A redundant control system for underwater robots

Abstract

This application belongs to the field of underwater operation equipment control technology and provides an underwater robot redundant control system, including a main processor, a sub-processor, and a switching module. The main processor and the sub-processor communicate bidirectionally and synchronously obtain sensor data of the underwater robot. When the underwater robot is in an operating state, the main processor controls the operation of the underwater robot's working equipment. When the underwater robot is in a fault state, the sub-processor takes over control of the underwater robot, wherein the fault state includes at least one of a main processor fault state and an equipment fault state. The switching module switches the underwater robot's control mode according to the state of the underwater robot, wherein the control mode includes a main processor control mode and a sub-processor control mode. The technical solution provided by this application can accurately judge the state of the underwater robot and select reasonable response measures in complex underwater operation situations.

Description

Technical Field

[0001] The present application belongs to the technical field of underwater operation equipment control, and specifically provides a redundant control system for an underwater robot. Background Art

[0002] Underwater robots, also known as remote-controlled unmanned submersibles (ROVs), are intelligent devices that can perform various set operations underwater. They are used to replace humans in completing various tasks in complex underwater environments, such as surveying seabed topography, detecting mineral resources, collecting marine physical data, searching for underwater targets, inspecting submarine oil pipelines, and maintaining underwater construction operations. They are currently widely used in various fields such as the military, coast guard, maritime affairs, customs, nuclear power, hydropower, offshore oil, fisheries, maritime rescue, pipeline detection, and marine scientific research.

[0003] With the advancement of technologies such as marine engineering and deep-sea mining, human exploration of the ocean has gradually shifted from shallow waters to the deep sea. Underwater robots are now capable of performing a variety of precision operations at great depths and in dangerous areas. However, due to the complexity of the underwater environment, underwater robots often encounter various unexpected situations during operations, resulting in varying degrees of failure. Therefore, existing underwater robot control systems generally incorporate redundant control mechanisms.

[0004] However, due to the complexity of the underwater operating environment, when underwater robots encounter various types of faults, the causes of the faults are different, and the degree of impact on the normal operation of the underwater robots also varies greatly. If they are not accurately analyzed and evaluated, redundant control may be frequently activated when the underwater robot only has a minor fault, terminating normal operation, resulting in extended operation period and increased operation costs. Therefore, different response measures need to be taken for different fault types and impact levels to achieve a better balance between the operation safety and operation costs of the underwater robot. Summary of the Invention

[0005] The purpose of this application is to solve the problems existing in the above-mentioned prior art and to provide an underwater robot redundant control system that can accurately judge the fault status of the underwater robot and select the corresponding control mode according to different fault conditions.

[0006] The embodiments of the present application can be implemented through the following technical solutions:

[0007] A redundant control system for an underwater robot includes a main processor, a sub-processor, and a switching module. The main processor and the sub-processor communicate with each other bidirectionally and synchronously acquire sensor data of the underwater robot. When the underwater robot is in a working state, the main processor controls the operation of the underwater robot's working equipment. When the underwater robot is in a fault state, the sub-processor takes over control of the underwater robot, wherein the fault state includes at least one of a main processor fault state and an equipment fault state. The switching module switches the control mode of the underwater robot according to the state of the underwater robot, wherein the control mode includes a main processor control mode and a sub-processor control mode.

[0008] Furthermore, the secondary processor determines whether the underwater robot enters a fault state from a working state based on the following steps:

[0009] Step S10, monitoring the operating state of the main processor. If the operating state of the main processor is abnormal, determining that the underwater robot has entered a main processor failure state, otherwise executing step S20;

[0010] Step S20, performing abnormality detection on the sensor data synchronously acquired by the main processor and the sub-processor, and determining the equipment fault level of the underwater robot based on the detection result;

[0011] Step S30: If the equipment failure level is higher than the preset takeover level, it is determined that the underwater robot has entered an equipment failure state; otherwise, the process returns to step S10.

[0012] Preferably, the abnormal operating state of the main processor is at least one of the following situations: the heartbeat detection result of the main processor is abnormal, and the main processor fails to send sensor data to the secondary processor.

[0013] Preferably, the sensor data includes: posture data and depth data of the underwater robot and temperature data, air pressure data and humidity data of its sealed cabin.

[0014] Furthermore, the step S20 specifically includes the following steps:

[0015] Step S21: If the abnormality detection result of the posture data or the air pressure data is abnormal, determine that the device failure level is serious and execute step S30; otherwise, execute step S22;

[0016] Step S22: If the abnormality detection result of the depth data is abnormal, determine that the equipment fault level is medium and execute step S30; otherwise, execute step S23;

[0017] Step S23: If the abnormality detection result of the temperature data or the humidity data is abnormal, determine that the equipment fault level is minor and execute step S30; otherwise, execute step S24;

[0018] Step S24: Determine that the device fault level is no fault and return to step S10.

