Non-contact protection in machine collaborative work areas

Abstract

To provide a method for a contactless safeguarding at a cooperation zone of a machine and a monitoring machine.SOLUTION: In a method according to the invention: an access zone for a worker (46) is arranged at a first side of a cooperation zone (48) and a working zone of a machine is arranged at a second side; a plurality of protected fields (38) configured in an environment of the cooperation zone are monitored for protected field intrusions by at least one optoelectronic sensor and at least two of the protected fields are arranged in a first sequence starting from the first side such that a worker sequentially intrudes into these protected fields when approaching the cooperation zone, wherein the protected field intrusions are evaluated to safeguard the machine in the case of an unpermitted combination of protected field intrusions. Further, therein at least two of the protected fields are arranged in a second sequence starting from the second side such that the machine sequentially intrudes in these protected fields when approaching the cooperation zone.SELECTED DRAWING: Figure 8

Description

[Technical Field]

[0001] The present invention relates to a method and a monitoring device for contactless protection in the collaborative working area of ​​a machine according to the preambles of claims 1 and 15, respectively. [Background technology]

[0002] For non-contact monitoring of hazardous objects such as machines in industrial environments, photoelectric sensors are often used to monitor protected areas. Protected areas are sub-areas within the monitored area that must not be reached by the operator while the machine is running. If an unacceptable intrusion into the protected area, such as an operator's leg, is detected, a safety signal is sent to a safe output (OSSD, Output Signal Switching Device), causing the machine to transition to a safe state.

[0003] Sensors used in safety technology must operate with particularly high reliability and therefore must meet high safety requirements, such as those in the EN 13849 standard for machinery safety and the EN 61496 standard for non-contact protective devices (BWS). To meet these safety standards, several measures are taken, such as redundant and diverse electronics for reliable electronic evaluation or the monitoring of various functions, especially the contamination of optical components (including front panels). Such safety sensors and the safety applications implemented with them are assigned safety levels, such as SIL1 to SIL4 (Sicherheitslevel, safety level) or PLA to PLD (Performance Level, performance level).

[0004] To protect a machine, some areas are architecturally isolated using fences or other devices, while the remaining access areas are protected by sensors. A particularly challenging problem arises when repeated access to the protected machine is required during normal operation. An example is a robotic cell in which an industrial robot performs production or logistics steps that require sequential assistance. This involves, for example, the supply and retrieval of materials. In practice, such areas are usually still protected with fences and light grids. A person entering the machine's area is recognized and the machine is accordingly shut off. After completing the work step providing assistance to the machine and leaving the machine's area, the person must manually resume operation, for example, by operating a switch mounted outside the protected area. This is necessary because the sensor cannot reliably determine whether the person has actually left again. Light grids only recognize the passage itself and cannot subsequently determine on which side the person is located. The protection area of ​​a laser scanner cannot cover the entire area in front of the machine at all times, for example, because otherwise the protection area would be activated while the machine was in operation. Furthermore, humans can climb onto fixed objects, such as machine pedestals, and become invisible to the laser scanner, so traditionally, humans are responsible for ensuring that machines do not pose a danger to anyone when they are put back into operation.

[0005] More recently, safety laser scanners and safety cameras are known that can simultaneously evaluate multiple protection zones. However, simultaneous evaluation is very computationally intensive, and only a limited number of protection zones can be implemented in parallel. Furthermore, multiple protection zones do not in themselves solve the aforementioned problems, and the flexibility they provide is not yet fully utilized in most existing protection applications, and in any case, its potential is far from being fully exploited.

[0006] In Patent Document 1, a laser scanner configures multiple monitoring zones that at least partially overlap each other. This results in multiple monitoring segments that are distinguished from each other depending on which monitoring zones overlap. The number of monitoring zones provided on the hardware side is thus subdivided into monitoring segments. This substantially increases the number of potentially available protection zones, but they are still not automatically and intelligently configured thereby.

[0007] Patent Document 2 proposes a safety system that verifies a complex, non-certain evaluation with a less complex, certain evaluation. In one embodiment, on the one hand, the location of an object is determined in a non-certain way based on a scan point cloud. On the other hand, there is a raster of a protected area. The fine position calculated in a non-certain way is verified using the certain raster position.

[0008] Patent Document 3 discloses a photoelectric protection device that monitors which of a plurality of protection zones is violated by an object (protection zone violation) and which protection zone the object leaves (protection zone release). When the protection zone violation and protection zone release occur in a predetermined order, the operation of the equipment is automatically permitted.

[0009] Patent document 4 presents a device for protecting a dangerous area of ​​equipment, which monitors a protection area adapted to the dangerous area. The transition of the movement of an object when leaving the protection area is captured, and if a valid movement transition is recorded, an enabling signal is generated to re-enable the dangerous operation of the equipment.

[0010] In the unpublished European patent application No. 23162023.8, the area in front of the machine is monitored with lower and upper protection zones to distinguish approaching people from vehicles. [Prior art documents] [Patent documents]

[0011] [Patent Document 1] EP 3 470 879 A1 [Patent Document 2] EP 3 709 106 A1 [Patent Document 3] EP 3 153 885 A1 [Patent Document 4] EP 3 575 666 A1 Summary of the Invention [Problem to be solved by the invention]

[0012] SUMMARY OF THE INVENTION In light of the above, the object of the present invention is to improve the protection in machine collaborative work areas. [Means for solving the problem]

[0013] This problem is solved by a method and a monitoring device for contactless protection in a shared working area of ​​a machine, as set forth in claims 1 and 15, respectively. The machine preferably refers to at least one robot. The shared working area refers to an area used by both an operator and a machine, for example, to transfer a workpiece or material in one direction or another, or to perform manual or machine-assisted installation steps. However, this shared access must not occur simultaneously during the machine's movement, because otherwise unwanted contact or accidents could occur, which is the purpose of the protection.

