- Define modules using part families, functional differences, loads and maintenance needs to manage the complexity of common and dedicated components.
- Verify positioning, locking, all six force/moment components, utility connections, tool presence and tool identity at the quick-change interface.
- Error-proofing must compare the target vehicle model, actual workpiece, installed tool, control recipe and storage location.
- Changeover time includes the complete tool change, first-piece confirmation and abnormal-event recovery. The locking action is only one component.
00Executive summary
Handling multiple vehicle models on a shared line requires gripping functions to change with part geometry, mass, center of gravity, contact areas and process orientation. Compare end-effector weight, operating envelope, maintenance difficulty, abnormal modes, investment and footprint together. This article organizes the design into five layers: a common load-bearing body, standardized interfaces, model-specific functional modules, storage stations and recipe control. Mechanical, electrical, pneumatic/vacuum and information-based error-proofing are implemented at each interface and throughout the changeover process.
Research on reconfigurable automotive assembly systems emphasizes responding to changes in products and volume through module selection, system integration, and reconfiguration strategies [1]. ISO 11593:2022 provides a terminology framework for automatic end-effector exchange systems [2]. Mechanical flanges may reference the dimensions and marking requirements of ISO 9409-1:2004, but that standard expressly does not specify other requirements or the load capacity of a quick-change device [3]. Use of a standardized flange therefore does not by itself establish the safety, stiffness, or load capacity of the quick-change system.
Key findings
- Set modular boundaries using part families, functional differences, load envelopes and maintenance strategy, identifying functions that can be shared and those requiring separate configurations.
- Verify positioning, locking, load capacity, stiffness, utility transfer, lock/unlock feedback and tool presence at each quick-change interface. A single locked signal cannot detect every error.
- Error-proofing must check consistency among the planned vehicle model, actual workpiece, installed tool, control recipe and storage location. Sensor faults and attempted manual bypasses must not permit unsafe operation.
- Permit unlocking only when the tool is safely docked, the load has been removed, motion has stopped and a valid authorized command is present.
- Cycle-time assessment covers the individual part cycle, complete changeover, first-piece confirmation and abnormal-event recovery. Required confirmation steps must not be removed to shorten changeover time.
01Problem definition and module boundaries
This article addresses changeover design for mechanical jaws, suction beams, support arms, internal-expansion grippers and locating modules used with automotive door panels, headliners, instrument panels, seats, battery packs and glass. The modules may be fitted to pneumatic industrial manipulators, industrial robots or dedicated handling machines. The scope covers end-effector modules and changeover procedures; production-sequence optimization for the entire mixed-model line is a separate task.
First establish part-family data: record each model/part's mass, center of gravity, inertia, permitted contact areas, prohibited and restricted areas, pick and place orientations, path envelope, cycle time, quality requirements and abnormal states. Then group parts by the same load-transfer principle + similar interfaces + shared verification boundaries. Parts with entirely different load paths or safety functions require different modules or separate equipment; they must not be forced into a common configuration.
| Architecture layer | Main responsibilities | Defined design requirements |
|---|---|---|
| Common load-bearing body | Provides rated load capacity, degrees of freedom, balancing and basic control | Maximum load/moment, interface location, envelope |
| Primary quick-change interface | Repeatable positioning, locking, utility transfer and signal transmission | Mechanical datum, locking principle, capacity, and service life |
| Model-specific functional module | Contact, locate, and clamp or grip the specific workpiece by suction | Contact area, clamping force, module ID, restricted area |
| Storage station | Supports offline tools and allows safe coupling/decoupling | Guidance, presence detection, docking, cleanliness, and collision prevention |
| Recipes and traceability | Vehicle model identification, tool authorization, parameters and records | Version, permissions, verification, changes and logs |
02Mechanical and load design of the quick-change interface
Design location and locking separately in quick-change interfaces. Locating elements establish a repeatable datum; locking elements provide preload and carry loads. Fastening screws must not serve directly as precision locating references. Load verification must cover all six force/moment components, combined moments, impact, fatigue and stiffness. Rated payload mass is only one selection input.
