Robot end-side model online grayscale update and safe rollback method

Abstract

The application discloses a kind of robot end side model online gray scale update and safe rollback method, belong to robot control and data processing technical field.The method generates state vector and executability constraint by collecting sensor and actuator data, and difference coding is carried out to new and old model parallel inference;Local feasible pipeline and safe transition kernel function are constructed, and model action smooth mapping is realized;Dynamic envelope verification is executed using hard real-time safety monitor, and the physical safety of update process is guaranteed;Model stable takeover is realized based on the joint determination of progress, safety and convergence evidence, and when abnormal, it is quickly rolled back through reverse safe transition kernel function.The application solves the problems of action step, rollback discontinuity and real-time deficiency in traditional model switching, realizes the online update of end side model without interruption, low disturbance and high safety, and is suitable for real-time control systems such as industrial robots and collaborative robots, to improve the continuity and reliability of equipment operation.

Description

Technical Field

[0001] This invention relates to the field of robot control and data processing technology, and in particular to a method for online grayscale update and safe rollback of robot end-side models. Background Technology

[0002] Online updates of robot edge models refer to the digital data processing process that replaces local decision-making calculation programs via computer networks during device operation. With the development of edge computing technology, edge devices need to frequently receive optimized algorithm models pushed from the cloud to adapt to complex and ever-changing operating environments. Canary updates, as a common deployment strategy in software engineering, aim to verify the correctness of the algorithm logic by gradually increasing the proportion of the new model's calculation weights, and to perform rollback operations to restore the old program's running state when anomalies occur.

[0003] Chinese patent publication number CN111488159A discloses a dynamically configurable canary release method, which includes the following steps: When the nginx server starts, a timetask is generated, which retrieves the latest canary release strategy from the canary release management system; the latest canary release strategy is cached in the Lua canary release engine; a user initiates a request through a client; the user's request data is matched with the latest canary release strategy in the Lua canary release engine; if no match is found, the request is forwarded to the original stable version server; if a match is found, the request is forwarded to the canary version server. This method allows for controllable release scope, reducing deployment risks; easy traffic control and intervention; immediate rollback in case of problems; and targeted verification of product functions by specifying target users.

[0004] Existing edge-side model update schemes typically employ master-slave process switching or hard switching logic to hand over digital instructions. The system runs two sets of computing models, old and new, in parallel in the background, determining whether to fully transfer control to the new model based on a preset fixed time window or a simple error threshold. Regarding rollback mechanisms, existing schemes mostly rely on pre-stored snapshots of the old instructions. When the control data output by the new model deviates from the normal range, the system directly blocks the output channel of the new model and forcibly retrieves the old instruction snapshot to overwrite the control variables in the current memory registers.

[0005] This data processing approach, which relies on fixed logic switching and snapshot overwriting, suffers from underlying computational flaws when dealing with highly dynamic physical systems. The fixed-time-window switching logic lacks mathematical evaluation of the differences in the output instruction spaces between the old and new models, making it prone to numerical jumps at the moment of control handover, potentially leading to integral saturation or derivative surges in the underlying control algorithm. The rollback method, which directly retrieves snapshot-overwritten memory, disrupts the temporal continuity of control instructions and fails to incorporate dynamic envelope calculations based on the current system's physical constraints. This results in the rollback instruction itself potentially exceeding the transient response limits of the executor, leaving the digital processing system lacking mathematical guarantees for smooth transitions when dealing with anomalies. Summary of the Invention

[0006] To address the aforementioned issues, this invention provides a method for online grayscale update and safe rollback of robot end-side models. It employs computer data processing techniques such as multi-source data temporal alignment and fusion, differential encoding of actions between old and new models, online learning of safe transition kernel functions, and hard real-time dynamic envelope verification. This method enables smooth mapping of instructions between old and new models and safe mathematical rollback under abnormal conditions, even with limited end-side computing resources.

[0007] The above objectives can be achieved through the following approach: A method for online grayscale update and safe rollback of robot end-side model, the method comprising: The sensor data and actuator feedback data of the current control cycle are acquired and fused to generate the current state vector. The action amplitude boundary and action change boundary are extracted from the actuator feedback data to generate executability constraint information, and the state input data is output. Based on the state input data, perform online inference of the old model and shadow inference of the new model to generate old model actions and new model original actions, and perform differential encoding on the old model actions and the new model original actions to generate new and old action pairs data and action difference features; Based on the current state vector, the action difference features, and the executability constraint information, a local feasible pipeline is constructed and feasible transition domain description data is generated; Based on the feasible transition domain description data and the new and old action pair data, a safe transition kernel function is learned online, and transition kernel parameters and stability evidence data are output. Receive the grayscale advancement trigger signal and generate a transition window control command. Adjust the homotopy advancement rate based on the transition window control command, and map the original action of the new model to the current cycle transition action based on the transition kernel parameters, and output the transition progress status. The current cycle transition action is input into a safety monitor with hard real-time constraints to perform dynamic envelope verification, outputting the safety verification result, envelope erosion indication and safety margin change, and generating a transition confidence state based on the safety margin change. Based on the transition progress status, the transition credibility status, and the stability evidence data, a takeover determination is performed, a takeover enable signal is generated, and the takeover completion status is output. When the envelope erosion indication appears or the stability evidence data does not meet the convergence trend, a rollback trigger signal is generated, and the reverse safe transition kernel function is called to generate a rollback transition action sequence. The rollback completion status is output, and the actuator of the robot is controlled to perform corresponding physical actions based on the current cycle transition action or the rollback transition action sequence.

[0008] Optionally, the output state input data includes: acquiring the timestamp information of the sensor data and the timestamp information of the actuator feedback data and performing time-series alignment to generate aligned data; performing noise suppression and feature fusion on the aligned data to generate the current state vector; performing capability boundary identification and motion change boundary calculation on the actuator feedback data to generate the executability constraint information, and combining the current state vector and the executability constraint information to generate the state input data.

[0009] Optionally, generating the new and old action pair data and action difference features includes: calling the old model inference module to generate the old model action based on the state input data; calling the new model shadow inference module to generate the new model original action based on the state input data; performing action difference calculation and structured encoding on the old model action and the new model original action to generate the new and old action pair data and action difference features, wherein the structured encoding includes a combined representation of action amplitude difference, action direction difference and action change rate difference.

[0010] Optionally, the step of constructing a locally feasible pipeline and generating feasible transition domain description data includes: generating an upper bound description of action changes based on the executability constraint information, as a feasibility boundary feature; calculating the tracking error based on the actuator feedback data and generating feedback residuals, extracting transient sensitive direction descriptions based on the feedback residuals, as sensitivity features; calculating the safety boundary distance based on the current state vector and generating a safety margin direction description, as a safety feature; jointly reducing the dimensionality of the feasibility boundary features, the sensitivity features, and the safety features to generate a low-dimensional transition coordinate system, and constructing the locally feasible pipeline accordingly, outputting the feasible transition domain description data.

[0011] Optionally, the output transition kernel parameters and stability evidence data include: constructing a transition feature vector based on the feasible transition domain description data, and inputting the transition feature vector and the new and old action pair data into an online learning module to generate the transition kernel parameters; performing feature mapping based on the transition kernel parameters to generate a gating factor and homotopy propagation variable as a description of the transition mapping; calculating a switching energy evaluation quantity based on the action difference features and the transient sensitive direction description, and forming a switching energy evaluation quantity sequence characterizing the convergence trend of the transition process, as the stability evidence data.

