When are enabling switches necessary?
Man and machine are moving ever closer together. Not only in the private sector, but also in industry. While robots and employees in production used to be separated from each other by protective devices such as safety light curtains and safety fences, robots and employees are now separated from each other by safety barriers. Collaborative robots have been on the rise for several years now. And not only in large corporations, but also increasingly in SMEs.
In the classic protected areas in which the fully automated robots previously worked, manual operation was only possible with the aid of an enabling switch. And this was mainly used during maintenance or installation work when manual operation was temporarily necessary and a person occasionally had to enter the protected area. Things are different with collaborative robots. Employees and robots work here as part of the Human-robot collaboration (HRC) permanently in close proximity to each other, without being physically separated by protective devices. This offers many opportunities if the safety risks are reduced with appropriate technology for collision avoidance or force and power limitation. This is because HRC closes the so-called “automation gap”. It was created by the classic protective grids between manual processing and fully automated processing by robots. Robotic devices only become a real co-worker through HRC. cobots and human assistants, which makes their work easier and processes more efficient.
But the question of when in this context Enabling switches are required for the safety of employees and when not, there is still great uncertainty, especially at international level. The last corresponding revision of the ISO 10218 took place in February 2016 and April 2017, in the form of a so-called TS (technical specification), of the ISO TS 15066. On around 30 pages, the International Organisation for Standardisation (ISO) here with the topic “Robots and robotic devices – collaborative robots”. However, this is also primarily concerned with how large „Permissible pain“ The maximum pressure and force permitted for robots in the event of a collision between humans and robots (Biomechanical limit values), if collision avoidance by enabling switches or other safety sensors is not used. Or the high standards of reliability, position and speed monitoring and collision detection that must be met by those safety functions that replace the classic safety fence.
The The requirement for a 3-stage enabling switch is relativised here under certain conditions. But when exactly, that is not clearly regulated. This quickly gave rise to the misconception among many managers that at MRK generally no Consent button is necessary. But this is wrong. And if in doubt, it is better to play it safe than to shy away from the cost and effort of installing consent buttons. Because it is still primarily 3-stage enabling switch very reliable, are easy to operate, very fail-safe and almost impossible to manipulate.
Why are collaborative robots a special case?
The Human-robot collaboration describes that Humans and robots share a workspace , which do not necessarily have to be equipped with guards. Not necessarily, since strictly speaking a so-called HRC can also exist if a protective device exists, but manual operation must take place within the danger zone during maintenance or repair work. Companies and employees alike benefit from increased efficiency and improved ergonomics as part of HRC. Collaborative robots are increasingly taking on tasks that are critical for people’s joints and posture in the long term, while at the same time speeding up production processes. However, the closer man and machine get to each other, the greater the potential danger. At least when there is uncertainty about relevant standards and regulations such as the EN ISO 10218 („Safety requirements for industrial robots“). This is a major issue in many companies, as HRC is a relatively new technology. And it is only recently that it has become increasingly popular in smaller companies. The expertise here is sometimes not available to the same extent as in large corporations. As the classic area of protection no longer applies to the HRC and increasingly solutions and innovations for the Reliable people detection and safety sensors the enabling switch fell behind at times.
The opinion that 3-stage enabling switch in the HRC are not absolutely necessary and legally prescribed is becoming more and more widespread. But that is not correct. There are also many legal details to consider here, so that in case of doubt it is generally safer to also use a consent button in robotics. And not only when a protected area must be entered by people for maintenance or installation work, but also when generally No separating protective device exists (Safety fence, door sensors for access to the protected area, etc.). It is not possible to give a general “yes” or “no” answer to the question of when an enabling switch is necessary. And the ISO does not currently provide a clear answer to this question. Let us therefore look at various non-collaborating and collaborating application examples for robots and the question of the necessity of the enabling switch in each example.
What exactly do 3-stage enabling switches do?
The still valid EN ISO 10218 from 2011 regulates the Section 4.2, that the Manual control of robots always outside the protected area should take place. This protected area is limited by the standard protective devices on the outer sides. However, it may be necessary to temporarily deactivate these protective devices for various reasons. For example, to carry out maintenance work. In this case, the 3-stage enabling switch is used. If the protective devices for normal operation are deactivated, then Additional measures be taken in order to Ensure personal protection in special operations.
In most modern industrial systems, the “normal” operation, i.e. for fully automatic functions, e.g. robots.e.g. for robots. This is where the operational protective measures take effect. These bring the machine to a standstill if a person enters the danger zone or the safety door opens. However, if new equipment, process changes or programming work is required, the normal protective devices must be cancelled and the machines must be controlled in manual mode. The enabling switches now fulfil the protective function here.
