Introducing three-dimensional zone monitoring

In comparison with traditional hinged and sliding machine guards, safety light curtains and laser area scanners are highly advantageous for applications requiring frequent access by operators. Not only is opening a physical guard time-consuming and fatiguing, but maintenance can be hindered by the presence of the guard and its supporting structure.

Nevertheless, light curtains and laser area scanners only monitor a flat plane - though mirrors and/or multiple light curtains can be used to create faceted protection zones. As a result, the protected area is often greater than the hazardous zone, which is a waste of floor space and can also mean that the barrier is triggered earlier than is absolutely necessary, costing valuable process time.

In the world of mass production, where floor space is expensive and time is of the essence, it would clearly be beneficial to have a non-physical safety barrier that can protect a three-dimensional zone closely matching the hazardous zone. And this is exactly what Pilz and DaimlerChrysler have done by developing SafetyEYE, a safety-related sensing and control system that is based on three-dimensional machine vision. The system is being approved to EN 954-1 Category 3, EN IEC 62061 Safety Integrity Level (SIL) 2, and EN ISO 13849-1 Performance Level (PL) 'd' [see note on standards].

The two companies have worked closely together, with Pilz taking overall responsibility for system development and providing the expertise behind the safety functionality, industrial design and programming software. DaimlerChrysler specified the practical requirements, developed the image processing algorithms (building on its experience with automotive collision-avoidance systems) and supported the comprehensive test programme.

System architecture

Each SafetyEYE system comprises a sensing device with three greyscale cameras - to give three-dimensional coverage - with a fibre-optic link to an analysis unit containing high-performance computers and a programmable safety and control system.

Sensing device

The IP65 sensor unit is mounted above the application, enabling a zone to be monitored around a hazard. Maximum coverage would be for a three-dimensional envelope that approximates to a pyramid with a base measuring 12.8 x 9.6m and a height of 10m. Up to a height of 5m, the system can detect a person's body (ie objects >140mm) within the monitored zone. If the sensing device is mounted 5m above floor level, giving a monitored area of 6.4 x 4.8m, the system can detect a person's leg (ie objects >70mm). For detection heights between 1.5 and 2.8m, a person's arm can be detected (ie objects >40mm). It is technically feasible to add finger detection, but the initial market requirement is for body, leg and arm detection only. The lighting requirement is within the range 300-600 lux, which is similar to normal office light levels and therefore not onerous to achieve.

Configuration software

Intuitive drag-and-drop configuration software enables three-dimensional zones to be defined within the overall detection envelope, both as warning and detection (danger) zones. The zones do not have to extend from floor to ceiling and they can be grouped; muting can be programmed to enable parts to be fed into or out of a process. Of course, if the application requirements change, then the zones can be quickly and easily reconfigured in software alone - with no hardware changes necessary. Note that multiple defined user levels ensure that, for example, a maintenance engineer does not have the same program access rights as a developer. During set-up, the developer has access to a live video feed, plus snapshot images can be stored.

The zones are fixed, rather than varying with the position of the robot or other machinery, but dynamic muting and blanking is currently under development. 'Cut' zones can be used to ensure that the presence of a fixed object (a control cabinet, say) does not constitute a breach of the safety zones.

If a person enters a warning zone, an alarm is sounded and the hazardous machinery is slowed down or stopped, depending on the application requirements; if the detection zone is entered, the machine is immediately brought to a standstill.

Depending on the physical layout of the hazards, one SafetyEYE system can monitor multiple machines. A maximum of 16 'arrangements' of zones can be monitored, with an unlimited number of zones per 'arrangement' - and two or more 'arrangements' can share common zones.

A large hazard - such as an automotive body in white on a conveyor - could be monitored concurrently by two SafetyEYE systems to ensure full coverage. While the main emphasis is on the detection of objects that enter the configured zones, it should be noted that the system also detects if a robot or workpiece breaches the programmed working envelope.

Reference marks on the floor or surrounding structure are monitored by the cameras to ensure the sensing device is correctly aligned, and lines would typically be painted on the floor so that operators can see the extent of the warning and detection zones so they can avoid triggering the system unintentionally. An interesting aspect of the system is that any breaches of the warning or detection zones can be recorded by the cameras. While managers may find this useful, trade unions may be less keen to have their members identified in this way.

