Improving Safety of Human-Robot Interaction Through Energy Regulation Control and Passive Compliant Design

Modern production processes continuously require enhancement in production time and the quality of the products. The use of robots in this field of application has formed an increasingly important aspect of the drive for efficiency. These robots typically work in restricted areas to prevent any harmful interaction with humans and are designed for repeatability, speed and precision. However, new opportunities are arising in homes and offices that mean that robots will not be confined to these relatively restricted factory environments and this sets new demands in terms of safety and ability to interact with the environment. These new requirements make industrial heavy and stiff manipulators controlled with high gain PID controllers not suited to cooperate and work closely with humans. In order to cope with this, impedance control (Hogan, 1985; Ikeura and Inooka, 1995; Zollo, Siciliano et al., 2002; Zollo, Siciliano et al., 2003) for decreasing the replicated output impedance of the system to safe values and safety-oriented control strategies (Heinzmann and Zelinsky, 1999; Bicchi and Tonietti, 2004; Kulic and Croft, 2004) to react safely when a Human-Robot Interaction is detected have been introduced. The mentioned control algorithms work well for slow interaction transients and within specific frequency bands, however when the frequencies are above the closed loop bandwidth of the robot, these strategies are ineffective in reacting safely making the resulting system to be dangerous. When a sudden and fast impact occurs, the output impedance of the robot is dominated by the link and the rotor reflected inertia. This latter term is usually high due to the high reduction ratio of the gear making the overall robot output impedance large and dangerous meaning that the system’s safety is once again compromised. An alternative to this “active” approach is the incorporation of intrinsically safe structures particularly focusing on the actuation systems design. Several actuator prototypes have been developed embedding either passive compliant elements in the structure (Pratt and Williamson, 1995; Sugar, 2002; Yoon, Kang et al., 2003; Hurst, Chestnutt et al., 2004; Zinn, Khatib et al., 2004; Hollander, Sugar et al., 2005; Tonietti, Schiavi et al., 2005; Schiavi, Grioli et al., 2008; Tsagarakis, Laffranchi et al., 2009; Catalano, Grioli et al., 2010; Jafari, Tsagarakis et al., 2010; Tsagarakis, Laffranchi et al., 2010) or, more recently, clutches/damping devices (Lauzier and Gosselin, 2011; Shafer and Kermani, 2011) to decouple the link (i.e. the part usually interacting with the human) from the rotor during interaction with either the environment

or people.Considering the first class of actuation devices, compliance is not only beneficial from the safety perspective but it also can be used to gain higher energy efficiency levels (Jafari, Tsagarakis et al., 2011), as protection from shock loads, (Kajikawa and Abe, 2010) or to achieve mechanical power peaks which could not be obtained with a stiff structure (Laffranchi, Tsagarakis et al., 2009).Series Elastic Actuators (SEAs) are a particular class of actuators with passive compliance (Pratt and Williamson, 1995;Sugar, 2002;Zinn, Khatib et al., 2004;Hollander, Sugar et al., 2005;Tsagarakis, Laffranchi et al., 2009).They employ a fixed stiffness passive elastic element located between the actuator-gear group and the output link.The introduced decoupling action makes the high frequency output impedance to be dominated by the link inertia only, removing the effect of the actuator's reflected inertia which dominates in rigid robots.In addition, its main disadvantage of the preset passive mechanical compliance can be at some degree minimized by combining the unit with an active stiffness control.From what has been mentioned previously it can be concluded that the implementation of a safety-oriented control algorithm on an inherently compliant system (e.g.SEA) can guarantee the safety of the Human-Robot Interaction over the frequency spectrum.
Although no standard is defined for such "human friendly" robots1 , the safety of a robotic structure is usually characterized by means of safety indexes which were developed in fields that are different from robotics.A well known safety criterion is the Head Injury Criterion, or HIC (Versace, 1971) which was born in the automotive industry and has been used in robotics in (Haddadin, Albu-Schaffer et al., 2008;Bicchi and Tonietti, 2004;Zinn, Khatib et al., 2004).These indexes are based on tests made on human and animal cadavers consisting in the replication of collisions where the orders of magnitude of the physical variables (e.g.velocity) are significantly different from those of a generic robotic system.In addition, the computation of this index uses only the acceleration of the head during the impact, without taking into account the sequence of events and the boundary conditions.For instance, it does not distinguish between the case of a collision with a free head or a collision with a clamped head, despite the fact that the risks are very different for the two cases (Haddadin, Albu-Schaffer et al., 2008).It is clear from the above that these criteria are not suited to characterize the safety of a robotic system.In addition, as far as the HIC is concerned, the complexity and the computation requirements of this index make difficult the real time implementation of this criterion within the control system of a robotic device in order to ensure safety.
Motivated by these demands this Chapter presents an approach which enhances Human-Robot Interaction safety by combining a passive compliant actuator with a control technique, based on the regulation of the energy stored in the robotic system, with the aim of limiting this energy to specified safe energy thresholds.These maximum safe values are obtained by analysing collisions against a constrained and a free head and experimental data of energy absorption to failure of cranium bones and cervical spines.The proposed Energy Regulation Control (ERC) has been applied on a series elastic actuator (SEA) to evaluate the presented concept.ERC is a position-based controller that modifies the trajectory reference as a function of the maximum energy value imposed by the user.The Improving Safety of Human-Robot Interaction Through Energy Regulation Control and Passive Compliant Design 157 proposed control method is designed, simulated and tested on a prototype series elastic robotic joint.The experimental results show the capability of the combined unit in limiting the system stored energy to the maximum set threshold.The presented strategy is designed, simulated and evaluated on a prototype series elastic robotic joint.The paper is structured as follows: the critical human-robot interaction scenarios considered in this work are analysed in Section 2 which also reports on the calculation of the safety thresholds and on the energy exchange during collisions.Section 3 introduces the dynamic model of the series elastic actuator prototype used in this work and the energy regulation control scheme.Section 4 presents a simulation analysis with section 5 validating the effectiveness of the control strategy by means of experimental results.Section 6 covers the conclusions and future work.

