the operator and the machine. It would then still be possible to distinguish where the operator and the machine are located.

[0028] If only a second minimum number is maintained that is smaller than the first minimum number, preferably the second minimum number is equal to one, the worker preferably receives a warning not to approach the cooperation area any further. The buffer of free protective fields has now become too small; it no longer contains sufficient reserves. In this situation, as explained above, the machine has preferably received the instruction to withdraw from a protective field in order to restore a larger buffer. Until then, however, the worker should be cautious and not approach any further in order to give the machine sufficient time to withdraw. The warning is given, for example, in the form of a display, the color of a lamp and / or an acoustic signal. However, there is preferably no safeguarding yet; the machine can continue working, preferably as soon as it has restored the first minimum number.

[0029] The machine is preferably safeguarded if a minimum number is not met. Here, where there are staggered minimum numbers as in the previous paragraphs, the smallest minimum number is meant. In particular, there is no longer any buffer; the protective fields in which the worker intervenes are directly adjacent to the protective fields in which the machine intervenes. In this situation, it is no longer possible to distinguish whether the worker and the machine are still in adjacent protective fields or whether they can already come into contact in the same protective field; therefore, safeguarding is no longer avoidable. Safeguarding means an appropriate response that prevents an accident. This can be slowing the machine down, backing away, or immediately stopping or bringing it into a safe state. According to the ISO 10218-1 standard, categories of stops can be distinguished.A Category 2 stop allows the machine's power supply to remain uninterrupted. Only Category 0 and 1 stop levels can be used as emergency stops. The mildest form of protection that still ensures safety is always preferred. For example, the automatic restart discussed in the following paragraph is possible with a Category 2 stop, but not after an emergency stop.

[0030] The machine preferably restarts automatically as soon as the minimum number is restored or no further interventions are made in the protective field. The machine will resume work automatically when there is again a sufficient buffer of free protective fields between the worker and the machine. As a precaution, automatic restart can be linked to the stricter condition that all interventions in the protective field have been removed in the meantime. It is conceivable to provide independent access protection, such as an additional safe radar or another optoelectronic sensor. This prevents a person from entering the work area during the safeguarding process and not leaving it unnoticed.

[0031] To evaluate protective field interventions and the measures to be taken with regard to the machine, a state machine is preferably used whose transitions are determined by an additional intervention in a protective field of a sequence or the termination of an intervention in a protective field of a sequence. The measures include moving the machine away from the cooperation area in the second direction, prohibiting interventions in a protective field by the machine, and / or lifting a prohibition on interventions in a protective field. Additional interventions or the termination of interventions could also be referred to as approach and departure movements of the worker or machine. The respective states are linked to instructions to the machine and, if necessary, its safeguarding.Such instructions result in the machine maintaining a greater distance from the cooperation zone by prohibiting interventions in protective fields or initially establishing a distance by actively withdrawing. Conversely, such prohibitions can be lifted in situations where the worker is sufficiently far away from the cooperation zone.

[0032] The first sequence preferably comprises, from the outside to the inside of the cooperation area, a first protective field α, a second protective field β, and a third protective field γ. The cooperation area is monitored by a fourth protective field δ. The second sequence, from the inside to the outside of the cooperation area, comprises a fifth protective field ε and a sixth protective field ζ. This is an advantageous protective field configuration when balancing sufficient protection and flexibility without unnecessary complexity due to a large number of protective fields.

[0033] Preferably, two optoelectronic sensors monitor five protective fields W, A, B, C, D, namely one optoelectronic sensor in the access area monitors an outer first protective field W, a second protective field A closing the area between the first protective field W and the cooperation area and a fourth protective field C adjoining this in the work area and encompassing the cooperation area, and the other optoelectronic sensor in the work area monitors an outer fifth protective field D and a third protective field B adjoining this, encompassing the cooperation area and extending into the access area. This is an advantageous configuration involving two sensors, each of which requires very few protective fields. The protective field W can only be a warning field and not yet a protective field. This is particularly useful if the sensor can only monitor a limited number of protective fields.A warning field is preferably subsumed under the term protective field here, since it can play the same role within the sequence.

[0034] The monitoring of the two sensors preferably overlaps at least in the fourth protective field C, so that a higher safety level is achieved there. For example, if each sensor is individually designed only according to PLc, even PLd can be achieved in protective field C. The overlap and thus the higher safety level can extend to additional protective fields.