[0019] Preferably, anomaly detection specifically includes the following steps:

[0020] The first step is to determine whether the sensor data obtained by the secondary processor exceeds the preset normal range of sensor data. If not, exit the abnormality detection and set the abnormality detection result to normal. If it exceeds, execute the second step;

[0021] The second step is to determine whether the sensor data synchronously obtained by the main processor exceeds the preset normal range of sensor data. If it exceeds, the abnormality detection is exited and the abnormality detection result is set as abnormal. If it does not exceed, the third step is executed:

[0022] The third step is to send a sensor data inconsistency warning to the main processor;

[0023] Step 4: Exit anomaly detection and set the anomaly detection result to normal.

[0024] Preferably, the posture data of the underwater robot includes the posture data of the first posture sensor obtained by the main processor and the posture data of the second posture sensor obtained synchronously by the sub-processor, wherein the first posture sensor is arranged at the center of gravity of the underwater robot, and the second posture sensor is arranged at a position closer to the sub-processor than the first posture sensor.

[0025] Furthermore, the switching module includes a selection submodule and a switching submodule; the selection submodule synchronously receives a first chip select signal output by the main processor and a second chip select signal output by the sub-processor, determines a control mode based on the first chip select signal and the second chip select signal, and outputs a control mode signal; the switching submodule synchronously receives the control mode signal, the first control signal output by the main processor, and the second control signal output by the sub-processor, and selectively outputs the first control signal or the second control signal to the working equipment of the underwater robot based on the control mode signal.

[0026] Furthermore, the selection submodule determines the control mode based on the following criteria: when the first chip select signal and the second chip select signal are both normal, the control mode is determined to be the main processor control mode; when the first chip select signal is abnormal and the second chip select signal is abnormal, the control mode is determined to be the sub-processor control mode.

[0027] Furthermore, when the underwater robot is in a device failure state, the secondary processor forcibly sets both the first chip select signal and the second chip select signal to abnormal; when the underwater robot is in a main processor failure state, the first chip select signal is abnormal, and the secondary processor forcibly sets the second chip select signal to abnormal.

[0028] Preferably, the selection submodule further determines the control mode based on the following criteria: when the first chip select signal is normal and the second chip select signal is abnormal, the control mode is determined to be the main processor control mode.

[0029] Preferably, the main processor sends a return inquiry signal to the host computer when the first chip select signal is normal and the second chip select signal is abnormal; the sub-processor controls the underwater robot to return according to a preset return plan after the underwater robot enters a fault state.

[0030] Preferably, the selection submodule is an AND gate, whose first input terminal is used to input the first chip select signal and is connected to the VCC terminal through a first pull-up resistor, its second input terminal is used to input the second chip select signal and is connected to the VCC terminal through a second pull-up resistor, and its ground terminal is connected to the GND terminal; when the first chip select signal and the second chip select signal are normal, they correspond to low-level signals, and when the first chip select signal and the second chip select signal are abnormal, they correspond to high-level signals; when the control mode is the main processor control mode, the control mode signal is a low-level signal, and when the control mode is the secondary processor control mode, the control mode signal is a high-level signal.

[0031] Preferably, the ratio of the main frequencies of the main processor and the secondary processor is greater than or equal to 2, and the ratio of the storage spaces is greater than or equal to 8.

[0032] An embodiment of the present application provides an underwater robot redundant control system that can accurately judge the state of the underwater robot in response to various complex situations, and requires different response measures to be taken for different fault types and impact levels to achieve reasonable selection of redundant protection measures. At the same time, the underwater robot redundant control system can avoid excessive occupation of system resources required for normal operations through an optimized system architecture, so as to achieve a better balance between the operational safety and operating costs of the underwater robot. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 Schematic diagram of the system framework of the underwater robot redundant control system according to an embodiment of the present application;

[0034] Figure 2 This is a flow chart of a secondary processor determining whether an underwater robot has entered a fault state according to an embodiment of the present application;

[0035] Figure 3 Schematic diagram of the framework structure of the switching module according to an embodiment of the present application;

[0036] Figure 4 is a schematic diagram of a switching module according to a specific embodiment;

[0037] Figure 5a is a circuit schematic diagram of a selection submodule according to a specific embodiment;

[0038] Figure 5b is a circuit schematic diagram of a switching submodule according to a specific embodiment. DETAILED DESCRIPTION

[0039] Hereinafter, the present application will be further described based on preferred embodiments with reference to the accompanying drawings.