U = |F_x|/F_x,allow + |F_y|/F_y,allow + |F_z|/F_z,allow + |M_x|/M_x,allow + |M_y|/M_y,allow + |M_z|/M_z,allowThe equation above illustrates a conservative normalized utilization calculation. For product selection, use the manufacturer's combined-load curves or a validated model, accounting for dynamics, service life, eccentricity and safety factors in the allowable values. Verification must include the tool changer, manipulator flange, adapter plate and module frame to cover the complete load path.
02.1 Positioning, locking and pressure-loss behavior
Published tool-changer documentation describes lock/unlock position feedback, tool-presence or ready-to-lock signals, and mechanically retained or fail-safe locking arrangements [4][5]. Use these features as architecture references and verify their integration for the application. Loss of locking pressure may impair positioning accuracy even when the mechanical lock prevents the tool from detaching. Motion should therefore normally stop, with locking verified again after pressure is restored [4].
| Mechanical properties | Design issues | Verification method |
|---|---|---|
| Repeatable positioning | Is TCP/datum drift acceptable after repeated changeovers? | Coordinate measurement after repeated changeover cycles |
| Locking capacity | Retention after worst-case eccentric loading, emergency stop, and service-life cycling | Static load, dynamic, durability and pressure loss tests |
| Mechanical error-proofing | Can the wrong direction/wrong module be physically inserted? | Trial assembly in reversed and offset positions and with similar modules |
| Docking support | Whether the tool is fully supported by the station before unlocking | Docking sensing, load removal, and unlocking test |
| Contamination tolerance | Do welding slag, oil, and dust affect positioning/connection? | Cycle testing under specified contamination conditions |
03Utilities, signals and tool identification
Provide standardized pneumatic, vacuum, power, communication and cooling connections according to module needs. Seal unused ports or explicitly disable them in the recipe to prevent incorrect connections and leakage. For electrical interfaces, assess coupling sequence, connection/disconnection under power, arcing, pin damage and contamination. For pneumatic/vacuum interfaces, assess residual pressure, cross-connection and seal life.
Tool identification may use mechanical coding, independent discrete codes, RFID, memory chips or network device identities. High-risk applications should not rely solely on an easily copied text label. With n-bit discrete codes, a minimum Hamming distance of 2 between valid codes detects any single-bit error; correcting single-bit errors requires a minimum distance of 3. Combine identification with tool-presence detection, lock verification and mechanical interface error-proofing.
Run_Enable = Locked ∧ Tool_Present ∧ ID_Valid ∧ (Tool_ID = Target_ID) ∧ Utilities_OK ∧ Recipe_ValidRecipe validation must check the identifier, version, approval status, integrity and applicable workpiece version together. If the network is unavailable or identities conflict, the system must not enter automatic/production motion and must provide diagnostic information for troubleshooting.
04Error-proofing from production planning to motion permission
Apply error-proofing throughout tool retrieval, installation and preparation for operation. Check consistency among five items: the target model/part, the actual workpiece, the tool retrieved from storage, the tool detected at the quick-change interface and the recipe loaded by the control system. If any item disagrees, the system must remain in a recoverable state and must not bypass the check to proceed.
04.1 Error-proofing layers
- Mechanical error-proofing: Asymmetric pins, keys, profiles and connectors prevent incorrect modules from being fully inserted.
- State checks: Detect tool presence, readiness to lock, locked and unlocked positions, supply pressure/vacuum and storage-station status.
- Identity checks: Match the module ID to the target vehicle model, identified workpiece and recipe.
- Sequence checks: Inhibit unlocking until the tool is docked and unloaded and motion has stopped. Inhibit departure until locking is verified.