The guidelines state that an interlocking device must be used to prevent the Machine operation only made possible by a second, separate action. In order for a person working in the safety area to be able to move the machine, the enabling switch must also be confirmed in the form of a manually operated control device. Every person working in the danger zone must carry this approval device with them.
The 3-stage operating principle of an enabling switch is as follows.
- Level 1: the button has not yet been pressed Machine is either deactivated (Off) or runs with the safety functions of normal operation activated.
- Level 2: the centre position of the enabling switch. The machine runs while the safety guards such as doors are deactivated so that maintenance work or new settings can be carried out (On).
- Level 3: If the button is pressed too firmly, the machine is brought to a standstill (Off). The enabling switch protects the operator and people in the danger zone in the event of an overreaction in a shock situation
Manual operation of a robot is therefore only possible as long as the enabling switch is in the centre position (level 2). If it is either released (level 1) or pressed too hard (level 3), for example as a result of a shock situation, a heart attack or an electric shock, the Operation stops automatically. In addition, some enabling switches have an additional Emergency stop button (Emergency stop switch).
However, in the case of HRC, there is no such protected area or spatial separation by protective fences in everyday working life. So man and machine are constantly working together. Many companies are therefore asking themselves whether all employees now have to use an enabling switch at all times, or whether this is no longer necessary because other protection systems – in particular personal identification – are being used. This is because collaborative robots must be able to reliably detect people and independently stop operation or independently limit and adjust force, pressure and power. However, this does not mean that a classic enabling switch is superfluous.
Prerequisite for the operation of collaborative robots
The Requirements for collaborative robots and the integrated safety systems for personal detection, risk minimisation and force and power limitation regulates the ISO/TS 15066. In principle, collaborative robots can work fully automatically in close proximity to humans, without the need for a safety fence, if a Completed risk assessment based on the force and power limitation and the validation of all possible collision scenarios comes to the conclusion that the application is safe. An interesting theoretical basis for the safe detection of persons as a protective device for collaborative robots is provided by the Dissertation from Dr.-Ing. Björn Ostermann from 2014, which he wrote at the University of Wuppertal.
The risk assessment:
- Data collection such as product name, product type, year of manufacture, intended area of application or use, foreseeable misuse, product functions, etc.
- Which potential dangers exist?
- Stabbing and piercing
- Cutting in and cutting off
- Move in
- Electric shock
- Contact with hazardous substances
- Where are Collisions (Physical contact between humans and machines) potentially possible in the collaboration space?
- Risk assessment: How likely is it that an identified hazard will materialise and what would the consequences be? How often and for how long does this risk exist per employee?
- Example: An employee who carries out assembly work together with a robot all day long is exposed to the potential risk longer and more frequently than an employee who loads a pallet loaded by a robot a few times a day.
- Is used with Collision avoidance or force, impulse and power limitation?
- With which ever Active safety functions in automatic mode can pressure and force be controlled so that there is no risk of injury to persons?
- Corresponding “machine limits” are now defined based on the information already recorded.
- On the basis of this data (Risk analysis) it is now assessed whether the necessary security is sufficient or whether additional measures need to be taken to minimise risk that go beyond the security systems integrated in the system (Risk assessment).
- This risk assessment is repeated until the use of the collaborative robot is categorised as safe.
A series of Always active safety functions in automatic mode can replace the active safety functions of a three-stage enabling switch, for example the Tool Center Point (TCP)-Speed limit, the TCP space limitation, joint position limitations and joint speed limitations. And this is precisely what distinguishes collaborative robots from conventional industrial robots, for which an enabling switch after EN ISO 10218 is mandatory. However, an enabling switch can still be useful or even mandatory.
The corresponding technical specification is not yet linked to the Machinery Directive. However, the same experts who worked on ISO 10218-1/-2 (still the applicable standard for all industrial robots), are also authors of the TS 15066. It can therefore act as a guideline for safety in HRC and should definitely be taken into account.
And these TS answers the question of whether or not an enabling switch is necessary for the MRK as follows:
„[…] If a risk assessment determines that the risk reduction normally achieved by the application of an enabling device would alternatively be achieved by inherently safe design measures or safety-assessed limiting functions, then the hand-held pendant station for a collaborative robotic system may be equipped without an enabling device […]“
However, this formulation raises at least as many questions as it answers. In principle, this formulation only states that collaborative robots do not require an enabling switch if their integrated safety functions are safe “enough”. But what does enough mean?
