A physical fuse safety control method and system for embodied intelligent robots

Abstract

The application discloses a physical fusing safety control method and system for embodied intelligent robots, and belongs to the technical field of embodied intelligent safety control. The system comprises a three-layer redundant fusing architecture and an old-age adaptation double-button emergency control terminal: a physical fusing module is independent of software operation; an embedded fusing module completes behavior recognition and abnormal braking within 20 milliseconds; and a main control coordination module realizes multi-modal fusion and task safety verification within 50 milliseconds. The emergency control terminal adopts a double-button design with a button spacing of 30 mm or more, and an emergency stop button is directly connected to the physical fusing through a special channel, with a total response time of 10 milliseconds or less. The system integrates a five-level fusing response mechanism, and voice instructions are encrypted by AES-256-GCM, signed by HMAC-SHA256, and bound and verified with a skill platform. The application realizes hardware intrinsic safety, millisecond-level emergency stop, old-age adaptation convenient operation, and controllable voice instructions throughout the process, and forms a complete safety system in cooperation with existing patent clusters, and is suitable for close-range human-machine interaction scenes such as families, the elderly and medical treatment.

Description

Technical Field

[0001] This invention belongs to the field of safety control technology for embodied intelligent robots, and specifically relates to a physical fuse safety control method and system for embodied intelligent robots. Background Technology

[0002] With the rapid iteration and evolution of embodied intelligence technology, the application penetration rate of intelligent equipment such as service robots, elderly assistance robots, and family companion robots in open and complex scenarios such as home living, institutional elderly care, medical care, and community services continues to increase. Embodied intelligent robots possess core characteristics such as physical entity interaction, autonomous mobile operation, and multimodal perception and decision-making. They are deeply integrated with human living spaces and coexist and collaborate closely. Their safety control capabilities directly determine the safety of human-computer interaction and the reliability of scenario applications, becoming a core technological bottleneck restricting the large-scale implementation of the industry.

[0003] Traditional industrial robot safety control solutions are designed for closed, structured industrial environments, relying on software-level anomaly detection, command interception, and motion constraint mechanisms. Their response time is generally greater than 100 milliseconds, making them prone to trajectory deviations and collisions that can cause injuries in high-speed scenarios. They are ill-suited for the real-time safety requirements of close human-robot collaboration. Existing service robot safety solutions have significant technical flaws: First, the safety mechanisms are highly dependent on the main control system's software status. When the main control system experiences software crashes, algorithm failures, network attacks, or malicious control, the software circuit breaker mechanism completely fails, creating a high-risk "failed-open" state where the robot continues to perform dangerous actions. Second, there is a lack of physical safety interaction terminals that users can directly intervene in. In emergencies, emergency stops must be triggered via mobile apps, touchscreens, or complex button combinations. This cumbersome process and delayed response make it difficult for elderly users and those with disabilities to quickly complete operations, greatly increasing the risk of accidents. Therefore; thirdly, voice control, as the mainstream interaction method, is disconnected from the security control system. Voice commands are not encrypted, verified, or subject to access control, resulting in security vulnerabilities such as command tampering, malicious injection, and illegal execution. The command execution process is not subject to security constraints. Fourthly, the circuit breaker response mechanism lacks a hierarchical design and has not formed a three-layer redundant defense system of hardware-software-main control. Under extreme and abnormal scenarios, it is impossible to achieve hardware-level intrinsic security protection. Fifthly, the emergency interaction terminal has not been optimized for elderly users and users with physical disabilities. The buttons are small, the layout is complex, and the operation threshold is high, making it difficult to meet the convenient and safe operation needs of special groups.

[0004] Based on the aforementioned industry technical pain points, there is an urgent need to develop a physical fuse safety control system with inherent hardware security, millisecond-level fast response, age-friendly and convenient interaction, voice command encryption verification, and multi-level fuse collaborative control, to fill the existing technological gap and enhance the all-scenario safety protection capabilities of embodied intelligent robots. Summary of the Invention

[0005] In view of this, the present invention provides a physical fuse safety control method and system for embodied intelligent robots, so as to solve or alleviate one of the technical problems existing in the prior art, and at least provide a beneficial option.