[0014] The common work area is accessible by a worker from a first side beyond the entry area and by a machine from a second side exiting the machine's work area. The first side preferably faces the second side, in which case the machine is behind the common work area from the worker's perspective. Otherwise, the work area is preferably enclosed, i.e., mechanically guarded by a fence or the like, and in that case there may be a separate entry area, also guarded according to the present invention. One example is a robot cell as an isolated work area.

[0015] At least one photoelectric sensor monitors multiple protected zones around the shared work area for intrusions. Protected zones are independently configurable sub-areas within the sensor's detection area. Historically, they're called protected zones, but depending on the sensor type, they may actually be three-dimensional spatial regions. At least two of the protected zones are arranged in a first sequence, starting from the first side. Thus, a worker approaching the shared work area will trigger a protected zone intrusion in each of these protected zones one after the other. Unlike conventional protected zones, a protected zone intrusion does not immediately trigger protection. Instead, there are permitted and prohibited combinations of protected zone intrusions, and the machine is protected only in the case of prohibited combinations.

[0016] The basic idea behind this invention is to add monitoring of the operator-side sequence to monitoring of the machine-side sequence. That is, at least two of the protected zones are arranged in a second sequence from the second side. As a result, machines approaching the common work area will incur protected zone intrusions in the second sequence. Geometrically, it is clear that the protected zones of the two sequences are different. That is, the protected zone of the first sequence on the operator's side is separate from the protected zone of the second sequence on the machine's side. The two sequences meet in the common work area, where, exceptionally, one protected zone can assume a dual role and belong to both sequences. The evaluation of permitted and prohibited combinations of protected zone intrusions now includes the second sequence. Whether the operator should be allowed to approach while the machine continues to operate, or whether the machine needs to be guarded, depends on both the operator's behavior and the machine's behavior.

[0017] In principle, a machine can extend beyond the shared working area and enter the first sequence from its second side. This does not in itself imply an impermissible combination of protected area intrusions, but of course it can be intentionally prohibited as an impermissible combination. Conversely, the same basically applies to the worker and his / her intrusion into the protected area of ​​the second sequence. However, this is preferably prohibited to ensure rear entry protection. Overall, the principle that the worker and the machine always remain on their respective sides in an advantageous manner during the operation of the machine is observed, but the present invention can still be made safety-conscious under certain conditions.

[0018] Preferably, the at least one photoelectric sensor is a safe sensor that appropriately monitors a safe protected area. "Safe" and "safe" as used throughout the specification mean that measures have been taken to limit errors to a defined safety level or to fulfil the provisions of safety standards relating to machine safety or non-contact protective devices (some of which are listed at the beginning). "Not safe" is the opposite of "safe", and therefore non-safe devices, transmission paths, evaluations etc. do not fulfil the above-mentioned requirements regarding error safety.

[0019] The method is a computer-implemented method that runs, for example, in the computing unit of the photoelectric sensor and / or in a connected computing unit. The configuration of the protection zone precedes the contactless protection and is typically performed manually by a safety expert due to the complexity of the safety aspects that must be observed. However, it is conceivable to use automatic assistance, such as proposing the protection zone, or to use a configuration program (e.g. similar to a CAD program) with graphical assistance for fitting geometric objects as parts of the protection zone into an image of the machine's surroundings.

[0020] The present invention has the advantage that cooperative safety can be achieved with relatively simple means. Multiple protection zones can be extended using just one photoelectric sensor. Preferably, two or more sensors can be used to obtain additional perspectives or achieve a higher level of safety through redundancy. This number is always much smaller than in conventional systems, which often require multiple light grids. This saves costs and assembly space. For example, the intelligent protection according to the present invention allows for a more compact robot cell, which is associated with further productivity and cost advantages. The protection of access to collaborative work areas can also serve as rear access protection and can support automatic restart. The machine is only slowed down or even stopped when absolutely necessary.

[0021] Preferably, the photoelectric sensor is a three-dimensional sensor, specifically an optical transit time camera, and the protected area is a three-dimensional protected area. This allows for highly flexible configuration of multiple protected areas and protected area sequences that effectively protect the perimeter of a collaborative work area. These protected areas are three-dimensional spatial regions, thus allowing for tighter gaps and better adaptable monitoring. Note that the traditional term "protected area" remains relevant even in the case of a spatial dimension. The first, secure photoelectric sensor may instead be a laser scanner. However, a three-dimensional camera can be more easily mounted with a suitable viewpoint to monitor the appropriate protected area. Another alternative is an FMCW sensor, which has an even higher dimension due to the additional measurement of velocity components, but can still be considered a three-dimensional sensor.