[0040] A remote operated vehicle (ROV) is a robot designed for underwater operations. It typically consists of a cabin (typically with a sealed compartment inside), a control system, a power supply system, and various other equipment required to operate in watertight conditions. The ROV's control system typically uses an embedded operating system and is connected via cables to various devices located outside or inside the cabin (such as power equipment, communications equipment, sensors, image acquisition equipment, pan / tilt systems, robotic arms or grippers, navigation and positioning equipment, and lighting). Programs running in the control system control these external devices, while the power supply system provides power to the operating system and various other equipment.

[0041] Underwater robots can perform a variety of precision underwater operations through remote control or autonomous operation. In some operational scenarios that require continuous operation without pause (such as underwater guarding and searching), or in some operating environments that restrict the retrieval of underwater robots (such as exploration in confined environments), if the underwater robot cannot continue to operate due to a fault, it will seriously affect the operation and even cause a larger safety accident. Therefore, it is generally necessary to set up a redundant protection mechanism for the underwater robot's control system. The following factors should be considered as much as possible when designing the redundant protection mechanism:

[0042] (1) The underwater operation environment is complex, and it is much more difficult to obtain information on various emergencies than on surface or land operations. Therefore, in most cases, the control system needs to make autonomous judgments and select reasonable response measures. If the judgment is wrong or the response measures are inappropriate, on the one hand, the fault situation may continue to deteriorate and even affect the safety of underwater operations and underwater robots. On the other hand, it may cause normal operations to be frequently terminated when there are only some minor faults, thereby delaying the operation period and increasing the operation cost.

[0043] (2) In order to cope with the long duration and complex working conditions of underwater operations, the control system of underwater robots is generally built with a more stable embedded system. However, at the same time, its computing, storage, and communication resources are orders of magnitude different from those of ordinary PC systems. Therefore, the module that provides redundant protection for the control system of underwater robots should also pay attention to avoid excessive competition for resources required for normal operations, or even a large amount of system resources being idle or wasted, resulting in the impact on normal operations.

[0044] To this end, the present application provides an underwater robot redundant control system through an embodiment. The control system can accurately judge the state of the underwater robot in response to various complex conditions, and reasonably select redundant protection measures according to different states. At the same time, the redundant control system can avoid excessive occupation of system resources required for normal operation through an optimized system architecture.

[0045] Figure 1 This is an architectural diagram of a robot redundant control system provided according to some preferred embodiments of the present application, such as Figure 1 As shown, the computer redundant control system includes a main processor, a secondary processor and a switching module.

[0046] In some preferred embodiments, the ratio of the main processor's clock speed to the secondary processor's clock speed is greater than or equal to 2, and the ratio of their memory capacities is greater than or equal to 8. For example, the main processor uses an STM32F407VET6 with a clock speed of 168 MHz and 512 KB of Flash memory, while the secondary processor uses an STM32F103C8T6 with a clock speed of 72 MHz and 64 KB of Flash memory. The main processor has significantly higher performance than the secondary processor, ensuring that system resources are prioritized for underwater operations.

[0047] like Figure 1 As shown, bidirectional communication is performed between the main processor and the sub-processor. For example, in some embodiments, the main processor and the sub-processor are connected via a heartbeat line (or other signal line capable of bidirectional data transmission) via a serial port to achieve bidirectional data transmission.

[0048] Furthermore, in some specific embodiments, various sensor devices are installed at various locations on the underwater robot in a fixed connection, mounting, or hanging manner to collect various types of sensor data. For example, a posture sensor (or gyro sensor) and a depth sensor can be installed outside (or inside) the underwater robot's cabin to obtain the underwater robot's posture data and depth data. In another example, a temperature and humidity sensor and an air pressure sensor can be installed inside the underwater robot's sealed cabin to obtain temperature data, humidity data, and air pressure data within the sealed cabin. For another example, the types and layout of sensor devices can be increased or changed according to the specific requirements of underwater operations.

[0049] The above sensor devices can communicate with the main processor and the sub-processor through SPI, IIC, CAN and other communication methods to ensure that the main processor and the sub-processor synchronously obtain the sensor data of the underwater robot.

[0050] The main processor controls the operation of the underwater robot's working equipment when the underwater robot is in a working state. The specific type, installation method and working mode of the working equipment can be selected according to specific operational requirements. For example, the underwater robot can be used for photographing underwater environments and capturing / acquiring underwater targets. Its working equipment includes underwater cameras, underwater video cameras, robotic arms with grippers, etc. The above-mentioned working equipment is powered by a power supply system and is controlled by a program running on the main processor when in a working state.

