Contactless safeguarding at cooperation zone of machine

Abstract

To provide a method for a contactless safeguarding at a cooperation zone of a machine and a monitoring machine.SOLUTION: In a method according to the invention: an access zone for a worker (46) is arranged at a first side of a cooperation zone (48) and a working zone of a machine is arranged at a second side; a plurality of protected fields (38) configured in an environment of the cooperation zone are monitored for protected field intrusions by at least one optoelectronic sensor and at least two of the protected fields are arranged in a first sequence starting from the first side such that a worker sequentially intrudes into these protected fields when approaching the cooperation zone, wherein the protected field intrusions are evaluated to safeguard the machine in the case of an unpermitted combination of protected field intrusions. Further, therein at least two of the protected fields are arranged in a second sequence starting from the second side such that the machine sequentially intrudes in these protected fields when approaching the cooperation zone.SELECTED DRAWING: Figure 8

Description

[Technical field]

[0001] The present invention relates to a method and a monitoring device for contactless protection in collaborative working areas of machines as claimed in the preambles of claims 1 and 15, respectively. [Background technology]

[0002] For non-contact monitoring of hazards such as machines in industrial environments, photoelectric sensors with monitoring of protected areas are very often used. Protected areas are sub-areas within the monitored area that must not be reached by the operator while the machine is in operation. If an unacceptable intrusion into the protected area, e.g. the operator's leg, is detected, a safety signal is sent to a safe output (OSSD, Output Signal Switching Device) and the machine is put into a safe state.

[0003] Sensors used in safety technology must operate particularly reliably and therefore meet high safety demands, e.g. the standard EN 13849 for the safety of machinery or the equipment standard EN 61496 for non-contact protective devices (beruehrungslos wirkende Schutzeinrichtungen, BWS). To meet these safety standards, several measures are taken, e.g. a reliable electronic evaluation by redundant and multiple electronics or the monitoring of various functions, in particular the monitoring of contamination of optical components (including the front panel). For such safety sensors or the safety applications implemented with them, safety stages or levels are defined, e.g. from SIL1 to SIL4 (Sicherheitslevel, safety level) or from PLA to PLD (Performance Level, performance level).

[0004] For protection, the machine is architecturally fenced off in some areas, for example with a fence, and the remaining access area is protected by sensors. Particularly difficult problems arise if it is necessary to repeatedly reach the machine to be protected during normal operation. An example is a robot cell in which an industrial robot performs production or logistics steps that require sequential support. Here, for example, the supply and retrieval of materials is a problem. In practice, such areas are usually still protected by fences and light grids. A person entering the area of ​​the machine is recognized and the machine is switched off based on this. After completing the work steps in which the machine is supported and leaving the area of ​​the machine, the operation must be resumed manually. This is done, for example, by the person operating a switch that is installed outside the protected area. This is necessary because the sensor cannot reliably understand whether the person has really left again. The light grid only recognizes the passage itself and cannot determine on which side the person is located afterwards. The protection area of ​​the laser scanner cannot cover the entire area in front of the machine at all times, because otherwise the machine would activate the protection area while it is running, for example. Furthermore, a human could climb onto a fixed object, such as the machine's base, and become invisible to the laser scanner, so traditionally a human would be responsible for making sure the machine does not pose a danger to anyone when it is put back into operation.

[0005] More recently, safety laser scanners and safety cameras are known which evaluate several protection zones simultaneously, however, simultaneous evaluation is very computationally intensive and only a limited number of protection zones can be provided in parallel, and also, multiple protection zones do not solve the aforementioned problems in themselves, and the flexibility they make available is still completely unused in most existing protection applications, and in any case its potential is far from being fully exploited.

[0006] In the patent document 1, a number of monitoring areas are configured in the laser scanner, which at least partially overlap each other. This results in a number of monitoring segments that are differentiated from each other depending on which monitoring areas overlap each other. The number of monitoring areas provided on the hardware side is thus subdivided into monitoring segments. This substantially increases the number of protection areas that can be made available, but they are still not automatically and intelligently configured by this.

[0007] US Patent No. 5,399,633 proposes a security system that validates a complex, non-robust evaluation by a less complex, robust evaluation. In one embodiment, on the one hand, the object is located in a non-robust manner based on a scan point cloud. On the other hand, there is a raster of the protected area. The fine position calculated in a non-robust manner is verified with the robust raster position.

[0008] Patent Document 3 discloses an optoelectronic protection device that monitors which of a plurality of protection areas is violated by an object (protection area violation) and which protection area the object leaves (protection area release). When the violation of the protection area and the release of the protection area are consecutive in a predetermined order, the operation of the equipment is automatically permitted.

[0009] Patent document 4 presents a device for protecting a danger zone of an installation, which monitors a protection zone adapted to the danger zone. The motion transition of an object when leaving the protection zone is captured, and if a valid motion transition is recorded, an enabling signal is generated to re-enable the danger operation of the installation.

[0010] In the unpublished European patent application No. 23162023.8, the area in front of the machine is monitored with lower and upper protective zones to distinguish approaching people from vehicles. [Prior art documents] [Patent documents]

[0011] [Patent Document 1] EP 3 470 879 A1 [Patent Document 2] EP 3 709 106 A1 [Patent Document 3] EP 3 153 885 A1 [Patent Document 4] EP 3 575 666 A1 Summary of the Invention [Problem to be solved by the invention]

[0012] SUMMARY OF THE DISCLOSURE In light of the above, it is an object of the present invention to provide improved protection in the area of ​​shared machine work. [Means for solving the problem]

[0013] This problem is solved by a method and a monitoring device for contact-free protection in the common working area of ​​a machine according to claims 1 and 15, respectively. The machine preferably means at least one robot. The common working area means an area used by both the worker and the machine, for example to pass a workpiece or material in one direction or another, to carry out manual or machine-assisted installation steps, etc. However, this common access must not take place simultaneously during the machine movement, because otherwise unwanted contacts or accidents may occur, which is the purpose of the protection to prevent.

