Method for disconnecting a manual control unit from a multi-axis robot and robot for implementing such a method

Abstract

This method relates to the disconnection of a manual control unit of a multi-axis robot, including a connecting cord for connecting the unit to a controller. The cord includes an input power line and output power line for each of the two cabling circuits of an emergency stop button, and an input power line and output power line for each of the two cabling circuits of a dead man contactor. The method comprises successive steps, in which: a) an operator makes a request to disconnect the unit, b) during a predetermined length of time, the safety controller does not trigger an emergency stop based on the control of the electrical cabling circuits, c) at the end of the predetermined length of time, the safety controller does not trigger an emergency stop if and only if, on the one hand, only one of the two cabling circuits of the emergency stop button is open and, on the other hand, only one of the two cabling circuits of the dead man contactor is open.

Claims

1. A method for disconnecting a manual control unit of a multi-axis robot, the manual control unit including: an emergency stop button, a dead man contactor, a connecting cord for connecting the manual control unit to a robot controller, the connecting cord including: an input power line and an output power line for each of two cabling circuits of the emergency stop button, and an input power line and an output power line for each of two cabling circuits of the dead man contactor, the robot controller including: a central processing unit configured to execute programs for commanding a robot arm, and a safety controller configured to test the two cabling circuits of the emergency stop button and the two cabling circuits of the dead man contactor, and trigger an emergency stop of the robot arm, wherein the method comprises successive steps, in which: a) an operator makes a request to disconnect the manual control unit, b) during a predetermined length of time started upon the disconnection request, the safety controller suspends the control of the two electrical cabling circuits of the emergency stop button and of the two cabling circuits of the dead man contactor so as not to trigger the emergency stop, c) at the end of the predetermined length of time, the safety controller does not trigger an emergency stop of the robot arm if and only if, on the one hand, only one of the two cabling circuits of the emergency stop button is open and, on the other hand, only one of the two cabling circuits of the dead man contactor is open.

2. The method according to claim 1, wherein during step b), an operator connects a stopper to the robot controller in place of the cord, the stopper closing only one of the two cabling circuits of the emergency stop button and closing only one of the two cabling circuits of the dead man contactor.

3. The method according to claim 2, wherein the method further comprises subsequent steps, in which: a′) an operator removes the stopper, b′) during a second predetermined length of time started upon removal of the stopper, the safety controller suspends the control of the two electrical cabling circuits of the emergency stop button and of the two cabling circuits of the dead man contactor so as not to trigger the emergency stop, c′) at the end of the second predetermined length of time, the safety controller triggers the emergency stop if the two cabling circuits of the emergency stop button are open and if the two cabling circuits of the dead man contactor are open.

4. The method according to claim 1, wherein during step a), the disconnection request is done using the manual control unit.

5. The method according to claim 4, wherein the disconnection request order is received by an interface of the manual control unit.

6. The method according to claim 1, wherein during step a), the disconnection request is done using a disconnection contactor connected to the safety controller.

7. A multi-axis robot including a manual control unit that includes: an emergency stop button, a dead man contactor, a connecting cord for connecting the manual control unit to a robot controller, the connecting cord including: an input power line and an output power line for each of two cabling circuits of the emergency stop button, and an input power line and an output power line for each of two cabling circuits of the dead man contactor, the robot controller including: a central processing unit configured to execute programs for commanding a robot arm, and a safety controller configured to test the two cabling circuits of the emergency stop button and the two cabling circuits of the dead man contactor, and trigger an emergency stop of the robot arm, wherein, at the end of a predetermined length of time started upon a disconnection request, the safety controller does not trigger an emergency stop of the robot arm if and only if, on the one hand, only one of the two cabling circuits of the emergency stop button is open and, on the other hand, only one of the two cabling circuits of the dead man contactor is open, wherein the multi-axis robot further comprises a stopper configured, when it is connected to the robot controller in place of the cord, to close only one of the two cabling circuits of the emergency stop button and only one of the two cabling circuits of the dead man contactor.

8. The multi-axis robot according to claim 7, wherein the manual control unit comprises an interface configured to receive the disconnection request.

9. The multi-axis robot according to claim 7, wherein the robot controller comprises a disconnection contactor connected to the safety controller and configured to receive the disconnection request.

Description

(1) The invention will be better understood upon reading the following description of a multi-axis robot and a method for disconnecting a manual control unit from such a robot, provided solely as an example and done in reference to the appended drawings, in which:

(2) FIG. 1 is a diagrammatic view of a multi-axis robot according to the invention;

(3) FIG. 2 is a diagram of the cabling of a manual control unit of the robot of FIG. 1 to the safety controller; and

(4) FIG. 3 is a cabling diagram of a stopper of the robot of FIG. 1.