[0051] In addition, the working equipment also includes a power system. For example, an underwater robot can have a power system composed of 8 thrusters. By adjusting the angle and speed of the thrusters in different positions, the underwater robot can realize various navigation, steering, posture adjustment, operation hovering and other actions.

[0052] When the underwater robot is in a faulty state, the secondary processor takes over control of the underwater robot. The switching module switches the underwater robot's control mode based on the robot's current state. The underwater robot's control modes include a primary processor control mode and a secondary processor control mode. The primary processor control mode has been described in detail above. The following, combined with the accompanying drawings and preferred embodiments, details the faulty state determination process and the corresponding control mode switching implementation.

[0053] In an embodiment of the present application, the fault state may include a main processor fault state and an equipment fault state. The underwater robot may enter one of the above fault states from a working state at a certain moment, or the underwater robot may also enter a state where the above two fault states exist at the same time from a working state at a certain moment.

[0054] Specifically, the main processor failure state corresponds to a state in which serious problems occur in the hardware or software of the main processor during its operation, for example, a state in which the main processor cannot operate normally due to a main processor chip failure or a program running on the main processor running out of order.

[0055] Specifically, an equipment failure state occurs when complex underwater operating conditions cause equipment other than the control system to malfunction during underwater robot operation. For example, abnormal air pressure inside a sealed cabin can lead to a serious problem, such as rapid water leakage. Abnormal humidity or temperature inside a sealed cabin could also be caused by minor leakage from the cabin or overheating of the circuit boards. These problems may only affect the safety of the underwater robot if they persist for a long time.

[0056] Obviously, corresponding to the different abnormal situations encountered during the operation of underwater robots, the causes and severity should be judged first, and then different countermeasures should be adopted. At the same time, it should also be considered how to reasonably allocate the system's computing, storage, and communication resources to avoid the above judgment process from excessively consuming the main processor resources and affecting the implementation of its underwater operations.

[0057] In the embodiment of the present application, the state of the underwater robot is determined by the secondary processor, such as Figure 2 As shown, in some preferred embodiments, the secondary processor determines whether the underwater robot enters a fault state from a working state based on the following steps:

[0058] Step S10, monitoring the operating state of the main processor. If the operating state of the main processor is abnormal, determining that the underwater robot has entered a main processor failure state, otherwise executing step S20;

[0059] Step S20, performing abnormality detection on the sensor data synchronously acquired by the main processor and the sub-processor, and determining the equipment fault level of the underwater robot based on the detection result;

[0060] Step S30: If the equipment failure level is higher than the preset takeover level, it is determined that the underwater robot has entered an equipment failure state; otherwise, the process returns to step S10.

[0061] The above steps S10 to S30 are performed in a certain continuous cycle during the operation of the underwater robot, wherein the secondary processor continuously monitors the operating state of the main processor through step S10, and immediately determines that the underwater robot enters the main processor fault state when the main processor operating state is abnormal. In some specific embodiments, such as Figure 2 As shown, the running status judgment can be performed through a heartbeat line, which continuously detects the heartbeat signal of the main processor and judges that the running status of the main processor is abnormal when the heartbeat detection result is abnormal; in other specific embodiments, the heartbeat line is also used to send the sensor signal obtained by the main processor to the secondary processor. When the secondary processor cannot receive the sensor data sent by the main processor, it is judged that the running status of the main processor is abnormal.

[0062] When the main processor is in normal operation, the sub-processor detects the device status of the underwater robot through steps S20 to S30, and determines whether the device enters a fault state. In some specific embodiments, step S20 specifically includes the following steps:

[0063] Step S21: If the abnormality detection result of the posture data or the air pressure data is abnormal, determine that the device failure level is serious and execute step S30; otherwise, execute step S22;

[0064] Step S22: If the abnormality detection result of the depth data is abnormal, determine that the equipment fault level is medium and execute step S30; otherwise, execute step S23;

[0065] Step S23: If the abnormality detection result of the temperature data or the humidity data is abnormal, determine that the equipment fault level is minor and execute step S30; otherwise, execute step S24;

[0066] Step S24: Determine that the device fault level is no fault and return to step S10.

[0067] For underwater robots, when different sensor data are abnormal, there will be different degrees of impact on the underwater robot. For example, as described above, when the air pressure data inside the sealed cabin is abnormal, there may be a serious problem of rapid water leakage in the sealed cabin, and it is necessary to immediately terminate the ongoing underwater operation and return or surface in time; when the humidity or temperature data inside the sealed cabin is abnormal, it may be caused by slight leakage of the cabin or overheating of the circuit board. The above problems may only affect the safety of the underwater robot when they continue for a long time. Therefore, after sending an alarm to the main processor, the main processor can control the underwater robot to return after completing the current operation.