Analysis unit

Signals from the cameras - at a rate of 20 per second - are analysed by two separate image processing systems running on the analysis unit's two computers, each of which has a different operating system installed. The outputs from the image processing system are then compared by the programmable safety and control unit (a PSS 3047-3 ETH-2 or PSS SB 3057-5 ETH-2 with SafetyBUS p connection), which equates to a dual-channel input being fed to the dual-redundant programmable safety unit. If a breach of the zones is detected by either one of the vision systems, or if there is any discrepancy between the three-dimensional images output from the image processing systems, an appropriate output is issued by the analysis unit to, for example, signal an alarm, reduce the speed of operation or halt the process, depending on the circumstances. The vision system algorithms are set to respond to violations that extend over three successive images, so the response time for the system is 150 milliseconds.

Other safety and non-safety devices can also be connected directly to the analysis unit, such as emergency stop switches and reset buttons.

Currently the analysis unit is equipped with an Ethernet connection for communication and configuration, and a CompactFlash card slot for the easy exchange and backup of the configuration. In the future, the analysis unit will have a SafetyNET port for the exchange of safety-related data with other safety devices or systems.

In addition to processing the safety-related inputs and outputs (I/O), the analysis unit is also able to perform some conventional (non-safety) control functions. For instance, in one application that was trialled, a robot placed components into an oven for heat treatment and then subsequently moved them to a collection bin. The SafetyEYE system created a safety barrier around the robot, and the analysis unit also monitored the amount of product in the bin so that it could be emptied once it was full.

Cost-effective alternative

Despite a purchase price of around 8400 (EUR12,500) per system, SafetyEYE is very cost-effective compared with conventional safety light curtains and laser area scanners. In fact the total cost of an installed and maintained system can be around 70 per cent lower. Most of the difference is accounted for by the fact that a SafetyEYE system can be installed and commissioned in approximately two hours, whereas a conventional safety system would take a whole day or more. Bear in mind that a typical two-robot arrangement might require two safety light curtains and two laser area scanners (to check the areas between the light curtains and the robots are clear), four monitoring units for use with these safety devices, plus fixed guarding to safeguard the areas not protected by the light curtains.

Nonetheless, it has to be remembered that the non-physical barrier presented by the SafetyEYE system shares some of the limitations of light curtains and laser area scanners: it cannot protect workers against broken parts or tools, noise, arc flash, fumes or dust. As such, it is unlikely to replace conventional physical guarding in applications where such hazards are present.

SafetyEYE already has concept approval from BG and full product approval is due to be in place by April 2007. After that, trial systems will be offered to prospective customers, and production systems are expected to be available in September 2007.

The first application for SafetyEYE is on the production line for the new Mercedes-Benz C-Class. Meanwhile, the team developing the SafetyEYE system is looking ahead to future enhancements. One possibility is to distinguish between, say, a human hand and a tool. If this can be achieved, it would pave the way for a human operative and a robot to work in parallel on the same assembly.

Applications outside industry

SafetyEYE was developed primarily to protect workers in the vicinity of robots and other machinery operating in automotive plants, yet the concept is clearly suitable for use in other industries. Moreover, in addition to protecting people from hazardous objects, the system can also be used to protect objects from people. One example that Pilz is exploring is the use of SafetyEYE in museums, art galleries and similar environments where exhibits need to be clearly visible, yet they also need to be protected. A SafetyEYE sensor device could be installed unobtrusively above the item, with warning and detection zones configured as appropriate. It would even be possible to use one SafetyEYE system to simultaneously monitor separate zones around two or more items. The resultant security could be less distracting than traditional barriers and display cases, as well as being more cost-effective and reliable than security guards.

Other potential applications exist in the medical sector, semiconductor production and amusements.

Note on standards

EN 954-1 (and BS EN 954-1) Safety of machinery, Safety-related parts of control systems, Part 1: General principles for design is a key machinery safety standard. Category 3 covers all but the most hazardous machinery.

EN IEC 62061 Safety of machinery, Functional safety of safety-related electrical, electronic and programmable electronic control systems is applicable to systems such as SafetyEYE that utilise programmable controls. SIL 2 is, broadly speaking, equivalent to Category 3 of EN 945-1.

EN ISO 13849-1 Safety of machinery, Safety related parts of control systems, General principles for design is soon to replace EN 954-1. Performance Level 'd' is, broadly speaking, equivalent to Category 3 of EN 945-1.