[0014] The common working area is reachable by the worker from a first side beyond the entry area and by the machine from a second side leaving the working area of ​​the machine. The first side is preferably opposite the second side, in which case the machine is behind the common working area as seen by the worker. If not, the working area is preferably closed, i.e. mechanically guarded by a fence or the like, in which case there may in particular also be another entry area guarded according to the invention. An example is a robot cell as an isolated working area.

[0015] At least one photoelectric sensor monitors the protection zones for intrusions in the surrounding area. The protection zones are independently configurable sub-areas of the sensor's detection area, so named for historical reasons, but in fact may be three-dimensional spatial areas depending on the type of sensor. At least two of the protection zones are arranged in a first sequence from the first side. A worker approaching the collaboration area thus triggers protection zone intrusions in these protection zones one after the other. Unlike conventional protection zones, a protection zone intrusion never immediately triggers protection. Instead, there are permitted and unpermitted combinations of protection zone intrusions, and the machine is only protected in the case of unpermitted combinations.

[0016] The basic idea from which the invention starts is to supplement the monitoring of the sequence on the operator side with the monitoring of the sequence on the machine side. That is, at least two of the protected areas are arranged in a second sequence from the second side, so that a machine approaching the common working area will trigger a protected area intrusion in the second sequence one after the other. It is already clear from a geometrical perspective that the protected areas of the two sequences are different protected areas. That is, the protected area of ​​the first sequence on the operator side is different from the protected area of ​​the second sequence on the machine side. The two sequences meet in the common working area, where, exceptionally, one protected area can take on a dual role and belong to both sequences. The evaluation of permitted and not permitted combinations of protected area intrusions now includes the second sequence. That is, whether the approach of the operator is allowed while the machine continues to operate or whether the machine needs to be guarded depends on both the operator's behavior and on the machine's behavior.

[0017] The machine can in principle penetrate beyond the common working area from its second side into the first sequence. This does not in itself yet mean an impermissible combination of protected area penetration, but of course it can be deliberately prohibited as an impermissible combination. Conversely, this also basically applies to the worker and his penetration into the protected area of ​​the second sequence. However, it is preferably prohibited, thus ensuring rear entry protection. Although the principle that the worker and the machine always remain on their respective sides in an advantageous manner during the operation of the machine is observed overall, the invention can still be made to be safety-conscious under certain conditions.

[0018] The at least one photoelectric sensor is preferably a safe sensor which accordingly performs safe protected area monitoring. "Safe" and "safe" mean, as in the entire specification, that measures have been taken to limit errors to a defined safe level or to fulfil the provisions of safety standards relating to machine safety or non-contact protective devices (some of which are listed at the beginning). "Not safe" is the opposite of "safe", so that non-safe devices, transmission paths, evaluations etc. do not fulfil the above requirements regarding error safety.

[0019] The method is a computer-implemented method, which for example proceeds in the computing unit of the photoelectric sensor and / or in a connected computing unit. The configuration of the protection zone goes beyond the contactless protection and is typically performed manually by a safety expert due to the complexity of the safety aspects to be respected. However, it is conceivable to use automatic assistance, such as proposing the protection zone, or to use a configuration program (e.g. similar to a CAD program) with graphical assistance for fitting geometric objects as parts of the protection zone into an image of the machine's surroundings.

[0020] The invention has the advantage that cooperative safety can be achieved by relatively simple means. Multiple protection zones can be extended even from just one photoelectric sensor. In order to obtain additional perspectives or to achieve a higher level of safety by redundancy, preferably more than two sensors can be used. In any case, the number is much smaller compared to conventional devices, which often require a large number of light grids. This saves costs and assembly space, for example, a more compact robot cell can be built up thanks to the intelligent protection according to the invention, which is further linked to productivity and cost advantages. The protection of access to the collaborative working area can also serve as rear access protection and can support automatic restart. The slowing down or even stopping of the machine is only carried out when it is really necessary.

[0021] The photoelectric sensor is preferably a three-dimensional sensor, in particular an optical transit time camera, and the protected area is preferably a three-dimensional protected area. This allows a very flexible configuration of multiple protected areas and sequences of protected areas that effectively protect the perimeter of the collaborative area. These protected areas are three-dimensional spatial regions and therefore allow for a more gap-free and better adaptable monitoring. However, the traditional term protected area is adhered to even in the spatial extent. The first safe photoelectric sensor may alternatively be a laser scanner. However, a three-dimensional camera can be more easily mounted at a suitable viewpoint from which the appropriate protected area can be monitored. Another alternative is the FMCW sensor, which has an even higher dimension than a three-dimensional sensor due to the additional measurement of the velocity component, but can still be considered as a three-dimensional sensor in particular.