[0012] Optionally, the output transition progress state includes: acquiring the grayscale advancement trigger signal and parsing it to obtain the advancement stage identifier, generating the transition window control instruction; adjusting the homotopy advancement rate and updating the homotopy advancement variable based on the transition window control instruction, generating an advancement control quantity; performing continuous mapping on the original action of the new model based on the advancement control quantity, the gating factor and the transition kernel parameter, generating the current cycle transition action, and generating the transition progress state based on the homotopy advancement variable to characterize the completion ratio of the online grayscale update of the end-side model.

[0013] Optionally, generating the transition confidence state includes: inputting the current cycle transition action and the executability constraint information into the safety monitor with hard real-time constraints to perform dynamic envelope verification, generating the safety verification result and the envelope erosion indication; calculating the safety boundary distance and updating the safety margin based on the safety verification result, generating the safety margin change; classifying the safety margin change by trend and generating trend labels, and generating the transition confidence state based on the trend labels and the envelope erosion indication.

[0014] Optionally, generating the takeover enable signal and outputting the takeover completion status includes: acquiring the transition progress status and generating a stage completion index to form progress evidence; acquiring the transition credibility status and extracting a credibility sequence to form security evidence; acquiring the stability evidence data and extracting a convergence trend index to form convergence evidence; performing a joint determination based on the progress evidence, the security evidence, and the convergence evidence to generate the takeover enable signal, updating the control status after generating the takeover enable signal, and outputting the takeover completion status.

[0015] Optionally, generating the rollback transition action sequence and outputting the rollback completion status includes: generating a risk event label based on the envelope erosion indicator and the stability evidence data, and generating the rollback trigger signal accordingly; calling the reverse safety transition kernel function based on the rollback trigger signal, and generating a reverse propagation control quantity based on the transition kernel parameters and the homotopy propagation variable; mapping the current cycle transition action along the reverse homotopy trajectory to a rollback transition action sequence based on the reverse propagation control quantity, and inputting the rollback transition action sequence into the safety monitor with hard real-time constraints for dynamic envelope verification to update the rollback confidence; generating the rollback completion status based on the rollback confidence; if the dynamic envelope verification fails, adjusting the parameter change range of the rollback transition action sequence or extending the execution time interval of the sequence, and re-executing the mapping and verification until there are no safety alarms throughout the rollback execution.

[0016] Compared with the prior art, the present invention has the following advantages: This invention eliminates the time difference and dimensional differences of multi-source heterogeneous data by acquiring sensor data and actuator feedback data and performing time-series alignment and feature fusion at the underlying data processing stage. At the same time, it extracts action amplitude boundaries and action change boundaries to generate executability constraint information. This constraint extraction mechanism based on digital data processing provides rigorous numerical boundaries for subsequent model inference, avoids the underlying calculation module from generating out-of-bounds instructions due to abnormal input data, and improves the data reliability of the edge model running environment.

[0017] Simultaneously, the safe transition kernel function is learned online using the difference features between the old and new actions and the data and actions. Based on the transition kernel parameters and homotopy advancement variables, the original actions of the new model are continuously mapped. This process transforms the discrete model switching actions into smooth mathematical interpolation calculations. It achieves dynamic allocation of control weights without interrupting the digital processing flow on the end side, eliminates the sudden changes in calculation values ​​caused by model replacement, and ensures the continuity and stability of digital control commands in the time series.

[0018] By inputting the current cycle transition action into a safety monitor with hard real-time constraints to perform dynamic envelope verification, the risk assessment value during the model update process is quantified in real time based on the safety verification result and envelope erosion indication. When numerical out-of-bounds or abnormal convergence trend is detected, the reverse safety transition kernel function is called to generate a rollback transition action sequence. This mechanism builds a safety computing sandbox at the computer layer that is independent of the main business logic, ensuring that when the model grayscale advancement fails, it can quickly fall back to a safe state by relying on pure mathematical mapping, preventing the spread of abnormal data to the physical execution layer.

[0019] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures pointed out in the description, claims and drawings. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a schematic diagram of the method flow of the present invention; Figure 2 This is a thermal schematic diagram of the dynamic envelope verification and safety margin of the present invention; Figure 3 This is a schematic diagram of the multi-evidence joint takeover determination radar of the present invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] Reference Figure 1 As shown, one embodiment of the present invention proposes a method for online grayscale update and safe rollback of a robot end-side model, the method comprising: S1. Acquire sensor data and actuator feedback data of the current control cycle and perform fusion processing to generate the current state vector. Extract the action amplitude boundary and action change boundary from the actuator feedback data to generate executability constraint information and output the state input data. In one embodiment of the present invention, step S1 further includes the following steps: acquiring the timestamp information of the sensor data and the timestamp information of the actuator feedback data and performing time-series alignment to generate aligned data; performing noise suppression and feature fusion on the aligned data to generate the current state vector; performing capability boundary identification and motion change boundary calculation on the actuator feedback data to generate executability constraint information, and combining the current state vector and the executability constraint information to generate state input data.

[0024] Specifically, the system acquires sensor data and actuator feedback data for the current control cycle. Sensor data represents the measured values ​​of the external environment and the actuator's own pose obtained through the sensing hardware, while actuator feedback data represents the actual position and current measurement values ​​returned by the driven components. To eliminate the time difference in data acquisition, the timestamp information of both the sensor data and the actuator feedback data is read. The timestamp information is essentially a precise timing marker for the data acquisition moment. Due to inherent differences in the acquisition frequencies of the underlying hardware, these two types of data must be time-aligned. This means unifying data from different acquisition frequencies to the same time base, thereby generating aligned data. This aligned data represents the set of measured values ​​after time base unification. The time alignment process relies on linear interpolation, and the specific calculation logic conforms to the following formula: , in Represents aligned data. The actuator feedback data represents the current moment. The actuator feedback data represents the next moment. Timestamp information representing sensor data, The timestamp information representing the data fed back by the actuator at the current moment. This represents the timestamp information indicating the data fed back by the actuator at the next moment.

[0025] After acquiring the aligned data, noise suppression is performed on both the aligned data and the sensor data to remove random interference components. Noise suppression employs an exponential moving average algorithm and uses a smoothing coefficient to filter out high-frequency noise. The smoothing coefficient is determined based on the noise spectrum distribution characteristics collected during previous hardware bench testing. After noise suppression, feature fusion is performed, combining multi-source data into a unified mathematical expression to generate a current state vector. This current state vector represents a numerical sequence describing the physical state of the system within the current control cycle. The feature fusion process requires data normalization to eliminate dimensional differences before concatenation and combination. The calculation process is as follows: , in Represents the current state vector. This represents sensor data after noise suppression. and These represent the lower and upper physical limits of sensor data, respectively. This represents aligned data after noise suppression. and These represent the lower and upper physical limits of the aligned data, respectively.

[0026] Simultaneously, the actuator feedback data is used to identify capability boundaries, that is, to determine the maximum physical limit that the drive component can output in the current state, thereby extracting the motion amplitude boundary. This motion amplitude boundary represents the maximum absolute position value that the drive component is allowed to reach. Also, the motion change boundary is calculated simultaneously, that is, to determine the maximum allowable rate of change of the drive component per unit time, thereby extracting the motion change boundary. This motion change boundary represents the maximum allowable speed limit value of the drive component. The motion amplitude boundary and the motion change boundary together generate executability constraint information. The executability constraint information represents a set of constraints containing the motion amplitude boundary and the motion change boundary. The motion change boundary is calculated using the following formula: , in Represents the boundary of action change. This represents the maximum permissible current of the drive components; this value is set based on experimental data of the motor's thermal load. This represents the current current in the actuator feedback data. This represents the torque constant of the driving component.

[0027] After completing all the above calculations, the current state vector and the executability constraint information are combined to generate state input data. The state input data represents a comprehensive data structure formed by concatenating the current state vector and the executability constraint information, which is specifically used for the subsequent model inference process. The combination process is as follows: , in Represents the status input data. This represents the transpose of the current state vector. Represents the boundary of the action amplitude. It represents the boundary of action change.