The following questions provide orientation.
If you can answer all of these with “Yes”, it can be assumed that an enabling switch is not absolutely necessary:
Three important questions for MRK
- Is the risk assessment based solely on force and power limitation, without taking into account other protective measures that enable the robot to be stopped using other aids such as sensors, laser scanners or even an enabling switch?
- Can the robot’s biomechanical limit values (force and pressure) – validated in the risk analysis – rule out a hazard for employees in all conceivable scenarios and in all foreseeable application errors?
- Are the robot’s integrated safety functions equally and always active in automatic and manual mode?
In these examples, enabling switches are required for the HRC
In practice, force and power limitation and the monitored stop are primarily used for HRC applications to minimise risk. With regard to force and power limitation, however, the main challenge for the responsible integrators is to measure the clamping and free collision required for the risk assessment. Additional safety measures such as an enabling switch can significantly simplify the risk assessment here.
The monitored stop
Safety mats or laser scanners separate the protected and non-protected work areas and replace the old safety fences. They announce the entry of a person into the working area of the collaborative robot and trigger a safety stop. Does an employee or, in particular, a programmer now have to be responsible for the manual movement of the robot during installation or maintenance work closer to the robot than the sensors for the safety-rated monitored stop allowit is necessary to monitor the movement of the robot by another safety function that can move it temporarily or stop it in an emergency. This function is then fulfilled by the Three-stage enabling switch.
The size of the collaboration room
As part of the risk assessment, the size of the so-called collaboration space is determined. This does not necessarily extend over the entire movement range of the robot. For example, robots that automatically load pallets, which are then taken away by an employee. However, if the entire movement range of the robot is also defined as a collaboration space, the necessary measurements and analyses for the risk assessment are enormously complex. Pinch and shear points in particular are very dangerous for people in the collaboration space. For robots with force and power limitation, it is therefore advisable to minimise the number of potential clamping points. However, this is not always easy. Space-limiting safety functions or the division of the workspace into two areas (Normal area and collaboration room), which restrict the robot’s range of movement to a greater extent, provide a remedy here, as the collaboration space is thus reduced. And thus also the space in which the corresponding measurements for the risk assessment must be carried out. You can then work in the area within the collaboration room without the consent button (Reduced safety parameters). Measured by light grids or other sensors, the robot reduces its speed and force within this range. The consent button is required outside the collaboration room (normal safety parameters). This is because the robot can work at higher speeds and higher performance in this normal area, as there are normally no people in this area. The use of consent sensors significantly simplifies the risk assessment of the HRC.
Simplified risk assessment thanks to consent button
In large collaboration spaces that extend over the entire movement area, the risk assessment is very extensive and complex. All clamping and shearing points, collision possibilities and forces must be calculated. Dividing the workspaces into a normal area and a small actual collaboration space helps here, but requires an enabling switch in the normal area.
- In the normal area, the usual safety parameters apply, similar to conventional fully automated industrial robots that have worked within the known safety fences. With the difference that the area is only separated by a safety level and a laser grid. If a person crosses the laser grid, the robot brakes (safety stop). In this area, people may only move the robot with an enabling switch. As humans only enter the normal area in exceptional situations, the robot can work here at normal speed, power and force, without force and power limitations based on the detailed risk analysis. The time-consuming measurement and calculation of the free collision, as well as the clamping and shear points, is also eliminated in this area.
- If the robot crosses the Programmed security level, it switches from normal operating mode to power and performance-limited mode (or vice versa, depending on the area from which the robot crosses the safety level).
- In the collaboration space, the values such as speed, force and power are reduced according to the force and power limits resulting from the risk assessment. Within the collaboration space, the detailed Risk analysis incl. Measurement and determination of clamping and shear points and the free collision. For this reason, an enabling switch can be omitted within this area.
By dividing the process into two areas, this approach therefore offers the advantage that the complex risk assessment can be limited to the smallest possible collaboration space. Namely on the Area in front of the light or laser grating. Clamping points and collision possibilities must also be calculated and the robot’s safety systems and parameters configured accordingly. However, this force and power limit must only be observed in the collaboration room.
As soon as the robot moves moves behind the grid and through the safety level into the normal area, the force and power limitation is cancelled. The possible pinch and shear points, as well as the free collision, do not need to be examined in detail for this area, as it is a classical protected area according to EN ISO 10218. This is why a 3-step enabling switch required when performing manual movements.