[0022] Preferably, at least two photoelectric sensors each monitor a part of the plurality of protection zones, so that at least one protection zone is monitored by both photoelectric sensors and thus at a higher safety level. With multiple sensors, it is possible to add additional viewpoints, monitor a larger area together, or increase the number of monitored protection zones. Very preferably, exactly two sensors are already sufficient for this, especially if they are 3D cameras. Another advantage is that a redundant monitoring of the protection zones is possible in the overlapping area of ​​the two sensors. This allows even higher safety levels to be reached. For example, two sensors that by themselves only have PLc (performance level according to ISO TS 62998) can even be combined to achieve PLd. This is also attractive because bringing a device up to a high safety level means a lot of costs, which can only be carried out by the manufacturer in a costly development process. The combination of sensors, on the other hand, can be carried out with hardware available at the user's side.

[0023] Preferably, one protected area includes the common working area. In this way, the central area to which the workers and the machine have regular access is protected as such. Particularly preferably, this protected area is monitored by both photoelectric sensors. In this way, an even higher level of safety is achieved locally, especially for the overlapping monitored areas. There may also be other protected areas that are overlappingly monitored and thus have a higher level of safety, especially for protected areas that directly border the protected area of ​​the common working area.

[0024] Preferably, if the intrusions in the protected areas of the first and / or second sequence from outside to inside, where the inside refers to the common working area, remain between the protected areas of the two sequences, a combination of protected area intrusions is considered to be permitted. That is, the expected transition according to the rule is that the worker and the machine approach the common working area from each side. To this extent, the order of the protected area intrusions can be imposed architecturally and by the configuration of the protected areas. As a further condition, it is required that a minimum number of protected areas without intrusions remain between the worker and the machine. This of course implicitly imposes a minimum distance, but this is not the only problem. Rather, without the minimum number, it is no longer possible to determine whether the worker and the machine have possibly already met, as will be explained in more detail later. The minimum number can be understood as a buffer of free protected areas between the worker and the machine.

[0025] Preferably, when an intrusion occurs in a protection zone of the first sequence, the machine is no longer allowed to enter the protection zone assigned to that protection zone of the first sequence corresponding to said minimum number, and if it has already entered the assigned protection zone, the machine exits it. That is to say, when an operator is approaching, the machine cannot enter a particular protection zone which it would have been allowed to enter without the operator, but which is now too close to the operator recognized in the protection zone. As a result, the minimum number of protection zones without protection zone intrusions between the operator and the machine is still maintained or restored. The prohibition of entry into the corresponding protection zone is an instruction to the machine control, as is the case with the possible exit. In order to avoid the costs of achieving a compliant safety in the machine control, it is preferable that the device itself is not safe. The monitoring of the protection zones ensures that it is recognized whether the machine control has followed the instruction, so that in case of an error, it is possible to deal with it by issuing a new instruction to the machine control or, if necessary, by guarding the machine. The determination of which protection zone is the respective assigned protection zone is either determined together with the protection zone configuration or manually during adjustment of the safety application, for example in the form of a finite automaton to be introduced further below, or it is assigned, for example, to the nth adjacent protection zone in the sequence, in particular where n is equal to a minimum number plus or minus a constant.

[0026] If the first minimum number is maintained, the machine continues to work without limiting its working speed. The first minimum number is preferably equal to 2. In this case, the buffer of free protected area is large enough that no danger is yet imminent. Even if the two approach each other further and another intrusion into the protected area occurs, there is still a free protected area between the operator and the machine. At this time, it is still possible to identify where the operator and the machine are located.

[0027] If only a second minimum number smaller than the first minimum number, preferably equal to 1, is maintained, the worker is preferably warned not to approach the collaborative area any further. Now the buffer of free protected area is too small and there is no more sufficient reserve there. In this situation, the machine preferably receives an instruction to leave the protected area as described above, in order to recover a larger buffer. However, the worker should pay attention long enough and not approach any further, to give the machine enough time to leave. The warning is for example in the form of a display, a lamp color and / or an acoustic signal. However, preferably no guarding is performed yet, and the machine is allowed to continue working further, preferably as soon as the first minimum number is recovered.

[0028] The machine is preferably guarded if the minimum number is not maintained. In case of several minimum numbers graded as in the previous paragraph, the smallest minimum number is meant here. In particular, there is now no buffer at all and the protected area penetrated on the operator side directly borders the protected area penetrated on the machine side. In this situation, it can no longer be distinguished whether the operator and the machine still remain in adjacent protected areas, respectively, or whether they are already in the same protected area and risk contact, and therefore guarding is no longer unavoidable. Guarding means an appropriate reaction to prevent an accident from occurring. It can be a slowdown, a reversal or an immediate stop of the machine or a transition to a safe state. Stop categories can be differentiated according to the standard ISO 10218-1. In a category 2 stop, it is permitted to leave the current supply of the machine uninterrupted. Only stop categories 0 and 1 can be used as emergency stops. Preferably, always choose the most conservative form of protection that still guarantees safety. For example, the automatic restart discussed in the next paragraph can be combined with a category 2 stop, but not after an emergency stop.

[0029] The machine preferably automatically resumes operation as soon as the minimum number is restored or as soon as there are no more intrusions in any of the protected areas. The machine automatically resumes its work as soon as there is again a sufficient buffer of free protected areas between the operator and the machine. To be on the safe side, this automatic resumption can be subject to a stricter condition that all intrusions in the protected areas have been cleared in the meantime. It is conceivable to provide an independent rear entry protection, for example an additional safe radar or another photoelectric sensor. This prevents a person from entering the work area during the protection and then not being noticed and leaving it again.