[0006] The technical solution of this invention is implemented as follows: a physical circuit breaker safety control method and system for embodied intelligent robots, including a three-layer redundant circuit breaker architecture with deep mutual cooperation and an aging-friendly emergency control terminal. The three-layer redundant circuit breaker architecture is composed of a physical circuit breaker module, an embedded circuit breaker module, and a main control coordination module cascaded in sequence. The emergency control terminal is a dual-button remote control with an aging-friendly minimalist structure design, which only has two physical buttons: a voice call button and an emergency stop button. The physical fuse module is fixedly installed at the electrical connection node between the robot's power system and control system. It consists of three parts: a current sampling unit, a comparison and decision unit, and an execution mechanism. It can operate completely independently of the robot's software system, operating system, and main control chip. When an abnormal current signal is detected in the power circuit, it directly drives the execution mechanism to perform a physical-level electrical disconnection operation with a response time of no more than ten milliseconds. The embedded fuse module is deployed inside the robot's embedded real-time control system and forms a tight hardware-level connection with the robot's motion controller. It includes a behavior pattern recognition unit, a strategy verification unit, and an interrupt response unit. It can perform behavior pattern matching and safety strategy verification on the robot's real-time motion state. When a violation is determined, a high-priority braking command is sent through the hardware interrupt channel, with a response time of no more than 20 milliseconds. The main control and coordination module is mounted on the robot's main control computing platform and integrates a multimodal data fusion unit, a task planning unit, and a status monitoring unit. It can complete the fusion processing of multi-source perception data such as vision, voice, touch, and torque, and generate a motion command sequence that meets safety constraints based on the fused data. At the same time, it performs predictive monitoring of the entire task execution process, with a response time of no more than fifty milliseconds. The emergency control terminal is connected to the physical fuse module and the main control coordination module through two independent wireless communication links. The dedicated trigger channel is directly connected to the physical fuse module to realize hardware-level emergency stop triggering, and the standard command channel is connected to the main control coordination module to realize voice command transmission. The voice call button adopts the press-to-talk working mode, and the emergency stop button adopts a concave red anti-mistouch structure design. The size of the two physical buttons is not less than 30 mm, and the button spacing is maintained between 8 and 12 mm.

[0007] Furthermore, the current sampling unit of the physical fuse module is implemented by a shunt resistor or Hall current sensor connected in series in the power circuit, which can continuously collect the analog current signal flowing through the robot power system in real time, convert it into digital sample value and output it synchronously to the comparison and decision unit. The comparison and decision unit internally stores a current characteristic database of various robot motors under normal operating conditions, including motor starting current peak value, running current steady state value, current change rate during acceleration and deceleration, stall current threshold and multi-dimensional safety threshold. It can compare real-time digital sampled values ​​with the current characteristic database point by point. When the sampled value exceeds the preset safety range, it is immediately determined as an abnormal current event and outputs a fuse trigger signal. The actuator uses mechanical relays or solid-state thyristors as switching devices. After receiving a fuse trigger signal, it directly disconnects the electrical connection between the power system and the control system at the physical level, causing the robot motor to enter a power-off self-locking state. This execution process is not controlled or interfered with by any software module of the robot.

[0008] Furthermore, the behavior pattern recognition unit of the embedded fuse module is pre-loaded with a robot normal behavior feature library generated through statistical learning of a large amount of actual operation data. This library covers the robot's joint angle sequences, end effector motion trajectories, motion speed and acceleration curves, and joint torque change characteristics. It can collect robot motion state data in real time and perform similarity matching calculations with the normal behavior feature library. When the real-time behavior pattern deviates from the normal range and exceeds the preset deviation threshold, it outputs the abnormal behavior judgment result. The policy verification unit can pull the latest security policy data from the cloud security policy server in real time and cache it locally, including environmental restricted areas, speed limit areas, personnel approach safety distance, and human-computer interaction constraint rules. Based on the security policy, it performs compliance verification on abnormal behavior and outputs the verification result after determining that it is a violation. The interrupt response unit is directly connected to the robot motion controller via a hardware interrupt pin. The interrupt command sent has a higher priority than all software-scheduled tasks and can force the motion controller to immediately stop executing all current motion commands.