[0028] For example, the robot control system acquires sensor data and actuator feedback data for the current control cycle. At this time, the sensor data shows a joint angle of 45 degrees with a corresponding timestamp of 0.015 seconds. The actuator feedback data shows a position of 40 degrees at 0.010 seconds and a position of 50 degrees at 0.020 seconds. The timestamps for these two measurements are 0.010 seconds and 0.020 seconds, respectively. The timestamps of the sensor data and the actuator feedback data are then extracted and time-aligned. Based on the aforementioned linear interpolation formula, the three time parameters of 0.015 seconds, 0.010 seconds, and 0.020 seconds are substituted to calculate an interpolation weight of 0.5. This weight is then used to interpolate the 40-degree and 50-degree values, ultimately generating an aligned data of 45 degrees. Subsequently, noise suppression and feature fusion were performed on the aligned data. Assuming the physical lower limit of the aligned data is 0 degrees and the physical upper limit is 100 degrees, after normalization, this value was concatenated with other normalized sensor values ​​to generate the current state vector. In terms of constraint calculation, capability boundary identification and motion change boundary calculation were performed simultaneously on the actuator feedback data. The current current in the actuator feedback data was read as 5 amps, the maximum allowable current set based on motor thermal load experimental data was 15 amps, and the torque constant of the drive component was 2 amps per second per radian. Substituting these values ​​into the motion change boundary calculation formula, the motion change boundary was obtained as 5 radians per second. Simultaneously, the motion amplitude boundary in the current state was identified as 90 degrees. The 90-degree motion amplitude boundary was then combined with the 5-radian-per-second motion change boundary to generate executability constraint information. Finally, the current state vector containing values ​​such as 0.45 was concatenated with the executability constraint information, and the output state input data was used for subsequent processes.

[0029] S2. Based on the state input data, perform online inference of the old model and shadow inference of the new model to generate old model actions and new model original actions, and perform differential encoding on the old model actions and new model original actions to generate new and old action pairs data and action difference features; In one embodiment of the present invention, step S2 further includes the following steps: generating old model actions by calling the old model inference module based on state input data; generating new model original actions by calling the new model shadow inference module based on state input data; performing action difference calculation and structured encoding on the old model actions and the new model original actions to generate new and old action pair data and action difference features, wherein the structured encoding includes a combined representation of action amplitude difference, action direction difference and action change rate difference.

[0030] Specifically, based on the state input data generated in the aforementioned steps, online inference of the old model is executed. Here, the old model inference module represents the baseline decision calculation program that currently dominates the robot's physical execution component, while the old model action represents the expected execution position command output by the baseline decision calculation program based on the current state. At the same time, shadow inference of the new model is executed based on the same state input data. The original action of the new model is generated by calling the shadow inference module of the new model. The shadow inference module of the new model represents the decision calculation program to be verified that receives data synchronously in the background but is isolated from physical execution permissions. The original action of the new model represents the expected execution position command output by the decision calculation program to be verified. This parallel computing mechanism ensures that the old and new models produce corresponding output commands under completely consistent input conditions.

[0031] After acquiring two types of motion commands, differential encoding is performed on the old model's motion and the original motion of the new model. This is achieved through motion difference calculation and structured encoding. Motion difference calculation represents the process of comparing the spatial and temporal deviations of the output commands from the old and new models, while structured encoding represents the process of converting multi-dimensional deviation physical quantities into feature vectors with a unified mathematical scale. During motion difference calculation, the motion amplitude difference, motion direction difference, and motion rate of change difference are calculated respectively. The motion amplitude difference represents the Euclidean distance between the output commands of the old and new models in absolute position; the motion direction difference represents the cosine of the angle between the output commands of the old and new models in spatial vectors; and the motion rate of change... The difference represents the rate of change of the deviation between the output commands of the old and new models within a unit control cycle. To eliminate the dimensional differences between different physical quantities, structured coding includes a combined representation of the difference in motion amplitude, motion direction, and motion rate of change. Dimensionlessness is achieved by dividing each difference by its corresponding physical boundary, thereby generating motion difference features. These motion difference features represent a comprehensive feature vector that integrates multidimensional differences and eliminates physical dimensions. Simultaneously, the old model's motion is directly concatenated with the original motion of the new model to generate new and old motion pair data. This new and old motion pair data represents a concatenated set containing the original commands of the old and new models. The above calculation and encoding process is expressed by the following formula: , , , , , in Represents the difference in motion amplitude. Represents the original action of the new model. Represents the old model's actions. This indicates a difference in the direction of movement. The difference in the rate of change of the representative action. This represents the control cycle duration, which is set based on industrial control standards, with a typical value range of 0.005-0.02 seconds. Represents action difference features. Represents the boundary of the action amplitude. Represents the boundary of action change. This represents the relationship between old and new actions on the data.

[0032] For example, based on the state input data, online inference of the old model is performed, and the old model inference module is called to generate old model actions. At this time, the old model actions output by the old model inference module are vectors composed of 0.3 radians and 0.4 radians in the two-dimensional joint space. Based on the same state input data, shadow inference of the new model is performed, and the new model shadow inference module is called to generate the original actions of the new model. The output original actions of the new model are vectors composed of 0.33 radians and 0.44 radians in the two-dimensional joint space. Then, differential encoding is performed on the old model actions and the original actions of the new model. The specific approach is to perform action difference calculation. Substituting the above vectors into the action amplitude difference formula, the calculated action amplitude difference is 0.05 radians. The motion direction difference formula calculates the motion direction difference to be 1. Based on the industrial control standard setting of a control cycle length of 0.01 seconds, the motion amplitude difference of 0.05 radians is divided by 0.01 seconds to extract the motion change rate difference of 5 radians per second. After the difference extraction is completed, structured encoding is performed. The previously extracted motion amplitude boundary of 1.5 radians (0.0333) and motion change boundary of 5 radians per second (1) are read. The motion amplitude difference, motion direction difference, and motion change rate difference are combined and represented to generate motion difference features composed of 0.0333, 1, and 1. At the same time, the old model motion is concatenated with the original motion of the new model to generate a sequence composed of 0.3, 0.4, 0.33, and 0.44 as the new and old motion pair data.

[0033] S3. Construct a locally feasible pipeline and generate feasible transition domain description data based on the current state vector, action difference features and executability constraint information; In one embodiment of the present invention, step S3 further includes the following steps: generating an upper bound description of action changes based on executability constraint information as a feasibility boundary feature; calculating the tracking error based on actuator feedback data and generating feedback residuals, extracting transient sensitive direction descriptions based on the feedback residuals as sensitivity features; calculating the safety boundary distance based on the current state vector and generating a safety margin direction description as a safety feature; jointly reducing the dimensionality of the feasibility boundary features, sensitivity features, and safety features to generate a low-dimensional transition coordinate system, and constructing a locally feasible pipeline accordingly to output feasible transition domain description data.

[0034] Specifically, the previously generated executability constraint information is read, and the action change boundary and action amplitude boundary are extracted. Combined with the control cycle duration, the upper bound description of action change is calculated. This upper bound description represents the ratio of the maximum allowable action change to the maximum action amplitude within the current control cycle. This value is directly used as the feasibility boundary feature. The calculation process uses the following formula: , in Represents the characteristics of the feasibility boundary. Represents the boundary of action change. Represents the duration of the control cycle. This represents the boundary of the action amplitude.