[0030] To evaluate the intrusion into the protected area and therefore the measures to be taken with respect to the machine, a finite automaton is preferably used whose transitions depend on the additional intrusion into the protected area of ​​the sequence or the end of the intrusion into the protected area of ​​the sequence, said measures being preferably a moving away movement that moves the machine away from the collaborative area in a second direction, a prohibition of the machine from entering a certain protected area and / or a lifting of the prohibition of the intrusion into a certain protected area. The additional intrusion or the end of the intrusion can also be called an approaching and moving away movement of the operator or the machine. Each state is associated with an instruction to the machine and, if necessary, a guarding of the machine. When such an instruction is given, the machine maintains a larger distance to the collaborative area by prohibiting the intrusion into the protected area or creates the distance for the time being by active retreat. Conversely, in a state where the operator is sufficiently far away from the collaborative area, such a prohibition can be lifted.

[0031] Preferably, the first sequence includes a first protected area α, a second protected area β and a third protected area γ from outside to inside to the collaborative area, the collaborative area being monitored through a fourth protected area δ, and the second sequence includes a fifth protected area ε and a sixth protected area ζ from inside to outside starting from the collaborative area. This is an advantageous configuration of protected areas that has been carefully designed to provide sufficient protection and flexibility without the unnecessary complexity of a large number of protected areas.

[0032] Preferably, two photoelectric sensors monitor five protection zones W, A, B, C, D, i.e. one photoelectric sensor monitors in the entry area a first protection zone W on the outside, a second protection zone A closing the area between the first protection zone W and the collaborative work zone, and a fourth protection zone C in the work zone connected to the protection zone A and including the collaborative work zone, while the other photoelectric sensor monitors in the work zone a fifth protection zone D on the outside and a third protection zone B connected to the protection zone D, including the collaborative work zone and projecting into the entry area. This is an advantageous arrangement in that two sensors are involved and each sensor requires a very small number of protection zones. The protection zone W may not yet be a protection zone, but simply a warning zone. This is particularly advantageous if the sensor can only monitor a limited number of protection zones. The warning zone is preferably included here in the concept of a protection zone, since it can play the same role in the sequence.

[0033] The monitoring of the two sensors preferably overlaps with one another at least in a fourth protection zone C, so that a higher safety level is achieved here. For example, even PLd can be achieved in protection zone C, even if the sensors themselves are only designed according to PLc. The overlapping and the resulting higher safety level can be extended to other protection zones.

[0034] Preferably, the first protection area W is monitored as a first functional protection area α, the second protection area A excluding the third protection area B as a second functional protection area β, the third protection area B excluding the fourth protection area C as a third functional protection area γ, the overlapping area of ​​the third protection area B and the fourth protection area C as a fourth functional protection area δ, the fourth protection area C excluding the third protection area B as a fifth functional protection area ε, and the fifth protection area D excluding the fourth protection area C as a sixth protection area ζ. Functional protection areas means that from the perspective of the safety application, one protection area is monitored, which does not have to directly correspond to a protection area defined for one sensor. Rather, the monitoring of the functional protection areas is performed by jointly evaluating the intrusions into the protection areas defined for each sensor in practice. These include, in particular, overlapping areas (AND conditions for a protected area intrusion) and exclusive areas (OHNE or UND NICHT conditions for a protected area intrusion). This joint evaluation effectively allows more protected areas than the total number of protected areas of the involved sensors, and in particular allows certain protected areas to be monitored redundantly and therefore with a higher security level. The specifically presented allocation combines the two configurations described in the previous paragraph. This allows preferably the fourth functional protected area δ corresponding to the collaboration area, and even more preferably the third functional protected area γ adjacent thereto and / or the fifth functional protected area ε adjacent thereto to reach a higher security level.

[0035] The monitoring device according to the invention is provided with at least one photoelectric sensor for monitoring a protected area, preferably a safe one, which comprises a receiver for generating a reception signal from the incoming reception light. Depending on the sensor, the reception signal is, for example, a signal of a photodiode capturing the returning scanning light beam, or image data of an image sensor, which is generally called the reception signal. A control and evaluation unit is responsible for the protection area monitoring and the inspection of the intrusion into the protection area for impermissible combinations. The control and evaluation unit can be implemented in the sensor and / or in a computing unit connected thereto, in particular in a safety control device connected to the sensor. A safety control device is a safety evaluation unit realized in any hardware, in the narrow sense a safety control device as a control device approved for safety applications. A highly advantageous distribution of tasks is performed in the sensor for the protection area monitoring and externally for the evaluation of the intrusion into the protection area in order to recognize impermissible combinations. In particular, one of the embodiments of the method according to the invention is carried out in the monitoring device.

[0036] The invention, together with further characteristics and advantages thereof, will now be described in greater detail, exemplarily on the basis of embodiments, with reference to the accompanying drawings, in which: FIG. [Brief description of the drawings]

