Method and apparatus for assuring safe work.

Background of the Invention

(1) Field of the Invention

0001The present invention relates to a method and an apparatus for assuring working safety. More particularly, this invention pertains to a method and an apparatus which can surely provide safe work environments for workers.

(2) Description of the Related Art

0002For works involving a working system which permits the movable section of a machine and men to work cooperatively, gas facilities which are accompanied by explosion and other similar facilities, it is extremely important to keep safety measures for workers.

0003When men and machines alternately work in common work space, accidents may occur when the movable section of a machine collides or hits against part of a worker's body and energy the machine has is transmitted to the worker's body. For example, in the case where a man carries work in the work space and a robot processes it, an accident is likely to occur when the arm of the robot hits against part of the man's body.

0004A typical conventional safety assuring system for use in such a working system is designed in such a way that an optical signal from an optical radar sensor is emanated onto the working area of the movable section of a machine, and any work involving the movable section of the machine will be stopped when the optical signal is reflected by a worker and received by the sensor, which indicates the presence of a dangerous environment. That is, the conventional safety assuring system is realized based on the concept that work on the machine side should be terminated upon detection of a dangerous condition or environment (man or men present in the work space).

0005With the use of such a conventional safety system, however, when the signal-emitting section of the optical radar sensor fails for some reasons and the optical signal is not sent to the working area, the optical signal will not be received even if a worker or workers are in the working area of the movable section of a machine. In this case there involves a problem that erroneous discrimination that no workers are present is made, so that the work of the machine's movable section continues, resulting in dangerously erroneous status. In other words, there are some situations the conventional safety system cannot cope with to provide safe work environments for workers.

Summary of the Invention

0006It is therefore an object of the present invention to provide a method and an apparatus for surely assuring safe works.

0007To achieve this object, according to a safe work assuring method of the present invention, to assure safety of a worker in a work space where the worker works in cooperation with a machine, with an output energy status expressed as a binary variable represented by logical values 1 and 0, generation of work executing energy on the machine side for the work space is permitted only when a work enable signal of a logical value of 1 corresponding to a high energy status is generated.

0008Since the present method is designed such that work executing energy on the machine side for the work space is generated only when the work enable signal of a logical value of 1 corresponding to the high energy status is issued, the work enable signal for the high energy status will not be generated even when a sensor for detecting safety fails. In this way collision of a machine with men can be prevented, thus surely assuring safe work environments.

0009The work enable signal may be generated only when the sensor detects a safe status in which no workers are present in the work space or when the sensor detects a safe status in which a worker is in safe space other than the work space.

0010Further, the sensor may be designed to detect a safe status upon reception of an input of a logical value of 1 corresponding to the high energy status, and the work enable signal to be generated by the sensor does not include a logical negation. In this case, when the sensor fails, the sensor will be prevented from producing an output of a logical value of 1 corresponding to the high energy status.

0011Furthermore, the method may be modified in such a way that given that information representing a safe status and a dangerous status are expressed respectively by binary logical values of 1 and 0, an energy status received by the sensor and safety information to be sent based on the energy status coincide with each other as a logical value of 1. This will result in further improvement of the fail-safe.

0012A safe assuring apparatus according to the present invention comprises a sensor for detecting a safety of a worker and generating a work enable signal of a logical value of 1 corresponding to a high energy status to permit working of a movable section of a machine, given that an output energy status is expressed as a binary variable represented by logical values 1 and 0; and a logical product element for sending a drive signal of a logical value of 1 corresponding to a high energy status for the movable section of the machine to the machine side as an output signal for generation of work executing energy only upon reception of the work enable signal of a logical value of 1 from the sensor.

0013With this arrangement, the sensor generates a work enable signal of a logical value of 1 corresponding to a high energy status when detecting the safety of a worker in the work space, and the logical product element sends a drive signal for the movable section of the machine to the machine side as its output signal for generation of this work executing energy only upon generation of this work enable signal. When the sensor fails, therefore, the sensor output represents a low energy status so that the movable section of the machine will not be driven, thus assuring safe work environments.

0014The sensor may be designed to detect the safe status upon reception of a logical value of 1 corresponding to the high energy status and output the work enable signal without involving a negation circuit. Even if the sensor fails, the sensor is prevented from producing an output of a logical value of 1 corresponding to the high energy status.