(5) The arm B of the multi-axis robot R shown in FIG. 1 is provided with degrees of freedom, for example six, each commanded by a motor able to move a moving part of the robot arm B around geometric axes, to move a tool O in space. The motors are for example brushless three-phase motors. Each motor cooperates with an electromagnetic brake.

(6) Position sensors or encoders are distributed in the robot arm B and make it possible to measure movement information relative to the degrees of freedom, for example the angular position of the moving parts around each of the axes.

(7) Alternatively, the sensors measure the speed or acceleration of the moving parts, or a combination of movement information from among the position, speed and acceleration.

(8) The robot arm B is controlled by a robot controller C positioned in a cabinet A separate from the robot arm B. The cabinet A in particular contains a central processing unit 2, power inverters V and a safety controller 5. These three elements 2, V and 5 communicate with one another by means of a shared bus 100.

(9) A connection/disconnection contactor 6 of the manual control unit 10 is electrically connected to the safety controller 5. This contactor 6 is accessible from outside the cabinet A of the robot controller C and allows an operator to send a disconnection order to the robot controller C.

(10) The central processing unit 2 is configured to execute programs for controlling the robot arm B. It generates the trajectory of the tool O from movement orders. The central processing unit 2 also computes angular positions to be reached for each of the degrees of freedom of the robot arm B, by applying a kinematic model associated with the robot arm B, as well as computing angular positions to be reached for each motor, taking any reductions and couplings into account. These position set points of the motors are sent to the inverter V of each motor.

(11) The inverters V supply electricity for the phases of the motors and incorporate a torque cutoff function.

(12) A manual control unit 10 communicates with the central processing unit 2 by means of an Ethernet link formed by a cable 11, and includes an interface for communicating with an operator, such as a touchscreen 101. This interface 101 allows an operator to send command orders to the robot R and receive operating information from the robot R, for example the position of the tool O. The manual control unit 10 has an emergency stop button 10A and a dead man contactor 10B. The emergency stop button 10A and the dead man contactor 10B are separately connected to the cabinet A, using two separate electrical connections 12 and 13.

(13) All of the electrical connecting cables 11, 12 and 13 between the manual control unit 10 and the robot controller C are gathered in a single cord 1 provided at its free end with a first connector 81, designed to be connected with a second connector 82 of the manual control unit 10, situated on the cabinet A of the robot controller C.

(14) As shown in FIGS. 2 and 3, the electrical connections 12 and 13 of the emergency stop button 10A and the dead man contactor 10B are each provided with a first cabling circuit AU1 or HM1 and a second cabling circuit AU2 or HM2, which guarantee a dual safety level.

(15) The cabling circuits AU1 and AU2 of the emergency stop button 10A belong to the connection 12 and are each provided with a switch 91 or 92. The two switches 91 and 92 are closed by default, such that they allow the passage of the electrical current in the cabling circuits AU1 and AU2, and are mechanically connected so as to be synchronized with the emergency stop button 10A. In other words, pressing the emergency stop button 10A causes the two switches 91 and 92 to open simultaneously.

(16) The cabling circuits HM1 and HM2 of the dead man contactor 10B belong to the connection 13 and are each provided with a switch 93 or 94. Both switches 93 and 94 are open by default, such that they prevent the passage of electrical current in the circuit HM1 and HM2. The switches 93 and 94 are mechanically connected in a synchronized manner to the dead man contactor 10B. Thus, pressing on the dead man contactor 10B causes simultaneous closure of the two switches 93 and 94.

(17) For the cabling of the emergency stop 10A, the cord 1 of the manual control unit 10 and the connectors 81 and 82 include four electrical conductors, i.e., an input line eAU1 and an output line sAU1 belonging to the first cabling circuit AU1, and an input line eAU2 as well as an output line sAU2 belonging to the second cabling circuit AU2, within the cable of the electrical connection 12.

(18) The switch 91 is inserted between the lines eAU1 and sAU1 of the first cabling circuit AU1 of the emergency stop button 10A. The switch 92 is inserted between the lines eAU2 and sAU2 of the second cabling circuit AU2 of the emergency stop button 10A.

(19) Likewise, for the cabling of the dead man contactor 10B, the cord 1 of the manual control unit 10 and the connectors 81 and 82 include four additional electrical conductors, i.e., an input line eHM1 and output line sHM1 belonging to the first cabling circuit HM1, an input line eHM2 and output line sHM2 belonging to the second cabling circuit HM2, within the electrical connection 13.