[0035] Simultaneously, based on actuator feedback data and the old model's motion calculation, the tracking error is calculated. The tracking error represents the spatial deviation between the actual physical execution position and the baseline expected position. The tracking error is divided by the motion amplitude boundary to generate the feedback residual. Subsequently, the feedback residual is vector normalized to extract the transient sensitive direction description. The transient sensitive direction description represents the spatial vector direction most prone to physical oscillation. This description is directly used as the sensitivity feature. The above data is calculated using the following formula: , , , in Represents tracking error. This represents the actuator feedback data. Represents the old model's actions. Representative feedback residuals, The transient sensitivity direction is described, i.e., the sensitivity characteristics.

[0036] The current state vector is read synchronously, and its Euclidean distance to the preset physical safety limit is calculated to obtain the safety boundary distance. The safety boundary distance represents the remaining numerical space between the current physical state and the dangerous state. The current state vector is reversed and multiplied by the safety boundary distance to generate a safety margin direction description. The safety margin direction description represents a vector pointing to the safest physical state. This description is directly used as a safety feature, and the calculation logic is based on the formula: , , in Represents the safe boundary distance. Represents the current state vector. This represents the direction of safety margin, i.e., safety characteristics.

[0037] After obtaining the above features, the feasibility boundary features, sensitivity features, and safety features are concatenated into a high-dimensional feature matrix. Principal component analysis (PCA) is used to perform joint dimensionality reduction. During the startup phase, 5000 sets of historical operational data (each set containing feasibility boundary features, sensitivity features, and safety features) are collected in advance. Their covariance matrices are calculated, and eigenvalues ​​and eigenvectors are solved. The two principal component directions with a cumulative contribution rate greater than 95% are selected to form the projection matrix. This matrix remains fixed during operation. Redundant information is eliminated by extracting the first two principal components, generating a two-dimensional low-dimensional transition coordinate system. This low-dimensional transition coordinate system represents a simplified spatial reference system that retains core constraint information. Before constructing the locally feasible pipeline, the three-dimensional action difference features are first projected onto the two-dimensional low-dimensional transition coordinate system to obtain the projected two-dimensional transition difference features. The product of the low-dimensional transition coordinate system and the projected features is calculated to construct a locally feasible pipeline. The locally feasible pipeline represents a numerical channel in low-dimensional space that allows for safe switching between the old and new model actions. Finally, the feasible transition domain description data describing this channel is output. The calculation process is as follows: , , , , in Represents a high-dimensional feature matrix. Represents a low-dimensional transition coordinate system. This represents the projection matrix defined based on the data variance distribution. Represents a locally feasible pipeline. Representing action difference features, it directly assigns the numerical set of local feasible pipelines to the feasible transition domain description data and outputs it.

[0038] For example, the reading motion change boundary is 5 radians per second, the control cycle duration is 0.01 seconds, and the motion amplitude boundary is 1.5 radians. Substituting these values ​​into the formula, the upper bound of the motion change is calculated to be 0.0333. This value serves as the feasibility boundary feature. The actuator feedback data is obtained as a vector consisting of 0.28 radians and 0.38 radians, while the old model motion is a vector consisting of 0.3 radians and 0.4 radians. Subtracting the two, the tracking error is calculated as a vector consisting of -0.02 radians and -0.02 radians. Dividing the tracking error by the 1.5 radian motion amplitude boundary generates a feedback residual consisting of a vector consisting of -0.0133 and -0.0133. The feedback residual is normalized, and the transient sensitive direction is extracted and described as consisting of -0.0133 radians. The vector consisting of 0.707 and -0.707 is used as a sensitivity feature. Then, the current state vector is read as a vector consisting of 0.45 and 0.45, its magnitude is calculated to be 0.636, and the safety boundary distance is calculated to be 0.364. The current state vector is reverse normalized and multiplied by 0.364 to generate a safety margin direction description consisting of a vector consisting of -0.257 and -0.257, which is used as a safety feature. At the same time, the values ​​of 0.0333, -0.707, and -0.257 are concatenated to generate a high-dimensional feature matrix. Joint dimensionality reduction is performed through the projection matrix to generate a low-dimensional transition coordinate system. The low-dimensional transition coordinate system is multiplied with the action difference feature to construct a locally feasible pipeline, and the feasible transition domain description data containing the above channel boundary values ​​is output.

[0039] S4. Based on the feasible transition domain description data and the new and old action pair data, learn the safe transition kernel function online and output the transition kernel parameters and stability evidence data; In one embodiment of the present invention, step S4 further includes the following steps: constructing a transition feature vector based on feasible transition domain description data, and inputting the transition feature vector and new and old action pair data into an online learning module to generate transition kernel parameters; performing feature mapping based on the transition kernel parameters to generate a gating factor and homotopy propagation variable as a description of the transition mapping; calculating the switching energy evaluation quantity based on action difference features and transient sensitive direction description, and forming a switching energy evaluation quantity sequence characterizing the convergence trend of the transition process as stability evidence data.

[0040] Specifically, it receives the previously generated feasible transition domain description data, which represents the numerical channel boundary information describing the safe switching between the old and new model actions. The transition feature vector is constructed by: converting the local feasible pipeline... It is formed by splicing the center line and the width value, that is , in and These represent the mean and width of the pipeline on each low-dimensional coordinate axis, respectively. A transition feature vector is constructed based on the feasible transition domain description data. Then, the transition feature vector and the previously generated new and old action pairs are input into the online learning module. The online learning module represents a parameter optimization calculation program that continuously updates its internal weights by receiving data in real time. In this embodiment, the online learning module uses a recursive least squares algorithm to update the transition kernel parameters and employs a sliding window mechanism to accumulate samples from the most recent 10-20 control cycles. A typical window size is 15, balancing the real-time performance and stability of online learning. The latest transition feature vector is received in each control cycle. Data on new and old actions Then, the parameters are updated according to the following recursive formula. This module fits the mapping relationship between the input data through the ridge regression algorithm, learns the safe transition kernel function online, and generates transition kernel parameters. The safe transition kernel function represents the mathematical transformation rule for smooth and safe mapping between the old and new model actions. The transition kernel parameters represent the weight matrix that defines the transformation rule. The calculation process of the transition kernel parameters is as follows: , in Represents the transition kernel parameters. Represents the transition feature vector. This represents the transpose of the transition eigenvector. This represents the regularization coefficient, which is fixed at 0.01 in this embodiment. This value is predetermined through mesh search in a standard robot dynamics simulation environment to balance fitting accuracy and parameter generalization ability. Represents the identity matrix. This represents the transpose of data from the old and new actions.

[0041] After obtaining the transition kernel parameters, feature mapping is performed based on them. Feature mapping represents the process of converting input features into control variables through a nonlinear function. This mapping is used to generate a gating factor and a homotopy advancement variable, which describe the transition mapping. The transition mapping description represents a comprehensive variable describing the mixing ratio of old and new actions and the advancement state. The gating factor represents a dimensionless coefficient controlling the mixing ratio of old and new actions. The homotopy advancement variable represents a continuous value characterizing the degree of evolution from old model actions to new model actions. The feature mapping is calculated using the following formula: , in Represents the gating factor. Represents the natural constant. Represents the boundary of the action amplitude. This represents the homotopy progression variable.

[0042] Simultaneously, the previously generated motion difference features and transient sensitive direction descriptions are read. The motion difference features represent a comprehensive feature vector that integrates multidimensional differences and eliminates physical dimensions. The transient sensitive direction description represents the spatial vector direction most prone to physical oscillation. To match the dimensions of the two, the original 2D transient sensitive direction description is expanded to 3D: The last dimension represents the scalar baseline value of the sensitivity to the rate of change of motion (fixed at 1). The switching energy evaluation metric is calculated based on the motion difference characteristics and transient sensitivity direction description. This metric represents the magnitude of the disturbance energy that may be injected during model switching, and its calculation logic must conform to the formula: , in This represents the switching energy evaluation quantity. The transpose representing the action difference feature. The extended transient sensitivity direction description arranges the calculation results of the current period and the historical period in chronological order to form a switching energy evaluation quantity sequence that characterizes the convergence trend of the transition process. This sequence is directly output as stability evidence data, which represents a numerical sequence that proves that the transition process will not cause the system to diverge or oscillate.