[0022] Preferably, at least two photoelectric sensors each monitor a portion of the multiple protection zones, with at least one protection zone being monitored by both photoelectric sensors and thus at a higher safety level. Using multiple sensors allows for additional viewpoints, a larger overall monitoring area, or an increased number of monitored protection zones. Highly preferred, exactly two sensors are already sufficient for this purpose, especially if they are 3D cameras. Another advantage is the redundant monitoring of protection zones in the overlapping areas of the two sensors. This allows for even higher safety levels to be reached. For example, two sensors that by themselves only meet PLc (performance level according to ISO TS 62998) can even be combined to achieve PLd. This is also attractive because bringing a device to a higher safety level implies significant costs, which can only be achieved by the manufacturer in a costly development process. Sensor combinations, on the other hand, can be implemented using hardware already available at the user's site.

[0023] Preferably, one protected area includes the common work area. This protects the central area that is routinely accessed by workers and machines. This protected area is particularly preferably monitored by both photoelectric sensors. This achieves an even higher level of safety locally, especially for the overlapping monitored area. Other protected areas, particularly those directly adjacent to the protected area of ​​the common work area, may also be overlappingly monitored and thus have a higher level of safety.

[0024] Preferably, assuming that "inside" refers to the common work area, if a minimum number of protected zones without intrusions remains between the protected zones of the first and / or second sequences, even if intrusions occur from outside to inside, this combination is considered to be an allowable combination of protected zone intrusions. That is, the expected progression according to the rules is that the worker and machine approach the common work area from each side. The order of protected zone intrusions can be enforced up to this point architecturally and by the configuration of the protected zones. A further condition requires that a minimum number of protected zones without intrusions remain between the worker and the machine. This, of course, implicitly enforces a minimum distance, but that's not the only issue. Rather, without this minimum number, it becomes impossible to determine whether the worker and the machine have already met, as will be explained in more detail later. The minimum number can be understood as a buffer of free protected zones between the worker and the machine.

[0025] Preferably, if an intrusion into a protected zone in the first sequence occurs, the machine is no longer permitted to enter the protected zone assigned to that protected zone in the first sequence corresponding to the minimum number, and if it has already entered the assigned protected zone, the machine exits it. That is, when a worker is approaching, the machine is prevented from entering a particular protected zone that would have been permitted if the worker were not present, but is now too close to the worker recognized in the protected zone. As a result, the minimum number of protected zones without intrusion between the worker and the machine is still maintained or restored. The prohibition of entry into the corresponding protected zone is an instruction to the machine control device, as is the possible exit. To avoid the cost of achieving a safety standard in the machine control device, the device itself is preferably not safety. Protective zone monitoring reliably determines whether the machine control device has followed the instructions, so that errors can be addressed by issuing new instructions to the machine control device or, if necessary, by providing machine protection. The determination of which protection zone is the assigned protection zone in each case is either determined together with the protection zone configuration or manually during adjustment of the safety application, for example in the form of a finite automaton as will be described further below, or it is assigned, for example, to the nth adjacent protection zone in the sequence, where n is equal to a minimum number plus or minus a constant.

[0026] If the first minimum number is maintained, the machine continues working without limiting its working speed. The first minimum number is preferably equal to 2. In this case, the buffer of free protection zone is large enough that no danger is imminent. Even if the two get closer and another intrusion into the protection zone occurs, there is still free protection zone between the worker and the machine. At this time, it is possible to continue to identify the locations of the worker and the machine.

[0027] If only a second minimum number, smaller than the first minimum number and preferably equal to 1, is maintained, the worker is preferably warned not to approach the collaborative work area any further. The buffer of free protected area is now too small and there is no longer enough reserve there. In this situation, the machine preferably receives an instruction to exit the protected area as described above in order to restore a larger buffer. However, the worker should pay attention long enough and not approach any further to give the machine enough time to exit. The warning can be in the form of, for example, a display, a lamp color and / or an acoustic signal. However, preferably no protection is provided yet and the machine is allowed to continue working further, preferably as soon as the first minimum number is restored.

[0028] The machine is preferably guarded if the minimum number is not maintained. In the case of multiple, graduated minimum numbers, as in the previous paragraph, the smallest minimum number is meant here. Specifically, now there is no longer any buffer, and the protected zone entered on the operator's side directly borders the protected zone entered on the machine's side. In this situation, it is no longer possible to distinguish whether the operator and the machine remain in adjacent protected zones or whether they are already in the same protected zone and risk contact, and therefore guarding is no longer necessary. Guarding refers to an appropriate reaction to prevent an accident from occurring. This can be a machine slowdown, reversal, or an immediate stop or transition to a safe state. Stop categories can be distinguished according to standard ISO 10218-1. A category 2 stop allows the machine's current supply to remain uninterrupted. Only stop categories 0 and 1 can be used for emergency stops. Preferably, always choose the most conservative form of protection that still guarantees safety. For example, automatic restart, as discussed in the next paragraph, can be combined with a category 2 stop but not after an emergency stop.

[0029] Preferably, the machine automatically resumes operation as soon as the minimum number is restored or there are no more intrusions into any of the protected areas. The machine automatically resumes its work once a sufficient buffer of free protected areas is again created between the operator and the machine. To be on the safe side, this automatic resumption can be subject to a stricter condition: all protected area intrusions have been eliminated in the meantime. It is conceivable to provide independent rear entry protection, such as an additional safety radar or another photoelectric sensor. This prevents a person from entering the work area during protection and then re-entering it unnoticed.