0015The logical product element may be designed to produce an output only when an input signal of a higher level than that of a power supply voltage is applied to two input terminals of the logical product element. This can provide such a fail-safe measure that the logical product element will not generate an output of a logical value of 1 corresponding to the high energy status whatever failure occurs in the logical product element, thus ensuring higher safety.

Brief Description of the Drawings

0016<ul id="ul0001" list-style="none"><li>Fig. 1 is a diagram illustrating a model of a man/machine working system to which the present invention is applied;</li><li>Fig. 2 is a diagram showing a system structure that can ensure safety in the working system;</li><li>Fig. 3 is a model diagram exemplifying how to realize a safety system according to the present invention;</li><li>Fig. 4 is a diagram for explaining the structure of a sensor which cannot be employed in the present invention;</li><li>Fig. 5 is a diagram of the basic structure of a proper sensor for use in the present invention;</li><li>Fig. 6 is a circuit diagram of a logical product calculating circuit illustrating one embodiment of a logical product element of Fig. 3;</li><li>Fig. 7 is a diagram showing the structure of one embodiment of a fail-safe sensor;</li><li>Fig. 8 is a diagram depicting the structure of another embodiment of the fail-safe sensor;</li><li>Fig. 9 is a diagram illustrating the structure of a further embodiment of the fail-safe sensor; and</li><li>Fig. 10 is a circuit diagram illustrating an embodiment of an amplifying circuit and a rectifying circuit to make the sensor fail-safe.</li></ul>

Detailed Description of the Preferred Embodiment

0017A method and an apparatus for assuring safe work according to the present invention will be understood from the following detailed description of a preferred embodiment.

0018The embodiment will be explained with reference to a man/machine working system in the case where men and machines alternately work in common work space.

0019Fig. 1 shows a model of the man/machine working system according to this embodiment. "Work space" means the space where men (workers) and a movable section of a machine, such as the arm of a robot, alternately work; for example, worker carry work in this space and the machine processes it. "Machine space" and "man space" mean safe space, i.e., space where the movable section of the machine will not collide against the workers or is kept by a safe distance away from the latter.

0020To prevent collision between men and the machine's movable section, the above man/machine working system should be so designed that men enter the work space while at least the machine's movable section is out of the space, or vice versa.

0021Fig. 2 illustrates a model of this safe work assuring system.

0022Mx, Po, Hx, and Ho are binary logical variables. Mx indicates an intention that the movable section of a machine in the machine space will move to the work space in response to a command ("1" for the presence of the intention and "0" for no intention). Po represents work executing energy of the machine's movable section in the work space ("1" for energy present and "0" for no energy). Hx indicates an intention that men in the man space will move to the work space ("1" for the presence of the intention and "0" for no intention), and Ho work executing energy of men in the work space ("1" for energy present and "0" for no energy).

0023For a man to enter the work space and begin working (Ho = 1), a sensor Sh should detect that the machine's movable section is not working in the work space, then a work enable signal (logical value of 1) from the sensor Sh is compared with the work intention of the man, Hx = 1, by means of a logical product element Gh, and the human intention Hx = 1 is output as Ho = 1. In this case, the sensor Sh is the eyes of the man, and the logical product element Gh is the man's brain. For the machine's movable section to move in the work space to do the required work (Po = 1), a sensor Sm should detect that nobody is working in the work space, then a work enable signal Pe(Pe = 1) from the sensor Sm is compared with the intention of the machine's movable section, Mx = 1, by a logical product element Gm, and the intention of the machine's movable section Mx = 1 is output as Po = 1. The intention Mx of the movable section of the machine means, for example, a work command issued from a controller provided on the machine side.

0024Suppose that men will not risk themselves if they know that the work is actually dangerous. To ensure safe work environments, it is inevitable that the movable sections of machines are designed to execute their own work only when men are not working in the work space, i.e., only when the work enable signal (logical value of 1) is sent from the sensor Sm. In other words, the structure shown in Fig. 3 is necessary to realize a safe working system which can assure the safe work environments. In Fig. 3, the work enable signal Pe is determined based on received information of safety in the work space; Pe = 1 (energy present) when safe or nobody is in the work space, and Pe = 0 (no energy) when it is dangerous to work or when men are in the work space.

0025How to design a sensor for the safe working system shown in Fig. 3 will be described below referring to Figs. 4 and 5.