[0035] Preferably, the first protective field W is monitored as the functional first protective field α, the second protective field A without the third protective field B as the second functional protective field β, the third protective field B without the fourth protective field C as the functional third protective field γ, an overlap area of ​​the third protective field B with the fourth protective field C as the functional fourth protective field δ, the fourth protective field C without the third protective field B as the functional fifth protective field ε and the fifth protective field D without the fourth protective field C as the sixth protective field ζ. Functional protective field means that from the perspective of the safety application, a protective field is monitored, but this protective field does not have to directly correspond to a protective field defined for a sensor. Rather, the monitoring of a functional protective field takes place through the joint evaluation of interventions in the protective fields actually defined for each sensor.In particular, there are overlapping areas ("AND" condition for the protective field interventions) and exclusive areas ("WITHOUT" or "AND NOT" condition for the protective field interventions). Effectively, such joint evaluations make more protective fields possible than the sum of the protective fields of the participating sensors, and in addition, certain protective fields can be monitored redundantly and therefore with a higher level of safety. The specifically specified assignment combines the two configurations explained in the previous paragraphs. This allows the functional fourth protective field δ for the cooperation area, and even more preferably also the adjacent functional third protective field γ and / or the adjacent fifth functional protective field ε, to achieve a higher level of safety.

[0036] The monitoring device according to the invention provides at least one preferably safe optoelectronic sensor for protective field monitoring, which has a light receiver for generating a received signal from incident received light. Depending on the sensor, the received signal is, for example, the signal from a photodiode that receives a returning scanning beam, or image data from an image sensor is generally referred to as the received signal. A control and evaluation unit is responsible for monitoring the protective field and for checking protective field interventions for an impermissible combination. The control and evaluation unit can be implemented in the sensor and / or a computing unit connected to it, in particular a safety controller connected to the sensor.A safety controller refers to a safe evaluation unit implemented in any hardware, in particular a safety controller as a controller approved for safety applications in the narrower sense. A particularly advantageous division of tasks provides for protective field monitoring internally in the sensor and an external evaluation of protective field interventions to detect impermissible combinations. In particular, one of the embodiments of the method according to the invention is implemented in the monitoring device.

[0037] The invention will be explained in more detail below with regard to further features and advantages, using exemplary embodiments and with reference to the accompanying drawings. The figures of the drawing show: Fig. 1 shows a schematic block diagram of a 3D time-of-flight camera; Fig. 2 shows a schematic diagram of a monitoring device with two cameras and a safety controller; Fig. 3 shows a schematic diagram of a protective field configuration of a first camera; Fig. 4 shows a schematic diagram of a protective field configuration of a second camera; Fig. 5 shows a schematic diagram of the combined protective field configuration of both cameras according to Figures 3 and 4 ; Fig. 6 an alternative representation of the protective field configuration of the first camera according to Figure 3 from the top view; Fig. 7 an alternative representation of the protective field configuration of the second camera according to Figure 4 from the top view; Fig. 8 an alternative representation of the combined protective field configuration of both cameras according to Figure 5 from the top view; Fig. 9 a view similar Figure 8, in which the protective fields actually monitored by the cameras are combined through joint evaluation to form more finely defined functional protective fields; Fig. 10 a schematic representation of an exemplary approach situation of a worker still at a great distance from the machine to be protected, which can also be understood as an exemplary state of a state machine; Fig. 11 a schematic representation of the approach situation of a worker now at a short distance from the machine to be protected, which can also be understood as another exemplary state of the state machine; Fig. 12 a schematic representation of the approach situation of a worker now with no detectable distance to the machine to be protected, which can also be understood as another exemplary state of the state machine; and Fig. 13 an overview representation of the state machine, from which three states in the Figures 10 to 12be illustrated by example.

[0038] Figure 1shows a schematic block diagram of a camera 10, which is preferably designed as a 3D time-of-flight camera and which is described as representative of an optoelectronic sensor that can be used in connection with the invention. An illumination unit 12 emits transmitted light 16, modulated by a transmitting optics 14, into a monitored area 18. LEDs or lasers in the form of edge emitters or VCSELs can be considered as the light source. The illumination unit 12 can be controlled such that the amplitude of the transmitted light 16 is modulated at a frequency typically in the range of 1 MHz to 1000 MHz. The modulation is, for example, sinusoidal or rectangular, or in any case a periodic modulation. The frequency creates a limited unambiguous range for the distance measurement, so that small modulation frequencies are required for long ranges of the camera 10.Alternatively, measurements are carried out at two to three or more modulation frequencies in order to increase the unambiguousness range by combining the measurements.