[0043] For example, feasible transition domain description data is received and linearly arranged to construct a transition feature vector consisting of 0.5 and 0.8. Then, new and old action pairs consisting of 0.3, 0.4, 0.33, and 0.44 are read to extract the old model actions. With the original action of the new model The action increment vector is calculated. The transition feature vector and action increment vector are input into the online learning module. A regularization coefficient of 0.01 is set, and the transition kernel parameters (0.035 radians and 0.045 radians) are calculated using the ridge regression formula. Feature mapping is performed based on these parameters. The action amplitude boundary is read as 1.5 radians. The transpose of the transition kernel parameters is multiplied by the transition feature vector to obtain 0.0535 radians. Dividing this by 1.5 radians yields 0.0357. Substituting this into the natural exponential function, a gating factor of 0.509 is calculated. This value is directly assigned to the homotopy advancement variable to generate the gating factor and homotopy advancement variable describing the transition mapping. The action difference features (0.0333, 1, and 1) are read, and the two-dimensional spatial component is extracted. The transient sensitive direction description, consisting of -0.707 and -0.707, is multiplied by the transpose of the action difference feature spatial component and the transient sensitive direction description to obtain -1.414. The square of this value is used to calculate the switching energy evaluation quantity as 2.0. Finally, 2.0 and 2.150 from the previous cycle are arranged in chronological order to form the switching energy evaluation quantity sequence, which is then output as stability evidence data.

[0044] S5. Receive the grayscale advancement trigger signal and generate a transition window control command. Adjust the homotopy advancement rate based on the transition window control command, and map the original action of the new model to the current cycle transition action based on the transition kernel parameters, and output the transition progress status. In one embodiment of the present invention, step S5 further includes the following steps: acquiring the grayscale advancement trigger signal and parsing it to obtain the advancement stage identifier, generating a transition window control instruction; adjusting the homotopy advancement rate and updating the homotopy advancement variable based on the transition window control instruction, generating an advancement control quantity; performing continuous mapping on the original action of the new model based on the advancement control quantity, the gating factor and the transition kernel parameter, generating the current cycle transition action, and generating a transition progress state based on the homotopy advancement variable to characterize the completion ratio of the online grayscale update of the end-side model.

[0045] Specifically, the grayscale advancement trigger signal is acquired and parsed to obtain the advancement stage identifier. The grayscale advancement trigger signal represents a Boolean instruction received by the system to start or continue model replacement. The advancement stage identifier represents a numerical label indicating the specific stage of the replacement process. Based on this identifier, a transition window control instruction is generated, which represents a set of parameters used to control the advancement rhythm.

[0046] The homotopic propulsion rate is adjusted based on the transition window control command. The homotopic propulsion rate represents the allowable increase in the propulsion ratio per unit control cycle, and the adjustment process conforms to the following formula: , in Represents the homotopy propulsion rate, This represents the rate adjustment coefficient extracted from the transition window control instructions. This represents the baseline advance rate, which is set based on historical smooth handover test experience. In this embodiment, the baseline advance rate is... The initial setting is 2. This value was determined through offline simulation. The robot model was tested with 100 grayscale switching cycles in the Simulink environment, and the maximum propulsion rate that could guarantee no overshoot in more than 95% of the test cases was selected.

[0047] Subsequently, the homotopy propulsion variable is updated to generate the propulsion control quantity. The homotopy propulsion variable represents a continuous value characterizing the degree of evolution from the old model action to the new model action. The propulsion control quantity represents the actual propulsion ratio used in the current cycle, and its calculation is as follows: , , in Represents the updated homotopy advancement variable. Represents the homotopy progression variable generated in the early stage. Represents the duration of the control cycle. This represents the amount of control that is being promoted.

[0048] Next, a continuous mapping is performed on the original motion of the new model based on the propulsion control quantity, gating factor, and transition kernel parameters. Continuous mapping represents a mathematical calculation process that smoothly interpolates the old and new motions according to a specific ratio and kernel parameters, thereby generating the current cycle transition motion. The current cycle transition motion represents the position command actually prepared to be issued to the physical execution unit after mapping, and is calculated according to the following formula: , in Represents the transitional action of the current cycle. Represents the old model's actions. Represents the gating factor. Represents the original action of the new model. Represents the transition kernel parameters. This represents the transition feature vector. Finally, a transition progress state is generated based on the homotopy advancement variable to characterize the completion ratio of the online grayscale update of the edge model. The transition progress state represents a percentage value reflecting the model replacement progress. Upon initial startup, the homotopy advancement variable... Initialize to 0.

[0049] For example, a grayscale advancement trigger signal is obtained. The grayscale advancement trigger signal can be generated by the cloud management platform or the local security decision module. The trigger conditions include: model update instructions issued by the cloud, stable status of the local system for 5 consecutive control cycles (tracking error less than 0.01 radians), and preset timed advancement nodes. The propulsion phase identifier is carried by the trigger signal and is used to distinguish between the initial propulsion phase (0-30%), the stable propulsion phase (30%-70%), and the final takeover phase (70%-100%). The propulsion phase identifier is parsed as 2 (corresponding to the stable propulsion phase). Based on this, a transition window control command is generated, and the rate adjustment coefficient is extracted to be 0.5. The baseline propulsion rate, set based on historical smooth switching test experience, is read as the reciprocal of 2 seconds. Substituting this into the calculation, the homotopy propulsion rate is calculated as the reciprocal of 1 second. The previously generated homotopy propulsion variable is read as 0.509, the control cycle duration is 0.01 seconds, and the homotopy propulsion variable is updated to 0.519, which is then used as the propulsion control variable. The old model's action is read as a vector composed of 0.3 radians and 0.4 radians, and the new model's original action is read as a vector composed of 0.33 radians and 0.44 radians. The gating factor is 0.509, the transition kernel parameters are a vector composed of 0.035 radians and 0.045 radians, and the transition feature vector is... The continuous mapping calculation is performed to generate the current cycle transition action as a vector consisting of 0.3357 radians and 0.4384 radians. Based on the updated homotopy advancement variable of 0.519 multiplied by 100%, the transition progress state is generated as 51.9%, which represents the completion ratio of the online grayscale update of the end-side model.

[0050] S6. Input the current cycle transition action into a safety monitor with hard real-time constraints to perform dynamic envelope verification, output the safety verification result, envelope erosion indication and safety margin change, and generate a transition confidence state based on the safety margin change. In one embodiment of the present invention, step S6 further includes the following steps: inputting the current cycle transition action and executability constraint information into a safety monitor with hard real-time constraints to perform dynamic envelope verification, generating a safety verification result and an envelope erosion indication; calculating the safety boundary distance and updating the safety margin based on the safety verification result, generating a safety margin change; classifying the safety margin change by trend and generating a trend label; generating a transition confidence state based on the trend label and the envelope erosion indication.