Critical scenarios in human-robot Interaction and related safe energy thresholds 2.1 Critical human-robot collision scenarios
In this study, the collision between the robot and the human head is considered as a reference case since the head is one of the most delicate parts of the human body.Two collision cases are analyzed.In the first case, Figure 1a, the robot is colliding against a clamped head, while in the second case the robot is colliding against a free head which can therefore accelerate after the collision with the robot link.In the first case the impact forces are only exerted on the skull bones, while in the second case, after the first stage of the impact, the head can be subject of high acceleration/velocity motion exerting stress on the neck that can be equally or more significant than the stress exerted on the skull bones.In the first case the energy absorbed by the human cranial bone is examined, while for the second case it is useful to take also into consideration the energy absorbed by the human upper cervical bone.

Safe energy thresholds for the cranial bone in the constrained head collision scenario
Data on the amount of energy required to cause the failure of the cranial bones can be found in (Wood, 1971;Margulies and Thibault, 2000).In (Wood, 1971) skulls of adult humans were exposed to dynamic tests with stress rates ranging from 0.005 s -1 to 150 s -1 .The results show that the energy absorbed to failure is constant over the frequency spectrum (Wood, 1971) meaning that this parameter is independent of the collision velocity.The above suggests that bounding the energy level of the robotic device can be a suitable strategy which can guarantee low accidental risks during collisions between the robot and the human.From (Wood, 1971) the linear regression of the values of energy absorbed to failure measured in 120 specimens over the spectrum returns an energy/volume ratio of ε failure_adult ≈ 0.29 mJ•mm -3 .
The volume of the cranium can be computed using the following formula from (Manjuath, 2002): Where L is the maximum antero-posterior length of the skull, B is the breadth and H is the height.For the typical adult skull L = 196 mm, B = 155 mm, H = 112 mm (Tilley and Associates, 1993).By multiplying (1) with the energy/volume ratio, the energy level that can cause the failure of a typical adult skull can be derived to be equal to: The above energy level is just an indicative value of the energy required to break a typical adult human skull.In this work a more conservative level is considered in order to prevent not only the failure of the skull bone but also to minimize the risk of a serious injury.Such a conservative level can be the energy required to produce the same effects on an infant human head instead of an adult human head.In contrast to the stiff adult cranium, the infant skull is a compliant structure capable of substantial deformation under external loading and is thus much more delicate.In (Margulies and Thibault, 2000) experiments were carried out to check the rupture of the three-point bending at two velocity rates: in a first case a quasi-static excitation is forced on the cranium with the velocity of the loading nose equal to 2.5mm/min (42.3•10 -6 m/s), while in the second case the loading nose is moving at a velocity that is 2540mm/min (42.3•10 -3 m/s).(Margulies and Thibault, 2000) In the case of the "slow" loading nose the amount of energy absorbed is smaller if compared with the other case.In contradiction to the human adult cranium case, the absorption of energy to failure is a function of the strain rate and, of course, of the age of the infant (Fig. 2).

