Incorporating cobots safely

The key to keeping collaborative robots (cobots) safe is to carefully consider the risks involved and configure the robot and its control system to mitigate potential hazards. Fortunately, technical specifications are now available to help guide developers along the path to safety.

This article looks at the advantages of adding cobots to a working environment and points out the safety concerns before describing the recent regulatory guidelines and presenting risk assessment and mitigation strategies. It then introduces cobots with built-in safety mechanisms that allow them to be safely added to any production or workflow environment.

Why add collaborative robots?

Industrial robots in major manufacturing facilities have long proven their worth in terms of increasing production throughput while reducing costs. Now compact, generalised industrial robots are bringing such benefits to mid and small scale production. Unlike their larger scale counterparts, however, compact robots are designed to operate in cooperation with their human operators rather than in isolation (Figure 1). The two share a workspace, helping to minimise the robot’s use of valuable production floor space and improve its cost effectiveness.

Like all powered machinery, these cobots have the potential to cause injury if not utilised properly. Integration of a cobot into a production line then, requires that careful consideration be given to the issue of operator safety. Factors to keep in mind include the robot’s range and speed of motion, the materials it is handling, and the operator’s method and frequency of interaction. Once those are understood, appropriate safety-enhancing features can be incorporated into the system design.

Above: Figure 2. Risk level assessment requires examining the severity and likelihood of possible injuries. (Image source: Richard A. Quinnell)

Regulatory requirements from organisations such as OSHA (Occupational Safety and Health Administration) in the US, CCOHS in Canada, and the European Commission, mandate some elements of cobot operational safety. OSHA 29 Code of Federal Regulations (CFR) 1910, for instance, calls for systems to lock out hazardous energy sources during servicing operations (Section 147) and to prevent electrical shocks from occurring during operation (Section 333). Such regulations, however, were developed to apply to all forms of industrial machinery and have not necessarily kept pace with technology. There is relatively little regulation specific to industrial robots in general or cobots in particular.

Industry has filled the gap, however, by developing several technical standards specific to industrial robots. These include the IEC 61508 standard on functional safety, the ISO 12100 standard on design for machine safety, and the ISO 10218-1 and -2 standards on safety for industrial robots.

Above: Figure 3. Robot human contact - accidental or anticipated - falls into two categories: transient and quasi-stationary. (Image source: Richard A. Quinnell)

Most recently, industry has released the ISO/TS 15066 technical standard on collaborative robot safety. Only some sections of these standards are defined as requirements for robotic system design. The rest are recommendations that provide developers and operators with detailed guidelines for ensuring safe interaction of robots and humans.

Cobot risk assessment

The road to cobot safety begins with a careful risk assessment of the intended robotic operation and usage model - not just of the robot itself, but the entire application and operating environment. A robotic system handling sharp-edged sheets of metal, for instance, creates different risks than those of a system handling cardboard boxes. Similarly, risk assessment for a robot equipped with a gripper will differ from that of a robot with a drill or soldering iron.

Thus, developers must fully understand the system’s scope of operations, the robot’s movement characteristics, the workspace and workflow, and other similar factors in order to identify the potential risk sources in robot operation. These sources include any possible robot-human interaction - whether intended, inadvertent, or resulting from equipment failure - that might result in an injury of some kind.

Once the risks are identified, each must be evaluated. This evaluation categorises each such interaction as a negligible, low, medium, high, or very high risk using three key criteria:

• Severity of potential injury
• Frequency and/or duration of exposure to the hazard
• Probability of avoiding the hazard

A representative risk evaluation tree is shown in Figure 2. The severity of injury ranges from minor, such as cuts or bruises that completely heal in a few days, to serious, resulting in permanent damage or death. Exposure ranges from low (occasional) to high (frequent or continual), and avoidance probability ranges from likely to not possible. Evaluators can quantify these criteria in their own way to reflect their specific circumstances.

Above: Figure 4. Speed and separation monitoring identifies zones around the robot that define its safe operation. (Image source: Richard A. Quinnell)

One of the insights that ISO/TS 15066 has brought to the industry, however, is a quantitative definition of physical contact between robot and human that is non-injurious. This definition is especially important in cobot applications, where physical contact is highly likely or even intended. The standard defines two types of contact: transient and quasi-static (Figure 3).