[0009] Furthermore, the multimodal data fusion unit of the main control and coordination module accesses multi-channel perception data from vision sensors, voice sensors, tactile sensors, and torque sensors through a standardized data interface, and uses time synchronization stamps and spatial registration algorithms to fuse multi-source heterogeneous data into a unified representation of the environment and robot state. The task planning unit completes task decomposition, path planning, and action generation based on a unified state representation, and follows preset safety constraints throughout the process to generate a collision-free, compliant, and safe motion instruction sequence. The status monitoring unit uses a model predictive control algorithm to perform forward simulation of the task execution process, predict potential violations of safety constraints in advance, and proactively trigger the corresponding level of circuit breaker response action based on the risk level.

[0010] Furthermore, the system also integrates a five-level circuit breaker response mechanism, which is divided into L1 level corrective response, L2 level warning response, L3 level soft circuit breaker response, L4 level hard circuit breaker response, and L5 level physical circuit breaker response in order of increasing severity of the anomaly. The L1 level correction response is automatically triggered by the embedded fuse module to perform real-time path correction for slight trajectory deviations. The L2 level warning response is automatically triggered by the embedded fuse module, which simultaneously outputs voice warnings, reduces the robot's movement speed, and sends status prompts to the emergency control terminal. The L3 level soft fuse response can be triggered by the user through voice commands on the emergency control terminal, forcibly terminating the current task and locking the robot while maintaining power supply; The L4 level hard fuse response is automatically triggered by the main control coordination module or by user voice command, causing the robot to enter a deep braking and low power lock state. Level L5 physical fuse response is triggered directly by the user pressing the emergency stop button on the emergency control terminal. The physical fuse module immediately performs electrical disconnection, which is the highest level of fuse response that cannot be restored by voice.

[0011] Furthermore, the voice call button of the emergency control terminal is made of orange frosted anti-slip silicone material with a diameter of 35 mm. The button surface is set with a slightly raised tactile texture, the pressing stroke is 2.5 mm, and the pressing force is 6 Newtons, which can provide users with clear and distinct tactile feedback. When the user presses the voice call button, the voice acquisition circuit is activated, and the first status indicator light is lit to indicate that the voice input state has been entered. When the user releases the button, the voice acquisition stops immediately and the indicator light is turned off. After the voice signal is preprocessed internally by the terminal to perform noise reduction, echo cancellation, and silence detection, it is encrypted with AES-256-GCM and signed with HMAC-SHA256 using the built-in key. The resulting signed encrypted data packet is sent to the robot's main control system through the standard command channel. The main control system can only execute voice command parsing and task scheduling after verifying the signature using the paired public key.

[0012] Furthermore, the emergency stop button of the emergency control terminal adopts a red concave structure design with a diameter of 32 mm and a concave depth of 1.5 mm, which can effectively prevent accidental operation during daily use. The emergency stop button is directly electrically connected to the physical fuse module through a dedicated trigger channel independent of the robot software system. The transmission delay of the emergency stop signal triggered by the user's pressing action is no more than one millisecond, and the total time from pressing the button to the complete disconnection of the power system electrical connection is no more than ten milliseconds. After the emergency stop button is triggered, the second status indicator light remains lit in red as a warning. The robot remains in a power-off locked state and can only be unlocked by administrator authorization or by a specific combination of physical buttons. At the same time, the system automatically records the emergency stop event and stores it in non-volatile memory for subsequent fault analysis.