[0037] [Figure 1] FIG. 1 is a schematic block diagram of a three-dimensional optical transit-time camera. [Diagram 2] Schematic diagram of a surveillance system with two cameras and a safety control device. [Diagram 3] Schematic diagram of a protection zone configuration for a first camera. [Figure 4] Schematic diagram of a protection zone configuration for a second camera. [Diagram 5] FIG. 5 is a schematic diagram of the combined two-camera protection zone configuration shown in FIGS. 3 and 4. [Figure 6] FIG. 4 is another top view of the first camera protection zone configuration shown in FIG. 3 . [Figure 7]5 is another top view of the second camera protection zone configuration shown in FIG. 4. [Figure 8] Another top-down view of the combined two-camera protection zone configuration shown in Figure 5. [Figure 9] FIG. 9 is a diagram similar to FIG. 8, but in which the protection zones actually monitored by the cameras are combined by joint evaluation into more refined functional protection zones. [Figure 10] A schematic diagram of an exemplary situation in which a worker is approaching the machine to be protected while still at a great distance, which can also be understood as an exemplary state of a finite automaton. [Figure 11] FIG. 2 is a schematic diagram of a situation in which a worker is approaching the machine to be protected when the distance to the machine is already short, and can also be understood as another exemplary state of a finite automaton. [Figure 12] FIG. 2 is a schematic diagram of a situation in which a worker is approaching the machine to be protected when there is no longer any appreciable distance to it, which can also be understood as yet another exemplary state of the finite automaton. [Figure 13] An overview of a finite automaton illustrating the three states of Figures 10 to 12 as exemplary examples. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0038] FIG. 1 shows a schematic block diagram of a camera 10. The camera is preferably configured as a three-dimensional optical transit-time camera, which will be described as representative of photoelectric sensors that can be used in the context of the present invention. An illumination unit 12 emits modulated emitted light 16 through light emission optics 14 into a monitoring area 18. The light source can be an LED or an edge-emitting light emitter or a laser in the form of a VCSEL. The illumination unit 12 can be controlled such that the amplitude of the emitted light 16 is modulated with a frequency typically in the range of 1 MHz to 1000 MHz. This modulation is for example sinusoidal or square-wave shaped, and in any case is a periodic modulation. A low modulation frequency is necessary to increase the range of the camera 10, since the frequency limits the range of uniqueness of the distance measurement. Alternatively, measurements can be performed with two to three or more modulation frequencies, which are combined to increase the range of uniqueness.

[0039] When the emitted light 16 strikes an object or person 20 in the monitoring area 18, a part of it is reflected as received light 22 to the camera 10, where it is guided through a receiving optical system 24, for example a single lens or a receiving objective lens, to an image sensor 26. The image sensor 26 comprises a number of receiving elements or receiving pixels 26a, arranged for example in a matrix or line. The resolution of the image sensor 26a can range from two or a few receiving pixels 26a to several thousand or even millions. In the receiving pixels, demodulation is performed by a lock-in method. By repeatedly detecting and shifting the modulation of the emitted light 16 slightly each time, a number of sample values ​​are obtained from which the phase difference between the emitted light 16 and the received light 22 can finally be measured, which can be used to measure the light propagation time. Since the pixel arrangement is typically a matrix, a lateral position resolution is achieved in the X and Y directions, to which the Z direction for distance measurement is added to obtain three-dimensional image data. When speaking of a 3D camera, a 3D optical transit time camera or 3D image data, preferably this 3D detection is meant, but in principle other pixel arrangements are also conceivable, such as a line of pixels selected from a matrix or a line of pixels constituting the entire image sensor of a line camera.

[0040] A number of protection zones can be configured in the control and evaluation unit 28. The protection zones are defined for partial areas of the monitoring area 18 by means of geometrical reference values. The reference values ​​are configured by the control and evaluation unit 28, for example in a CAD program or in any other way, and are loaded via the interface 30. The protection zones are monitored for intrusions of objects and a safety output signal is output at the safety outputs 32, 34 in case of intrusion of a protection zone. Preferably, several safety outputs 32, 34 are provided per protection zone, or the output signal is coded at a single safety output for each intruded protection zone. The camera 10, and in particular the evaluation of the protection zones including the output signal, are preferably safe in the sense defined at the beginning.

[0041] The above-mentioned three-dimensional camera 10, in particular a TOF camera, is highly suitable for the protection according to the invention, but other sensors, in particular safety laser scanners, are also conceivable, possibly with the necessary constraints due to, for example, boundary conditions for the application geometry.

[0042] FIG. 2 shows a schematic diagram of a monitoring device with two cameras 10a-b each connected to a safety control device 36. Although the combination of several cameras 10a-b is very advantageous, the invention can also be implemented with a single camera 10a-b. However, as will be explained later, a higher level of safety in a protected area monitored in an overlapping manner cannot be achieved with a single camera 10a-b. The safety control device 36 allows a higher-level evaluation of the intrusion into the protected area reported by each camera 10a-b. In this case, if a danger is recognized, a signal for ensuring safety is output to the machine or robot to be monitored. The machine or robot slows down accordingly or at least changes to a work step that does not pose a danger in the case of the recognized object movement, and only in an emergency is the machine transferred to a safe state. This achieves high availability and productivity overall. The specific monitoring according to the invention will be explained in more detail later with reference to FIGS. 3-13.

[0043] It is highly advantageous to assign the evaluations for recognizing intrusions into the protected area and for the superior assessment of intrusions into the protected area in the safety control device 36 to the control and evaluation unit 28 in the cameras 10a-b. For the safety control device, very simple logic circuits (e.g. in the form of finite automata) that do not impose high hardware demands are sufficient. However, the invention is not limited to a specific assignment of the evaluation functions to specific hardware components, but can be distributed arbitrarily, internally and externally. This includes the extreme cases where no independent evaluations are performed at all in the cameras 10a-b or, conversely, where the functionality of the safety control device is integrated in at least one of the cameras 10a-b. Examples of internal computing units are microprocessors or digital computing modules such as CPUs (Central Processing Units), FPGAs (Field Programmable Gate Arrays), DSPs (Digital Signal Processors), ASICs (Application-Specific Integrated Circuits), AI processors, NPUs (Neural Processing Units), GPUs (Graphics Processing Units), VPUs (Video Processing Units), etc. The external computing unit may be the safety control device 36 already mentioned, or may be any type of computer, such as a notebook, a smartphone or a tablet, or may be a local network, an edge device or the cloud.