(20) The switch 93 is inserted between the lines eHM1 and sHM1 of the first cabling circuit HM1 of the dead man contactor 10B. The switch 94 is inserted between the lines eHM2 and sHM2 of the second cabling circuit HM2 of the dead man contactor 10B.

(21) On the robot controller C side, each electrical line eAU1, sAU1, eAU2, sAU2, eHM1, sHM1, eHM2 and sHM2 is connected to the safety controller 5 so as to close each cabling circuit AU1, AU2, HM1 and HM2.

(22) The safety controller 5 includes a computing unit 52 able to perform safety functions, based on information made accessible by the shared bus 100 input lines eAU1, eAU2, eHM1 and eHM2 and output lines sAU1, sAU2, sHM1 and sHM2 connected to the emergency stop 10A and the dead man contactor 10B. The computing unit 52 is able to verify whether a cabling circuit AU1, AU2, HM1 or HM2 is closed or open by applying an electric signal to its input line eAU1, eAU2, eHM1 or eHM2 and comparing this signal to a signal measured at the output line sAU1, sAU2, sHM1 or sHM2 of this circuit. The computing unit 52 is able to trigger an emergency stop of the robot arm B, during which the computing unit 52 activates the cutoff function of the torque of the inverters V.

(23) During the use of the robot R, the safety controller 5 continuously monitors the cabling circuits of the emergency stop button AU1 and AU2 and the dead man contactor HM1 and HM2. This check is termed normal monitoring of the cabling circuits of the emergency stop button AU1 and AU2 and of the dead man contactor HM1 and HM2. More specifically, the safety controller 5 tests whether the current passes in each cabling circuit AU1, AU2, HM1 and HM2 and records the electrical state of each circuit. The safety controller 5 recovers the “0” logic information when the circuit is open, i.e., when the current does not pass, and the “1” logic information when the circuit is closed, i.e., when the current passes.

(24) Hereinafter, (a, b) denotes the pair of logic information items of the cabling circuits AU1 and AU2 of the emergency stop button 10A, or the cabling circuits HM1 and HM2 of the dead man contactor 10B, respectively. Reference “a” is the electric state of the first cabling circuit AU1 or HM1, and “b” is the electric state of the second cabling circuit AU2 or HM2.

(25) For the cabling circuits AU1 and AU2 of the emergency stop button 10A, the pair of logic information items (1, 1) recovered simultaneously corresponds to an authorized operating state of the robot arm B. The emergency stop button 10A is not actuated and the switches 91 and 92 are closed.

(26) For the cabling circuits AU1 and AU2 of the emergency stop button 10A, the pair of logic information items (0, 0) recovered simultaneously corresponds to an emergency stop state of the robot arm B. The emergency stop button 10A is actuated and the switches 91 and 92 are open. The safety controller 5 then triggers the emergency stop, if it is not already activated.

(27) For the cabling circuits AU1 and AU2 of the emergency stop button 10A, the pairs of logic information items (0, 1) and (1, 0) recovered simultaneously correspond to a malfunction of the cabling circuits AU1 or AU2. In both of these cases, the safety controller 5 triggers the emergency stop and emits a signal indicating a fault of the cabling circuits AU1 and AU2 of the emergency stop button 10A.

(28) For the cabling circuits HM1 and HM2 of the dead man contactor 10B, the pair of logic information items (1, 1) recovered simultaneously corresponds to an actuation of the dead man circuits 10B by an operator. The manual control unit 10 is activated and the unit 10 is authorized to control the robot arm B. The switches 93 and 94 are closed.

(29) For the cabling circuits HM1 and HM2 of the dead man contactor 10B, the pair of logic information items (0, 0) recovered simultaneously corresponds to a deactivated state of the manual control unit 10 in which the central processing unit 2 no longer takes into account commands from the manual control unit 10. The operator does not act on the dead man contactor 10B. The switches 93 and 94 are open.

(30) The pairs of logic information items (0, 1) and (1, 0) recovered simultaneously on the cabling circuits HM1 and HM2 correspond to malfunctions of the cabling circuits HM1 or HM2. In both of these cases, the safety controller 5 triggers the emergency stop and emits a signal of a fault of one of the cabling circuits HM1 and HM2 of the dead man contactor 10B.

(31) The robot controller C further comprises a stopper 7, shown diagrammatically in FIG. 3, designed to be connected to the second connector 82 of the cabinet A, on the robot controller C, in place of the first connector 81, when the manual control unit 10 has been removed. When the stopper 7 is connected to the second connector 82, the electric lines eAU1 and sAU1 of the first cabling circuit AU1 of the emergency stop button 10A are connected to one another electrically by means of electric conductors 7AU of the stopper 7. Likewise, the electrical lines eHM1 and sHM1 of the first cabling circuit HM1 of the dead man contactor 10B are electrically connected to one another by means of electric conductors 7HM of the stopper 7. The stopper 7 does not include means for closing the cabling circuits AU2 and HM2. When the stopper 7 is connected to the connector 82, the cabling circuits AU2 and HM2 are open.