[0068] Accordingly, in an embodiment of the present application, the equipment failure level is divided into severe, medium and mild according to the severity of the underwater robot failure reflected by different sensor data. In the above steps S21 to S24, the sensor data is detected for abnormalities. Specifically, the sub-processor prioritizes detecting sensor data that has a greater impact on the operation of the equipment. If there is an abnormality in the detection result, it directly returns to the more severe failure level. Otherwise, it continues to detect sensor data that has a smaller impact on the operation of the equipment until the abnormality detection of all sensor data is completed and the equipment failure level is finally determined. Then, in step S30, it is determined whether the underwater robot is in an equipment failure state based on whether the above equipment failure level is higher than the takeover level.

[0069] In an embodiment of the present application, a sub-processor is used to perform anomaly detection to determine whether there is an equipment failure in the underwater robot. First, it can ensure that the computing resources of the main processor are used first to control the operation process of the underwater robot, and avoid the fault detection and judgment process occupying too many of its resources. The sub-processor can select a chip with a lower frequency or configuration based on the needs of fault detection and judgment, thereby saving costs while ensuring the accuracy of detection and judgment.

[0070] Secondly, since the main processor consumes a lot of resources to control the operation of the underwater robot, the sensor data it obtains often has problems of lag and data errors. Using the secondary processor to obtain more accurate sensor data for anomaly detection can accurately judge the various equipment failures of the underwater robot and ensure timely response to various failures.

[0071] In some preferred embodiments, the secondary processor performs anomaly detection on each type of sensor data by the following steps:

[0072] The first step is to determine whether the sensor data obtained by the secondary processor exceeds the preset normal range of sensor data. If not, exit the abnormality detection and set the abnormality detection result to normal. If it exceeds, execute the second step;

[0073] The second step is to determine whether the sensor data synchronously obtained by the main processor exceeds the preset normal range of sensor data. If it exceeds, the abnormality detection is exited and the abnormality detection result is set as abnormal. If it does not exceed, the third step is executed:

[0074] The third step is to send a sensor data inconsistency warning to the main processor;

[0075] Step 4: Exit anomaly detection and set the anomaly detection result to normal.

[0076] In the process of detecting abnormalities in sensor data, if the sensor data obtained by the sub-processor is normal through the first step, there is no need for subsequent detection and it returns directly to normal. If the sensor data obtained by the sub-processor is abnormal, there are the following possibilities: 1) There is indeed a fault in the corresponding part or equipment of the underwater robot; 2) Data fluctuations occur during the sensor data acquisition process, causing it to exceed the normal range; 3) There is a fault in the sub-processor itself.

[0077] To this end, in the above-mentioned abnormality detection, if the sensor data obtained by the secondary processor is abnormal, the sensor data obtained by the main processor is further used for verification, and a judgment is made based on the verification result. If both are abnormal, the detection result is determined to be abnormal. Otherwise, the detection result is determined to be normal, and only a warning of data inconsistency is issued to the main processor.

[0078] In the embodiments of the present application, the takeover level can be determined based on the operating environment, task conditions, and equipment characteristics of different underwater robots. For example, when operating in shallow waters or nearshore environments, the takeover level can be appropriately increased. For example, the takeover level can be set to medium, so that the secondary processor will only take over the underwater robot when the equipment failure level is severe. When operating in deep waters or over long distances, the takeover level can be set to minor. In this case, the secondary processor will begin to take over the underwater robot as long as the equipment failure level is medium.

[0079] In some preferred embodiments, Figure 1 As shown, the underwater robot is equipped with two attitude data sensors, namely a first attitude sensor and a second attitude sensor. The first attitude sensor is set at the center of gravity of the underwater robot, and its attitude data is synchronously acquired by the main processor and the secondary processor. The second attitude sensor is set closer to the secondary processor than the first attitude sensor, for example, integrated on the circuit board of the secondary processor, and its attitude data is acquired only by the secondary processor.

[0080] Existing underwater robots generally place attitude sensors (such as gyroscope sensors) at the center of gravity of the underwater robot. The attitude information obtained at this position can accurately reflect the overall attitude of the robot and can be directly provided for the robot's motion control. However, since the attitude sensor is connected to the circuit board by a cable and the electromagnetic environment is relatively complex, it may be interfered with by other devices (for example, the magnetic field interference caused by the rotation of the motor will affect the operation of the attitude sensor. The magnetic field generated by different motor speeds is different, and the impact on the attitude sensor is also dynamically changing), thereby affecting the accuracy of the data obtained by the attitude sensor.