[0013] Furthermore, the system forms a mandatory binding and collaborative mechanism with the cloud-based skills distribution platform. Before being released, all skills packages must undergo digital signature and authorization by the certification center using the RSA-2048 or ECDSA-P256 algorithm. When a user issues a skill execution task via voice command through the emergency control terminal, the robot's main control system first verifies the signature integrity of the skill package, checks the validity period of the permission certificate, and verifies the compliance of the operating environment. Only after all three verifications are passed can the skill package be loaded and executed. During the operation of the skill pack, the embedded circuit breaker module continuously monitors the matching degree between the real-time behavior pattern and the preset behavior characteristics. When a behavior deviation is detected, the circuit breaker response of level L1 to level L3 is automatically triggered according to the degree of deviation. When a user performs a skill switching operation, the system automatically enters the L3 level soft circuit breaker state. Only after the new skill pack is loaded and passes the security check will the system exit the circuit breaker state and resume normal operation.

[0014] Furthermore, this includes the following steps: The physical fuse module collects the current data of the robot's power system in real time through the current sampling unit. The comparison and decision unit compares the current data with the preset safety threshold. When the threshold is exceeded, the actuator is immediately driven to physically cut off the electrical connection. The entire process runs independently of the software system. The embedded fuse module collects the robot's motion state in real time through the behavior pattern recognition unit and matches it with the preset normal behavior feature library. When an abnormality occurs, it is checked by the strategy verification unit and then forcibly braked through the interrupt response unit. The main control and coordination module integrates multimodal perception data, generates safety constraint task instructions, and predicts and monitors the entire process, proactively triggering corresponding circuit breaker responses when potential violations are detected. The user presses and holds the voice call button on the emergency control terminal to enter the voice acquisition state. The voice signal is sent to the main control system after being encrypted and signed. After the signature is verified, the task instruction is parsed and executed. In an emergency, if the user presses the emergency stop button, the terminal will directly trigger the physical fuse module through a dedicated trigger channel to perform a 10-millisecond electrical cut-off, and the robot will enter a power-off lockout state.

[0015] Furthermore, the specific execution flow of the five-level circuit breaker response is as follows: When a slight deviation from the robot's trajectory is detected, the embedded fuse module automatically triggers an L1-level correction response to complete the path correction. When a clear abnormal behavior pattern is detected, the embedded fuse module automatically triggers an L2 level warning response, simultaneously issuing a prompt sound, reducing movement speed, and illuminating the terminal warning light. When a user sends a "pause" or "stop" command via voice, the system triggers an L3-level soft fuse response to terminate the task while maintaining power. The task can be restarted via voice command. When the main control and coordination module detects that a safety constraint has been violated, it triggers an L4 level hard circuit breaker response, and the robot enters deep lockout. It can only attempt to reset after identity verification. When a user presses the emergency stop button, it directly triggers an L5 level physical fuse response, and the physical fuse module immediately cuts off power. This response only supports physical authorization unlocking and does not support voice recovery.

[0016] The embodiments of the present invention have the following advantages due to the adoption of the above technical solutions: 1. Overcome the shortcomings of existing software circuit breaker solutions, such as delayed response, reliance on software operation, and open failures. Provide a physical circuit breaker safety control system that operates independently in hardware and has a response time of ≤10 milliseconds, achieving hardware-level intrinsic safety protection in extreme scenarios.

[0017] To address the issue that existing technologies prevent users from easily and directly intervening in the safety control loop, an age-friendly dual-button emergency control terminal is provided, enabling physical fuse triggering within 10 milliseconds and lowering the operational threshold for special groups.

[0018] To address the issues of disconnect between voice control and security systems, and lack of command verification, this system implements AES-256-GCM encryption, HMAC-SHA256 signature verification, and mandatory binding of voice commands to the skill platform, ensuring that commands are secure and controllable throughout the entire process.

[0019] It solves the problems of non-tiered circuit breaker response and inability for users to intervene, and realizes five-level circuit breaker response and collaborative control with user terminals, supporting tiered triggering and safe recovery.

[0020] It realizes emergency control terminal with three-layer redundant circuit breaker architecture and five levels. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a flowchart of the three-layer architecture of the present invention. Detailed Implementation

[0023] In the following description, only certain exemplary embodiments are briefly described. As those skilled in the art will recognize, the described embodiments can be modified in various ways without departing from the spirit or scope of the invention. Therefore, the drawings and description are considered to be exemplary in nature and not restrictive.

