: Japanese aged society is coming true and more and more conspicuous, and such a subject as the expansion of the field of work along with the enhancement of safety and the high degree of working life for the elderly and aged workers have become a matter of great concern. Recently, machines controled by software of ME (Micro-Electronics) have been prevailing at many working places. However, it is not always easy for aged workers to handle such ME machines, because the coordination between the aged workers and the ME technology is necessary. Therefore, a variety of software should be developed for the aged workers to have mental adaptation to such a new technology that would impose psycological stresses on them. A variety of hardware should also be developed that will compensate for the degrading ability of perception, such as vision and hearing, or performance such as physical power responces.
    The Ministry of Labour has long promoted the studies in the light of coordination on the ME technology with the aged workers since 1986, and the Research Institute of Industrial Safety, one of the agencies of the Ministry of Labour, has conducted the following researches under the joint program to develop ME technology for the aged workers: (1) Development of safety measures for securing safety of the aged workers, (2) Development of a robot manipulator for helping the aged workers in the use of ME technology. In this chapter of the report, the background of our studies and summary are presented.

:On the basis of probability, in which accidents are recognized as an unavoidable happening, 'safety' cannot be logically discussed and developed. In this report, logical safety is . approached.
    As safety goes with the information indicating the 'safety', the condition for constructing any reasonable safety operation system is that the information (safety information) must be transmitted 'unate'. This means that the extraction of safety information demands the introduction of the threshold logic into the operational space. In this report, the safety condition is logically defined in an operation requiring safety, and the definition of 'safety control system' is presented on the basis of the condition securing the safe operation.
    In the denned safety control system, interlocking as a fundamental element is logically developed under an energy transmitting model of interlocking. The model defines the condition of output signal in the interlocking. The interlocking indicates the truth that a practical safety system composes a phased structure, consists of a system in which safety information is transmitted 'unate', and a system in which the safety information is not necessarily transmitted.

Key Words: Safety, Safety System, Safety Control, Safety Control System, Interlocking, Fail-Safe,Energy Transmitting

: The safety control system has an interlocking structure, and its elements, i.e. AND gates and safety sensors, must have fail-safe characteristics. Therefore, in order to construct a safety control system such fail-safe devices are necessary. In this research, fail-safe devices were developed.
    These devices are divided into two groups. One is a group of elementary parts, such as Integrated Circuits, which are used to construct fail-safe devices. The other is a group of safety sensors, such as human detectors, which are commonly used in the safety system.
    These devices are summarized in the tables.

1. The ultrasonic sensor of pulse radar type have fail-safe features by self-checking. In every pulse emission, it examines itself. The construction of such sensor system and characteristics of sensor are described.
2. The conditions needed to photoelectronic sensors for safety are clarified. These are noise compatibility and multi-beam function. The logical structure of fail-safe photoelectric sensor is clarified, and the circuit diagram and failure analysis of fail-safe photoelectric sensor are indicated.
3. A safety mat of vibration type was developed in order to overcome the defects of safety mats of mechanical contact type and PCR type. The conditions for fail-safe mat and the principle of mechanical vibration are clarified. The characteristics of the mat are indicated.
4. Fail-safe AND gate is one of the most basic elements of fail-safe signal processing. The fail-safe characteristic is obtained by oscillation and excess over power source level. Its circuit diagram is indicated and failure analysis is conducted.
5. Fail-safe window comparator (WC) is also.one of the most basic elements of fail-safe signal processing. That distinguishs the signal between the upper and lower limits in a fail-safe manner. This is used for signal processing of sensors and makes a fail-safe sensor system. A circuit diagram with power supply and an input/output circuit is indicated and its failure analysis is conducted.
6. Fail-safe ON/OFF delay elements, which are the applications of fail-safe AND gate IC, have the delay function and the fail-safe feature. In ON delay the prolong of delay time is a safe side change and in OFF delay the shortening of delay time is a safe side change.
7. The intelligent relay is a relay system with fail-safe characteristic, i.e. a relay without deposition. The conventional non-deposition relay has a short life because its contact is weak for the sake of non-deposition. This is the improvement upon non-deposition relay. With the help of semiconductor switch, such as thyristor, it can have long life. Usually thyristor cuts off the circuit and in case of thyristor failure, the non-deposition relay will cut off the circuit.
8. The hold monitor is a device which monitors the hold condition of machinery. When it finds unexpected start of motion, it cuts off the electrical power supply. To say it more precisely, it allows power supply to the machine only in static condition and cuts off power in case of start of machine motion. The system configuration, the structure of mechanical window switch, i.e. mechanical hold monitor sensor, and the characteristics of sensor are described.

Key Words: Safety, Safety System, Safety Control, Interlocking, Fail-Safe, Safety Sensor

: Of the function of the man-machine interface of robot, those functions that are especially related to safety are described in this chapter. Based on the assumption that a human operator inadvertently makes mistakes when issuing commands to the robot, two types of interlocking are proposed for the remote control robot system. The robot system is equipped with a fundamental interlocking for safety monitoring on the robot side (i.e., fail-safe approach) and with a supplementary interlocking for exceptional tasks that cannot be covered by the fundamental interlocking (i.e., fool-proof approach).
    For many assembly operation, a manipulator is required to have dexterity, achieved by position, force and compliance control of high degrees of freedom, as well as tactile sensing. The manipulator controlled by pneumatic servomechanism, which was used by the authors to control the force and compliance can be achieved to add the reliability of the supplementary interlocking.
    This interlocking scheme that does not impair the safety of the operator when he makes mistakes is developed for the manipulator that can control the flexibility of operation over a wide range of conditions.
    In this chapter, a new type of pneumatic servo system comprises two analog airflow valves with an electric-magnetically driven plunger.
    The analysis and evaluation of this system are conducted. And examples are given to show the force and compliance control of the manipulator joins and artificial fingers.

