Speed and separation monitoring for cobot cells
A safety sensor that measures the gap, not the zone.
Safety-Cam looks down on a cobot cell, measures where the robot actually is every frame, and grades its speed by the distance to the nearest person. People share the cell. The robot slows as they approach and stops only when the separation says it must.
Top-down active stereo · depth in FPGA fabric · ISO 13849-1 PLd Cat 3 design target
Pre-certification prototype. The depth pipeline, illumination and safety link run on the bench today. Envelope-based separation is in development. What's built and what isn't
01 · The problem
Fixed zones size the whole cell for the worst case.
A laser scanner or light curtain guards a keep-out area drawn around everywhere the arm could ever reach. Anyone inside that line stops the robot, even when the arm is working on the far side of the table. The cell is only as collaborative as its largest zone, and every nuisance stop costs throughput.
Measure where the robot actually is, and the guarded area shrinks to the arm's current pose. The same person standing in the same spot no longer stops the line.
02 · How it works
Three steps, every frame.
- 1
Measure
Global-shutter stereo cameras look straight down on the cell under eye-safe 940 nm dot illumination. A stereo matcher built into the FPGA fabric turns every frame into a dense depth map, one pixel per clock cycle, with no operating system in the path. Seen from above, depth is a height map of the floor.
- 2
Separate
Anything taller than the floor learned at commissioning is occupied. Growing outward from the robot's base finds the robot's envelope, including the blind spot beneath the arm. Everything else occupied is treated as a person. A distance transform gives the shortest gap between the two.
- 3
Grade
The gap is compared with the protective separation distance from ISO/TS 15066, using the robot's own stopping time and a 1.6 m/s human approach speed. The result is one of five speed levels, sent to the robot controller 20 times a second over a checked safety link.
Thresholds come from the robot's stop parameters, not a drawing. If no valid safety message reaches the robot for 200 ms, the robot stops.
No joint feed from the robot
The envelope is measured, not reported. The sensor works with any arm and never relies on the robot to describe where it is.
Contact reads as STOP
If a person touches the robot, the two shapes merge, the gap reads zero and the output is a stop. The ambiguous case resolves to the safe one.
Faults fail to stop
Robot not found, floor drift, a moved camera, late frames or a stale link all drive the safe state.
03 · Architecture
Two diverse channels on one module.
Four global-shutter cameras face the same way over the cell, forming two stereo pairs that see the same scene. One AMD Kria K26 module carries two channels built from different technology: channel A decides in software on the lockstep R5 processor, channel B in isolated FPGA logic. Each has its own camera pair, isolated supply, watchdog and safety output. Either channel can stop the robot alone.
The depth pipeline is shared: one full-resolution matcher in the fabric serves both pairs in turn. Because it is bit-exact, a fixed test strip added to the top of every frame must produce a known answer, which catches permanent faults within one frame. Comparing channel A with channel B every frame catches the rest.
04 · Evidence
Measured on the bench, not modelled.
FPGA depth identical to the reference implementation, across 1,009,968 disparities
Pipeline latency is a fixed count of clock cycles, identical on every frame
Dense depth per frame, 128 disparity levels, every pixel
Measured fabric throughput per stereo pair today; continuous streaming raises the ceiling
The full verification story, timing closure and failure-mode analysis are in the technical documentation (access required).
05 · Status
Where it is today.
Running on the bench
- FPGA stereo pipeline with in-fabric rectification
- 940 nm flood and dot illumination with per-emitter power control
- Checked safety link to the robot, with a 200 ms timeout to stop
- Simulated 5-axis arm doing pick-and-place, slowed by the sensor
In development
- Envelope segmentation and gap measurement
- Safety monitor moving onto the lockstep R5 core
- Top-down mount, 100° optics and sub-pixel calibration
Next
- Physical robot-arm test cell
- Two-channel carrier: one K26 module, isolated supply per channel
- Certification: PLd Cat 3 is the design target; not yet certified
06 · Documents
Take the numbers with you.
Two one-page PDFs. Every value is marked as measured, target, estimate or derived, so you can see what is proven and what is still a design goal.
Sensing, detection range and resolution at a 3.0 m mount, safety rating, interfaces, electrical and environmental.
Safety functions, PLd Cat 3 targets (MTTFD, DCavg, PFHD), a worked separation distance, and the evidence behind each claim.
See it running.
The bench streams live depth and the speed level it is sending to the robot. Access is by request for cobot integrators, robot makers and technical due diligence.