[0044] Figures 3 and 4 show schematic diagrams of exemplary configurations of the protection zones 38 of the first camera 10a or the second camera 10b for protecting a machine 40, typically depicted as a robot, and the accompanying figure 5 shows a combined, superimposed protection zone configuration of both cameras 10a-b. Figures 6 and 7 show the individual protection zone configurations of figures 3 and 4 again, again seen from above, and correspondingly Figure 8 shows the combined protection zone configuration of figure 5, seen from above.

[0045] The protected area 38 is shown in cross section in Figures 3 to 5 and also has a depth extension. This is clear from the top views in Figures 6 to 8. It is therefore a three-dimensional protected area. The machine 40 is located in a mechanically protected work area 42, for example a robot cell, which cannot be accessed by humans. Through an access area 44 protected by the protected area 38, a worker 46 (only shown in Figures 6 to 8) has access to a collaborative work area 48, where he can for example supply or receive workpieces or materials to the machine 40 or from it.

[0046] The first camera 10a monitors three protection zones W, A, C aligned in a direction between the machine 40 and the approaching worker 46. The protection zone W may simply be a warning zone, i.e. a zone that, like the protection zone, recognizes the intrusion of an object and allows a corresponding reaction, but unlike the protection zone, does not have any inherent safety function. In the illustrated example, the robot cannot physically reach the warning zone W at all, so no protection function is necessary here. Correspondingly, the second camera 10b monitors two successive protection zones B and D. The geometry of the protection zone 38 is somewhat complex to adapt to the site realities, for example there is a void 50 around the collaborative working area 48. The protection zone monitoring of both cameras 10a-b is combined to a common protection zone sequence W, A, B, C, D. This sequence and the contribution of the individual cameras 10a-b can be traced again in the symbolic overview 52 of Figs. 6-8, added purely for illustrative purposes.

[0047] The protected zones W, A, B, C, D are simultaneously active. In this case, there are areas where the protected zones overlap each other and thus a higher safety level can be achieved. One such area is clearly shown in FIG. 8 by the dashed line 54. For example, a protected zone monitoring at safety level PLd is realized by superimposing two cameras 10a-b with safety level PLc. The protected zones form a first operator-side sequence and a second machine-side sequence. When the operator 46 approaches, the sequence WABCD is expected, and conversely when the machine 40 approaches, the sequence DCBAW, both of which preferably do not allow interference beyond the collaborative working area 48, for example so that the machine 40 cannot reach the protected zone W at all. The safety controller 36 rechecks these conditions (which will be more precise shortly) for the combination of current protected zone intrusions. The device allows the machine 40 to continue working without reducing efficiency unless the combination of intrusions into the protected area is completely dangerous, and if the situation is slightly dangerous, it issues an instruction to the machine control device of the machine 40 to prohibit any movement or to exit the machine 40, thereby preventing an actually dangerous situation from occurring, or activates the protection of the machine 40 if necessary.

[0048] FIG. 9 is a diagram similar to FIG. 8, showing the protected areas 38 actually monitored by the cameras 10a-b combined by joint evaluation into a more refined functional protected area. A functional protected area can be understood exactly the same as a protected area, except that the evaluation of the protected area intrusion may require combining both cameras 10a-b by an overlapping condition ("AND") or an exclusive condition ("OHNE"). It should be noted that such conditions can also be concatenated. By this principle, the six functional protected areas shown in FIG. 9, or more functional protected areas, can be created. With functional protected areas, the maximum number of protected areas of the cameras 10a-b that can be simultaneously monitored can exceed the original specifications of the cameras, but apart from that, there is no other difference between protected areas and functional protected areas for the present invention. On the contrary, the original protected area intrusion of WABCD is already sufficient for the following discussion. Specifically, Figure 9 shows, as exemplary examples, a first functional protection area α corresponding to protection area "W", a second functional protection area β corresponding to protection area "A excluding B", a third functional protection area γ corresponding to protection area "B excluding C", a fourth functional protection area δ including a collaborative work area 48 as an overlapping area of ​​protection areas "B and C", a fifth functional protection area ε corresponding to protection area "C excluding B", and a sixth functional protection area ζ corresponding to protection area "D excluding C".

[0049] While in Fig. 8 neither the machine 40 nor the worker has entered any of the protected areas 38, which is clearly not dangerous, Figs. 10-12 show the approaching movement of the worker 46, during which the machine 40 has, as an example, already entered the protected areas C and D, respectively, on its own side. In the situation of Fig. 10, the worker 46 has only entered the outermost protected area W for the time being. Since the machine 40 is still at a distance on its own side to the collaborative working area 48, the protected areas A and B are still free in the inner part of the common sequence formed by the worker-side and machine-side sequences from both sides. This is again concretely shown in the overview 52, ​​where an "x" indicates the intrusion into a protected area.

[0050] The minimum number of two free protection zones between the machine 40 and the worker 46 is deemed not dangerous and the machine 40 can continue working without slowing down. However, the machine control preferably receives instructions to keep the protection zone B free, i.e. not to approach any further, or even to leave the protection zone C as a precaution, in preparation for the expected further approach of the worker 46. The machine control is preferably not safe itself, since a safe machine control is expensive and should not be assumed lightly, at least in safety applications. It is therefore quite possible that the machine 40 still penetrates the protection zone B or does not leave the protection zone C despite the instructions. The safety control 36 then considers this to be impermissible, since it has prohibited it from remaining in the protection zone. It can then react accordingly by issuing further instructions to the machine 40 or by guarding the machine 40, if necessary.

