Seite - 82 - in Proceedings of the OAGM&ARW Joint Workshop - Vision, Automation and Robotics

may need further offline analysis later using different kinds of potentially related data available to the system. IV. SAFE PERCEPTION ARCHITECTURE REQUIREMENTS An architecture for a safe perception system typically includes components of the types machine, sensor, human, and processing unit. To construct a suitable architecture, we need a good understanding of these components in terms of their functionality and reliability as well as their relations and interfaces. Here we are going to propose a generic architecture by pointing out the requirements which enable the realization of a safe perception system for a typical collaborative robot system. This architecture should be in- dependent from the robot type, size of the workspace, and environmental factors as much as possible and also easy to deploy. In order to achieve such a goal, we have to consider the possibilities of failure of individual components in a system as discussed in Section III. Accordingly, an ideal safe architecture considers/includes the following requirements: • Embed safety inside different building blocks: consider safety not just as an add-on but embed it in each system component, robot, planning, and programming decisions. However, always keep the distinction be- tween operational functionality and safety functionality in mind. • A modular architecture: makes it easy to add/remove various hardware and software components. For in- stance, Robot Operating System (ROS) [17] has been used for our modular software architecture to provide a simple message passing and hardware abstraction. • Adding parallel redundancy: use multiple sensors in parallel over independent platforms to make sure that the failure of one is not causing the whole system to fail. • Heterogeneous system: using different types of sensors (e.g., laser scanner, time-of-flight camera, thermal cam- era, speech recognition, light curtain, etc.) to make sure that the system is robust against changing environmen- tal variables. For example, if there are poor visibility conditions at the workplace, conventional cameras may fail to obtain a picture but a thermal or time-of-flight (ToF) camera can help and even provide images through fog or smoke. • Reproducibility: which makes it easy to re-implement in different scenarios and setup the perception system in other new workspaces. • Mapping the Environment: modeling the 3D environ- ment in order to further simulate, localize and position thesensorsandobjects in theenvironment.Thishelps to decide how and where to mount the sensors to achieve the maximum coverage (high spatial distribution helps the robustness in case of local failures). • Contextaware: takes thecontextof theongoingscenario into account either by receiving it from operator or by analyzing the scene. Accordingly the system adapts the parameters and decision-making to that specific scenario. • Intelligent: learn fromtheprevious situations (fromboth false-positives and false-negatives) and hence provide feedback data and parameter correction for future im- provement. Using machine learning in robot perception is an example to achieve this goal. • Exploiting human perception: warn the human about the potential hazards. Unlike the conventional sensory perception, we do not only inform the human in close- to-danger scenarios. Instead, we additionally count on human perception by constantly giving a feedback re- garding the state of the robot to the human, for example by producing a sound according to the movements of the robot. This way the human herself/himself can make a decision if she/he feels something is out of the order. As mentioned above, redundancy is a major design paradigm to realize safety through perception. Relevant standards such as the previously mentioned ISO 10218 and ISO 13849 enforce redundancy throughout the system for achieving a required performance level for a safety function, i.e. redundancy in sensors, computational units and actuators as indicated in Figure 1. im I1 I2 L1 O1 O2 L2 mim m im im im cm I1, I2 input device, e.g. sensor L1, L2 logic device O1, O2 output device interconnection means m monitoring cm cross monitoring Legend Fig. 1. Redundant Safety Architecture (cat. 3, ISO 13849-1 cl. 6.2.6) This classic layout for achieving a high integrity / perfor- mance level has to be incorporated carefully as not to tamper with the safety of the overall system. This is important in particular as our complex robot system will involve both safety functionality at high integrity level as well as functional components with lower integrity level that should also contribute valuable information to improve the overall safety. In industry, one typically talks about yellow and gray components, referring to high integrity safety and general functional components, respectively. A clear structure, both in terms of hardware and software, is required in order to obtain the safety functionality at the desired performance levels. V. ARCHITECTURE REALIZATION In our lab we have various types of serial robotic manip- ulators in workspaces where safe human-robot interaction or collaboration is compulsory.Therefore, weutilize sensors for highly dependable perception using safety LIDARS (yellow hardware – OMRON OS32c) at performance level D (PLd) [8]. On the other hand, we intend to use functionally power- ful time-of-flight (ToF) cameras (gray hardware - PMD Pico Flexx) for environmental perception. Similarly, the control of the robots involve the low-level safety-enabled robot controllers (yellow hardware/software) in combination with a high-level control system that is implemented in ROS (gray 82