0026Suppose that information indicating safety (safety information) is represented by a binary logical variable S, and that "S = 1 means a safe status and "S = 0" a dangerous status.

0027In Fig. 4, S is the negation of the logical variable S that indicates the safe status (S = 1 indicates a dangerous status with energy present, while S = 0 means a safe status with no energy). A sensor S_m1 and a negation circuit N constitute the sensor Sm in Fig. 3.

0028With the above-described structure, the sensor S_m1 detects the dangerous status (S = 1), and the detection resultant (S' = 1) is negated by the negation circuit N. Based on the negation result (S = 1), an output signal, Pe = 0, is generated.

0029If the negation circuit N is normal when the logical value of the input signal to the negation circuit N becomes "0", the work enable signal Pe = 1 indicating the safe status is output. This signal output is also generated when a line I that connects the sensor S_m1 to the negation circuit N is disconnected. Specifically speaking, according to the sensor structure shown in Fig. 4, the work enable signal Pe = 1 indicating the safe status may erroneously be produced if a failure occurs on the input side of the negation circuit N fails.

0030Referring to Fig. 5, a sensor S_m2 detects information of the result of negating the dangerous status S in the negation circuit N, and outputs the work enable signal Pe as the detection result. The sensor S_m2 corresponds to the sensor Sm in Fig. 3.

0031The sensor S_m2 detecting the negation of the dangerous status S means the direct detection of the safe status (S = 1) by the sensor S_m2. In this case, if the sensor S_m2 is designed to always output the signal Pe = 0 when it malfunctions (i.e., the sensor S_m2 is designed fail-safe), the work enable signal Pe will be Pe = 0 when a failure occurs on the input side of the sensor S_m2 and the work enable signal Pe to permit the machine's movable section to do its work will not erroneously be Pe = 1 as shown in Fig. 4. Provided that the sensor S_m1 is designed fail-safe in Fig. 4, if the sensor S_m1 fails and erroneously gives an output S' = 0, the work enable signal Pe = 1 will be output regardless of the input signal S to the sensor.

0032In other words, in the safe work assuring system in Fig. 3, the sensor Sm needs to directly detect the safe status (S = 1), the sensor Sm must not erroneously output Pe = 1, and the logical product element Gm must not erroneously output Po = 1. Referring to Fig. 3, the logical variable S indicating the safety information, the work enable signal Pe and the output signal Po should have such a relationship (unate logical relationship) that at least the logical value will not erroneously become "1".

0033On the other hand, the intention on the machine side, Mx, is allowed to erroneously become "1" if if the logical product element Gm has such a characteristic that it will never transfer Mx = 1 as Po = 1 even when malfunctioning. That is, provided that the work space in which the safety should be secured is in the safe status (S = 1), even if Mx = 1 is erroneously generated, resulting in the output Po = 1, there will occur no real damage; at least no accidents will occur. As described above, with the work enable signal Pe = 0 (the work space is not safe), even when the logical product element Gm malfunctions, to have this particular characteristic, the two-input logical product element Gm should at least be designed never to output Po = 1 by a single input signal. In this respect, a C-MOS type two-input logical product circuit which is used for ordinary logical operations may produce an output of a logical level corresponding to a high energy status when it fails, or may generate an output signal indicating the high energy status even if only one of its two input signals is available. This type of logical product circuit cannot therefore serve as a logical product element in the safety system shown in Fig. 3.

0034Fig. 6 illustrates an embodiment of a logical product calculating circuit that can serve as the logical product element in Fig. 3.

0035Referring to Fig. 6, R1 to R5 denote resistors, Q1 to Q9 transistors, D, D1 and D2 diodes, and C1 and C2 capacitors. Reference characters E is the power supply voltage of the circuit, 1 and 2 represent input terminals, and OUT denotes an output terminal.