Situations in which the human can readily move away from contact with the robot, such as a robot part bumping against the operator’s arm, are considered transient. When the human is trapped between the robot and a fixed object, such as a robotic gripper pressing the operator’s hand against the tabletop, the contact is considered quasi-static.

Above: Figure 5. Workspace design can create inherent safety zones. (Image source: Richard A. Quinnell)

The limits for force of contact in a cobot application are based on the human threshold of pain. Collaborative robots must be configured so that any contact, intended or otherwise, will be below the pain threshold. Force limit values vary depending on what body part is involved. Head contact has a much lower pain threshold than arm contact, for instance. Further, quasi-static contacts have lower thresholds than transient contacts.

Once risks have been identified and evaluated, the critical question to ask for each is, “Is this an acceptable level of risk?” In most cases, a negligible or very low risk is tolerable and everything else will require one or more forms of mitigation. Choosing an appropriate form of risk mitigation followed by re-evaluation of the risk are thus the next steps along the road to robot safety, to be repeated until all risks have been reduced to acceptable levels.

Risk mitigation avenues

Some of the most preferred methods for risk mitigation include redesigning the process or layout of the robotic workspace to eliminate the hazard or to minimise exposure by limiting human interaction with the robot. Traditional industrial robot applications have limited human-robot interaction by using cages to keep humans out of the robot’s workspace with interlocks to shut down the robot when a human enters the workspace. For cobot applications, where robots need to share a collaborative workspace with humans, other methods are needed.

The industry has identified four key approaches for collaborative robot-human interaction:

• Safety-rated monitored stop
• Hand guiding
• Speed and separation monitoring
• Power and force limiting

Developers will need to determine which approach or combination of approaches best fits their application.

Above: Figure 6. Compact industrial robots such as the KUKA Agilus KR 3 are designed with safety as a major consideration and can safely share workspace and collaborate with human operators if industry standards are followed during setup. (Image source: Kuka Robotics)

The safety rated monitored stop works well in applications where the operator interacts with the robot only under specific conditions, such as loading or unloading the robot’s end-effector or performing inspections on work in progress. In this type of interaction, the robot operates autonomously within a protected workspace that is monitored to detect any human presence. The human operator initiates a safety-rated stop before entering that workspace, and while the operator is within the workspace, the robot remains powered but stationary. When the operator exits the workspace, the robot automatically resumes its autonomous operation. Should someone enter the monitored workspace without initiating the safety-rated stop, the system will initiate a protective stop that will shut down system power.

In the hand guiding scenario, the operator initiates a safety-rated stop before entering the robot’s workspace, then goes on to use a hand guiding mechanism to reposition the robotic arm before triggering the robot’s next operation. The hand guiding mechanism may involve simply grasping the robot arm and manipulating it, or it can involve the use of a handheld control device to command the robot’s motion. An application such as robotic lift assistance can utilise a hand-guided collaboration.

Above: Figure 7. The KUKA robot kits include a smartPad touch operator panel to enable hand-guided control where appropriate. (Image source: KUKA Robotics)

Speed and separation monitoring are useful in situations where the operator and robot frequently share the same workspace and the operator is able to move freely within that space. In this scenario the system monitors the human’s distance from the robot, working to maintain a minimum protective separation distance at all times (Figure 4). When the two are at a safe separation distance - so that there is no possibility of contact - the robot is free to move at full speed. Should the separation lessen, the robot continues working but slows, serving to reduce the effort required to bring the robot to a complete stop. When the separation becomes too small, the robot comes to a safety-rated stop to ensure that there is no possibility for it to cause an injury.