[0024] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0025] Example 1: Three-layer redundant circuit breaker architecture security control system This embodiment discloses a three-layer redundant circuit breaker architecture security control system, including a physical circuit breaker module, an embedded circuit breaker module, a main control coordination module, and an emergency control terminal.

[0026] The physical fuse module includes a current sampling unit, a comparison and decision unit, and an actuator. The current sampling unit uses a shunt resistor / Hall sensor to collect the power circuit current, converting it into a digital signal that is input to the comparison and decision unit. The comparison and decision unit has a built-in database of motor starting peak value, steady-state value, and acceleration / deceleration rate thresholds; if the threshold is exceeded, a fuse signal is immediately output. The actuator drives a relay / thyristor to physically disconnect the power and control electrical connections. The module operates independently with a response time ≤10 milliseconds.

[0027] The embedded circuit breaker module includes a behavior pattern recognition unit, a policy verification unit, and an interrupt response unit. The behavior pattern recognition unit has a pre-set feature library of joint angles, trajectories, and velocity accelerations, and matches and determines anomalies in real time; the policy verification unit obtains restricted areas, speed limits, and personnel detection policies from the cloud; the interrupt response unit sends braking commands via hardware interrupts, with higher priority than software scheduling and a response time of ≤20 milliseconds.

[0028] The main control and coordination module includes a multimodal data fusion unit, a task planning unit, and a status monitoring unit. The multimodal data fusion unit integrates visual, voice, tactile, and torque data; the task planning unit generates safety constraint motion commands; and the status monitoring unit predicts violations through model predictive control with a response time of ≤50 milliseconds.

[0029] The three-tier architecture forms a defense-in-depth system: physical circuit breakers provide underlying hardware security, embedded circuit breakers intercept abnormal behavior, and the main controller coordinates task-level security checks, covering all scenarios of anomalies. The response time increases progressively, and the protection scope expands progressively.

[0030] Example 2: Age-Friendly Dual-Button Emergency Control Terminal This embodiment discloses an age-friendly dual-button emergency control terminal, including a shell, a main control MCU, a wireless communication module, a voice processing module, a power management module, a voice call button, and an emergency stop button.

[0031] Voice call button: 35mm in diameter, orange frosted anti-slip silicone, slightly raised textured tactile markings, 10mm button spacing, 2.5mm press travel, 6N force, press to speak mode. Press and hold to activate voice acquisition, indicator light illuminates; release to stop acquisition. The voice signal undergoes noise reduction, echo cancellation, and silence detection, then is encrypted with AES-256-GCM and signed with HMAC-SHA256, and sent to the main control system through a standard command channel. It supports Mandarin, Sichuanese, Cantonese, and Shanghainese dialect recognition with high fault-tolerant algorithms.

[0032] Emergency Stop Button: 32mm in diameter, 1.5mm recessed red to prevent accidental activation, white stop icon, surrounded by a red warning light. When pressed, it connects directly to the physical fuse module via a dedicated trigger channel, with a signal transmission delay ≤1 millisecond and a total cut-off delay ≤10 milliseconds. It performs a hardware power-off lock, which requires authorized operation to unlock.

[0033] The terminal has a standby current of less than 10 microamps, can last for more than 6 months with two AAA batteries, and features multi-sensory feedback including tactile, auditory, and visual feedback. It also has anti-shake and anti-accidental touch features, automatic voice guidance for first-time users, and supports preset phrase quick operation.

[0034] Example 3: Collaborative Control of Terminal with Level 5 Circuit Breaker and Skill Platform This embodiment discloses a collaborative control method for an emergency control terminal, a five-level circuit breaker response system, and a skills distribution platform.

[0035] Level 5 circuit breaker response: L1 correction: Automatic trajectory correction via embedded module; L2 alert: Voice prompt + speed reduction + terminal indicator light alarm in case of abnormality; L3 soft fuse: triggered by voice "pause / stop", terminates the task and maintains power supply; triggered by voice "resume", restarts. L4 hard fuse: triggered by main controller detection of violation, deep braking low power lock, voice "reset" requires identity verification; L5 Physical Fuse: Triggered by the emergency stop button, it physically cuts off power and cannot be restored by voice; authorization is required to unlock.