0036The operation of this calculating circuit will be briefly described below. When no input voltage is applied to the input terminals 1 and 2, the transistors Q1 and Q5 are in an ON status. When a predetermined voltage is applied to both input terminals 1 and 2, the transistors Q1 to Q7 are repeatedly turned on and off in a specific order to cause oscillation: Q1 OFF - Q2 OFF - Q3 ONE - Q4 OFF - Q5 OFF - Q6 OFF - Q7 ON - Q1 ON - Q2 ON - Q3 OFF - Q4 ON - Q5 ON - Q6 ON - Q7 OFF - ... The oscillation output is transferred via the diode D to the transistors Q8 and Q9 for amplification. The amplified output is sent to a voltage multiplying rectifier, constituted by the capacitors C1 and C2 and diodes D1 and D2, and is superimposed on the power supply voltage E there. The resultant output is sent as a DC output through the output terminal OUT. The oscillation condition of this circuit is such that, with V1 and V2 being respectively input voltages to the input terminals 1 and 2, V1 and V2 should satisfy the following.<maths id="math0001" num=""><img file="EP0467082A2_D0001.tif" /></maths>

0037From the above, it is understood that the circuit has a logical product calculating function. In addition, this oscillation circuit has a characteristic that it cannot oscillate when any of the resistors R1-R5 is cut or any of the transistors Q1 - Q9 fails. In other words, the oscillation circuit has a fail-safe characteristic that it will not provide a DC output is no input signals are applied to both of the two input terminal, and will not produce an output in response to the input signal to one of the input terminals alone. The reason to superimpose the amplified output on the power supply voltage E in the rectifying circuit is to provide the input condition to permit the output from the logical product element to oscillate at the subsequent stage when the same logical product elements are cascade-connected.

0038Figs. 7 and 8 illustrate embodiments of the sensor for detecting safety information.

0039Fig. 7 shows an embodiment of the sensor in the case of directly monitoring the status of space (work space) the safety in which should be secured.

0040Referring to this diagram, the sensor comprises a light-emitting unit 13, a light-receiving unit 16 and a rectifying circuit 17. The light-emitting unit 13, including an oscillator 11 and a light-emitting element 12, emanates an AC light beam into the work space X the safety in which should be assured. The light-receiving unit 16, including a light-receiving element 14 and an AC amplifier 15, receives the light beam from the light-emitting unit 13 and produces an output. The rectifying circuit 17 rectifies the AC output from the light-receiving unit 16 and produces a DC output signal Pe.

0041With the above sensor structure, when an obstruction, such as a worker, is present in the work space X, the light beam from the light-emitting unit 13 is shielded by the worker and will not reach the light-receiving unit 16, rendering the output signal Pe = 0. When the worker is not in the work space X, the light beam from the light-emitting unit 13 will reach the light-receiving unit 16, providing the output signal Pe = 1.

0042In contrast to the above embodiment in Fig. 7 for directly monitoring the status in the work space X the safety in which should be secured, the embodiment shown in Fig. 8 is designed for the case of detecting if any man returns to the man space Y or indirectly monitoring the work space X. Like reference numerals as used in Fig. 7 are used to denote corresponding or identical elements in Fig. 8 to avoid their otherwise redundant description.

0043In this case, when no worker is in the man space Y, the light beam from the light-emitting unit 13 will not be reflected by the worker and will not reach the light-receiving unit 16, providing the output signal Pe = 0. When a worker is in the man space Y, the light beam from the light-emitting unit 13 will be reflected by the worker, reaching the light-receiving unit 16, and the signal Pe = 1 will be output.

0044In short, the safe status (S = 1) means no workers present in the work space X the safety in which should be assured according to the sensor structure shown in Fig. 7, while the safe status (S = 1) means a worker present in the man space Y according to the sensor structure in Fig. 8. In either case, the light beam to be received at the light-receiving element 14 will be received when in the safe status (S = 1) and will become a high energy status.

0045If the sensor having the radar structure shown in Fig. 8 is used in the safety information detecting method shown in Fig. 7, when no workers are present in the work space X or it is in the safe status (S = 1), the light beam from the light-emitting unit 13 will not reach the light-receiving unit 16 and no energy will be received there. If the sensor having the light-penetration structure shown in Fig. 7 is used in the safety information detecting method shown in Fig. 8, on the other hand, when a worker is present in the man space Y or it is in the safe status (S = 1), the light beam from the light-emitting unit 13 will not reach the light-receiving unit 16 and no energy will be received there. In both cases, to provide the work enable signal Pe = 1, a negation circuit is required on the output side of the sensor. The resultant sensor structure is the same as is shown in Fig. 4, which generates the work enable signal Pe = 1 even when the sensor fails to emit light, so that the sensor may dangerously considers the event as a safe status.