(32) Alternatively, the stopper 7 electrically connects the electrical lines eAU2 and sAU2 of the second emergency stop circuit AU2, and the electrical lines eHM2 and sHM2 of the second dead man circuit HM2, while the electrical lines eAU1 and sAU1 of the first emergency stop circuit AU1 and the electrical lines eHM1 and sHM1 of the first dead man circuit HM1 are not connected, such that the stopper 7 only closes the circuits AU2 and HM2, while the circuits AU1 and HM1 remain open.

(33) Thus, the stopper 7 electrically connects the input and output lines of only one of the two cabling circuits AU1 or AU2 of the emergency stop button 10A, and the input and output lines of only one of the two cabling circuits HM1 and HM2 of the dead man contactor 10B.

(34) The next part of the description relates to a method for disconnecting the manual control unit 10, for the disconnection between the manual control unit 10 and the robot controller C.

(35) In a first step a), when an operator wishes to disconnect the manual control unit 10 from the robot controller C, he uses the interface 101 to select the disconnection function of the manual control unit 10. This disconnection request is sent to the central processing unit 2, which records the order and sends it to the safety controller 5.

(36) Alternatively, the disconnection order is sent to the safety controller 5 by the disconnection contactor 6.

(37) In a second step b) after the step a), the safety controller 5 suspends the control of the cabling circuits AU1, AU2, HM1 and HM2 of the emergency stop button 10A and the dead man contactor 10B during a predetermined length of time t1, for example 30 seconds, starting as of the disconnection request. In other words, the safety controller 5 does not trigger the emergency stop even if the pairs of logic information items of the cabling circuits AU1 and AU2 are different from (1, 1). Thus, the activation function of the torque cutoff, performed by the safety controller 5, is deactivated.

(38) In a third step c), after the step b), the safety controller 5 then conducts a test of the cabling circuits AU1, AU2, HM1 and HM2 of the emergency stop button 10A and the dead man contactor 10B.

(39) This test consists of verifying two conditions X and Y. According to the first condition X, one emergency stop circuit AU1 or AU2 is open while the other circuit AU2 or AU1 is closed, which corresponds to the pairs of logic information items (0, 1) and (1, 0). According to the second condition Y, one dead man circuit HM1 or HM2 is open, while the other circuit HM2 or HM1 is closed, which corresponds to the pairs of logic information items (0, 1) and (1, 0).

(40) (a, b, c, d) denotes the quadruplet of logic information items of the cabling circuits AU1, AU2, HM1 and HM2. “a” is the electric state of the first cabling circuit of the emergency stop button AU1, “b” is the electric state of the second cabling circuit of the emergency stop button AU2, “c” is the electric state of the first cabling circuit of the dead man contactor HM1 and “d” is the electric state of the second cabling circuit of the dead man contactor HM2.

(41) With the stopper 7 of the example shown in the figures, the two conditions X and Y are met when the logic information of the cabling circuits AU1, AU2, HM1 and HM2 are equal to (1, 0, 1, 0).

(42) During the second step b), if an operator disconnects the cord 1 from the manual control unit 10 and connects the stopper 7 on the second connector 82 during the predetermined length of time t1, then the safety controller 5 detects, during the third step c), that the two conditions X and Y are met, i.e., the single cabling circuit AU1 of the emergency stop button 10B is closed and a single cabling circuit HM1 of the dead man contactor 10B is closed. The safety controller 5 closes the test procedure without triggering the emergency stop. During the test procedure, the safety controller 5 simultaneously analyzes the electric state of the cabling circuits AU1 and AU2 of the emergency stop button 10A and of the cabling circuits HM1 and HM2 of the dead man contactor 10B.

(43) In the third step c, at the end of the predetermined length of time t1 after the disconnection request, and if the conditions X and Y are not met, the safety controller 5 triggers the emergency stop. In a first case, this means that the operator has not connected the cord 1 and that the manual control unit 10 is still connected at the end of the predetermined length of time t1. This configuration corresponds to the logic information (1, 1, 0, 0). The emergency stop triggered by the safety controller 5 then allows the operator to disconnect the manual control unit 10 securely, by disconnecting the cord 1. The logic information items of the cabling circuits AU1, AU2, HM1 and HM2 are then equal to (0, 0, 0, 0). The test procedure ends.

