1 Introduction

Collaborative Operations (CO) refers to the ability for an industrial robot and an operator to share a common workspace—referred to as collaborative workspace (CW)—in order to complete tasks [1,2,3]. Collaborative operation implies that there is a higher probability for occurrence of hazardous situations due to close proximity of humans and machines [1]. The hazardous situations might lead to an accident resulting in serious injury to the operator, therefore safety is a requirement for collaborative applications [4].

Safety standards [2, 3, 5] defines four types of CO: (1) Safety-rated monitored stop. (2) Hand guiding. (3) Speed and separation monitoring and (4) Power and force limiting by design or control. Engineers can implement one or a combination of two or more types while designing collaborative workstations.

Robot manufactures (e.g. KUKA AG [6] and ABB [7]) have developed specific class of manipulators, marketed as collaborative robots that can detect collision with the robot structure (see fourth type of CO). Manipulators which are not designed to detect collision (e.g., KUKA KR-210) can also be used in collaborative applications, provided risk assessment [8] conducted on the robotic system has been judged to be safe with a minimum performance level (\(PL = d\)) [3].

Researchers have documented various technology focused measures to enable safe operations such as: (1) Safe robot structure that stops motion when an impact is detected [9], (2) Obstacle avoidance, human and pose detection and estimation [10, 11] and (3) Workspace monitoring using spatial camera [12].

In the context of collaborative operations with large industrial robots, the aim of the article is to show that limitations in human cognition plays an important role in maintaining a safe working environment. To support this aim, two collaborative workstations will be analysed with the purpose of identifying factors that can affect daily operations and design solutions that can offset these limitations.

Etherton et al. [13] notes that designers lack a database of known hazards during innovation and design stage. The robot safety standards (ISO 10218 [2, 3]) have tabulated a list of significant hazards to inform risk assessors of probable inherent dangers associated with robotic systems. Therefore, by recognizing limitations of human cognition, the goal of the article is to support practitioners in developing and maintaining a safe working environment.

This article is structured as follows: Sect. 2 will briefly describe the methodological approach and Sect. 3 presents a literature review. Section 4 details two cases that will be analyzed, where the analysis results are presented in Sect. 5. Section 6 discusses the results with final remarks in Sect. 7.

2 Methodology

An overview of the methodology is shown in Fig. 1. Two cases [14] will be analyzed to understand how the risk reduction measures support operator and process safety. The cases are two laboratory demonstrators where a large industrial robot aid operators in assembly tasks.

The data for the deductive analysis are derived from: (1) Semi-structured interviews [15, 16] with participants from the manufacturing industry who shared their experience after working with the demonstrators [17]. (2) Literature on human-automation interaction along with safety standards governing robotic systems. (3) Documentation of the Risk Assessment [8] process carried out during the development of the demonstrators.

Fig. 1
figure 1

Methodology to analyse the risk reduction measures to ensure personnel and process safety

Full size image

The analysis focused on the nature of tasks, in terms of task delegation (robot and operator tasks), spatial location of the tasks (robot and collaborative workspace) and time-frame (mode of operations) which governed completion of the delegated tasks.

3 Theoretical background

This section presents a brief literature review with an aim to: (1) characterize automation, (2) describe problems associated with automation and (3) detail interfaces to support interaction with automation.

3.1 Characterizing automation

Automation technologies such as industrial robots are used to perform a predefined process or procedure without human assistance. According to Sheridan and Parasuraman [18] interaction between a human and an automation device occurs when a human needs to (1) Specify the goals and tasks for automation, (2) Start and stop the system and (3) Receive status information (e.g., task status) from automation. This form of interaction is referred to as supervisory control [19] and seeks to establish a way for an operator to be in control of the tasks performed by automation [19]. Sheridan and Verplanck [19] introduced a hierarchical taxonomy that allows designers (of automation systems with supervisory control) to recognize how humans can collaborate with machines to carry out a task. This taxonomy is known as level of automation where the end-points are complete autonomy for either the machine or the human worker (see Table 1).