Key Words: Manipulator, Pneumatic Control, Man-Machine System, Interlocking, Compliance, Servo Valve, Artificial Hand, Master-Slave System

: A logic-based safety system to faciliate the safety of the worker in a human-machine system is applied to several conventional working systems which have been, to some extent, problematical for safety. The safety system contains a fail-safe interlocking on the basis of a safety confirmation sensor which issues a work output permission to the machine, which predicts and confirms safety, and which samples safety confirmation. The summary of the effectiveness of safety construction is as follows:

1. Trouble-Shooting in Load Transferring Operation
       The trouble-shooting manipulator has the function of mechanical adaptation so that it can correct configuration of loads without breaking them. The operator can control the manipulator manually and safely by means of the monitoring system.
2. Wire-Sling Operation
       The safe system for wire-slinging, i.e. an automatic-balancer is developed. The automatic balancer is a system which can correct the unbalance of loads caused by worker's erroneous wire-sling.
3. Safe Operation of Self-Maneuvering Transportation
       Self-maneuvering transportation is a transportational means in part of the industrial field. A worker rides on the carriage and operate it for himself. The safety operation system is clarified from the view point of safety confirmation type.
4. Indicator Lamps on the Operation Panel
       Light Emitted Diode (LED) have been widely used. The luminance of LED on control panels is very low compared with that of incandescent lamp. In order to increase luminance of LED, many experiments were carried out. With the result of that, the high luminance LED with competitive brightness to incandescent lamp is developed.
5. Double CPU Controller
       A double CPU system is constructed to supervise the mulfunction of the CPU. If either of the WDT (watch dog timer) detects the failure of a CPU, the CPU is reset and stops execution.
6. Signal Diagonosis for Noise Rejection
       A signal diagnosis device on a trial basis has a function for distinguishing between a distortion less input signal and a distorted one due to an electro-magnetic interference 'EMI'. The device is confirmed by experiment to fulfil the above function and to prevent a runaway of electronic apparatuses.
7. Three Dimensional Human-Detection System
       The three-dimensional human detector that has multi-infrared-sensors of pyroelectric type can detect a human approaching the robot's movable area. The detector has a self-diagnostic circuit for confirming the normal operation of sensors.
8. Safe Operation of Automatic Guided Vehicles
       The safety aspects of the design of automatic guided vehicles (AGV) is considered, and the safe operation system of AGV from the view point of safety confirmation type is developed and evaluated.

Key Words: Safety, Safety Operation, Safety Control, Transportation, Self-Diagonosis, Human-Detection, Automatic Guided Vehicles

: The strategy for ensuring the safety of man-machine systems is:
    1) To incorporate a fail-safe mechanism, and if this is not feasible, 2) To apply a fault-tolerant configuration, and 3) To execute equalitative and quantitative systems analyses.
    In this paper, first of all, the concept of hazard-space and hazard-sets is introduced in accordance with the A-C model hazard-production theory, and the definition of a fail-safe system and a fault-tolerant system is generalized, which results in the system condition for structuring the fail-safe mechanism in a system.
    Next, an actual man-machine system, which consists of aged workers and movable lifters for supporting the workers, is assumed. And the main hazards of lifters to the workers, which are produced during the operation of lifters, are identified , and hazard-control systems are structured using an A-G model. The applicability of a fail-safe mechanism to the hazard-control systems is explored systematically, and three design tactics for the hazard-control systems are presented. Then, qualitative and quantitative systems analyses are implemented using fault-tree analysis, and how to obtain the optimam design tactics is shown. Finally, the effectiveness of the hazard control systems is assessed by evaluating the statistically-expected-number of occurrences of the system failures (top event of the fault-tree) and compared with the residual risks of other systems.

: In this report, the safety control, technology on the principles of safety is evolved. The safety condition is logically defined in an operation requiring safety, and the definition of 'safety control system' is presented on condition that the safe operation is secured. In the defined safety control system, interlocking as a fundamental structure is logically developed using an energy transmitting model.
    Safety control system has an interlocking structure, and elements for the system, i.e. AND gates and safety sensors, must have fail-safe characteristics. Fail-safe AND gates, fail-safe safety sensors and fail-safe signal processing circuits were developed.
    The pneumatic manipulator whose output force and compliance can be controlled by servomechanism was developed. This can promote the reliability of supplementary interlocking. In this interlocking scheme the manipulator does not impair the safety of the operator even If he makes mistakes. Because of the decrease in operator's load, aged workers can operate the manipulator.
    The safety control technology is applied to the following industrial systems.

1. Trouble-shooting in load transferring operation
2. Wire-sling operation
3. Safe operation of self-maneuvering transportation
4. Indicator lamps on the operation panel
5. Double CPU system
6. Signal diagnosis for noise rejection
7. Three dimensional human-detection system
8. Safety operation system of automatic guided vehicles

    Systematic safety assessment of movable lifters is implemented using an A-C model.