Improving Safety of Human-Robot Interaction Through Energy Regulation Control and Passive Compliant Design 159
As expected, the energy absorbed to failure in this case is smaller than that of the adult human head and equal to ε failure_child ≈ 0.16 mJ•mm -3 .This is the mean value of the results obtained from specimens of 6 months old infants (Margulies and Thibault, 2000), see Fig. 2.
The typical volume of infant skulls can be found in (Sgouros, Goldin et al., 1999).For a 6months old infant this is equal to: Therefore, the level of energy that can cause the failure of a typical 6 months old child skull is equal to: It is reasonably lower compared with the one shown in ( 2) and therefore far from the dangerous energy levels required to seriously injure the cranium of an adult human being.

Safe energy thresholds for the cranial bone in the free head collision scenario
Injuries to the cervical spinal cord are of special concern, because damage in this region may result in deficits ranging from slight motor and sensory losses in the lower limbs to complete quadriplegia and lifelong ventilator dependency.

Analyzed structure Energy [J]
Clamped case Adult cranium 517 6-months old infant cranium 120
In (Bilston and Thibault, 1995)it has been shown that, during normal human head motion, quite large axial strains occur in the cervical spinal cord, although these probably occur at low and not dangerous strain rates.However, during accidental sudden impacts strains in the spinal cord occur very rapidly, resulting in temporary or permanent loss of neural function that is closed to the injured region.Measures of the level of the absorbed energy that may cause the failure of the cervical spinal cord can be found in (Yoganandan, Pintar et al., 1996).An average value for this parameter experimentally estimated using 7 intact adult specimens is The value in (5) represents a mean energy value which takes into account different kinds of pathologies, from the disruption of ligaments to the fracture of certain bones of the cervical spinal cord.It can be noticed that this value is much smaller than those in (2) and ( 4).This implies that from the energy absorption and failure point of view, the neck is a much more delicate structure compared to the cranial bone.
Table 1 summarizes the minimum absorbed energy levels, which may cause critical injuries in a human head or neck, during accidental collision of the clamped or free human head with a robot.

Energy regulation control
The basic concept of this control strategy is to limit the energy stored into the structure of the robot2 (joint and link) in safe levels below those introduced in section II.During the accidental collision the worst case condition is assumed, that is, all the energy stored in the link is transferred to the collided body.The proposed energy regulation control was implemented and evaluated on a single SEA joint.The employed actuator consists of three main components: a typical brushless DC motor, a harmonic reduction drive and the rotary passive compliant module.
Fig. 3.The CompAct SEA mechanical conceptual schematic.
These three components can be represented by the mechanical model shown in Fig. 3.The model is composed of the rotary inertia and viscous damping of the rotor J r , D r , the gear drive with reduction ratio N, the elastic module with an equivalent spring constant of K s , the output link inertia and axial damping coefficient J l , D l .In addition, θ r , θ are the motor mechanical angles before and after the reduction drive, q is the angle of the output.Finally, τ r is the torque provided by the actuator while τ j is the input torque of the elastic element and τ l is the torque imposed to the system by the load and/or the environment.
The above system can be described by the following set of dynamic equations.
 