[0030] To evaluate the intrusion into the protected area and therefore the countermeasures to be taken with respect to the machine, a finite automaton is preferably used, whose transitions depend on an additional intrusion into the protected area of ​​the sequence or the end of the intrusion into the protected area of ​​the sequence. The countermeasures are preferably a moving away movement that moves the machine away from the collaborative work area in a second direction, a prohibition on the machine entering a certain protected area, and / or the lifting of the prohibition on the intrusion into a certain protected area. The additional intrusion or the end of the intrusion can also be referred to as an approaching or moving away movement of the operator or the machine. Each state is associated with an instruction to the machine and, if necessary, machine protection. Such an instruction causes the machine to maintain a larger distance to the collaborative work area by prohibiting the machine from entering the protected area, or to temporarily create such a distance by actively retreating. Conversely, when the operator is sufficiently far from the collaborative work area, such a prohibition can be lifted.

[0031] Preferably, the first sequence includes a first protected area α, a second protected area β, and a third protected area γ from the outside in to the collaborative area, which is monitored through a fourth protected area δ, and the second sequence includes a fifth protected area ε and a sixth protected area ζ from the inside out, starting from the collaborative area. This is an advantageous configuration of protected areas that has been carefully designed to provide sufficient protection and flexibility without the unnecessary complexity of multiple protected areas.

[0032] Preferably, two photoelectric sensors monitor five protection zones W, A, B, C, and D. That is, one photoelectric sensor monitors the first protection zone W outside the entry area, the second protection zone A enclosing the area between the first protection zone W and the collaborative work area, and the fourth protection zone C connected to protection zone A within the work area and including the collaborative work area. The other photoelectric sensor monitors the fifth protection zone D outside the work area and the third protection zone B connected to protection zone D, including the collaborative work area, and protruding into the entry area. This is an advantageous configuration in that only two sensors are involved, and each sensor only needs to monitor a very small number of protection zones. Protection zone W may not yet be considered a protection zone, but may simply be considered a warning zone. This is particularly useful when a sensor can monitor only a limited number of protection zones. The warning zone is preferably included in the concept of protection zone here, since it can play the same role within the sequence.

[0033] The monitoring of the two sensors preferably overlaps with one another in at least a fourth protection zone C, so that a higher safety level is achieved here. For example, even PLd can be achieved in protection zone C, even if the sensors themselves are only designed to comply with PLc. The overlapping and the resulting higher safety level can be extended to other protection zones.

[0034] Preferably, the first protection zone W is monitored as the first functional protection zone α, the second protection zone A excluding the third protection zone B as the second functional protection zone β, the third protection zone B excluding the fourth protection zone C as the third functional protection zone γ, the overlapping area of ​​the third protection zone B and the fourth protection zone C as the fourth functional protection zone δ, the fourth protection zone C excluding the third protection zone B as the fifth functional protection zone ε, and the fifth protection zone D excluding the fourth protection zone C as the sixth protection zone ζ. Functional protection zones mean that, from the perspective of the safety application, one protection zone is monitored, but this protection zone does not have to directly correspond to a protection zone defined for one sensor. Rather, the monitoring of the functional protection zone is performed by jointly evaluating intrusions into each protection zone defined for each sensor. These include, in particular, overlapping areas ("AND" conditions for a protected area intrusion) and exclusive areas ("EXCEPT" or "AND NOT" conditions for a protected area intrusion). This joint evaluation effectively allows for more protected areas than the total number of protected areas of the involved sensors, and in particular allows certain protected areas to be monitored redundantly and therefore with a higher security level. The specifically presented allocation combines the two configurations described in the preceding paragraphs. This allows a higher security level to be achieved, preferably for the fourth functional protected area δ corresponding to the collaboration area, and even more preferably for the adjacent third functional protected area γ and / or the adjacent fifth functional protected area ε.

[0035] The monitoring device according to the present invention includes at least one photoelectric sensor for monitoring a preferably safe protected area, which includes a receiver for generating a received signal from the incident received light. Depending on the sensor, the received signal may be, for example, a signal from a photodiode capturing the returning scanning light beam, or the image data of an image sensor, which is generally referred to as the received signal. A control and evaluation unit is responsible for monitoring the protected area and for checking for intrusions into the protected area for impermissible combinations. The control and evaluation unit may be implemented in the sensor and / or in a computing unit connected thereto, in particular in a safety controller connected to the sensor. The safety controller is any hardware-implemented safety evaluation unit, specifically a safety controller as a controller approved for safety applications. A highly advantageous task distribution is to perform the protected area monitoring within the sensor and the evaluation of intrusions into the protected area to recognize impermissible combinations externally. In particular, the monitoring device implements one of the embodiments of the method according to the present invention.

[0036] The invention, together with further features and advantages thereof, will now be described in more detail, by way of example only, on the basis of embodiments and with reference to the accompanying drawings, in which: [Brief explanation of the drawings]

[0037] [Figure 1] Schematic block diagram of a 3D optical transit time camera. [Figure 2] Schematic diagram of a surveillance system with two cameras and one safety control device. [Figure 3] Schematic diagram of the protection zone configuration for the first camera. [Figure 4] Schematic diagram of the second camera protection zone configuration. [Figure 5] 5 is a schematic diagram of the combined two-camera protection zone configuration shown in Figures 3 and 4. [Figure 6] 4 is another top view of the first camera protection zone configuration shown in FIG. 3. [Figure 7]5 is another top view of the second camera protection zone configuration shown in FIG. 4. [Figure 8] Another top view of the combined two-camera protection zone configuration shown in Figure 5. [Figure 9] 9 is a diagram similar to FIG. 8, but showing the protection zones actually monitored by the cameras combined by joint evaluation into more refined functional protection zones. [Figure 10] A schematic diagram of an exemplary situation in which a worker is approaching the machine to be protected while still at a distance, which can also be understood as an exemplary state of a finite automaton. [Figure 11] This is a schematic diagram of a situation in which a worker is approaching the machine to be protected and is already close to it, and can also be understood as another exemplary state of a finite automaton. [Figure 12] A schematic diagram of a situation in which a worker is approaching the machine to be protected when there is no longer any appreciable distance to it, which can also be understood as yet another exemplary state of a finite automaton. [Figure 13] An overview of a finite state automaton illustrating the three states of Figures 10-12 as exemplary examples. DETAILED DESCRIPTION OF THE INVENTION