[0039] If the transmitted light 16 strikes an object or a person 20 in the surveillance area 18, a portion is reflected back to the camera 10 as received light 22 and there guided through a receiving optics 24, for example a single lens or a receiving lens, to an image sensor 26. The image sensor 26 has a plurality of receiving elements or receiving pixels 26a arranged, for example, in a matrix or row. The resolution of the image sensor 26 can range from two or a few to thousands or millions of received pixels 26a. Demodulation takes place therein according to a lock-in method. By repeated acquisition with modulation of the transmitted light 16 that is slightly offset over the repetitions, several sample values ​​are generated, from which the phase shift between the transmitted light 16 and the received light 22 and thus the light propagation time can ultimately be measured.The pixel arrangement is typically a matrix, resulting in lateral spatial resolution in an X-direction and a Y-direction, which is complemented by the Z-direction of the distance measurement to the three-dimensional image data. This 3D acquisition is preferably meant when referring to a 3D camera, a 3D time-of-flight camera, or three-dimensional image data. In principle, however, other pixel arrangements are also conceivable, such as a pixel row selected in a matrix or forming the entire image sensor of a line-scan camera.

[0040] Multiple protective fields can be configured in a control and evaluation unit 28. A protective field is defined by geometric specifications for a sub-area of ​​the monitoring area 18, which are configured, for example, in a CAD program or in any other way using the control and evaluation unit 28 or imported via an interface 30. The protective fields are monitored for object intrusions, and in the event of a protective field intrusion, a safe output signal is output at a safe output 32, 34. Preferably, multiple safe outputs 32, 34 are provided for each protective field, or the output signal encodes the protective fields affected by intrusions at a single safe output. The camera 10 and in particular the protective field evaluation including the output signals are preferably safe in the sense defined above.

[0041] The described 3D camera 10, in particular a TOF camera, is particularly suitable for the inventive security system. However, other sensors are also possible, in particular a security laser scanner. This may impose certain limitations, for example, due to constraints on the application geometry.

[0042] Figure 2shows a schematic representation of a monitoring device with two cameras 10a-b, each connected to a safety controller 36. The combination of several cameras 10a-b is particularly advantageous, but the invention can also be implemented with just one camera 10a-b. Only an increased level of safety in overlapping monitored protective fields, which will be discussed later, cannot be achieved with just one camera 10a-b. The safety controller 36 enables a higher-level evaluation of the protective field interventions reported by the individual cameras 10a-b. If a danger is detected, a safety-related signal is output to a monitored machine or robot. The machine or robot then slows down or switches to work steps that, at least with this detected object movement, cannot pose a danger, and only in an emergency is the machine transferred to a safe state.This results in high overall availability and productivity. The specific monitoring system according to the invention is described below with reference to the . Figures 3 to 13 explained in more detail.

[0043] Distributing the evaluation to internal control and evaluation units 28 of the cameras 10a-b for detecting protective field intrusions and for the higher-level evaluation of the protective field intrusions in the safety controller 36 is particularly advantageous. In the safety controller, a very simple logic, for example in the form of a state machine, is sufficient, which does not place high hardware demands. However, the invention is not limited to a specific assignment of the evaluation functionality to specific hardware components, but can be distributed internally and externally as desired, including the extreme cases in which no separate evaluation takes place in the cameras 10a-b or, conversely, in which at least one of the cameras 10a-b integrates the functionality of the safety controller.Examples of an internal computing unit are digital computing components such as a microprocessor or a CPU (Central Processing Unit), an FPGA (Field Programmable Gate Array), a DSP (Digital Signal Processor), an ASIC (Application-Specific Integrated Circuit), a KPI (KPU), an NPU (Neural Processing Unit), a GPU (Graphics Processing Unit), a VPU (Video Processing Unit), or the like. In addition to the aforementioned safety controller 36, an external computing unit can be a computer of any type, including notebooks, smartphones, or tablets, as well as a local network, an edge device, or a cloud.