Trajectory shaping based on energy regulation control
Considering the scenario of a single DOF robotic system, based on the actuation unit of Fig. 3, (Tsagarakis, Laffranchi et al., 2009), interacting with the body of the human operator as shown in Fig. 4, the amount of energy stored by the generic robot link body shown in Fig. 4 is: where ε k is the translational and rotational kinetic energy, ε e is the elastic potential energy and ε g is the gravitational potential energy.The energy stored into the prototype link as function of the parameters of the joint model introduced in Fig. 3 is: where the additional introduced parameters are the mass of the link m L , the acceleration of gravity g and the distance between the axis of rotation and the center of gravity of the link l COG.Furthermore, the angle θ S corresponds to the compression angle of the compliant element such that: Imposing an upper bound ε max to the total stored energy results in: From the above energy limit ε max the limit of the spring deflection angle θ S can be derived from ( 9) given the instantaneous kinetic and gravitational energy stored in the link: However, (12) gives a solution only if the term under the square root is greater than zero, i.e. when the total energy stored is dominated by the elastic potential energy, which is the case when an unexpected collision occurs.The term under the square root is negative when the sum of the kinetic and the gravitational potential energy is greater than the maximum energy allowed.Assuming that the robot manipulator is designed for safety, the maximum gravitational potential energy stored would be much smaller than the maximum energy threshold, and thus the condition in which the term becomes negative would be when the total energy stored is dominated by the kinetic energy, which is the case of a free motion at a velocity that makes the kinetic energy to reach the energy threshold ε max .
In this case and given the current angle θ, the term described by ( 12) is used to generate a new reference angle according to (13).In particular, (13) uses a proportional control law to regulate the reference trajectory.During the interaction the trajectory regulation law uses the difference between the instantaneous spring deflection angle θ S and the maximum deflection angle θ SMAX given by ( 11).For the free motion case the correction term of ( 12) is used to compute the modified reference trajectory of the joint θ D_MOD from the measured angle θ.The combined trajectory regulation law for both cases can be expressed as: where the term K p_INT is the proportional gain used for the interaction case and K p_FM is the proportional gain used for the free motion case.When the total energy stored exceeds the maximum allowed, the control system switches the value of the reference angle θ D to the modified one in function of the detected condition, according to (13).When the total energy stored is lower or equal than the maximum allowed, the system switches back to the reference value of the desired trajectory angle θ D .
Table 2 reports how the sign of the terms introduced in ( 12) and ( 13) is determined.When the condition ε e > ε max -ε k -ε g > 0 is verified the case of "possible interaction" is detected, whereas ε max -ε k -ε g < 0 identifies the condition of "possible free motion".
To prevent the high frequency components, introduced by the switching between reference trajectory and the safety imposed value, from entering the servo loop, a weighted mean between the desired trajectory angle θ D and the modified reference trajectory of the joint θ D_MOD was implemented.The signal "Enable" is the switching signal generated from the results of the comparison between the total energy stored, ε tot and the maximum energy threshold ε max .This signal, is low-pass filtered to give ME (Mean Enable), which is used as a weight for the "Weighted mean" block.The filter in Fig. 5 is an adaptive first order filter with bandwidth set in function of the difference between θ D and θ D_MOD .In detail, the pole of this filter is set to In this way, the maximum value of the derivative of the position reference (velocity) is limited to a maximum value MAX   obtained from a safety-based criterion (in this case, MAX θ  is the velocity that makes the kinetic energy to reach the maximum allowed ε MAX ).This makes the controller to not to inject large magnitude commands that can result unsafe during transitions from θ D to θ D_MOD and vice versa.The signal θ' 0D is the output of the block "Weighted Mean" and is given by _ '( 1) The overall energy regulation control scheme is shown in Fig. 6.

Simulation results
Simulations are carried out to validate the effectiveness of the introduced ERC scheme.The model used for the simulations is linear and does not take into account torque, velocity, current saturations to make the system free from these effects to better evaluate the efficacy of ERC.The simulation consists in setting a sinusoidal reference trajectory θ D with frequency of 2 rad/s and amplitude of 5 rad to the ERC-controlled system at the same time applying an intermittent output torque disturbance (amplitude: 20Nm, frequency 1.57 rad/s) to simulate accidental collision/interactions.The energy threshold ε MAX was set to 3J which is much lower than the safe values reported in Tab. 1 to trigger the ERC with link/motor velocity or spring deflection angle values well within the available ranges of the real system.The reason for this is that given the intrinsically safe properties of the actuator used for this study (i.e.soft and lightweight), these safe energy thresholds are reached only for extremely large deflection angles (potential energy storage) and/or velocities (kinetic energy storage).
Figs. 7a, 7b show the modification of the trajectory reference due to the action of ERC.The modified trajectory reference is different from the desired trajectory reference.The maximum differences these two values occur when the velocity of the link is maximum (high kinetic energy storage, Fig. 7c) and/or with the external torque disturbance, which determines a high elastic energy storage due to the deflection of the compliant element.The sinusoidal position reference has been planned such that the corresponding velocity level could grow over the energy limit and trigger the ERC.Fig. 7c presents each component of the energy stored in the link.When no external torque is applied ERC acts mostly on the kinetic energy (the deflection angle is very small in this case due to the high stiffness/inertia ratio, K S = 190 Nm•rad -1 J l = 4.98•10 -3 kg•m 2 ), however, when the disturbance collision torque is applied, the regulation is made on the overall energy.At the same time, the gravitational potential energy is almost equal to zero due to the lightweight link.