[0038] FIG. 1 shows a schematic block diagram of a camera 10. The camera is preferably configured as a three-dimensional optical transit-time camera and is described as representative of photoelectric sensors that can be used in connection with the present invention. An illumination unit 12 transmits modulated emitted light 16 through light-emitting optics 14 into a monitoring area 18. The light source can be an LED or an edge-emitting light emitter or a laser in the form of a VCSEL. The illumination unit 12 can be controlled so that the amplitude of the emitted light 16 is modulated at a frequency typically in the range of 1 MHz to 1000 MHz. This modulation can be sinusoidal or square-wave, for example, and in any case, is periodic. Because the frequency limits the range of unambiguity of the distance measurement, a low modulation frequency is required to increase the range of the camera 10. Alternatively, measurements can be performed at two, three, or more modulation frequencies and combined to increase the range of unambiguity.

[0039] When the emitted light 16 strikes an object or person 20 within the monitoring area 18, a portion of it is reflected back to the camera 10 as received light 22, which is then guided through a receiving optical system 24, such as a single lens or a receiving objective lens, to an image sensor 26. The image sensor 26 includes a large number of light-receiving elements or pixels 26a, arranged, for example, in a matrix or line. The resolution of the image sensor 26a can range from two or a few pixels 26a to thousands or even millions. The pixels perform demodulation using a lock-in method. By repeatedly detecting the emitted light 16 and slightly shifting the modulation of the light 16, multiple samples are obtained, which ultimately determine the phase difference between the emitted light 16 and the received light 22, which can then be used to measure the light transit time. Because the pixels are typically arranged in a matrix, lateral position resolution is achieved in the X and Y directions, and a distance measurement in the Z direction is added to this to produce three-dimensional image data. When we speak of a 3D camera, a 3D optical transit time camera or 3D image data, we preferably mean this 3D detection, but in principle other pixel arrangements are also conceivable, such as a line of pixels selected from a matrix or a line of pixels forming the entire image sensor of a line camera.

[0040] A number of protection zones can be configured in the control and evaluation unit 28. The protection zones are defined for sub-regions of the monitoring area 18 by geometric reference values. These reference values ​​are configured by the control and evaluation unit 28, for example in a CAD program or in any other way, or loaded via the interface 30. The protection zones are monitored for intrusions, and a safety output signal is output at the safety outputs 32, 34 in the event of a protection zone intrusion. Preferably, several safety outputs 32, 34 are provided per protection zone, or the output signal is a single safety output that codes each intruded protection zone. Preferably, the camera 10, and in particular the evaluation of the protection zones including the output signals, are safe in the sense defined above.

[0041] The above-mentioned three-dimensional camera 10, in particular a time-of-flight camera, is highly suitable for the protection according to the invention, although other sensors, in particular safety laser scanners, are also conceivable, possibly subject to certain constraints, for example due to boundary conditions on the application geometry.

[0042] FIG. 2 shows a schematic diagram of a monitoring system having two cameras 10a-b, each connected to a safety control device 36. While the combination of multiple cameras 10a-b is highly advantageous, the present invention can also be implemented with a single camera 10a-b. However, as will be explained later, the increased level of safety in overlappingly monitored protected areas cannot be achieved with a single camera 10a-b. The safety control device 36 enables a higher-level evaluation of the intrusions into the protected areas reported by each camera 10a-b. If a danger is recognized, a safety signal is output to the monitored machine or robot. The machine or robot may then slow down or at least divert to a work step that does not pose a risk to the recognized object movement. Only in an emergency is the machine transitioned to a safe state. This achieves high overall availability and productivity. Specific monitoring according to the present invention will be described in more detail later with reference to FIGS. 3-13.

[0043] It is highly advantageous to assign the evaluation functions for recognizing a protected area intrusion and for performing a higher-level assessment of the protected area intrusion in the safety control device 36 to the control and evaluation unit 28 in the cameras 10a-b. The safety control device can be a very simple logic circuit (e.g., in the form of a finite automaton) that does not impose high hardware requirements. However, the present invention is not limited to a specific assignment of evaluation functions to specific hardware components; it can be distributed internally and externally in any way. This includes extreme cases where no independent evaluation is performed within the cameras 10a-b at all, or conversely, where the functionality of the safety control device is integrated into at least one of the cameras 10a-b. Examples of internal computing units include microprocessors or digital computing modules such as CPUs (Central Processing Units), FPGAs (Field Programmable Gate Arrays), DSPs (Digital Signal Processors), ASICs (Application-Specific Integrated Circuits), AI processors, NPUs (Neural Processing Units), GPUs (Graphics Processing Units), and VPUs (Video Processing Units). The external computing unit may be the safety control device 36 already mentioned, or may be any type of computer such as a notebook, a smartphone or a tablet, or may be a local network, an edge device or the cloud.