The use of consent buttons as part of the simplified risk assessment can therefore save a lot of time and effort.
In practice, this solution is suitable for all applications in which humans and robots only actually share the space in one or a few places within the HRC. This makes it possible for the robot to operate at full power outside of these areas in order to achieve a short cycle time despite HRC in places.
|In front of the grille / In the collaboration room
|Robot operates at normal speed and power, manual movement only with enabling switch
|Breaks through the light grid
|Robot makes a safety stop until the human leaves the normal area again or moves the robot using an enabling switch
|In front of the grille
|Robot operates at reduced speed (force and power limitation, etc.)
|Robot operates at reduced speed (force and power limitation, etc.)
Conclusion: Enabling switches in robotics – yes or no?
Whether an enabling switch is necessary for safe HRC remains an important question that cannot be answered with a blanket “no”. The answer depends on various parameters.
Which protected areas are actually collaboration spaces according to EN ISO 10218-2 and which are not?
Which safety functions according to ISO TS that are active at all times were confirmed in the risk assessment for the collaborative robot?
- Speed and distance monitoring
- Personal registration
- Force and power limitation
- Safety-rated monitored stop
What type of HRC is it according to EN ISO 10218-1:2011, section 5.10?
- Safety-rated and monitored stop (Robot stops as soon as a human enters the collaboration room)
- Manual guidance: Human movements are converted into movements of the collaborative robot by means of sensors. The robot is therefore controlled exclusively by humans. A 3-stage enabling switch is usually used here.
- Speed and distance monitoring: Sensors monitor the distance between humans and collaborative robots at all times. If the distance falls below the minimum distance, the speed of the robot is reduced until a safety stop is reached.
- Force and power limitation: An inherent design or control system enables humans and robots to work side by side. Risks are minimised by monitoring various parameters, which are dynamically adjusted with the help of various safety functions that are active at all times. The parameters are based on the risk assessment, which allows possible collision or contact forces between humans and robots to be reduced to a safe level. The maximum permissible contact force of 150 newtons defined in the past by EN 10218:2011 is no longer valid. Annex A of ISO TS 15066 defines a body zone model which defines different pain thresholds for 29 body zones. They serve as guidelines for risk assessment.
- Only in variant d) of HRC is the term “actual collaboration” used by experts. This is because the other three variants are more a kind of peaceful coexistence. Humans and robots are in the same area, but only one of them is working. Humans and collaborative robots only work side by side or together when it comes to force and power limitation. And that is the actual goal of the HRC.
EN ISO 10218-2 Section 5.10.2
After EN ISO 10218-2 Section 5.10.2 (Safety-rated monitored stop) such robots are only limited by safety functions in automatic mode. In practice, the force and pressure measurement for calculating the collision forces is therefore often omitted in the risk assessment. In this case, an enabling switch is required in the same way as for classic fenced-in industrial robots.
Force and power limitation
For robots with force and power limitation, an enabling switch can be dispensed with if the risk assessment takes into account all pinch and shear points as well as collision possibilities in the collaboration space. The results of the risk assessment must also establish that all calculated values do not exceed the tolerance limits per body zone specified in Annex A of ISO TS 15066. In addition, the confirmed safety functions must be permanently active, both in manual and automated operation.
Annex A of ISO TS 15066
For collaborative applications in accordance with EN ISO 10218-2 section 5.10.2 – “Force and power limitation”, it is possible to work without an enabling switch. One condition for this is that all trap and collision possibilities are considered as part of the risk assessment and it is determined that the values within the tolerable range according to Annex A of ISO TS 15066 Secondly, the safety functions confirmed in the risk assessment must be active at all times.
|Safety functions & Working areas
|Enabling switch required?
|The robot operates within a safety fence with a safety door. If it is opened, the robot stops.
|The robot does not operate within a safety fence. Lasers or step mats detect people and interrupt the robot’s movement.
|The movement area is divided into a normal area and a collaboration area.
|Yes, but only in the normal area, not within the collaboration room
|The robot operates without a safety fence, but all collision points, as well as pinch and shear points, have been evaluated and are within the tolerable values. In addition, the safety parameters and safety functions are active at all times.
B-COMMAND Product Overview
In the B-COMMAND product overview you will quickly and easily find a solution for your application area. From pendant switches to radio remote control, everything is shown in our product overview to give you a quick overview of our product range.
Do you have any questions?
SEND US YOUR MESSAGE
Follow us on our social media channels and be informed about new products.