As noted by Miller and Parasuraman [20], supervisory control is the process of task delegation, which implies task decomposition. That is, automation designers establish the tasks performed by the machine and the operator. Task decomposition can be classified in terms of: (1) Level or degree of automation of the sub-tasks and (2) Type of automation or functions to automate.

A four stage human information processing model—a model to describe how humans process information and take action—was considered by Parasuramen et al. [21, 22] to develop the four functions that can be automated. These are:

  1. 1.

    Acquisition automation—A monitoring function that takes into account all relevant information about system status.

  2. 2.

    Information analysis—Based on the acquired information, options are formulated for achieving goals.

  3. 3.

    Decision and action selection—Based on the initial information analysis, a particular option or strategy is decided.

  4. 4.

    Action implementation—Carrying out the chosen option through control actions at an interface.

These four functions need not be automated at the same automation level and can vary as shown by Parasuramen et al. [21]. Luczak and Mueller [23] (Ch. 16), states that in the design of work in advanced manufacturing systems, the main functions are carried out by machines (e.g. function for which the system is established such as welding, drilling), whereas the secondary functions—which facilitate or support the main function (e.g. preparation, programming etc.)—are normally carried out manually.

Table 1 Level of automation (LoA) [19]
Full size table

The safety-sensor (Fig. 3, No. 7), once integrated with the workstation performs monitoring of a predefined workspace and will not change its behaviour and this form of automation is referred to as Static Automation. Adaptive Automation [18] refers to context-aware systems that can change its behaviour dynamically, where the division of labour between human workers and automation system is not fixed. In adaptive automation, the ability to invoke a function allocation can be done either by the machine and as noted by Sheridan and Parasuramen [18], this may not be easily accepted by the user who would like to be in control. However, in Adaptable Automation, the operator is always in charge of changing the behaviour of the automation system. Advances in computer based automation has made it possible to design complex systems, several challenges exist that needs to be considered while designing automation system.

3.2 Problems and challenges in human-automation collaboration

When designing automation systems where humans and machines interact, designers have to decide which function to automate at an appropriate automation level (chapter 17 in [23]). In a technology-cantered approach, these decisions are based on cost that can result in sub-optimal systems. Alternatively, in human-centered automation, the goal, according to Kaber and Endsley [22] is to create systems that retains human operators in control loops with meaning full and well designed tasks.

According to Parasuraman et al. [24], (1) Situational awareness, (2) Work load and (3) Trust in automation are constructs that are aimed at better understanding and predicting human performance in complex systems.

Situational awareness (SA) is defined as the perception of the elements in the environment within a volume of time and space, comprehension of their meaning and the projection of their status in the near future. [25] It refers to a person’s perception of their surrounding which enables them to make decisions, and according to Kaber and Endsley [22], there are two types of problems associated with SA: (1) Failure to detect a problem and (2) failure to understand the problem.

In addition, they state that loss in situational awareness occurs through these three mechanisms: (1) Changes in vigilance and complacency associated with monitoring, (2) assumption of a passive role instead of actively controlling the system and (3) changes in the quality or form of feedback provided to the human operator [26, 27].

Current technologies allows designers to develop automation systems that can change its behaviour and is referred to as mode of operation. Sarter and Woods [28] notes that, in complex systems, operators needs to keep track of the current mode, know when and how to change the mode and understand the function of each mode, which can increase the cognitive demands on the operator. Therefore, maintaining mode-awareness can be particularly challenging in systems that can change its mode based on environmental input or for protection purposes. The effect of systems with multiple mode of operation can result in accidents due to the higher risk of inadvertent activation of modes (mode-error) by the operator. Mode-error can also occur if an operator attempts to change the mode but instead activates an unanticipated function because of a lack of awareness of the system state [28].

When the level of automation is high, operators are often tasked with monitoring the system, which can lead to out of the loop condition. Monitoring refers to allocation of attention among appropriate displays and in the context of reliable systems (systems with few false-alarms), can lead to over-reliance in automation. Functions automated at low automation level leads to overload and fatigue resulting in the occurrence of mistakes [29] or other unanticipated situations.

In addition to overload and underload, Eberts and Salvendy [30] lists factors associated with decision making and interaction errors. They state that these cognitive factors can be used in the design of automation systems to reduce the probability of human errors.