[0051] Specifically, refer to Figure 2As shown, the current cycle transition action and executability constraint information are input into a safety monitor with hard real-time constraints. This safety monitor represents an independent verification program that must complete calculations within a strict time limit. It meets hard real-time requirements by: employing a priority-based preemptive scheduling mechanism to set the safety verification task as the highest priority; pre-allocating a fixed amount of memory space to avoid time uncertainties caused by dynamic memory allocation; and using streamlined computational logic to ensure all verification operations are completed within 1ms. Dynamic envelope verification is performed within this monitor, which is the process of comparing the expected action with the dynamically changing safety boundary. By extracting the action amplitude boundary from the executability constraint information, the difference between the action amplitude boundary and the current cycle transition action magnitude is calculated to generate a safety verification result. The safety verification result represents the absolute physical distance of the action from the safety boundary. When the safety verification result is less than zero, it indicates that the action has exceeded the safety boundary. The absolute value of this difference is extracted to generate an envelope erosion indicator; otherwise, the envelope erosion indicator is zero. The envelope erosion indicator represents the specific physical degree to which the action exceeds the safety boundary, and is calculated using the following formula: , , in This represents the security verification result. Represents the boundary of the action amplitude. Represents the transitional action of the current cycle. This indicates envelope erosion.

[0052] After completing the above verification, the safety boundary distance is calculated based on the safety verification results. The safety boundary distance represents the relative dimensionless value of the safety limit of the action distance. The safety boundary distance is generated by dividing the safety verification result by the action amplitude boundary and is directly used to update the safety margin. The safety margin represents the current overall safety reserve state. The safety margin of the current period is subtracted from the safety margin of the previous period to generate the change in safety margin. The change in safety margin represents the difference in the evolution of the safety reserve state over time. The above process is calculated using the following formula: , , , in Represents the safe boundary distance. This represents the security verification result. Represents the boundary of the action amplitude. Represents the updated safety margin. Represents the change in safety margin. This represents the safety margin of the previous cycle.

[0053] After obtaining the change in safety margin, the change in safety margin is classified into trends. Trend classification represents the process of dividing the direction of safety evolution based on the positive or negative characteristics of the change. The sign characteristics of the change in safety margin are extracted to generate trend labels. Trend labels represent numerical indicators indicating whether the safety status is improving or deteriorating. Based on the trend labels and envelope erosion indicators, a transition confidence state is generated. The transition confidence state represents an evaluation index that comprehensively reflects the safety and reliability of the current transition process. The trend labels and transition confidence states are calculated using the following formulas: , , in Represents trend tags, This represents a minimal constant to prevent the denominator from being zero. Represents the transitional credibility state. This represents a penalty coefficient set based on industrial safety regulations. In this embodiment, the penalty coefficient... It can be set to 10, which is based on the requirement in the industrial robot safety specifications that the maximum allowable overshoot must not exceed 10% of the command amplitude.

[0054] For example, the current cycle transition action and executability constraint information are input into a safety monitor with hard real-time constraints to perform dynamic envelope verification. The current cycle transition action is read as a vector consisting of 0.3357 radians and 0.4384 radians. The action amplitude boundary in the executability constraint information is read as 1.5 radians. The magnitude of the current cycle transition action is calculated as 0.552 radians, and a safety verification result of 0.948 radians is generated. Substituting 0.948 radians into the envelope erosion indicator formula, an envelope erosion indicator of 0 radians is generated. Based on the safety verification result, the safety boundary distance is calculated, and 0.948 radians is divided by... The safety boundary distance is generated at 1.5 radians, which is 0.632. Based on this, the safety margin is updated to 0.632. The safety margin of the previous period is read as 0.610, and the change in safety margin is generated as 0.022. The change in safety margin is classified into trends. The minimum constant is set to 0.0001. The trend label is generated as 0.999 by substituting 0.022 into the formula. The penalty coefficient set based on industrial safety specifications is read as 10. Finally, the transition confidence state is generated as 0.631. The homotopy advancement variable is read as 0.519. The transition kernel parameter is a vector composed of 0.035 radians and 0.045 radians. The modulus of the transition kernel parameters is calculated to be 0.057 radians. Dividing this by the action amplitude boundary of 1.5 radians yields 0.038. The natural constant is calculated to the power of -0.038, resulting in 0.963. Multiplying this by the homotopy propulsion variable generates a reverse propulsion control variable of 0.500. The current cycle transition action is mapped along the reverse homotopy trajectory. The current cycle transition action is read as a vector consisting of 0.3357 radians and 0.4384 radians. Based on the actuator's physical response limit, the parameter change amplitude is set to a vector consisting of 0.01 radians and 0.01 radians. The sequence step index is set to 5. Multiplying 5 by 0.500 yields 2.5. Multiplying this by the parameter change... The amplitude is reduced to a vector consisting of 0.025 radians and 0.025 radians. This vector is subtracted from the current cycle transition action to generate a single action in the rollback transition action sequence consisting of a vector consisting of 0.3107 radians and 0.4134 radians. The rollback transition action sequence is input into a safety monitor with hard real-time constraints for dynamic envelope verification. The magnitude of the single action is calculated to be 0.517 radians, and the rollback confidence is calculated and updated to 0.655. Since the verification passes and there is no safety alarm, the system generates a rollback completion status of 1 based on the rollback confidence. Finally, based on the rollback transition action sequence, the robot's actuator is controlled to perform the corresponding physical actions.

[0055] S7. Based on the transition progress status, transition credibility status and stability evidence data, perform takeover determination, generate takeover enable signal and output takeover completion status. In one embodiment of the present invention, step S7 further includes the following steps: obtaining the transition progress status and generating a stage completion index to form progress evidence; obtaining the transition credibility status and extracting a credibility sequence to form security evidence; obtaining stability evidence data and extracting a convergence trend index to form convergence evidence; performing a joint determination based on the progress evidence, security evidence, and convergence evidence to generate a takeover enable signal, and updating the control status after generating the takeover enable signal, and outputting the takeover completion status.

[0056] Specifically, refer to Figure 3 As shown, the transitional progress status generated in the early stage is obtained. This status represents a percentage reflecting the model replacement progress. The transitional progress status is divided by the target takeover progress threshold to generate a phase completion index. The target takeover progress threshold represents the minimum progress requirement allowed for complete takeover in the system design specifications. Based on the design specifications, the phase completion index represents the relative proportion of the current progress to the final goal. The value of the phase completion index is directly assigned to the progress evidence to form progress evidence. The progress evidence represents the supporting data for the progress dimension used in the final takeover decision. Its calculation formula is as follows: , in Indicators representing the completion rate of a stage This represents the transition progress status. This represents the threshold for the target takeover progress. This represents evidence of progress.

[0057] The system acquires the previously generated transition confidence status, which represents an evaluation index comprehensively reflecting the security and reliability of the current transition process. It combines the current period's transition confidence status with similar values ​​from historical periods in chronological order to extract a confidence sequence. This confidence sequence represents a set of values ​​recording the evolution of the security status over a period of time. The system calculates the statistical mean of the confidence sequence to form security evidence. This security evidence represents the average confidence level of the system maintaining a secure state within the recent evaluation window. The security evidence is calculated using the following formula: , in Represents security evidence. This represents the sequence length, which is set based on the evaluation window requirements. This represents the numerical values ​​in the credibility sequence.

[0058] Acquire the stability evidence data generated in the early stage. This data represents a numerical sequence proving that the transition process will not cause the system to diverge or oscillate. Extract the numerical differences between adjacent control periods from the stability evidence data, calculate the decay ratio, and extract the convergence trend index. The convergence trend index represents the rate at which the system's disturbance energy dissipates over time. The value of the convergence trend index is directly assigned to the convergence evidence to form convergence evidence. The convergence evidence represents the support data for the stability dimension used in the final takeover decision. The convergence evidence is calculated using the following formula: , in This represents a convergence trend indicator. The switching energy assessment value representing the previous cycle in the stability evidence data. The switching energy assessment value for the current cycle in the stability evidence data. This represents convergent evidence.