[0051] In the situation in FIG. 11, the worker 46 approaches even closer and also enters the protected area A. Since the machine is not moving, it is assumed that it has not received an instruction to first clear the protected area C just in case. The buffer of free protected areas between the machine 40 and the worker 46 has now been reduced to only one protected area B. The minimum number of free protected areas, one, does not yet represent a real danger, since it is clear that the machine 40 and the worker 46 can still be without contact and that they are still apart, on each side. However, this could now become dangerous very quickly. The worker 46 is therefore warned, for example by a yellow light now illuminating instead of the previous green light. The machine receives an instruction to leave the protected area C. The warning to the worker 46 is intended to hold him back in order to give the machine 40 the time it needs to leave.

[0052] In the situation in Fig. 12, the worker 46 has come even closer and now also encroaches on protected area B. However, the machine 40 has not yet cleared protected area C. This is because the worker 46 has entered too quickly or the machine control has not followed its instructions. Therefore, there is now an intrusion in all protected areas and there is no longer a buffer of free protected areas between the machine 40 and the worker 46. Indeed, the situation shown in Fig. 12 is still not at all dangerous. However, the safety control 36 can no longer identify it. Since there is no buffer of free protected areas, there is at least a possibility that the machine 40 and the worker 46 are in the same place, as viewed with the coarse position resolution provided by the protected areas. The machine 40 is therefore protected.

[0053] The machine 40 can now leave the protected area C, possibly in a slow mode that is not dangerous for humans, and also leave the protected area D. The worker 46 can also step back, either immediately or after finishing his work step in the collaborative working area 48. In this way, a minimum buffer of two free protected areas is created again between the machine 40 and the worker 46. Once this is the case, or, just to be sure, once a larger buffer has been created or there are no more protected area intrusions, the machine 40 can resume operation. This is done, for example, manually by the worker 46, after having verified that the working area 42 is free, by operating a switch that is only accessible from the outside. It is preferably conceivable to resume operation automatically, without the use of a switch or the like, as soon as the aforementioned conditions for the buffer are fulfilled again. Depending on the geometrical givens and the shape and arrangement of the concrete protected areas, an additional rear access protection, for example by means of a radar or another camera, may be necessary for this purpose. This prevents the worker 46 or other persons from entering the work area 42 while all protected areas would otherwise still be violated and therefore the monitoring equipment is effectively blind to this rear entry.

[0054] Although the above-mentioned minimum numbers of free guard zone buffers are very advantageous, they may be deviated from, i.e. a larger minimum number may be required, especially if longer sequences are being formed, consisting of more guard zones, for example to form very fine-grained sequences.

[0055] Fig. 13 shows an overview of a finite automaton that can be used to assign appropriate measures to the possible combinations of intrusions into the protected area, of which three states shown in Figs. 10 to 12 are explained as an example. The states are arranged in columns 1 to 6 according to the approach of the worker 46 to the collaborative area 48 and in the rows according to the approach of the machine 40. This gives rise to possible states 1a, ..., 6a, 1b, ..., 6d. Three of these states, namely 2c, 3c and 4c, have already been explained as an example with reference to Figs. 10 and 12 and are accordingly marked with the symbol 56 in those figures.

[0056] In each state shown in the table, the invaded protection zone is marked with an "x" in the upper right corner. Three regions of states can be distinguished: the sub-diagonal 58 consisting of states 2d, 3c, 4b and 5a, a first triangle 60 in the upper left half and a second triangle 62 in the lower right half. In each state in the first triangle 60, there are at least two free protection zones between the machine 40 and the worker 46, so that the machine 40 can continue to work without loss of efficiency. This was explained in FIG. 10. In each state on the sub-diagonal 58, there is now only one free protection zone between the machine 40 and the worker 46 as a buffer, so that the worker 46 is alerted so that the machine 40 can leave, as explained in FIG. 11. In each state in the second triangle 62, there is no buffer at all between the machine 40 and the worker 46 and the machine is therefore protected, as explained in FIG. 12.

[0057] The most important measures for each situation are thus already mentioned: either protection is necessary, as in the second triangle 62, a warning should be issued, as on the subdiagonal 58, or the machine 40 can continue working, as in the first triangle 60. The vertical arrows in FIG. 13 symbolically represent other possible measures. The downward arrows represent that the machine 40 can approach the collaborative area 48 in a protected state. The upward dashed arrows mean that the machine 40 will perform the preferred exit movement described above if the worker 46 is approaching. The exit of the machine 40 or the corresponding entry prohibition applies each time to the assigned protection zone for the new access of the worker 46. The point here is to recover the buffer of two free protection zones or to widen the buffer for the further approach of the worker 46. The horizontal arrows do not represent measures, but rather the behavior of the worker 46, i.e. his approach movement. As previously mentioned, approaching movement of the worker 46 is not dangerous for the conditions in the first triangle 60. Further approach may trigger protection for the conditions in the sub-diagonal 58, and protection is triggered for the conditions in the second triangle 62.