[0044] The Figures 3 and 4 show a schematic representation of an exemplary configuration of protective fields 38 for protecting a machine 40, represented as a robot, of the first camera 10a or the second camera 10b. Figure 5is a corresponding combined view of the superimposed protective field configuration of both cameras 10a-b. The Figures 6 and 7 show the individual protective field configurations of the Figures 3 and 4 again alternatively from the top view, according to the Figure 8 the combined protective field configuration of the Figure 5 from the top view.

[0045] The protective fields 38 are in the Figures 3 to 5 shown in section and have an additional depth extension, which is shown from the top view of the Figures 6 to 8 These are therefore spatial, three-dimensional protective fields. The machine 40 is located in a mechanically secured work area 42 that is inaccessible to persons, for example in a robot cell. Through an access area 44 secured by the protective fields 38, a Figures 6 to 8The worker 46 shown can reach a cooperation area 48 in order, for example, to supply a workpiece or material to the machine 40 or to receive it from it.

[0046] The first camera 10a monitors three protective fields W, A, C, which are arranged in a connecting direction between the machine 40 and the approaching worker 46. The protective field W can merely be a warning field, which, like a protective field, detects object intrusions and enables corresponding reactions, but unlike a protective field, does not have an actual safety function. In the example shown, the robot cannot physically reach the warning field W, so no protective function is required here. Accordingly, the second camera 10b monitors two consecutive protective fields B and D. The geometry of the protective fields 38 is somewhat more complex in order to adapt to local conditions, for example, with a recess 50 in the vicinity of the cooperation area 48. The combined protective field monitoring of both cameras 10a-b creates a common protective field sequence W, A, B, C, D.This sequence and the contribution of the individual cameras 10a-b can be seen in a symbolic overview 52 of the , which is added for explanatory purposes only. Figures 6 to 8 be traced again.

[0047] The protective fields W, A, B, C, and D are active simultaneously. There are areas where protective fields overlap and where a higher level of safety can be achieved. One such area is Figure 8marked by a dashed line 54. For example, protective field monitoring with safety level PLd is realized by superimposing two cameras 10a-b of safety level PLc. The protective fields form a first, worker-side sequence and a second machine-side sequence. When the worker 46 approaches, a WABCD sequence is expected; conversely, when the machine 40 approaches, a DCBAW sequence is expected. Preferably, reaching beyond the cooperation area 48 is not permitted, and, for example, the machine 40 could not even reach the protective field W. Such conditions for the combination of the existing protective field interventions, which will be further refined shortly, are checked by the safety controller 36.It allows the machine 40 to continue working without interruption as long as the combination of protective field interventions is completely uncritical, in somewhat more critical situations it issues instructions to a machine control system of the machine 40 in order to prevent a real hazardous situation by prohibiting certain movements or withdrawing the machine 40, or if necessary it triggers a safeguarding of the machine 40.

[0048] Figure 9 shows a representation similar Figure 8, in which the protective fields 38 actually monitored by the cameras 10a-b are combined through joint evaluation to form more finely defined functional protective fields. A functional protective field can be understood in the same way as a protective field, but its evaluation for protective field intrusions may only be possible in combination with both cameras 10a-b through overlap ("AND") or exclusivity conditions ("WITHOUT"), whereby such conditions can also be chained. According to this principle, the six functional protective fields of the Figure 9or even more functional protective fields are generated. For the purposes of the invention, apart from the fact that functional protective fields enable the maximum number of simultaneously monitored protective fields of the cameras 10a-b beyond their actual specifications, no further distinction is made between protective fields and functional protective fields. On the contrary, the original protective field interventions WABCD are sufficient for the following considerations. Specifically, Figure 9 for example, a first functional protective field α corresponding to the protective field W, a second functional protective field β corresponding to the protective field A WITHOUT B, a third functional protective field γ corresponding to the protective field B WITHOUT C, a fourth functional protective field δ with the cooperation area 48 as an overlap area of ​​the protective fields B AND C, a fifth functional protective field ε corresponding to the protective field C WITHOUT B and a sixth functional protective field ζ corresponding to the protective field D WITHOUT C.