[0036] Skills distribution platform collaboration: The skill package is signed and authorized by the certification center RSA-2048 / ECDSA-P256; the signature, authorization certificate and environment status are verified before the voice command is executed; the embedded module continuously compares the behavior characteristics during runtime, and the deviation triggers L1-L3 response; the skill switching automatically enters L3 soft circuit breaker, and exits after loading is completed and the verification is passed.

[0037] Voice command process: Press and hold the call button to collect data → Preprocessing → Encryption and signature → Sending → Main control verification of signature → Recognition and understanding → Task execution; Emergency stop process: Press the button to trigger → Send a signal through a dedicated channel → Physical fuse to cut off power → Lock the entire machine → Store fault records.

[0038] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various variations or substitutions within the technical scope disclosed in the present invention, and these should all be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A physical fuse safety control method and system for embodied intelligent robots, characterized in that: It includes a three-layer redundant fuse architecture with deep mutual collaboration and an aging-friendly emergency control terminal. The three-layer redundant fuse architecture is composed of a physical fuse module, an embedded fuse module, and a main control coordination module cascaded in sequence. The emergency control terminal is a dual-button remote control with an aging-friendly and minimalist structure design, with only two physical buttons: a voice call button and an emergency stop button. The physical fuse module is fixedly installed at the electrical connection node between the robot's power system and control system. It consists of three parts: a current sampling unit, a comparison and decision unit, and an execution mechanism. It can operate completely independently of the robot's software system, operating system, and main control chip. When an abnormal current signal is detected in the power circuit, it directly drives the execution mechanism to perform a physical-level electrical disconnection operation with a response time of no more than ten milliseconds. The embedded fuse module is deployed inside the robot's embedded real-time control system and forms a tight hardware-level connection with the robot's motion controller. It includes a behavior pattern recognition unit, a strategy verification unit, and an interrupt response unit. It can perform behavior pattern matching and safety strategy verification on the robot's real-time motion state. When a violation is determined, a high-priority braking command is sent through the hardware interrupt channel, with a response time of no more than 20 milliseconds. The main control and coordination module is mounted on the robot's main control computing platform and integrates a multimodal data fusion unit, a task planning unit, and a status monitoring unit. It can complete the fusion processing of multi-source perception data such as vision, voice, touch, and torque, and generate a motion command sequence that meets safety constraints based on the fused data. At the same time, it performs predictive monitoring of the entire task execution process, with a response time of no more than fifty milliseconds. The emergency control terminal is connected to the physical fuse module and the main control coordination module through two independent wireless communication links. The dedicated trigger channel is directly connected to the physical fuse module to realize hardware-level emergency stop triggering, and the standard command channel is connected to the main control coordination module to realize voice command transmission. The voice call button adopts the press-to-talk working mode, and the emergency stop button adopts a concave red anti-mistouch structure design. The size of the two physical buttons is not less than 30 mm, and the button spacing is maintained between 8 and 12 mm.

2. The physical fuse safety control method and system for embodied intelligent robots according to claim 1, characterized in that: The current sampling unit of the physical fuse module is implemented by a shunt resistor or Hall current sensor connected in series in the power circuit. It can continuously collect the analog current signal flowing through the robot power system in real time, convert it into digital sample value and output it synchronously to the comparison and decision unit. The comparison and decision unit internally stores a current characteristic database of various robot motors under normal operating conditions, including motor starting current peak value, running current steady state value, current change rate during acceleration and deceleration, stall current threshold and multi-dimensional safety threshold. It can compare real-time digital sampled values ​​with the current characteristic database point by point. When the sampled value exceeds the preset safety range, it is immediately determined as an abnormal current event and outputs a fuse trigger signal. The actuator uses mechanical relays or solid-state thyristors as switching devices. After receiving a fuse trigger signal, it directly disconnects the electrical connection between the power system and the control system at the physical level, causing the robot motor to enter a power-off self-locking state. This execution process is not controlled or interfered with by any software module of the robot.