Claims

1. 1. A method for contactless protection of a collaborative working area (48) of a machine (40), in particular of at least one robot, comprising: an access area (44) for a worker (46) arranged on a first side of the collaborative working area (48) and a working area (42) of the machine (40) arranged on a second side different from the first side, a protected area intrusion in a plurality of protected areas (38) arranged around the collaborative working area (48) is monitored by at least one photoelectric sensor (10), at least two of the protected areas (38) are arranged in a first sequence from the first side, so that the worker (46) intrudes into these protected areas one after the other when approaching the collaborative working area (48) and the protected area intrusion is evaluated, thereby protecting the machine (40) in the event of an unacceptable combination of protected area intrusions, At least two of the protected areas (38) are arranged in a second sequence from the second side, such that the machine (40) enters these protected areas (38) one after the other as it approaches the collaborative work area (48). The method comprising:

2. 2. The method according to claim 1, wherein the photoelectric sensor (10) is a three-dimensional sensor, in particular an optical transit time camera, and the protection area (38) is a three-dimensional protection area.

3. 2. The method according to claim 1, wherein at least two photoelectric sensors (10a-b) each monitor a part of the plurality of protected areas (38), and wherein at least one protected area (38) is monitored by both photoelectric sensors (10a-b) and thus at a higher safety level, in particular one protected area (38) including the collaborative working area (48) and wherein said protected area (38) is monitored by both photoelectric sensors (10a-b).

4. 2. The method of claim 1, wherein when intrusions occur in succession from outside to inside in the protected areas (38) of the first sequence and / or the second sequence, if there remains a minimum number of protected areas (38) without protected area intrusions between the protected areas (38) of the two sequences, where inside refers to the collaborative working area (48), this is considered to be an allowable combination of protected area intrusions.

5. 5. The method of claim 4, wherein, upon an intrusion within a protected area (38) of the first sequence, the machine (40) is no longer permitted to intrude into a protected area (38) assigned to that protected area of ​​the first sequence corresponding to the minimum number, and, if the machine (40) has already intruded into the assigned protected area (38), it exits therefrom.

6. 5. The method of claim 4, wherein if the minimum number of two is maintained, the machine (40) continues to work without limiting its operating speed.

7. 5. The method of claim 4, wherein if only a minimum number of one is maintained, the worker (46) is warned not to further approach the collaborative work area (48).

8. 5. The method of claim 4, wherein the machine (40) is guarded if a minimum number is not maintained.

9. 5. The method of claim 4, wherein the machine (40) automatically resumes operation as soon as the minimum number is restored or there are no more intrusions into any protected area (38).

10. The method according to any one of claims 1 to 9, wherein a finite automaton whose transitions depend on an additional intrusion into a protected area (38) of a sequence or on the end of an intrusion into a protected area (38) of a sequence is used to evaluate the intrusion into a protected area and therefore the measures to be taken with respect to the machine (40), the measures being an away movement moving the machine (40) away from the collaborative working area (48) in a second direction, a prohibition of the machine (40) from intruding into a protected area (38) and / or lifting of the prohibition of intruding into a protected area (38).

11. 2. The method of claim 1, wherein the first sequence includes a first protection area α, a second protection area β, and a third protection area γ from the outside to the inside to the collaborative area (48), the collaborative area (48) being monitored through a fourth protection area δ, and the second sequence includes a fifth protection area ε and a sixth protection area ζ from the inside to the outside starting from the collaborative area (48).

12. 2. The method according to claim 1, wherein two photoelectric sensors (10a-b) monitor five protected areas W, A, B, C, D, i.e. one photoelectric sensor (10a) monitors in the entry area (44) a first protected area W on the outside, a second protected area A enclosing the area between the first protected area W and the collaborative work area (48) and a fourth protected area C within the work area (42) connected to the protected area A and including the collaborative work area (48), and the other photoelectric sensor (10b) monitors in the work area (42) a fifth protected area D on the outside and a third protected area B connected to the protected area D, including the collaborative work area (48) and protruding into the entry area (44).

13. The method according to claim 12, wherein the monitoring of the two sensors (10a-b) overlaps with one another at least in a fourth protection zone C, so that a higher safety level is achieved here.

14. 14. The method according to claim 12 or 13, wherein the first protected area W is monitored as a functional first protected area α, the second protected area A excluding the third protected area B as a functional second protected area β, the third protected area B excluding the fourth protected area C as a functional third protected area γ, an overlapping area of ​​the third protected area B and the fourth protected area C as a functional fourth protected area δ, the fourth protected area C excluding the third protected area B as a functional fifth protected area ε, and the fifth protected area D excluding the fourth protected area C as a sixth protected area ζ.

15. A monitoring device for contactless protection in a collaborative working area (48) of a machine (40), in particular at least one robot, which comprises an access area (44) for a worker (46) arranged on a first side of the collaborative working area (48) and a working area (42) of the machine (40) arranged on a second side different from the first side, the monitoring device comprising at least one safe photoelectric sensor (10), in particular a three-dimensional camera, having a receiver (26) for generating a received signal, and based on the received signal, a monitoring device for contactless protection in a plurality of protection zones (38) arranged around the collaborative working area (48). a control and evaluation unit (28, 36) configured to monitor zone intrusions, wherein the protected zones (38) are arranged in a first sequence, at least two of which are arranged from the first side, such that the worker (46) intrudes into these protected zones one after the other when approaching the collaborative work area (48), and wherein the control and evaluation unit (28, 36) is configured to evaluate the protected zone intrusions and thereby protect the machine (40) in the event of an unacceptable combination of protected zone intrusions, the protected areas (38) are arranged such that at least two of the protected areas (38) are arranged in a second sequence from the second side, such that the machine (40) enters the protected areas (38) one after the other as it approaches the collaborative work area (48); A surveillance device comprising:

Images