[0059] A joint decision is made based on progress evidence, safety evidence, and convergence evidence. This joint decision represents a logical calculation process that comprehensively evaluates progress achievement, safety achievement, and energy convergence. The joint decision value is calculated by weighted summation of the aforementioned evidence. When the joint decision value exceeds a decision threshold, a takeover enable signal is generated. This signal represents a trigger instruction allowing the new model to fully acquire control. The joint decision value is calculated using the following formula: , in Represents the joint judgment value. Represents the schedule weight. Represents safety weight. The convergence weights are typically set to Wp=0.4, Ws=0.4, and Wc=0.2, and are determined through orthogonal testing on a robot bench. The decision threshold is determined through ROC curve analysis, with a typical range of 0.5-0.6 and a typical value of 0.55, to balance the timeliness and safety of takeover. When the joint decision value is lower than the threshold, the homotopy propulsion rate is automatically reduced to 50% of the baseline rate, and the evaluation window length is extended to 5 control cycles before re-determining the joint decision. If the decision fails to meet the threshold for three consecutive times, a rollback process is triggered. After generating the takeover enable signal, the control status is updated. The control status represents the model identifier of the currently dominant physical execution component. It switches between the old and new model identifiers based on the Boolean state of the takeover enable signal and outputs the takeover completion status, which represents a confirmation that the takeover process has ended. The calculation formula for the control status is as follows: , in Represents the state of control. Represents the old model identifier. This represents a takeover enable signal. This represents the new model identifier.

[0060] For example, firstly, the transition progress status is obtained as 100%, and the target takeover progress threshold set based on the system design specifications is read as 100%. Substituting these two values ​​into the formula and dividing, a phase completion index of 1 is generated. This value is directly assigned to the progress evidence, forming progress evidence of 1. The transition confidence status for the current period is obtained as 0.470. A confidence sequence consisting of 0.470, 0.480, and 0.490 is extracted based on historical values. The sequence length, set based on the evaluation window requirement, is 3, thus calculating a safety evidence of 0.480. Simultaneously, stability evidence data is obtained: the switching energy evaluation value for the previous period was 0.0800, and the switching energy evaluation value for the current period is 0.0. 726. Simultaneously, the convergence trend index is calculated to be 0.0925. This value is directly assigned to the convergence evidence, forming a convergence evidence of 0.0925. Based on the progress evidence, safety evidence, and convergence evidence, a joint judgment is performed. The progress weight, safety weight, and convergence weight, which are set according to the system's emphasis on each indicator, are read as 0.4, 0.4, and 0.2 respectively. The products of each are multiplied and added to calculate the joint judgment value of 0.6185. Then, it is compared with the judgment threshold set to 0.55. Since 0.6185 is greater than 0.55, a takeover enable signal of 1 is generated. The old model identifier is read as 0, the new model identifier is read as 1, and the updated control status is calculated as 1. Finally, the system outputs the takeover completion status as 1, confirming the end of the takeover process.

[0061] S8. When the envelope erosion indicator appears or the stability evidence data does not meet the convergence trend, a rollback trigger signal is generated, and the reverse safe transition kernel function is called to generate a rollback transition action sequence. The rollback completion status is output, and the robot's actuator is controlled to perform the corresponding physical action based on the current cycle transition action or the rollback transition action sequence.

[0062] In one embodiment of the present invention, step S8 further includes the following steps: generating risk event labels based on envelope erosion indication and stability evidence data, and generating rollback trigger signals accordingly; calling the reverse safety transition kernel function based on the rollback trigger signal, and generating reverse propagation control quantities based on transition kernel parameters and homotopy propagation variables; mapping the current cycle transition action along the reverse homotopy trajectory to a rollback transition action sequence based on the reverse propagation control quantities, and inputting the rollback transition action sequence into a safety monitor with hard real-time constraints for dynamic envelope verification to update rollback confidence, and generating a rollback completion status based on the rollback confidence; if the dynamic envelope verification fails, adjusting the parameter change range of the rollback transition action sequence or extending the execution time interval of the sequence, and re-executing the mapping and verification until there are no safety alarms throughout the rollback execution.

[0063] Specifically, the system continuously monitors the previously generated envelope erosion indicators and stability evidence data. Envelope erosion indicators represent the specific physical extent to which actions exceed the safety boundary, while stability evidence data represents a numerical sequence proving that the transition process will not cause system divergence or oscillation. Risk event labels are generated based on these data, representing numerical indicators that signify a dangerous system state. To quantify the degree of danger, a risk assessment value is calculated. When an envelope erosion indicator appears or the stability evidence data fails to meet a convergence trend, the risk assessment value exceeds the safety threshold. The risk event label is then set to a triggered state, and a rollback trigger signal is generated accordingly. This rollback trigger signal represents the instruction to activate the safety retreat mechanism. The risk assessment follows the formula below: , in Represents the risk assessment value. This represents the erosion weight set based on historical failure data. Represents envelope erosion indication, Represents the boundary of the action amplitude. This represents the divergence weights set based on the dynamic characteristics of the system. This represents a convergence trend indicator extracted from stability evidence data.

[0064] Based on the rollback trigger signal, the reverse safe transition kernel function is invoked. The reverse safe transition kernel function represents the mathematical transformation rule for safely reverting the action from the new model state to the old model state. Based on the previously generated transition kernel parameters and homotopy propulsion variables, a reverse propulsion control quantity is generated. The reverse propulsion control quantity represents a dimensionless value that controls the rollback speed and proportion. The reverse propulsion control quantity is calculated by the following formula: , in Represents the reverse control quantity. Represents homotopy progression variables, Represents the natural constant. The transition kernel parameter represents the reverse safety transition kernel function, which controls the smoothness of the rollback process by adjusting the modulus of the transition kernel parameter in the exponential term, ensuring that the rollback trajectory and the forward propulsion trajectory have symmetrical dynamic characteristics.

[0065] After obtaining the reverse propulsion control quantity, the current cycle transition action is mapped along the reverse homotopy trajectory to a rollback transition action sequence. The reverse homotopy trajectory represents the smooth path of action retraction, and the rollback transition action sequence represents the set of position commands during the retraction process. The calculation is based on the following formula: , in This represents a single action in the rollback transition sequence. Represents the transitional action of the current cycle. Represents the sequence step index. Represents the reverse control quantity. This represents the magnitude of parameter variation, which is based on the actuator's physical response limit setting.

[0066] The rollback transition sequence is input into a safety monitor with hard real-time constraints for dynamic envelope verification. The difference between the action in the sequence and the action amplitude boundary is calculated, and the rollback confidence is updated based on this difference. The rollback confidence, which represents the evaluation index of the safety of the rollback process, is calculated using the following formula: , in This represents the credibility of the rollback. This represents the action amplitude boundary, that is, the maximum absolute value of the position that the driven component is allowed to reach. This represents a single action in the rollback transition sequence. This represents the transpose of the single action vector. The overall representation calculates the magnitude of the single action in space, that is, the absolute physical distance of the single action. Based on the rollback confidence level, a rollback completion status is generated, which represents a confirmation flag indicating the end of the rollback.

[0067] If the dynamic envelope verification fails, i.e., a security alarm is detected, the parameter change range of the rollback transition action sequence will be adjusted or the execution time interval of the sequence will be extended. The execution time interval represents the time period for the action sequence to be issued. The parameter change range will be reduced and the execution time interval will be increased, calculated according to the following formula: , in This represents the extended execution time interval. This represents the extension coefficient set based on the security policy. The execution time interval is represented by the mapping and verification process, which is repeated until the rollback execution is completed without any safety alarms. Finally, based on the current cycle transition action or the rollback transition action sequence, the robot's actuator is controlled to perform the corresponding physical action. The robot's actuator represents the physical drive component, and the physical action represents the actual mechanical motion.