0046From the above, in order to constitute a sensor for detecting safety information, the safety information (S = 1 for the safe status and S = 0 for the dangerous status) should coincide with the status of the received energy of the sensor, and it is necessary to use a sensor that detects the safe status in terms of the high energy status. This is apparent from the sensor shown in Fig. 9.

0047The sensor in Fig. 9 is effective in a safety system which cuts off the power supply when the current erroneously flows to the motor to drive the robot's movable section, while the robot maintenance is being conducted by workers in the vicinity of the movable section in a hold status of the robot (status in which the movable section is stopped with power on).

0048The sensor includes an oscillator 21, a resistor R, a saturable magnetic core 22, an amplifier 23, a rectifying circuit 24 and a power line 25 for a motor (not shown) for driving the movable section of a machine. The oscillator 21 generates an AC output. The magnetic core 22 has a primary winding T1 and a secondary winding T2 wound around. The primary winding T1 is connected through the resistor R to the oscillator 21. The secondary winding T2 receives an AC signal running through the primary winding T1. The amplifier 23 amplifies the output of the secondary winding T2. The rectifying circuit 24 rectifies an AC output signal from the amplifier 23. The power lines 25, wound around the magnetic core 22, carries a current I to the motor.

0049In the sensor with the above structure, when the current I is not flowing through the power line 25, the AC signal from the primary winding T1 is received at the secondary winding T2 to generate the output signal Pe. In case that the current I erroneously flows through the power line 25, the magnetic core 22 will become saturated so that the AC signal from the primary winding T1 will not be sent to the secondary winding T2.

0050In other words, in the safe status (S = 1) in which no motor current flows, the input energy to the secondary winding T2 is high, providing the enable signal Pe = 1, while in the dangerous status (S = 0) where the motor current erroneously flows to be likely to move the movable section, there will be no energy, providing the enable signal Pe = 0.

0051Besides the above-described sensor which detects safety information depending on whether or not externally-applied energy is present, there is a direct-acting type sensor which directly detects the energy of a detection target, such as a solar battery, a microphone for extracting noise, or a temperature sensor. Suppose an infrared sensor, one of the direct-acting type sensors, which detects infrared rays irradiated from a human body, is used as the sensor in Fig. 7 or 8. Then, according to the system in Fig. 7 which considers no workers present as the safe status, it is safe when there is no received energy. To represent the safe status by a logical value of 1, a negation circuit is required. Therefore, such a sensor is effective in safety system in Fig. 8 that indirectly monitors space the safety in which should be secured, but cannot be applied to the safety system in Fig. 7 that directly monitors the space.

0052One way to design these sensors fail-safe is to generate an AC signal on the sender side and amplify the AC signal on the receiver side. Fig. 10 illustrates an embodiment of an amplifying circuit and a rectifying circuit on the receiver side in this case.

0053Referring to Fig. 10, C3 to C5 denote capacitors, R6 and R7 resistors, D3 and D4 diodes, and Q10 a transistor. The resistors R6 and R7 and the transistor Q10 constitute an emitter-grounded AC amplifier. The capacitors C3-C5 and the diodes D3 and D4 constitutes a voltage multiplying rectifier. Reference character E is the power supply voltage for the AC amplifier, and reference character a is the output voltage of the rectifying circuit. The work enable signal Pe = 1 when the output voltage a is present, and Pe = 0 when it is not provided. Sc denotes an AC input signal to be input to the amplifier in the light-receiving unit 16.

0054With the above structure, when the resistor R6 or R7, or transistor Q10 fails due to possible line disconnection or short-circuiting, no AC signal will be produced. The output signal of the amplifier (collector output signal of the transistor Q10) is superimposed on the power supply voltage E by the capacitor C4, a constituent of the rectifying circuit. If any of the electrical elements constituting the circuit shown in Fig. 9 fails, therefore, the output signal a of the rectifying circuit will not be produced when no input signal Sc is applied. That is, this sensor has a fail-safe structure.

0055As described above, according to the present invention, the safety of machine-working space is detected by a sensor, a work enable signal to permit the movable section of a machine to move is generated when the safety is confirmed, and the machine's movable section can move only upon generation of the work enable signal. This system will not therefore issue the work enable signal and inhibits the machine's movable section from moving when the sensor fails, thus ensuring safe working environments, as compared with the conventional system which stops moving the machine's movable section upon detection of the dangerous status, and cannot detect the dangerous status when the sensor fails, which may dangerously move the movable section of the machine.