Page - 81 - in Proceedings of the OAGM&ARW Joint Workshop - Vision, Automation and Robotics

consider these aspects early in the R&D efforts in order to qualify for real-world applications. II. RELATED WORK With the growing applications of robotics in human life and considering the high importance of human safety in HRI, more and more research is being dedicated to assure a safeperception incollaborativeenvironments.Kulic´ [13]was one of the first who has provided an extended and detailed overview regarding the safety in HRI. She managed to define many important terms in this scope and formulate a metric for danger measurement. [20] also provides a quick overview of safety issues in HRI. The work done in [16] categorizes the safety strategies in three categories: I) crash safety (e.g., limiting the power/force), II) active safety (e.g., by using proximity sensors, vision systems and force/contact sensors), and III) adaptive safety for intervening in the robot opera- tion and applying corrective actions that lead to collision avoidancewithout stopping the robotoperation. In theirwork and also the work from [6] the focus is more on the design principles. The latter also considers robustness, fast reaction time, and context awareness as the main parameters of a safe design.One interestingandgenuine ideamentioned thereand originally in [7] is the recommendation to design the robots such that they are predictable for a human. For instance, by using special sounds or human-like movements for a robot, the human can expect and foresee the robot’s moves and accordingly avoid unintended collisions with the robot. Some other researchers just focus on detecting and lo- calizing the human and accordingly prevent the robot from colliding with it. Depending on the type of the detecting sensor, their performance is evaluated. Active or marker- based sensors may be more challenging to implement and less convenient to apply in real scenarios, but they can provide a quite accurate and reliable collision avoidance. Their proximity distances can reach up to a few centimeters between human and robot [14]. On the other hand, other types of sensors such as cameras and laser scanners may have higher error ranges, but by combining multiple sensors together we can minimize the risk. In this direction, [18] fuses data from multiple heterogeneous 3D sensors to detect any moving object approaching the robot. Similar work has been done by [19], which constructs point clouds and 3D models of the moving objects and the robots in order to avoid collisions. Safety of a human is not always achieved by immediate protection from danger or collision. Sometimes hazards can be results of long-term inappropriate actions in HRI. For instance, [4] looksat thehumansafety fromanergonomicas- pect, which is a complementary point of view. They consider a work environment which ensures the occupational safety and describe the requirements for a workplace where human and robot can jointly perform an assembly process without separation between their workspaces. They also consider some human factors such as the age of the working person. In our work we are going to look at the safe perception in HRI with a holistic approach. We are going to explain what kinds of criteria are necessary to be obeyed in order to have a safe perception architecture and why a single safety precaution will fail. III. RISK ANALYSIS IN SAFE PERCEPTION In the design of a robot system, risk assessment is a main measure for achieving standards-compliant safety. The gen- eral process, consisting of risk analysis and risk evaluation, is described in [9], with extensions specific to robots given in [11] and [12]. First, the potential hazards of the robot system during all phases of its life cycle are to be identified. The hazards given in the annex of [11] may be seen as a list of examples, which must always be considered and carefully examined with the specific robot system and its application/task in mind. All identified hazards are then to be evaluated in terms of their risks. From the obtained results it may become clear that the risks have to be reduced by certain measures, leading also to updates in the results of risk analysis and evaluation, and thus a new iteration of the process steps. Eventually the residual risks of any remaining hazards are sufficiently low to allow for the designed robot system to be realized and considered safe. Risk assessment and safe perception influence each other in several ways. Already during the risk analysis, the capa- bilities gained from the perception infrastructure can serve as measures that counter certain hazards and reduce risks. But the risk analysis must also consider any potential hazards arising from system components, including also those that are specifically employed for safety reasons. If the used components do not provide a sufficiently high integrity / performance level or they are placed or configured in suboptimal ways, their total effect may be deteriorating. However, such choices will typically be identified and miti- gated in the further course of the iterative risk assessment and risk reduction, so that the final solution is able to achieve the required safety properties. When modifying the system design to achieve risk reduction, the integration of the safety perception infrastructure or the modification of its integration can be a central measure. Thus, as one of its results, the iterative process of risk assessment and risk reduction gives constraints on effective sensor placement that enables comprehensive sensor fusion later on. An example of such an improvement can be seen in the step from the arrangement depicted in Fig. 3 to the one in Fig. 5. In the running system, any residual risks are permanently relevant. The setup of the safe perception must be designed in a way that potential hazards that could not be eliminated by system designcanbepreventedordealtwithaccordinglybasedupon perception. Finally, the operation of the system continuously gives opportunities to gather new knowledge that can be used in a refined risk assessment to further improve the system’s safety. This could be done any time, but is necessary in particular when the system is going to be modified. Possible inputs may come from user feedback, other persons observ- ing the operation, or also the system itself. For the latter, we envision a component that is able to identify events that 81