3. The physical fuse safety control method and system for embodied intelligent robots according to claim 1, characterized in that: The behavior pattern recognition unit of the embedded fuse module is pre-loaded with a robot normal behavior feature library generated through statistical learning of a large amount of actual operation data. It covers the robot's joint angle sequence, end effector motion trajectory, motion speed and acceleration curve, and joint torque change characteristics. It can collect robot motion state data in real time and perform similarity matching calculation with the normal behavior feature library. When the real-time behavior pattern deviates from the normal range and exceeds the preset deviation threshold, it outputs the abnormal behavior judgment result. The policy verification unit can pull the latest security policy data from the cloud security policy server in real time and cache it locally, including environmental restricted areas, speed limit areas, personnel approach safety distance, and human-computer interaction constraint rules. Based on the security policy, it performs compliance verification on abnormal behavior and outputs the verification result after determining that it is a violation. The interrupt response unit is directly connected to the robot motion controller via a hardware interrupt pin. The interrupt command sent has a higher priority than all software-scheduled tasks and can force the motion controller to immediately stop executing all current motion commands.

4. The physical fuse safety control method and system for embodied intelligent robots according to claim 1, characterized in that: The multimodal data fusion unit of the main control and coordination module accesses multi-channel perception data from vision sensors, voice sensors, tactile sensors, and torque sensors through a standardized data interface, and uses time synchronization stamps and spatial registration algorithms to fuse multi-source heterogeneous data into a unified representation of the environment and robot state. The task planning unit completes task decomposition, path planning, and action generation based on a unified state representation, and follows preset safety constraints throughout the process to generate a collision-free, compliant, and safe motion instruction sequence. The status monitoring unit uses a model predictive control algorithm to perform forward simulation of the task execution process, predict potential violations of safety constraints in advance, and proactively trigger the corresponding level of circuit breaker response action based on the risk level.

5. The physical fuse safety control method and system for embodied intelligent robots according to claim 1, characterized in that: The system also integrates a five-level circuit breaker response mechanism, which is divided into L1 level corrective response, L2 level warning response, L3 level soft circuit breaker response, L4 level hard circuit breaker response, and L5 level physical circuit breaker response according to the severity of the abnormality from low to high. The L1 level correction response is automatically triggered by the embedded fuse module to perform real-time path correction for slight trajectory deviations. The L2 level warning response is automatically triggered by the embedded fuse module, which simultaneously outputs voice warnings, reduces the robot's movement speed, and sends status prompts to the emergency control terminal. The L3 level soft fuse response can be triggered by the user through voice commands on the emergency control terminal, forcibly terminating the current task and locking the robot while maintaining power supply; The L4 level hard fuse response is automatically triggered by the main control coordination module or by user voice command, causing the robot to enter a deep braking and low power lock state. Level L5 physical fuse response is triggered directly by the user pressing the emergency stop button on the emergency control terminal. The physical fuse module immediately performs electrical disconnection, which is the highest level of fuse response that cannot be restored by voice.

6. The physical fuse safety control method and system for embodied intelligent robots according to claim 1, characterized in that: The voice call button of the emergency control terminal is made of orange frosted anti-slip silicone material with a diameter of 35 mm. The button surface is set with a slightly raised tactile texture, the pressing stroke is 2.5 mm, and the pressing force is 6 Newtons, which can provide users with clear and distinct tactile feedback. When the user presses the voice call button, the voice acquisition circuit is activated, and the first status indicator light is lit to indicate that the voice input state has been entered. When the button is released, voice acquisition stops immediately and the indicator light is turned off. After the voice signal is preprocessed internally by the terminal to perform noise reduction, echo cancellation, and silence detection, it is encrypted with AES-256-GCM and signed with HMAC-SHA256 using the built-in key. The resulting signed encrypted data packet is sent to the robot's main control system through the standard command channel. The main control system can only execute voice command parsing and task scheduling after verifying the signature using the paired public key.