(44) In a second case, the two conditions X and Y are not met when the operator has disconnected the cord 1, but has not connected the stopper 7 on the second connector 82 at the end of the predetermined length of time t1. The logic information items of the circuits AU1, AU2, HM1 and HM2 are then equal to (0, 0, 0, 0). The operator must then connect the stopper 7 of the second connector 82 so that conditions X and Y are met and the test procedure ends. The emergency stop being triggered, the user can connect the stopper 7 completely safely.

(45) Thus, at the end of the predetermined length of time t1, the safety controller 5 does not trigger an emergency stop of the robot arm B if and only if on the one hand, only one of the two cabling circuits AU1 and AU2 of the emergency stop button 10A is open and, on the other hand, only one of the two cabling circuits HM1 and HM2 of the dead man contactor 10B is open. In the example of the stopper 7 shown in the figures, this corresponds to the quadruplet of logic information items (1, 0, 1, 0). Alternatively, it may involve the following configurations: (1, 0, 0, 1), (0, 1, 0, 1) or (0, 1, 1, 0).

(46) There are four operating configurations with no hardware failure of the robot: when the cabling circuits AU1, AU2, HM1 and HM2 are all open: (0, 0, 0, 0), when the cabling circuits AU1, AU2, HM1 and HM2 are all closed: (1, 1, 1, 1), when the two cabling circuits AU1 and AU2 of the emergency stop button 10A are open while the two cabling circuits of the dead man contactor 10B are closed: (0, 0, 1, 1), when the two cabling circuits AU1 and AU2 of the emergency stop button 10A are closed while the two cabling circuits of the dead man contactor 10B are open: (1, 1, 0, 0).

(47) In order for an operating error to result in the robot controller C erroneously detecting the presence of the stopper 7 whereas it has not been placed, and erroneously not triggering the emergency stop, it is necessary for two failures to occur simultaneously, i.e., a first failure regarding the electric state of only one of the cabling circuits AU1 and AU2 of the emergency stop button 10A, and a second failure regarding the electric state of only one of the cabling circuits HM1 and HM2 of the dead man contactor 10B.

(48) Thus, the disconnection procedure is according to the safety principles requiring a safe detection of failures of the safety system of the robot controller C.

(49) The next part of the document relates to a method for connecting the manual control unit 10 to the robot controller C, which includes three successive steps a′), b′) and c′).

(50) In the first step a′), the operator removes the stopper 7. This step may follow the reconnection of the stopper 7, during the disconnection method, as described above.

(51) In the second step b′), the safety controller 5 detects the removal of the stopper 7 by applying an electric signal to each input line eAU1, eAU2, eHM1 or eHM2 and comparing this signal to a signal measured at the output line sAU1, sAU2, sHM1 or sHM2 of this circuit. When the stopper 7 is disconnected, the logic information items of the circuits AU1, AU2, HM1 and HM2 are equal to (0, 0, 0, 0). The safety controller 5 then suspends the control of the cabling circuits AU1, AU2, HM1 and HM2 so as not to trigger an emergency stop during a second predetermined length of time t2 starting upon removal of the stopper 7, for example 30 seconds.

(52) In the third step c′), the safety controller 5 then conducts a test sequence of the electric state of the cabling circuits AU1, AU2, HM1 and HM2, as described in step c) of the disconnection method.

(53) If the two conditions X and Y previously set out are not met at the end of the second predetermined length of time t2, the safety controller 5 considers that the stopper 7 is still missing and reactivates the control of the cabling circuits AU1, AU2, HM1 and HM2 of the emergency stop button 10A and the dead man contactor HM1 and HM2. It is then able to perform the normal monitoring function of the circuits AU1, AU2, HM1 and HM2. The connection method ends.

(54) If the manual control unit 10 is connected and the two cabling circuits AU1 and AU2 of the emergency stop button 10A are closed, the safety controller 5 does not trigger an emergency stop. If the manual control unit 10 is not connected, then the safety controller 5 triggers the emergency stop, since it will have detected that the two cabling circuits AU1 and AU2 of the emergency stop button 10A are open.

(55) If the two conditions X and Y are met, this means that the stopper 7 has been reconnected and that the robot controller C has returned to the preceding configuration. The connection method ends.

(56) In this way, the connection procedure is also according to the safety principles requiring the safe detection of failures of the safety system of the robot controller C. The emergency stop is triggered if, at the end of the second predetermined length of time t2, the user has not reconnected the manual control unit 10 or has not reconnected the stopper 7.

(57) The invention applies to all types of multi-axis robots.

(58) In the context of the invention, the described alternatives may be combined with each other, at least in part.