[0049] While in Figure 8 in an obviously uncritical manner neither the machine 40 nor the worker intervene in any protective field 38, the Figures 10 to 12 an approach movement of the worker 46, in which, for example, the machine 40 already intervenes from its side in the protective fields C and D. In the situation of Figure 10 The worker 46 has initially only intervened in the outermost protective field W. Since the machine 40 still maintains a distance from the cooperation area 48 on its side, the protective fields A and B are still free in the inner part of the common sequence, which is composed of the worker-side and the machine-side sequence on both sides. This is also illustrated again in the symbolic overview 52, ​​in which an "x" marks a protective field intervention.

[0050] A minimum of two free protective fields between machine 40 and worker 46 is considered non-critical; machine 40 can continue operating at full speed. However, the machine control system preferably receives the instruction to release protective field B, i.e., not to approach any further, or even to withdraw from protective field C as a precautionary measure in preparation for an expected continued approach by worker 46. The machine control system itself is preferably not safe, since safe machine control requires considerable effort and should not simply be assumed in a safety application. It is therefore entirely possible that machine 40 may intervene in protective field B or not release protective field C despite an instruction given.The safety controller 36 then considers this to be inadmissible, since it had prohibited the presence in the affected protective field, and can react accordingly with further instructions to the machine 40 or, if necessary, by securing the machine 40.

[0051] In the situation of Figure 11Worker 46 has approached further and in doing so has also entered protective field A. The machine has not moved; it can be assumed that it has not received a corresponding instruction to clear protective field C as a precautionary measure. The buffer of free protective fields between machine 40 and worker 46 has shrunk to just a single protective field B. This minimum number of one free protective fields does not yet represent an actual danger, since machine 40 and worker 46 cannot come into contact and it is clear that both are still on their respective sides, separate from each other. However, a critical situation can now arise very quickly. Therefore, worker 46 receives a warning, for example in the form of a light that is now yellow and no longer green as before. The machine is instructed to withdraw from protective field C.The warning to the worker 46 is intended to encourage him to give the machine 40 the time required to withdraw.

[0052] In the situation of Figure 12 Worker 46 has approached even further and is now also interfering with protective field B. However, machine 40 has not yet released protective field C, either because worker 46 approached too quickly or because the machine control system did not follow the instruction. Therefore, there is now an intervention in all protective fields; there is no longer a buffer of free protective fields between machine 40 and worker 46. In the situation shown, this is the case. Figure 12 not dangerous at all. However, the safety controller 36 can no longer distinguish between the two; due to the lack of a buffer of free protective fields, machine 40 and worker 46 are, at least potentially, in the same location in its rough spatial resolution determined by the protective fields. Machine 40 is therefore protected.

[0053] The machine 40 can now possibly withdraw from the protective field C and then also from the protective field D in a creep mode that is safe for persons. The worker 46 can also withdraw, either immediately or after their work steps in the cooperation area 48 have been completed. In this way, a buffer of a minimum of two free protective fields can be created between the machine 40 and the worker 46. In this situation, or as a precaution only when an even larger buffer has been created or when there is no longer any interference with the protective field, the machine 40 can restart. This is done manually, for example, by pressing a button that the worker 46 can only reach from the outside and after they have ensured that the work area 42 is clear. Preferably, an automatic restart without a button or the like is possible as soon as the aforementioned condition for the buffer is met again.Depending on the geometric conditions and the specific protective field geometry and arrangement, additional step-back protection, such as radar or another camera, may be required. This is intended to prevent the worker 46 or another person from entering the work area 42 while all protective fields are already violated, and the monitoring device is therefore effectively blind to this step-back.

[0054] The specified minimum numbers for buffers of free protective fields are particularly advantageous, but it is also possible to deviate from this, i.e. to require a higher minimum number, especially when longer sequences are formed from more protective fields, for example to form very fine-grained sequences.

[0055] Figure 13shows an overview of a state machine with which the appropriate measure can be assigned to the possible combinations of protective field interventions, from which three states in the Figures 10 to 12 be illustrated by way of example. The states are arranged in the columns from 1 to 6 with increasing approach of the worker 46 and in the rows with increasing approach of the machine 40 to the cooperation area 48. This results in possible states 1a...6a, 1b, ...6d. Three of these states, namely 2c, 3c and 4c, have already been illustrated by way of example using the Figures 10 and 12 explained and they are marked accordingly with a symbol 56.