- Management controls: Assign unique module IDs and storage positions, perform inspections and post-repair verification, and approve software versions.
| Error scenario | Required inhibition | Verification records |
|---|---|---|
| Incorrect tool presented to the primary interface | Mechanical key or identity mismatch | Misinstallation test, ID log |
| Tool unlocked before it is fully docked | Docking/load-removal interlock | Partially docked fault injection |
| False lock feedback | Complementary lock/unlock signals, tool presence, and pressure/position plausibility | Stuck-signal test |
| Correct tool loads wrong recipe | Three-party verification of tool ID, target workpiece and recipe version | Recipe mismatch testing |
| Similar tool placed in the wrong storage position | Station/tool ID checks and matching physical profile | Misplaced storage test |
| Tool size drift after repair | Maintenance-status interlock and gauge or calibration confirmation | Maintenance release record |
05Changeover state machine and safety control
Organize the changeover state machine in this sequence: end production, clear the load, return to the safe changeover position, dock the tool, confirm load removal, permit unlocking, unlock and withdraw the master side. Then confirm the target station, approach the target tool, prepare to engage, lock and verify locking. Finally, validate tool ID/media/recipe, perform unloaded function checks, confirm the first piece and release for production.
Unlock permission is a safety-critical function. Require the tool to be in the correct storage station and fully supported, the end load to be zero or within the specified range, carrier motion to have stopped, orientation to be permitted, personnel/area conditions to be satisfied, and the authorized command to be valid. Conflicting lock signals or communication loss must stop the changeover and inhibit departure.
ISO 10218-2:2025 covers integration, commissioning, operation, maintenance and decommissioning of industrial robot applications and robot cells [6]. Include the end-effector tool changer in the complete-machine risk assessment. For pneumatic industrial manipulators and other non-robotic equipment, the same system-level approach can inform the assessment alongside the applicable regulations and equipment standards.
06Cycle time, availability and module selection
Changeover performance should be evaluated using total lost time:
T_change,total = T_clear + T_return + T_dock + T_unlock + T_pick + T_lock + T_verify + T_recipe + T_first-pieceChoose the number of modules based on model combinations, changeover frequency, cycle time, reliability, end-effector weight and maintenance inventory. Too few modules increase adjustment and incorrect-setting risks; too many increase investment, storage and maintenance burdens. Compare alternatives using the complete changeover loss on a consistent basis, rather than judging efficiency solely by the locking time.
06.1 Example decision matrix
| Option | End-effector weight | Changeover time | Error-proofing complexity | Suitable applications |
|---|---|---|---|---|
| Single adjustable tooling | High or medium | Low | Adjustment-position error-proofing is more demanding | Small part differences and frequent changeovers |
| Common body + quick-change modules | Medium | Medium/low | Clearly defined interface and identity checks | Functions are modularizable; many vehicle models |
| Multiple complete tooling sets | Low/medium | Medium | Primarily tool-selection checks | Large differences; high value per module |
| Separate equipment | Optimize by workstation | No mixed-line changeover | Clearly separated systems | Loads/risks/paths vary greatly |
Also record changeover fault-recovery time and first-pass yield when comparing options. Reconnection, recalibration and manual alarm bypasses affect overall availability; a short nominal changeover time does not necessarily mean low operating losses.