Experimental results
Experiments were conducted in order to verify the performance of the energy regulation control scheme introduced in the previous sections.The experiments were performed using the prototype actuation unit (Tsagarakis, Laffranchi et al., 2009) shown in Fig. 8. Two potentially risky scenarios were analyzed: the case of free motion at a high velocity and that of an accidental interaction.For both cases the highest contribution on the total energy stored into the actuator is given either by the kinetic (free motion) or the elastic potential energy (unexpected interaction).The gravitational potential energy is not giving a relevant contribution to the overall energy, this is because this system has a lightweight link (m L = 0.41 kg) contributing with a maximum value of ε g_max ≈ 0.45J when the link centre of gravity is at its highest position.

Free motion experiment
In the first experiment the joint performed a free motion driven by a sinusoidal trajectory with the parameters shown in Table 3.The parameters of the reference trajectory were selected to make the system exceed the maximum energy in order to demonstrate the control action of ERC.
In this case, apart from the gravitational potential energy that is very small due to the light weight link, the elastic potential energy is also close to zero since the deflection of the spring is minimum during the free motion due to the high stiffness -link inertia ratio (K S = 190 Nm rad -1 ; J l = 4.98•10 -3 kg m 2 ).Therefore the overall energy is determined by the kinetic energy.Fig. 9a shows the energy components of the joint.

Parameter Value
Amplitude of the trajectory reference A 0.92 rad Frequency of the trajectory reference ω 0.32Hz Maximum energy value imposed ε max 0.8 J Table 3. Parameters of the free motion experiment.As expected the overall energy is very close to the kinetic energy.In Fig. 9b it can be seen how the link velocity trajectory is limited in order to constrain the total energy of the system within the maximum set value.As the trajectory velocity exceeds 1.5 rad/s the control adjusts the reference in order to limit the total energy.As the trajectory velocity becomes smaller than the 1.5 rad/s threshold the reference velocity trajectory is tracked again.
Improving Safety of Human-Robot Interaction Through Energy Regulation Control and Passive Compliant Design 167

Unexpected interaction experiment
In this experiment the motor was commanded to follow a sinusoidal trajectory while interactions were generated within the range of motion of the link using a soft obstacle made of polyethylene, Fig. 10.
The trajectory parameters and the energy limit applied are illustrated in Table 4.The maximum imposed energy was set equal to 0.8J, which is much smaller than the values shown in Table 1.This was done in purpose in order to test the behaviour of the control system avoiding big force-torque exchanges that can damage the test equipment.
It can be observed that during interaction the kinetic energy drops to zero as a consequence of the decrease of the velocity of the link.The potential energy grows accordingly with the deflection due to the impact, making the overall energy to exceed the maximum allowable value.In this case the control works to limit the elastic potential energy, because the kinetic energy and the gravitational potential energy are constant due to the fact that the link is not in motion.Fig. 11b shows how the trajectory angle is modified in order to achieve the goal.

Conclusions and future work
In this paper a safe-oriented strategy to control a SEA system was presented.By combing series elastic mechanical design and energy regulation control an approach to cope with the problem of safety during the first instants of the impact, (i.e. the problem occurring in rigid torque-controlled robots) is proposed.The specific case presented here can be extended to a generic compliant actuation design.
The presented technique constrains the energy stored into the robotic link to a maximum value that is derived by a safety criterion.The proposed control scheme is a position based controller that adjusts the trajectory reference position as a function of the desired maximum energy threshold using the states of the system.The overall system was experimentally evaluated using a prototype SEA unit.
Future developments will include the formulation of ERC for multi degree of freedom systems and the implementation of the resulting scheme in a robotic arm.The manipulator on which this method will be tested has to be designed following safe-oriented criteria (e.g.soft and lightweight): this will allow lower amounts of energy storage which would be well below the energy safe thresholds.In such a case, performance (speed, dynamics) will not be limited during the execution of normal operations.The described ERC-controlled robot will be then used to carry further experiments to characterize the energy losses occurring during unexpected interactions to validate the safety level of the presented control strategy.A last research to be investigated in the future is the use of Energy Regulation Control in compliant actuators with variable physical damping such as VPDA systems, (Laffranchi, Tsagarakis et al., 2010;Laffranchi, Tsagarakis et al., 2011).ERC can be revised to exploit the passive properties of physical damping to safely dissipate excess of stored energy.
Fig.2.Energy absorbed to failure versus age -human cranial bone in three point bending,(Margulies and Thibault, 2000) Fig. 4. Conceptual mechanical schematic of a series elastic actuator interacting with a human.

Fig. 7 .
Fig. 7. (a) Position and (b) velocity trajectory modifications due to ERC.(c) Trend of the different components of the stored energy.

Fig. 8 .
Fig. 8.The actuator used for the experiment -Free motion experiment.