[0056] In the states shown in the table, the protective fields in which intervention has taken place are marked with an "x" in the top right corner. Three areas of the states can be distinguished: a secondary diagonal 58 consisting of states 2d, 3c, 4b, and 5a, a first triangle 60 above and to the left, and a second triangle 62 below and to the right. In the states within the first triangle 60, there are at least two free protective fields between machine 40 and worker 46, so that machine 40 can continue to operate unhindered. This was Figure 10 described. In the states on the secondary diagonal 58, there is only one free protective field as a buffer between machine 40 and worker 46, so that worker 46 receives a warning so that machine 40 can withdraw, as in Figure 11 In the states in the second triangle 62 there is no buffer at all between machine 40 and worker 46, and therefore the machine is operated as Figure 12explained secured.

[0057] This already states the most important measure for the states, namely whether safeguarding is required as within the second triangle 62, warning should be given as on the secondary diagonal 58 or the machine 40 can continue working as within the first triangle 60. The vertical arrows in Figure 13symbolize further possible measures. Arrows pointing downwards represent a permitted and secured approach of machine 40 to the cooperation area 48. Dashed arrows pointing upwards indicate the explained preferred withdrawal movement of machine 40 when worker 46 approaches. The withdrawal of machine 40 or a corresponding entry ban each affects a protective field assigned to the protective field that worker 46 is newly entering. This involves restoring the buffer of two free protective fields or expanding the buffer in preparation against further approach by worker 46. The horizontal arrows do not symbolize measures, but rather actions by worker 46, namely their approach movement. As already mentioned, approach movements by worker 46 are non-critical for states within the first triangle 60.For states on the secondary diagonal 58, a further approach could trigger a hedge; for states in the second triangle 62, the hedge is triggered.

Claims

1. A method for contactless safeguarding at a cooperation zone (48) of a machine (40) that a worker 46) and the machine (40) use in common, wherein an access zone (44) for the worker (46) is arranged at a first side of the cooperation zone (48) and a working zone (42) of the machine (40) is arranged at a second side different from the first side, wherein a plurality of protected fields (38) configured in the environment of the cooperation zone (48) are monitored for protected field intrusions by at least one optoelectronic sensor (10) and at least two of the protected fields (38) are arranged in a first sequence starting from the first side such that a worker (46) sequentially intrudes into these protected fields (38) when approaching the cooperation zone (48), and wherein the protected field intrusions are evaluated to safeguard the machine (40) in the case of an unpermitted combination of protected field intrusions, characterized in that there are permitted and unpermitted combinations of protected field intrusions and the machine (40) is only secured in the case of an unpermitted combination; in that at least two of the protected fields (38) are arranged in a second sequence starting from the second side such that the machine (40) sequentially intrudes in these protected fields (38) when approaching the cooperation zone (48); and in that the evaluation for permitted and unpermitted combinations of protected field intrusions includes the second sequence, with it being considered a permitted combination of protected field intrusions when an intrusion takes place sequentially from the outside to the inside in protected fields (38) of the first sequence and / or of the second sequence, and with inward designating the cooperation zone (48), but in this respect a minimum number of protected fields (38) without a protected field intrusion remaining between protected fields (38) of the two sequences.

2. A method in accordance with claim 1, wherein the optoelectronic sensor (10) is a 3D sensor, in particular a time of flight camera; and wherein the protected fields (38) are three-dimensional protected fields.

3. A method in accordance with claim 1 or claim 2, wherein at least two optoelectronic sensor (10a-b) each monitor some of the protected fields (38); and wherein at least one protected field (38) is monitored by both optoelectronic sensors (10a-b).

4. A method in accordance with claim 3, wherein a protected field (38) comprises the cooperation zone (48) and this protected field (38) is monitored by both optoelectronic sensors (10a-b).

5. A method in accordance with any one of the preceding claims, wherein when a protected field (38) of the first sequence is infringed, the machine may no longer intrude into a protected field (38) associated with the protected field (38) of the first sequence corresponding to the minimum number and the machine (40) withdraws from the associated protected field (38) if it already intrudes therein.

6. A method in accordance with any one of the preceding claims, wherein the machine (40) continues to work without any restriction of its work speed on observing a minimum number of two.

7. A method in accordance with any one of the preceding claims , wherein the worker (46) receives a warning not to further approach the cooperation zone (48) on observing only a minimum number of one.