07Verification matrix and FMEA
| Verification Item | Test conditions | Records | Acceptance criteria |
|---|---|---|---|
| Repeatable positioning | Repeated changeovers at specified temperatures and service-life intervals | TCP/datum deviation | Process tolerances are met and trends are stable |
| Lock load retention | Maximum six-component loading and emergency stop | Displacement, lock state, structural strain | No unlocking, no exceeding structural limits |
| Pressure/power loss | After locking and while in motion | Tool displacement, control status | Tool remains attached; motion stops safely and recovery is possible |
| Partial locking / foreign objects | Specified gaps and contamination | Lock, unlock and tool-presence signals | Inhibit station departure and production |
| Incorrect tool / recipe | All invalid combinations | ID, interlock, alarm | Reject every invalid combination and provide clear diagnostics |
| Utility connections | Maximum flow, vacuum, communication load | Leakage, pressure drop, messages, and temperature rise | Meets functional and fault-diagnostic requirements |
| Post-durability retest | Representative changeover cycles | Positioning, locking force, sealing, contacts | Deterioration is detectable before the maintenance limit is reached |
| Abnormal-event recovery | Network loss, jamming and storage-station damage | Steps, permissions, time | No unsafe bypass; traceable system states |
| Failure mode | Consequences | Prevention/Detection | Verification |
|---|---|---|---|
| Locking-mechanism wear | Tool play or detachment | Service-life tracking, lock feedback and periodic measurement | Durability testing and load-capacity retest |
| Tool unlocked before docking | Tool drop | Docking interlock, load removal and authorization | Unlock test with the tool partially docked |
| ID misidentification | Incorrect recipe or workpiece | Diverse identification methods and valid-code checks | Open-circuit, short-circuit and conflicting-ID fault injection |
| Connector not fully connected | Air pressure/vacuum/signal abnormality | Utility-status checks and lock-engagement travel | Partial-connection test |
| Storage station deformation | Positioning error or jamming | Station inspection, replaceable guides and protection | Post-collision inspection and recovery drill |
| Software version drift | Parameters do not match tool | Version signing, approval and rollback | Tests with obsolete versions and corrupted recipes |
Fault injection must include lock/unlock sensors stuck high or low, incorrect tool-presence signals, single-bit ID errors, communication loss, falling locking pressure, false docking signals, unintended release commands and incorrect storage positions. Verify that each fault inhibits hazardous motion. Manual confirmation in place of a failed sensor must not become a normal production mode.
08Implementation and conclusions
Begin by defining the part-family and process data, reviewing functional allocation and module interfaces, and specifying interface loads and utility connections. Develop the error-proofing logic and state machine, then perform prototype bench tests, verify every model/tool/recipe combination, and evaluate cycle time and abnormal-event recovery on site. Production maintenance and change control follow. Supporting records include the interface control document (ICD), tool ID register, storage-station drawings, six-component load table, recipe versions, fault-state table, verification records and spare-parts/maintenance plans.
A shared-line multi-model gripper should make every permitted combination identifiable, lockable, verifiable and maintainable, while blocking invalid combinations before hazardous motion. Define module responsibilities, interface loads and recipe permissions to keep shared functionality within verified limits. This article provides design and verification methods; specific tool-changer selection, whole-machine safety assessment and customer cycle-time acceptance use the corresponding load data, risk assessment and project test records.
References
- Colledani, M. et al. Design and management of reconfigurable assembly lines in the automotive industry. CIRP Annals, 2016. https://doi.org/10.1016/j.cirp.2016.04.123
- ISO 11593:2022. Robots for industrial environments - Automatic end effector exchange systems - Vocabulary. https://www.iso.org/standard/74676.html
- ISO 9409-1:2004. Manipulating industrial robots - Mechanical interfaces - Part 1: Plates. https://www.iso.org/standard/36578.html
- ATI Industrial Automation. Sensor Interface Plate and lock/unlock sensing; robotic tool changer documentation. https://www.ati-ia.com/products/toolchanger/SensorInterfacePlates.aspx
- SCHUNK. CMS manual change system - locking and tool presence monitoring. https://schunk.com/us/en/automation-technology/tool-changer/cms/c/PGR_7149
- ISO 10218-2:2025. Robotics - Safety requirements - Part 2: Industrial robot applications and robot cells. https://www.iso.org/standard/73934.html
- ISO/TR 20218-1:2018. Robotics - Safety design for industrial robot systems - Part 1: End-effectors. https://www.iso.org/standard/69488.html
- Stief, P. et al. A pragmatic optimization-based approach for analysis and configuration of a reconfigurable multi-product assembly line in the automotive industry. International Journal of Advanced Manufacturing Technology, 2023. https://doi.org/10.1007/s00170-023-12545-0
- Bajaj, N. M. et al. A Reconfigurable Gripper for Dexterous Manipulation in Flexible Assembly. Inventions, 2018. https://doi.org/10.3390/inventions3010004
- ISO 12100:2010. Safety of machinery - General principles for design - Risk assessment and risk reduction. https://www.iso.org/standard/51528.html