[0081] To this end, in an embodiment of the present application, a second attitude sensor is provided at a location closer to the secondary processor, such as on the PCB circuit board of the control system. Although the attitude data at this location is not accurate enough, it can still detect the attitude information of the underwater robot and is very stable. On this basis, with the second attitude sensor as the reference, when the attitude data obtained by it exceeds the normal range, the attitude data of the first attitude sensor is used to perform consistency detection: if the error between the attitude data obtained by the first attitude sensor and the second attitude sensor always remains within a certain range, the first attitude sensor is considered to be working normally; if the error between the attitude data obtained by the first attitude sensor and the second attitude sensor exceeds the threshold and continues to occur, the first attitude sensor is considered to be abnormal.

[0082] In an embodiment of the present application, a switching module is used to automatically switch the underwater robot's control mode based on the underwater robot's state (operating state, fault state). When the underwater robot is in the operating state, the control mode is switched to the primary processor control mode. When the underwater robot enters the fault state, the control mode is automatically switched to the secondary processor control mode. The specific implementation of the switching module is described in detail below with reference to the accompanying drawings.

[0083] Figure 3 FIG. 1 shows a schematic diagram of a switching module in some preferred embodiments. Figure 3 As shown, the switching module includes a selection submodule and a switching submodule, wherein the selection submodule synchronously receives a first chip select signal output by the main processor and a second chip select signal output by the secondary processor, determines a control mode based on the first chip select signal and the second chip select signal, and outputs a control mode signal;

[0084] The switching submodule synchronously receives the control mode signal, the first control signal output by the main processor, and the second control signal output by the sub-processor, wherein the switching submodule selectively outputs the first control signal or the second control signal to the working equipment of the underwater robot according to the control mode signal.

[0085] In some optional embodiments of the present application, the working equipment is a power system of an underwater robot, such as a power system composed of multiple thrusters. The first control signal is a control signal output by a primary processor for the power system, and the second control signal is a control signal output by a secondary processor for the power system. In other optional embodiments, the working equipment may also include other equipment of the underwater robot for performing underwater operations, such as a robotic arm, an image or video capture device, etc., and the first control signal and the second control signal may also include control signals for the aforementioned equipment.

[0086] In some preferred embodiments, the main processor, the secondary processor and the switching module implement the switching of the control mode by:

[0087] First, when the underwater robot is in an equipment failure state, the secondary processor forcibly sets both the first chip select signal and the second chip select signal to abnormal; when the underwater robot is in a main processor failure state, the first chip select signal is abnormal, and the secondary processor forcibly sets the second chip select signal to abnormal.

[0088] Secondly, when the first chip select signal and the second chip select signal are both normal, the selection submodule determines that the control mode is the main processor control mode, and outputs the control mode signal corresponding to the main processor control mode to the switching submodule; when the first chip select signal is abnormal and the second chip select signal is abnormal, the selection submodule determines that the control mode is the sub-processor control mode, and outputs the control mode signal corresponding to the sub-processor control mode to the switching submodule.

[0089] Finally, the switching submodule selects the control signal to be output to the working equipment according to the received control mode signal. When the control mode signal corresponds to the main processor control mode, the switching submodule outputs the first control signal output by the main processor to the working equipment of the underwater robot. Otherwise, the second control signal output by the sub-processor is output to the working equipment of the underwater robot.

[0090] Furthermore, in some preferred embodiments, when the first chip select signal is normal and the second chip select signal is abnormal, the selection submodule determines that the control mode is the main processor control mode and outputs a corresponding control mode signal.

[0091] Table 1 below lists, in some specific embodiments, state combinations of underwater robot control mode switching caused by normal / abnormal conditions of the first chip select signal and the second chip select signal.

[0092] Table 1

[0093] Underwater robot status First chip select signal Second chip select signal Control mode signal Working equipment control signal Working status normal normal Main processor control mode First control signal Fault status abnormal abnormal Subprocessor control mode The second control signal Subprocessor damage status normal abnormal Main processor control mode First control signal

[0094] In some preferred embodiments, the switching module can be implemented by logic gate circuits and multi-channel multiplexers. Figure 4 A specific embodiment of the switching module is shown, such as Figure 4 As shown, the selection submodule is implemented by an AND gate, and the switching submodule is implemented by a two-choose-one multi-channel selector.

[0095] Specifically, the main processor and the secondary processor confirm each other's survival status through the heartbeat line. Under normal circumstances, the chip select signals of the main processor and the secondary processor both output low level, and the output of the AND gate is low level, which is connected to the two-to-one multi-channel selector, so that it selects the PWM signal output of the main processor, which is output to the robot's working equipment after passing through the buffer chip;

[0096] When the secondary processor detects a fault in the main processor, the secondary processor sets its own chip select signal to a high level, while the chip select signal output by the main processor is in a floating state. At this time, due to the effect of the pull-up resistor, the signal output to the AND gate is raised to a high level, and the AND gate output is a high level, and then the secondary processor's PWM signal is output to the working device through the two-to-one multi-channel selector;

[0097] When the secondary processor detects a device fault, it sets its own chip select signal to a high level and, at the same time, forces the chip select signal of the main processor to a high level through the heartbeat line. The AND gate output is high, and the secondary processor's PWM signal is then output to the working device through the two-to-one multi-channel selector.