Hoff and Bashir [31] defines trust as the attitude that an agent will help achieve an individual’s goals in a situation characterized by uncertainty and vulnerability. They list the following design features that can help build and maintain trust in automation: (1) Appearance, (2) Ease of use, (3) Communication style, (4) Transparency/feedback and (5) Level of control.

3.3 Automation interface

An interface is a device that enables communication between a human and a machine (e.g., buttons, lights, displays) and forms part of a system. A characteristics of a well-designed systems is the ease of use, where information concerning automation modes, current system and future states can potentially enhance system performance—provided they do so in good etiquette [18].

With an increase in automation, inappropriate feedback can be the source of the problem [32], and as noted by Sarter et al. [28, 33], appropriate feedback is a prerequisite for operators to maintain awareness of system state in order to take suitable actions.

Interfaces can aid to reduce the occurrence of an accident through effective warning signals or displays [34]. Machine safety standards recommend various measures such as floor markings and warning lamps (e.g. flashing red light) to convey a dangerous situation to nearby personnel. Conversely, emergency buttons, installed at strategic locations allow personnel to shut down a machine. Intuitive user interface, as noted by Villani et al. [35], is a key feature for programming and working with collaborative robots.

Several approaches have been proposed to the selection, placement and design of interfaces. Ecological interface design [36] is an approach where a given domain of work is decomposed into parts, beginning with the main goal, then into the means by which the goal is achieved. They enable direct perception of automation functional relationship without the need for extensive cognitive processing. Several authors have suggested principles for guiding the design of interfaces: (1) Present information necessary for the operators can respond to events quickly. That is, information that best describes the current system-state [18]. (2) Feedback of state of the system is important to reduce stress. The tools for feedback can be chosen to improve confidence and reduce cognitive load of the operator [28, 33]. (3) Interfaces can be designed to support anticipated and unanticipated events [29].

4 Case studies

4.1 Background

The cases presented in this section are results of research undertaken to understand safety issues related to collaboration with large industrial robots. They were developed in cooperation with manufacturing and safety engineers to demonstrate industrially relevant safety solutions, which led to the installation of two laboratory demonstrators [37,38,39].

Risk assessment [2, 3, 8] is a standardized process of hazard identification, risk analysis and evaluation. Risk assessment is followed by risk reduction activities and have guided the development of the demonstrators. Table 2 compares two cases and highlights the differences in terms of their operational characteristics.

4.2 Case 1: assembly of flywheel housing cover (FWC)

Figure 2 is the plan view of a workstation where a robot aids an operator in the assembly of flywheel housing cover (FWC). The sequence of tasks are:

  1. 1.

    The robot in automatic mode picks up the FWC and waits at the hand-over position. The light curtain mutes and the red light turns green. The operator can safely enter the fenced zone (Fig. 3).

  2. 2.

    To hand-guide the robot, the operator engages two enabling switches integrated to the tool (see Fig. 4). The operator moves the robot by actuating the tool.

  3. 3.

    The operator moves the robot towards the engine block, aligns the two pins (not shown) before mating the two surfaces. After the clamps are removed, the robot is moved back to the hand-over position.

  4. 4.

    The operator engages the three button switch to convey that hand-guiding is complete (Fig. 4). The operator exit the fenced area, engages the mode-change button (Fig. 5) which re-activates the light curtain. The light turns red and the robot starts the next cycle.

Table 2 The two case studies are compared to highlight the differences in their operational characteristic
Full size table
Fig. 2
figure 2

The layout of a workstation where a robot is used to aid operators in the assembly of a flywheel housing cover (FWC)

Full size image
Fig. 3
figure 3

The layout of the demonstrator to showcase safety solutions in collaborative assembly of under-body car panels

Full size image

4.3 Case 2: assembly of under-body car panels (UBP)

Figure 3 details the demonstrator where a robot aids an operator in the assembly of UBP. The sequence of tasks are:

  1. 1.

    In automatic mode, the robot moves from home position [P1] to pick up UBP using vacuum cups. The robot moves out of the robot workspace and synchronises with the moving line at position P3.

  2. 2.