[0068] For example, the detected envelope erosion indicator is 0.1 radians, the convergence trend index extracted from the stability evidence data is -0.05, the erosion weight set based on historical fault data is 2, the divergence weight set based on the system's dynamic characteristics is 1, and the action amplitude boundary is 1.5 radians. Substituting these values ​​into the formula, the calculated risk assessment value is 0.1834. Since this value is greater than 0, a risk event label of 1 is generated, and a rollback trigger signal of 1 is generated accordingly, and the reverse safe transition kernel function is called.

[0069] It should be noted that the electrical connections between the various units described above do not necessarily represent direct or indirect connections. Any indirect connection method can be applied to the embodiments of the present invention as long as it achieves the purpose of the present invention. The above are merely exemplary embodiments of the present invention and should not be construed as limiting the scope of the present invention.

[0070] All equivalent changes and modifications made in accordance with the teachings of this invention are still within the scope of this invention. Those skilled in the art will readily conceive of other embodiments of this invention upon considering the specification and the disclosure of practical truth. This application is intended to cover any variations, uses, or adaptations of this invention that follow the general principles of this invention and include common knowledge or conventional techniques in the art not described herein.

Claims

1. A method for online grayscale update and safe rollback of a robot end-side model, characterized in that, The method includes: The sensor data and actuator feedback data of the current control cycle are acquired and fused to generate the current state vector. The action amplitude boundary and action change boundary are extracted from the actuator feedback data to generate executability constraint information, and the state input data is output. Based on the state input data, perform online inference of the old model and shadow inference of the new model to generate old model actions and new model original actions, and perform differential encoding on the old model actions and the new model original actions to generate new and old action pairs data and action difference features; Based on the current state vector, the action difference features, and the executability constraint information, a local feasible pipeline is constructed and feasible transition domain description data is generated; Based on the feasible transition domain description data and the new and old action pair data, a safe transition kernel function is learned online, and transition kernel parameters and stability evidence data are output. Receive the grayscale advancement trigger signal and generate a transition window control command. Adjust the homotopy advancement rate based on the transition window control command, and map the original action of the new model to the current cycle transition action based on the transition kernel parameters, and output the transition progress status. The current cycle transition action is input into a safety monitor with hard real-time constraints to perform dynamic envelope verification, outputting the safety verification result, envelope erosion indication and safety margin change, and generating a transition confidence state based on the safety margin change. Based on the transition progress status, the transition credibility status, and the stability evidence data, a takeover determination is performed, a takeover enable signal is generated, and the takeover completion status is output. When the envelope erosion indication appears or the stability evidence data does not meet the convergence trend, a rollback trigger signal is generated, and the reverse safe transition kernel function is called to generate a rollback transition action sequence. The rollback completion status is output, and the actuator of the robot is controlled to perform corresponding physical actions based on the current cycle transition action or the rollback transition action sequence.

2. The method for online grayscale update and safe rollback of a robot end-side model according to claim 1, characterized in that, The output status input data includes: The timestamp information of the sensor data and the timestamp information of the actuator feedback data are obtained and time-aligned to generate aligned data. The aligned data is subjected to noise suppression and feature fusion to generate the current state vector; The actuator feedback data is used to identify capability boundaries and calculate action change boundaries to generate the executability constraint information. The current state vector and the executability constraint information are then combined to generate the state input data.

3. The method for online grayscale update and safe rollback of a robot end-side model according to claim 1, characterized in that, The generated new and old action pairs data and action difference features include: Based on the state input data, the old model inference module is invoked to generate the old model action; Based on the state input data, the new model shadow reasoning module is invoked to generate the original action of the new model; The old model action and the original action of the new model are subjected to action difference calculation and structured encoding to generate the old and new action pair data and the action difference features. The structured encoding includes a combined representation of action amplitude difference, action direction difference and action change rate difference.

4. The method for online grayscale update and safe rollback of a robot end-side model according to claim 1, characterized in that, The process of constructing a locally feasible pipeline and generating feasible transition domain description data includes: Based on the executability constraint information, an upper bound description of action changes is generated as a feasibility boundary feature; The tracking error is calculated based on the actuator feedback data and a feedback residual is generated. A transient sensitive direction description is extracted based on the feedback residual as a sensitivity feature. Based on the current state vector, the safety boundary distance is calculated and a safety margin direction description is generated as a safety feature; The feasibility boundary features, the sensitivity features, and the security features are jointly reduced in dimensionality to generate a low-dimensional transition coordinate system, and the local feasible pipeline is constructed accordingly to output the feasible transition domain description data.

5. The method for online grayscale update and safe rollback of a robot end-side model according to claim 4, characterized in that, The output transition kernel parameters and stability evidence data include: Based on the feasible transition domain description data, a transition feature vector is constructed, and the transition feature vector and the new and old action pair data are input into the online learning module to generate the transition kernel parameters; Based on the transition kernel parameters, feature mapping is performed to generate a gating factor and a homotopy advancement variable that describe the transition mapping. Based on the action difference features and the transient sensitive direction description, the switching energy evaluation quantity is calculated, and a switching energy evaluation quantity sequence characterizing the convergence trend of the transition process is formed as the stability evidence data.

6. The method for online grayscale update and safe rollback of a robot end-side model according to claim 5, characterized in that, The output transition progress status includes: The grayscale advancement trigger signal is acquired and the advancement stage identifier is parsed to generate the transition window control command; Based on the transition window control command, the homotopy propulsion rate is adjusted and the homotopy propulsion variable is updated to generate a propulsion control quantity; Based on the propulsion control quantity, the gating factor, and the transition kernel parameter, a continuous mapping is performed on the original action of the new model to generate the current cycle transition action, and the transition progress state is generated based on the homotopy propulsion variable to characterize the completion ratio of the online grayscale update of the end-side model.

7. The method for online grayscale update and safe rollback of a robot end-side model according to claim 1, characterized in that, The generated transition credibility state includes: The current cycle transition action and the executable constraint information are input into the safety monitor with hard real-time constraints to perform dynamic envelope verification, and the safety verification result and the envelope erosion indication are generated. Based on the security verification results, the security boundary distance is calculated and the security margin is updated to generate the change in the security margin. The change in the safety margin is classified into trends and trend labels are generated. The transition confidence state is generated based on the trend labels and the envelope erosion indication.

8. The method for online grayscale update and safe rollback of a robot end-side model according to claim 1, characterized in that, The process of generating a takeover enable signal and outputting a takeover completion status includes: The transition progress status is obtained and a stage completion index is generated to form progress evidence; The transitional credibility state is obtained and the credibility sequence is extracted to form security evidence; The stability evidence data is obtained and convergence trend indicators are extracted to form convergence evidence; Based on the progress evidence, the security evidence, and the convergence evidence, a joint determination is performed to generate the takeover enable signal. After generating the takeover enable signal, the control status is updated, and the takeover completion status is output.

9. A method for online grayscale update and safe rollback of a robot end-side model according to claim 5 or 6, characterized in that, The generated rollback transition sequence, and the output rollback completion status include: Risk event labels are generated based on the envelope erosion indication and the stability evidence data, and the rollback trigger signal is generated accordingly. The reverse safety transition kernel function is invoked based on the rollback trigger signal, and a reverse propulsion control quantity is generated based on the transition kernel parameters and the homotopy propulsion variable. Based on the reverse propulsion control quantity, the current cycle transition action is mapped along the reverse homotopy trajectory to a rollback transition action sequence, and the rollback transition action sequence is input into the safety monitor with hard real-time constraints for dynamic envelope verification to update the rollback confidence. The rollback completion status is generated based on the rollback confidence. If the dynamic envelope verification fails, the parameter change range of the rollback transition action sequence is adjusted or the execution time interval of the sequence is extended, and the mapping and verification are re-executed until there are no security alarms throughout the rollback execution.

Images