[0044] Figures 3 and 4 show schematic diagrams of exemplary configurations of the protection zones 38 of the first camera 10a or the second camera 10b for protecting a machine 40, typically depicted as a robot. Figure 5 is an accompanying diagram of a combined protection zone configuration of both cameras 10a-b, superimposed on one another. Figures 6 and 7 show the individual protection zone configurations of Figures 3 and 4 again, viewed from above, and correspondingly, Figure 8 shows the combined protection zone configuration of Figure 5, viewed from above.

[0045] The protected area 38 is shown in cross section in Figures 3-5 and also extends in depth. This is clear from the top views in Figures 6-8. In other words, it is a three-dimensional protected area. The machine 40 is located in a mechanically protected work area 42, e.g., a robot cell, where humans cannot enter. Through an access area 44 protected by the protected area 38, a worker 46 (shown only in Figures 6-8) can reach a collaborative work area 48, where he can, for example, supply or receive workpieces or materials to or from the machine 40.

[0046] The first camera 10a monitors three protection zones W, A, and C aligned in a direction connecting the machine 40 and the approaching worker 46. Protection zone W may simply be a warning zone, i.e., a zone that, like a protection zone, recognizes intrusions and enables corresponding reactions, but unlike a protection zone, does not have any inherent safety features. In the illustrated example, the robot cannot physically reach warning zone W at all, so no protection is necessary. Correspondingly, the second camera 10b monitors two consecutive protection zones B and D. The geometry of the protection zones 38 is somewhat complex to accommodate site realities, e.g., there is a void 50 around the collaborative work area 48. The protection zone monitoring of both cameras 10a-b is combined to form a common protection zone sequence W, A, B, C, and D. This sequence and the contributions of the individual cameras 10a-b can be retraced in the symbolic overview 52 in Figures 6-8, which is added solely for illustrative purposes.

[0047] The protected zones W, A, B, C, and D are simultaneously active. There are regions where the protected zones overlap, achieving a higher safety level. One such region is clearly indicated by dashed line 54 in FIG. 8 . For example, the overlapping of two cameras 10a-b at safety level PLc provides protected zone monitoring at safety level PLd. The protected zones form a first operator-side sequence and a second machine-side sequence. The expected sequence for an approaching operator 46 is WABCD, while the expected sequence for an approaching machine 40 is DCBAW. Preferably, neither sequence allows interference beyond the collaborative work area 48, preventing the machine 40 from reaching protected zone W at all. The safety controller 36 re-examines these conditions (which will be more precisely described shortly) for the current combination of protected zone intrusions. The device allows the machine 40 to continue working without reducing efficiency unless the combination of intrusions into the protected area is completely dangerous, and if the situation is slightly dangerous, it issues an instruction to the machine control device of the machine 40 to prohibit some kind of movement or to exit the machine 40, thereby preventing an actual dangerous situation from occurring, or if necessary, activates the protection of the machine 40.

[0048] FIG. 9 is a diagram similar to FIG. 8, showing the protection zones 38 actually monitored by cameras 10a-b combined through joint evaluation into a more refined functional protection zone. A functional protection zone can be understood exactly like a protection zone, except that the evaluation of the protection zone intrusion may require combining both cameras 10a-b through an overlapping condition ("AND") or an exclusive condition ("EXCEPT"). Such conditions can also be combined. This principle allows the creation of the six functional protection zones shown in FIG. 9, or even more. While functional protection zones allow the maximum number of protection zones simultaneously monitored by cameras 10a-b to exceed the cameras' original specifications, there is no other difference between protection zones and functional protection zones for the present invention. Indeed, for the following discussion, the original protection zone intrusions WABCD are already sufficient. Specifically, Figure 9 shows, as exemplary examples, a first functional protection area α corresponding to protection area "W," a second functional protection area β corresponding to protection area "A excluding B," a third functional protection area γ corresponding to protection area "B excluding C," a fourth functional protection area δ including a collaborative work area 48 as an overlapping area of ​​protection areas "B and C," a fifth functional protection area ε corresponding to protection area "C excluding B," and a sixth functional protection area ζ corresponding to protection area "D excluding C."

[0049] While in Fig. 8 neither the machine 40 nor the worker has entered any of the protected areas 38 and there is clearly no danger, Figs. 10 to 12 show the approaching movement of the worker 46, during which the machine 40 has exemplarily already entered protected areas C and D on its own side. In the situation in Fig. 10, the worker 46 has so far only entered the outermost protected area W. Since the machine 40 is still at a distance from the collaborative working area 48 on its own side, protected areas A and B are still free in the inner part of the common sequence formed by the worker-side and machine-side sequences from both sides. This is again concretely shown in view 52, ​​where an "x" indicates a protected area intrusion.

[0050] The minimum number of two open protected zones between the machine 40 and the worker 46 is deemed non-hazardous, and the machine 40 can continue working without slowing down. However, the machine control preferably receives instructions to keep protected zone B clear in preparation for the expected further approach of the worker 46, i.e., not to approach any further, or even to leave protected zone C as a precaution. The machine control is preferably not safe itself, since a safe machine control is expensive and should not be assumed lightly, at least in safety applications. Therefore, it is quite possible that the machine 40 may still enter protected zone B or, despite instructions, not leave protected zone C. The safety control 36 then considers this to be impermissible, since it has prohibited the machine 40 from remaining in that protected zone. The safety control can then respond by issuing further instructions to the machine 40 or, if necessary, by guarding the machine 40.