    After synchronization, red light turns green, the operator activates collaborative mode by engaging the enabling switch integrated to the nut-runner (see Fig. 6) which mutes the laser scanner.

  3. 3.

    The operator enters the collaborative workspace and begins fastening the panels. Then, the operator moves out, engages the mode-change button, disengages the enabling switch, activating the laser scanner. The robot moves out of the collaborative workspace to start the next cycle.

Fig. 4
figure 4

Initiating the three button switch integrated with the hand-guiding tool

Full size image
Fig. 5
figure 5

Engaging the mode-change button after exiting the fenced area

Full size image
Fig. 6
figure 6

A prototype of an electric nut-runner with an integrated enabling switch

Full size image

5 Result

This section analyses the risk reduction measures implemented in the workstations presented in Sect. 4 and is summarized in Table 3.

5.1 Assembly of flywheel housing cover (FWC)

Fences, light curtain and reset button During automatic mode, light curtains monitor the entrance to the hand-over position (P3 in Fig. 2). If the operator triggers the light curtain either intentionally (mode-error) or unintentionally (Loss in situational Awareness), will result in a safe-stop. During collaborative mode, the light curtain will be muted to allow for hand-guiding the robot. If an operator triggers a safety-stop by accident, the reset-button can restart the cycle to avoid production delays. Lamps function as a feedback device that communicates the state of the system, which allows the operator to respond suitably. Floor markings helps the operators recognize the operating boundaries of the collaborative workspace.

Pressure sensitive mats are used to monitor the presence of humans in the robot workspace triggers an emergency stop. This can occur if the operator fails to detect a person inside the robot workspace before engaging the mode-change button. Physical fences requires deliberate actions and does not allow for easy entry to a hazardous space, thereby mitigating risks associated with automation misuse.

Enabling switches A force sensor mounted on the hand-guiding tool allows the operator to move the robot by actuating it (Fig. 4). The hand-guiding tool is designed with enabling switches that must be engaged to move the robot thereby mitigating risks associated with Mode-error. This design feature is expected to avoid unexpected robot motion if someone accidentally collides with the hand-guiding tool or if the force sensor picks up nearby process disturbances. The placement of the hand-guiding tool behind the FWC ensures that the hands are at a safe position and also enables the operator to align guide-pins with the FWC.

Mode-change button The operator must engage the three buttons simultaneously, before leaving the collaborative workspace to engage the mode-change button. Engaging the three button switch marks completion of the current cycle and the operator will move out of the collaborative workspace. The mode-change button activates the light curtain and the robot starts the next cycle.

5.2 Assembly of under-body panels (UBP)

Fences, laser scanner, light curtain and reset button During automatic mode, the laser scanner monitors the robot and collaborative workspace, will result in a safe-stop when (1) An operator enters the collaborative workspace intending to carry out assembly task (Mode-error) and (2) An operator enters the collaborative workspace unintentionally (Loss in situational awareness). (3) An operator jumps over the fence (Automation misuse) to the robot workspace.

If the operator fail to complete the assembly task on time, the light curtain (Fig 3 [13]) will be triggered and will result in an emergency stop. This safety measure was introduced with an understanding that the reason for this failure maybe due to operator being clamped or stuck on the moving line or the robot.

If an operator triggers a safety-stop, a reset-button (Fig. 3 [6]) is used to restart the next cycle to avoid production delays. Warning Lamps placed at two ends of the workstation are interfaces to communicate the mode of the system. A red light during automatic mode, green light during collaborative mode which starts blinking when the line is about to reach its end position. To support operators in spatial awareness, floor markings aid them in visualizing the limits of the CW.

Enabling device They are attached to the electric nut-runner (Fig. 6) and should be engaged before entering the collaborative workspace. Engaging the enabling switch signals that the operator is ready to carry out tasks and mutes the laser scanner. The explicit action of engaging the switch enables the operators to be in control of this system-state and avoid being reliant in automation.

Mode change button After leaving the CW. the operator engages the mode-change button which starts the next cycle. This re-activates the laser scanner and the robot moves back into the robot workspace at high speed (Fig. 7).