7. The physical fuse safety control method and system for embodied intelligent robots according to claim 1, characterized in that: The emergency stop button of the emergency control terminal adopts a red concave structure design with a diameter of 32 mm and a concave depth of 1.5 mm, which can effectively prevent accidental operation during daily use. The emergency stop button is directly electrically connected to the physical fuse module through a dedicated trigger channel independent of the robot software system. The transmission delay of the emergency stop signal triggered by the user's pressing action is no more than one millisecond, and the total time from pressing the button to the complete disconnection of the power system electrical connection is no more than ten milliseconds. After the emergency stop button is triggered, the second status indicator light remains lit in red as a warning. The robot remains in a power-off locked state and can only be unlocked by administrator authorization or by a specific combination of physical buttons. At the same time, the system automatically records the emergency stop event and stores it in non-volatile memory for subsequent fault analysis.

8. The physical fuse safety control method and system for embodied intelligent robots according to claim 1, characterized in that: The system forms a mandatory binding and collaborative mechanism with the cloud-based skills distribution platform. Before all skills packages are released, they must be digitally signed and authorized by the certification center using the RSA-2048 or ECDSA-P256 algorithms. When a user issues a skill execution task via voice command through the emergency control terminal, the robot's main control system first verifies the signature integrity of the skill package, checks the validity period of the permission certificate, and verifies the compliance of the operating environment. Only after all three verifications are passed can the skill package be loaded and executed. During the operation of the skill pack, the embedded circuit breaker module continuously monitors the matching degree between the real-time behavior pattern and the preset behavior characteristics. When a behavior deviation is detected, the circuit breaker response of level L1 to level L3 is automatically triggered according to the degree of deviation. When a user performs a skill switching operation, the system automatically enters the L3 level soft circuit breaker state. Only after the new skill pack is loaded and passes the security check will the system exit the circuit breaker state and resume normal operation.

9. A physical fuse safety control method and system for embodied intelligent robots according to any one of claims 1-8, characterized in that: Includes the following steps: The physical fuse module collects the current data of the robot's power system in real time through the current sampling unit. The comparison and decision unit compares the current data with the preset safety threshold. When the threshold is exceeded, the actuator is immediately driven to physically cut off the electrical connection. The entire process runs independently of the software system. The embedded fuse module collects the robot's motion state in real time through the behavior pattern recognition unit and matches it with the preset normal behavior feature library. When an abnormality occurs, it is checked by the strategy verification unit and then forcibly braked through the interrupt response unit. The main control and coordination module integrates multimodal perception data, generates safety constraint task instructions, and predicts and monitors the entire process, proactively triggering corresponding circuit breaker responses when potential violations are detected. The user presses and holds the voice call button on the emergency control terminal to enter the voice acquisition state. The voice signal is sent to the main control system after being encrypted and signed. After the signature is verified, the task instruction is parsed and executed. In an emergency, if the user presses the emergency stop button, the terminal will directly trigger the physical fuse module through a dedicated trigger channel to perform a 10-millisecond electrical cut-off, and the robot will enter a power-off lockout state.

10. A physical fuse safety control method and system for embodied intelligent robots according to claim 9, characterized in that: The specific execution process of the five-level circuit breaker response is as follows: When a slight deviation from the robot's trajectory is detected, the embedded fuse module automatically triggers an L1-level correction response to complete the path correction. When a clear abnormal behavior pattern is detected, the embedded fuse module automatically triggers an L2 level warning response, simultaneously issuing a prompt sound, reducing movement speed, and illuminating the terminal warning light. When a user sends a "pause" or "stop" command via voice, the system triggers an L3-level soft fuse response to terminate the task while maintaining power. The task can be restarted via voice command by "resume". When the main control and coordination module detects that a safety constraint has been violated, it triggers an L4 level hard circuit breaker response, and the robot enters deep lockout. It can only attempt to reset after identity verification. When a user presses the emergency stop button, it directly triggers an L5 level physical fuse response, and the physical fuse module immediately cuts off power. This response only supports physical authorization unlocking and does not support voice recovery.

Images