[0051] In the situation in Figure 11, the worker 46 has come even closer and is now encroaching on protected area A. Since the machine is not moving, it is likely that it has not received an instruction to first clear protected area C, just in case. The buffer of free protected areas between the machine 40 and the worker 46 has now been reduced to just one protected area B. The minimum number of free protected areas, one, does not yet represent a real danger, since it is clear that the machine 40 and the worker 46 can still avoid contact and are still on each side of each other. However, this could very quickly become a dangerous situation. The worker 46 is therefore warned, for example, by a yellow light instead of the previous green light. The machine receives an instruction to leave protected area C. The warning to the worker 46 serves to hold him back in order to give the machine 40 the time it needs to exit.

[0052] In the situation in Figure 12, the worker 46 has moved even closer and now also encroaches on protected zone B. However, the machine 40 has not yet cleared protected zone C. This is either because the worker 46 entered too quickly or because the machine controller did not follow instructions. Therefore, there is now an intrusion in all protected zones, and there is no longer a buffer of clear protected zone between the machine 40 and the worker 46. Admittedly, the situation shown in Figure 12 is still not dangerous at all; however, the safety controller 36 can no longer identify it. Because there is no buffer of clear protected zone, there is at least a chance that the machine 40 and the worker 46 are in the same location, as viewed at the coarse position resolution provided by the protected zones. Therefore, the machine 40 is protected.

[0053] The machine 40 can now exit the protected area C and also the protected area D, possibly at a slow speed that is safe for humans. The worker 46 can also step back, either immediately or after completing his work step in the collaborative work area 48. This again creates a minimum buffer of two free protected areas between the machine 40 and the worker 46. Once this situation is reached, or, just to be safe, once a larger buffer has been created or there are no more protected area intrusions, the machine 40 can resume operation. This can be done manually, for example, by the worker 46 operating a switch that can only be reached from the outside after verifying that the work area 42 is free. Preferably, operation can be resumed automatically, without the use of a switch or the like, as soon as the aforementioned conditions for the buffer are met again. Depending on the geometrical conditions and the shape and layout of the specific protected areas, this may require additional rear entry protection, for example, using radar or another camera. This prevents the worker 46 or other persons from entering the work area 42 while all protected areas are still otherwise violated and therefore the monitoring equipment is effectively blind to this rear entry.

[0054] Although the minimum numbers of free guard zone buffers given above are very advantageous, they may be deviated from, i.e., a larger minimum number may be required, especially if longer sequences are being formed, consisting of more guard zones, for example, to form very fine-grained sequences.

[0055] Figure 13 shows a schematic diagram of a finite state machine that can be used to assign appropriate countermeasures to possible combinations of protected area intrusions, of which three states shown in Figures 10-12 will be described as exemplary. The states are arranged in columns 1 to 6 according to the approach of the worker 46 to the collaborative work area 48, and in the rows according to the approach of the machine 40. This results in possible states 1a, ..., 6a, 1b, ..., 6d. Three of these states, namely 2c, 3c, and 4c, have already been described as exemplary in Figures 10 and 12 and are accordingly labeled 56 in those figures.

[0056] In each state shown in the table, the invaded protected area is marked with an "x" in the upper right corner. Three regions of the state can be distinguished: the subdiagonal 58 consisting of states 2d, 3c, 4b, and 5a, the first triangle 60 in the upper left half, and the second triangle 62 in the lower right half. In each state within the first triangle 60, there are at least two free protected areas between the machine 40 and the worker 46, so the machine 40 can continue working without losing efficiency, as explained in FIG. 10. In each state on the subdiagonal 58, there is now only one free protected area between the machine 40 and the worker 46 as a buffer, so the worker 46 is warned so that the machine 40 can exit, as explained in FIG. 11. In each state within the second triangle 62, there is no buffer at all between the machine 40 and the worker 46, so the machine is protected, as explained in FIG. 12.

[0057] The most important countermeasure for each situation is thus already apparent: whether protection is necessary (as in the second triangle 62), whether a warning should be issued (as in the subdiagonal 58), or whether the machine 40 can continue working (as in the first triangle 60). The vertical arrows in FIG. 13 symbolically represent other possible countermeasures. The downward arrow indicates that the machine 40 can approach the collaborative work area 48 while being protected. The upward dashed arrow indicates that the machine 40 will perform the preferred exit movement described above if the worker 46 is approaching. The machine 40's exit or the corresponding entry prohibition applies each time to the assigned protected area relative to the newly entered protected area by the worker 46. The key here is to restore the buffer of two free protected areas or to expand the buffer in preparation for the worker's further approach. The horizontal arrows do not represent countermeasures, but rather symbolically represent the behavior of the worker 46, i.e., his approach movement. As previously mentioned, the approaching movement of the worker 46 is not dangerous for the conditions in the first triangle 60. Further approach may trigger protection for the conditions in the sub-diagonal 58, and protection is triggered for the conditions in the second triangle 62.