Table 3 Description of risk reduction measures and their safety function used in the collaborative workstation
Full size table
Fig. 7
figure 7

Operator engaging mode-change after exiting the collaborative area

Full size image

6 Discussion

This section discusses the influence of human factors in safety of collaborative operations with large industrial robots.

6.1 Safety during automatic mode

The assembly cycle is initiated by the operator, where the robot in automatic mode (AM), completes tasks without human intervention. These sub-tasks can be calibrated to keep pace with the overall goals of the assembly plant by moving at suitable speeds in the robot workspace (RW).

Though automatic mode implies no human intervention, operators needs to be aware of the system-state. A loss in situational awareness might result in a safety-stop, when a human intentionally (mode-error) or unintentionally (loss in SA) enters the monitored space.

That is, accidental activation of safety-function to avoid production delays should be minimized. This can be achieved through: (1) Strategically located sensor placement, (2) Visible warning labels/signals and (3) Operator training. These measures can help to avoid but not prevent unintended activation of safety-stop and as noted in Table 3 (6), a reset button is used to start the cycle from its current position.

Table 4 Description of probable task sequence that justifies the use of an enabling device (ED) and mode-change button (MD) in the assembly of under-body panels (UBP)
Full size table

6.2 Initiating collaborative mode

When automated tasks are completed, the system changes its state to collaborative mode (CM). Collaborative mode is active when the monitoring sensors are muted and warning lamps turn from red to green. In case 1 (see Sect. 4.2), the hand-guided operation is implemented using sensor-based control, where the hand-guiding tool mounted on a force-torque sensor allows movement of the robot to be manually controlled by actuating the tool. The absence of an enabling switch can lead to a hazardous situation due to the following reasons:

  1. 1.

    While hand-guiding, the operator can be momentarily distracted and forgets that the sensor-based motion is active.

  2. 2.

    In a situation where the robot is left unattended, personnel in the vicinity or residual forces from nearby workstations can actuate the sensor and cause unintended motion of the robot.

The risks associated with unintentional or uncontrolled motion is very high and is attributed to the physical size of the robot. To mitigate these risks a requirement was defined where hand-guiding is active only if enabling switches are active. In addition to avoiding hazards associated with loss in situational awareness, the design ensures that both hands are at a predefined and safe location thereby eliminating the risk of crushing or clamping.

In case 2 (see Sect. 4.3), when the robot and the line synchronises, the system conveys that the CM can be initiated. This mode can be initiated either by (1) the operator engaging the enabling switch mounted on the nut-runner or (2) automation, thereby removing the need for an enabling device. The result is to mute the laser scanner so that the operator can safely enter the CW.That is, the level of automation determined by the designer sets the requirements for safety and these are programmed based on relevant parameters such as cycle time, assembly operation etc.

6.3 Initiating automatic mode

When collaborative tasks are complete, AM must be initiated safely. In case 1, when the robot is at the hand-over position, risk assessment pointed at a two-step procedure: (1) engage the three button switch (a deliberate action) and then (2) the operator goes out and engage the mode-change button. If the operator does not engage the three-button switch, the mode-change button does not activate the mode-change. A hazardous situation can exist under circumstances where personnel in the vicinity engages (mode-error) the mode-change button while the RW is occupied of if operator in charge of CO did not finish allocated tasks, or if the robot is outside the fenced space.

In case 2, an enabling switch (see Fig. 6) allows the operator to be in charge (improves trust) of the workstation as the operator can decide when mode-change occurs and also ensures that external actors does not influence proper functioning of the cell. However, the use of enabling switches along with mode-change button are tasks that operators must keep track off. The effectiveness of these feedback devices has been compared in Table 4.

7 Conclusion

Safeguarding solutions for two collaborative workstations were analysed to understand the underlying mechanism that can result in serious accidents or production delays. The analyses identified two problems associated with interaction between humans and automation, which are loss in situational-awareness and mode-awareness. The article highlights their role in safety and discusses design features that has the potential to improve comprehension of the system-state. To conclude, hazards associated with limitations in human cognition is an additional requirement to design a safe collaborative systems. Recognition of these limitations during risk assessment allows system integrators to develop safe and productive automation that can support operators in assembly tasks.