[0098] When the secondary processor is damaged, the main processor is in normal working state and it still outputs a low-level chip select signal, while the chip select signal output by the secondary processor is in a floating state. At this time, due to the effect of the pull-up resistor, the signal output to the AND gate is raised to a high level, and then the AND gate outputs a low level, and then the PWM signal of the main processor is output to the working device through the two-to-one multi-channel selector.

[0099] Table 2 below shows the Figure 4 The combination of chip select signals, control mode signals and working device control signals in the embodiment shown.

[0100] Table 2

[0101] Underwater robot status First chip select signal Second chip select signal Control mode signal Working equipment control signal Working status 0 0 0 PWM output from the main processor Fault status 1 1 1 PWM output from the subprocessor Subprocessor damage status 1 0 1 PWM output from the main processor

[0102] It should be understood that without departing from the technical concept of this application, Figure 4 The embodiment shown in the figure can be modified in various ways. For example, a NAND gate can be used instead of Figure 4 The same mode switching function can be achieved by using an AND gate and using a pull-down resistor instead of a pull-up resistor, and changing the input-output correspondence of the two-to-one multi-channel selector accordingly.

[0103] Figure 5a and Figure 5b The specific circuit principle diagram of the AND gate and the two-choose-one multi-channel selector in a specific embodiment is further shown. Figure 5a As shown, the model of AND gate U7 is SN74AHC1G08DCKR, and its two input terminals A and B respectively input the chip select signal PWM CS1 output by the main processor and the chip select signal PWM CS2 output by the sub-processor, and are connected to the 3.3V power supply through pull-up resistors R13 and R11 respectively. Its output terminal Y is used to output the control mode signal.

[0104] Figure 5a and Figure 5b In the embodiment shown, the power system of the underwater robot includes 8 underwater thrusters, and the main processor and the auxiliary processor respectively output 8 control signals to control the 8 underwater thrusters. Figure 5bIn the embodiment shown, the two two-to-one multi-channel selectors U9 and U10 are both of model SN74LVC157ARGYR, and each selector inputs 4 first control signals (numbered with the prefix TIM) and 4 second control signals (numbered with the prefix RE_TIM), and outputs the first control signal or the second control signal to 8 thrusters through SELECT_CH1 to SELECT_CH8 in a selective manner through the mode control signal PWM_CS_OUT.

[0105] In some preferred embodiments, the main processor sends a return inquiry signal to the host computer when the first chip select signal is normal and the second chip select signal is abnormal; the sub-processor controls the underwater robot to return according to a preset return plan after the underwater robot enters a fault state. Specifically, when the underwater robot enters a fault state, the sub-processor takes over control of the underwater robot. At this time, because the processing power of the sub-processor is far weaker than that of the main processor, it can no longer continue the original underwater operation alone. Therefore, it controls the underwater robot to return according to the preset return plan. When the first chip select signal is normal and the second chip select signal is abnormal, it means that the main processor can operate normally, but the sub-processor is damaged. At this time, the redundant protection mechanism has failed. The main processor sends a return inquiry signal to the host computer, and the host computer determines whether to continue to complete the underwater operation task or return directly.

[0106] The above is a detailed introduction to the specific implementation methods of the present application. For those skilled in the art, several improvements and modifications can be made to the present application without departing from the principles of the present application. These improvements and modifications also fall within the scope of protection of the claims of the present application.