Claims

1. 1. A method for non-contact protection of a collaborative work area (48) of a machine (40), in particular of at least one robot, comprising: an access area (44) for a worker (46) arranged on a first side of the collaborative work area (48) and a work area (42) of the machine (40) arranged on a second side different from the first side; a plurality of protected areas (38) arranged around the collaborative work area (48) are monitored for protected area intrusions by at least one photoelectric sensor (10); at least two of the protected areas (38) are arranged in a first order from the first side, so that the worker (46) intrudes into these protected areas in turn when approaching the collaborative work area (48) and the protected area intrusions are evaluated, thereby protecting the machine (40) in the event of an unacceptable combination of protected area intrusions, At least two of the protected areas (38) are arranged in a second order from the second side, so that the machine (40) enters these protected areas (38) in order when approaching the collaborative work area (48). A method characterized by:

2. 2. The method according to claim 1, wherein the photoelectric sensor (10) is a three-dimensional sensor, in particular an optical transit time camera, and the protection area (38) is a three-dimensional protection area.

3. 2. The method of claim 1, wherein at least two photoelectric sensors (10a-b) each monitor a part of the plurality of protected areas (38), and at least one protected area (38) is monitored by both photoelectric sensors (10a-b) and therefore at a higher safety level, and in particular one protected area (38) includes the collaborative work area (48) and is monitored by both photoelectric sensors (10a-b).

4. 2. The method of claim 1, wherein, even if an intrusion occurs in the protected areas (38) of the first order and / or the second order from outside to inside, if a minimum number of protected areas (38) without a protected area intrusion remains between the two orders of protected areas (38), where inside refers to the collaborative work area (48), this is considered to be an allowable combination of protected area intrusions.

5. 5. The method of claim 4, wherein, upon an intrusion into a protected area (38) of the first order, the machine (40) is no longer permitted to intrude into a protected area (38) assigned to that protected area of ​​the first order corresponding to the lowest number, and, if the machine (40) has already intruded into the assigned protected area (38), the machine (40) exits therefrom.

6. 5. The method of claim 4, wherein if the minimum number of two is maintained, the machine (40) continues to work without limiting its operating speed.

7. 5. The method of claim 4, wherein if only a minimum number of one is maintained, the worker (46) is warned not to further approach the collaborative work area (48).

8. 5. The method of claim 4, wherein the machine (40) is guarded if a minimum number is not maintained.

9. 5. The method of claim 4, wherein the machine (40) automatically resumes operation as soon as the minimum number is restored or there are no more intrusions into any protected area (38).

10. 10. The method according to claim 1, wherein a finite automaton whose transitions depend on a further intrusion into a protected area (38) or on the end of an intrusion into a protected area (38) is used to evaluate the intrusion into a protected area and therefore the countermeasures to be taken with respect to the machine (40), the countermeasures being an away movement of the machine (40) away from the collaborative work area (48) in a second direction, a prohibition of the machine (40) from intruding into a protected area (38), and / or a lifting of the prohibition of the machine (40) from intruding into a protected area (38).

11. 2. The method of claim 1, wherein the first sequence includes a first protection zone α, a second protection zone β, and a third protection zone γ from outside to inside to the collaborative working area (48), the collaborative working area (48) being monitored through a fourth protection zone δ, and the second sequence includes a fifth protection zone ε and a sixth protection zone ζ from inside to outside starting from the collaborative working area (48).

12. 2. The method of claim 1, wherein two photoelectric sensors (10a-b) monitor five protected areas W, A, B, C, D, i.e., one photoelectric sensor (10a) monitors, in the entry area (44), a first protected area W on the outside, a second protected area A enclosing the area between the first protected area W and the collaborative work area (48), and a fourth protected area C within the work area (42) connected to the protected area A and including the collaborative work area (48), and the other photoelectric sensor (10b) monitors, in the work area (42), a fifth protected area D on the outside, and a third protected area B connected to the protected area D, including the collaborative work area (48), and protruding into the entry area (44).

13. 13. The method according to claim 12, wherein the monitoring of the two sensors (10a-b) overlaps with one another in at least a fourth protection zone C, so that a higher safety level is achieved here.

14. 14. The method according to claim 12 or 13, wherein the first protected area W is monitored as a functional first protected area α, the second protected area A excluding the third protected area B as a functional second protected area β, the third protected area B excluding the fourth protected area C as a functional third protected area γ, the overlapping area of ​​the third protected area B and the fourth protected area C as a functional fourth protected area δ, the fourth protected area C excluding the third protected area B as a functional fifth protected area ε, and the fifth protected area D excluding the fourth protected area C as a sixth protected area ζ.

15. A monitoring device for non-contact protection in a collaborative work area (48) of a machine (40), in particular at least one robot, is provided, the monitoring device having an access area (44) for a worker (46) arranged on a first side of the collaborative work area (48) and a work area (42) of the machine (40) arranged on a second side different from the first side, the monitoring device comprising at least one safety photoelectric sensor (10), in particular a three-dimensional camera, having a receiver (26) for generating a received signal, and detecting, based on the received signal, the presence or absence of a plurality of protection zones (38) arranged around the collaborative work area (48). a control and evaluation unit (28, 36) configured to monitor intrusions into protected areas, wherein at least two of the protected areas (38) are arranged in a first order from the first side, so that the worker (46) intrudes into these protected areas in turn when approaching the collaborative work area (48), and the control and evaluation unit (28, 36) is configured to evaluate the intrusions into the protected areas and thereby protect the machine (40) in the event of an impermissible combination of intrusions into the protected areas; The protected areas (38) are configured such that at least two of the protected areas (38) are arranged in a second order from the second side, so that the machine (40) enters the protected areas (38) in sequence when approaching the collaborative work area (48). A monitoring device comprising:

Images