8. A method in accordance with any one of the preceding claims, wherein the machine (40) is safeguarded when a minimum number has not been observed, with safeguarding meaning a slowing down of the machine (40), a rearward evasion, an immediate stop, or a change into a safe state.

9. A method in accordance with any one of the preceding claims, wherein the machine (40) restarts automatically as soon as the minimum number has been reestablished or a protected field (38) is no longer infringed.

10. A method in accordance with any one of the preceding claims, wherein, for the evaluation of the protected field intrusions and the measures therefore to be taken with respect to the machine (40), a finite state machine is used whose transitions are determined by an additional intrusion into a protected field (38) of a sequence or the ending of an intrusion into the protected field (38) of a sequence is determined; and wherein the measures are a moving of the machine (40) away from the cooperation zone (48) in the second direction, a prohibition of intrusions into a protected field (38) by the machine (40), and / or the canceling of a prohibition of intrusions into a protected field (38).

11. A method in accordance with any one of the preceding claims, wherein the first sequence comprises, from the outside to the inside with respect to the cooperation zone (48), a first protected field α, a second protected field β, and a third protected field γ , the cooperation zone (48) is monitored by a fourth protected field δ and the second sequence, starting from the inside to the outside of the cooperation zone (48), comprises a fifth protected field ε and a sixth protected field ζ.

12. A method in accordance with any one of the preceding claims, wherein two optoelectronic sensors (10a-b) monitor five protected fields W, A, B, C, D, namely the one optoelectronic sensor (10a) in the access zone (44) monitors an outer first protected field W, a second protected field A enclosing the zone between the first protected field W and the cooperation zone (48), and a fourth protected field C adjoining in the working zone (42) and comprising the cooperation zone (48) and the other optoelectronic sensor (10b) in the working zone (42) monitors an outer fifth protected field D and an adjoining third protected field B comprising the cooperation zone (48) and projecting into the access zone (44).

13. A method in accordance with claim 12, wherein the monitoring processes of the two sensors (10a-b) overlap one another at least in the fourth protected field C.

14. A method in accordance with claim 12 or claim 13, wherein the first protected field W is monitored as a functional first protected field α, the second protected field A without the third protected field B as a second functional protected field β, the third protected field B without the fourth protected field C as a functional third protected field γ, an overlap zone of the third protected field B with the fourth protected field C as a functional fourth protected field δ, the fourth protected field C without the third protected field B as a functional fifth protected field ε, and the fifth protected field D without the fourth protected field C as a sixth protected field ζ.

15. A monitoring device for contactless safeguarding at a cooperation zone (48) of a machine (40) that a worker (46) and the machine (40) use in common, wherein an access zone (44) for a worker (46) is arranged at a first side of the cooperation zone (48) and a working zone (42) of the machine (40) is arranged at a second side different from the first side, and wherein the monitoring device has at least one safe optoelectronic sensor (10) having a light receiver (26) for generating a received signal and has a control and evaluation unit (28, 36) that is configured to monitor a plurality of protected fields (38) configured in the environment of the cooperation zone (48) for protected field intrusions with reference to the received signal, wherein the protected fields (38) are configured such that at least two of the protected fields (38) are arranged in a first sequence starting from the first side such that a worker (46) sequentially intrudes into these protected fields (38) when approaching the cooperation zone (48), and wherein the control and evaluation unit (28, 36) is configured to evaluate the protected field intrusions to safeguard the machine (40) in the case of an unpermitted combination of protected field intrusions, characterized in that there are permitted and unpermitted combinations of protected field intrusions and the control and evaluation unit (28, 36) only safeguards the machine (40) in the case of an unpermitted combination; in that the protected fields are configured such that at least two of the protected fields (38) are arranged in a second sequence starting from the second side such that the machine (40) sequentially intrudes in these protected fields (38) when approaching the cooperation zone (48); and in that the evaluation of the control and evaluation unit (28, 36) for permitted and unpermitted combinations of protected field intrusions includes the second sequence, with it being considered a permitted combination of protected field intrusions when an intrusion takes place sequentially from the outside to the inside in protected fields (38) of the first sequence and / or of the second sequence, and with inward designating the cooperation zone (48), but in this respect a minimum number of protected fields (38) without a protected field intrusion remaining between protected fields (38) of the two sequences.