Defining the distances for each stage in this approach requires understanding the robotic system’s movement capabilities. The system should be designed so that once the monitors detect a human moving toward the protected space, the robotic mechanisms come to a complete stop before the human can reach that space. In order to calculate suitable separation distances, developers need to know:

• How fast the robot and human move
• The system’s reaction time to detect the potential intrusion
• How long it takes for the robot to stop moving after it receives a command

The workspace layout can help simplify the definition and monitoring of safety zones for the speed and separation monitoring approach. In one example, the layout creates inherent safety zones (Figure 5). A workbench separates the human from the robot’s operating space, in which the robot can freely move at full speed. The robot can automatically reduce speed when it enters the collaborative areas at the sides of the workbench, which are laid out to limit opportunities for quasi-static contact. The reduced speed minimises risk in this area by reducing potential transient contact force and maximising the opportunity for avoiding any hazards.

Mechanical stops can prevent the robotic mechanism from ever entering the human’s operating area, eliminating risk. Such an arrangement would require only minimal monitoring of the robot’s operating space for human intrusion to ensure a high degree of system safety.

The power and force limiting approach is especially useful in applications where human-robot contact is highly likely. To use the approach, the robot must be capable of sensing when unusual forces have been applied to the mechanism so that it can detect and react to contact. The robot should also be designed to minimise potential contact force, such as by avoiding sharp edges and pinch points, incorporating surface padding, and limiting movement speed.

The application should be designed so that contact is infrequent and avoidable, with care taken to evaluate what types of contact (transient or quasi-static) might occur and what body parts might be involved. The application design should also aim to minimise the opportunities for quasi-static contact and prevent contact with head, neck, or throat altogether.

Robotic system safety features

Developers selecting a robot for a collaborative application should keep in mind how they might implement one or more of these mitigation methods. The robot’s physical design as well as the systems that control it are all factors to evaluate in determining how readily safety measures can be implemented. Typically, however, robot vendors have worked to make their systems safety ready.

For example, the Agilus robot kit family from KUKA, includes a smartPAD touch operator panel for hand-guided control and the KR C4 system controller with integrated safety features. The optional KUKA.SafeOperation software completes the package. The kit’s arms come with various reach lengths, including 540mm (KR 3 R540), 900mm (KR 6 R900-2), and 1,100mm (KR 10 R1100-2) (Figure 6).

All three robots are designed with rounded surfaces under energy absorbing padding to minimise the pressure of contact. Joints are covered to eliminate any pinching hazards. The robots also offer adjustable mechanical stops for key movement axes so that developers can physically restrict the robot’s operating space.

The included smartPAD helps address applications where hand-guided operation is required (Figure 7).

Above: Figure 8. Developers can refine position related safety monitoring using KUKA.SafeOperation software with which they can define an operating area and model end-effector tools. (Image source: KUKA Robotics)

The KR C4 controller comes with integrated safety software that includes routines for implementing safety-rated and emergency stops as well as an ability to monitor industry standard external sensors, establishing a safety fence. In addition, the software can internally monitor the robot’s position and movement around any of its motion axes.

KUKA.SafeOperation software enhances this internal monitoring by allowing developers to define a fixed operating cell: a convex polygon with three to ten corners outside of which the robot should never move (Figure 7). In addition, developers can define up to 16 monitoring spaces within that cell using either Cartesian or axis-specific coordinates.

To further refine position-related safety monitoring, the SafeOperation software allows users to model the end-effector tool on the robot’s mounting flange as a collection of up to six user-defined spheres. These spheres move with the robot arm. If the arm or the tool spheres move into or out of the monitoring spaces during operation, the software will respond. Possible responses include signaling an alarm, slowing the robot’s motion, or implementing a safety stop. Developers can thus readily control how the robot behaves anywhere within its range of motion.

Such features simplify the implementation of risk mitigation schemes, but do not in themselves ensure safe human-robot interaction. Developers seeking to integrate a robotic system into their production workflow, especially in a cooperative application, must do the work of risk assessment and mitigation, much of which will be specific to their application. This effort includes following all manufacturer guidelines and restrictions, properly training users, and implementing monitoring systems and barriers as needed.

Conclusion

Robots and cobots are an increasingly welcome part of manufacturing and other workflows but do present potential hazards that industrial automation developers must take into account. While newly developed standards for robot safety do help, the availability of robotic systems that have been built from the ground up with safety as a prime consideration makes the integration of robots into a workflow much easier and safer.