Claims

1. A redundant control system for an underwater robot, comprising a main processor, a secondary processor, and a switching module, characterized in that: The ratio of the main processor's clock speed to that of the secondary processor is greater than or equal to 2, and the ratio of their storage space is greater than or equal to 8; The main processor and the sub-processor communicate bidirectionally and synchronously acquire sensor data of the underwater robot, wherein the sensor data includes: posture data, depth data of the underwater robot and temperature data, air pressure data and humidity data of its sealed cabin; The main processor controls the operation of the working equipment of the underwater robot when the underwater robot is in the working state; The secondary processor takes over control of the underwater robot when the underwater robot is in a fault state, wherein the fault state includes at least one of a main processor fault state and a device fault state; The switching module switches the control mode of the underwater robot according to the state of the underwater robot, and the control mode includes a main processor control mode and a sub-processor control mode; The secondary processor determines whether the underwater robot enters a fault state from a working state based on the following steps: Step S10, monitoring the operating state of the main processor. If the operating state of the main processor is abnormal, determining that the underwater robot has entered a main processor failure state, otherwise executing step S20; Step S20, performing abnormality detection on the sensor data synchronously acquired by the main processor and the sub-processor, and determining the equipment fault level of the underwater robot based on the detection result; Step S30: If the equipment failure level is higher than the preset takeover level, it is determined that the underwater robot has entered an equipment failure state; otherwise, the process returns to step S10; The step S20 specifically includes the following steps: Step S21, if the abnormality detection result of the posture data or the air pressure data is abnormal, determine that the equipment failure level is serious and execute step S30, otherwise execute step S22; Step S22: If the abnormality detection result of the depth data is abnormal, determine that the equipment failure level is medium and execute step S30; otherwise, execute step S23; Step S23: If the abnormality detection result of the temperature data or the humidity data is abnormal, determine that the equipment fault level is minor and execute step S30; otherwise, execute step S24; Step S24, determining that the device fault level is no fault and returning to step S10; The sub-processor performs anomaly detection on each type of sensor data through the following steps: The first step is to determine whether the sensor data obtained by the secondary processor exceeds the preset normal range of sensor data. If not, exit the abnormality detection and set the abnormality detection result to normal. If it exceeds, execute the second step; The second step is to determine whether the sensor data synchronously obtained by the main processor exceeds the preset normal range of sensor data. If it exceeds, the abnormality detection is exited and the abnormality detection result is set as abnormal. If it does not exceed, the third step is executed: The third step is to send a sensor data inconsistency warning to the main processor; Step 4: Exit anomaly detection and set the anomaly detection result to normal.

2. The underwater robot redundant control system according to claim 1, characterized in that: The abnormal operating state of the main processor is at least one of the following: The heartbeat detection result of the main processor is abnormal, and the main processor fails to send sensor data to the secondary processor.

3. The underwater robot redundant control system according to claim 1, characterized in that: The posture data of the underwater robot includes the posture data of the first posture sensor obtained by the main processor and the posture data of the second posture sensor obtained synchronously by the sub-processor, wherein the first posture sensor is set at the center of gravity of the underwater robot, and the second posture sensor is set at a position closer to the sub-processor than the first posture sensor.

4. The underwater robot redundant control system according to claim 1, characterized in that: The switching module includes a selection submodule and a switching submodule; The selection submodule synchronously receives a first chip select signal output by the main processor and a second chip select signal output by the secondary processor, determines a control mode based on the first chip select signal and the second chip select signal, and outputs a control mode signal; The switching submodule synchronously receives the control mode signal, the first control signal output by the main processor and the second control signal output by the sub-processor, and outputs the first control signal or the second control signal to the working equipment of the underwater robot in an alternative manner based on the control mode signal.

5. The underwater robot redundant control system according to claim 4, characterized in that: The selection submodule determines the control mode based on the following criteria: When both the first chip select signal and the second chip select signal are normal, determining the control mode to be a main processor control mode; When the first chip select signal is abnormal and the second chip select signal is abnormal, the control mode is determined to be a sub-processor control mode.

6. The underwater robot redundant control system according to claim 4, characterized in that: When the underwater robot is in a device failure state, the secondary processor forcibly sets both the first chip select signal and the second chip select signal to abnormal; When the underwater robot is in a main processor failure state, the first chip select signal is abnormal, and the secondary processor forcibly sets the second chip select signal to be abnormal.

7. The underwater robot redundant control system according to claim 5, characterized in that: The selection submodule further determines the control mode based on the following criteria: When the first chip select signal is normal and the second chip select signal is abnormal, the control mode is determined to be a main processor control mode.

8. The underwater robot redundant control system according to claim 7, characterized in that: The main processor sends a return inquiry signal to the host computer when the first chip select signal is normal and the second chip select signal is abnormal; After the underwater robot enters a fault state, the secondary processor controls the underwater robot to return according to a preset return plan.

9. The underwater robot redundant control system according to claim 4, characterized in that: The selection submodule is an AND gate, whose first input terminal is used to input the first chip select signal and is connected to the VCC terminal through a first pull-up resistor, whose second input terminal is used to input the second chip select signal and is connected to the VCC terminal through a second pull-up resistor, and whose ground terminal is connected to the GND terminal; When the first chip select signal and the second chip select signal are normal, they correspond to low-level signals; when the first chip select signal and the second chip select signal are abnormal, they correspond to high-level signals; When the control mode is the main processor control mode, the control mode signal is a low level signal; when the control mode is the sub-processor control mode, the control mode signal is a high level signal.

Images