Safety control device and safety rule adjustment method

Abstract

The problem is to achieve work efficiency and ensure safety of actions of control objects in different control systems, i.e., in an environment where heterogeneous systems are mixed. A safety control server (5) for controlling actions of control objects in heterogeneous systems under a plurality of control systems has an action adjustment section (5330) for outputting an action adjustment instruction for adjusting actions to a control object in a control system different from the control object, in the case where a conflict occurs in which the action of the control object deviates from an intended control result, an action plan adjustment section (5320) for adjusting a pre-stored action plan indicating an action rule for avoiding a conflict of the control object and for functioning, in the case where the adjustment of the action satisfies a prescribed condition, and a safety rule adjustment section (5310) for adjusting a pre-stored safety rule indicating an action rule for avoiding a conflict of the control object, in the case where the adjustment of the action plan satisfies a prescribed condition.

Description

Technical Field

[0001] This invention relates to control in an environment where multiple controlled objects exist in a mixed environment controlled by heterogeneous systems. Furthermore, the controlled objects include mobile bodies such as vehicles, and complete sets of equipment such as factories and power plants. Background Technology

[0002] Currently, in response to advancements in technologies such as AI (Artificial Intelligence), control technologies like autonomous driving are being implemented in a wide variety of fields. For example, in the transportation sector, autonomous driving technology and driver assistance technology for automobiles have been developed. Here, different autonomous driving technologies and driver assistance technologies coexist on the road. Furthermore, vehicles using these technologies and manually driven vehicles also coexist on the road. Moreover, in loading and unloading operations such as in warehouses where robots are used as one of the controlled objects, operators sometimes assist the robots in their work.

[0003] In control technologies that involve the coexistence of heterogeneous systems such as humans and machines, it is essential to ensure the safety of the controlled object's actions. For example, this includes preventing collisions, personal injury accidents, and property damage accidents involving the controlled object.

[0004] Patent Document 1 discloses a technology aimed at ensuring such safety. The objective of Patent Document 1 is to ensure sufficient safety even when an operator and machine are working together in coordination. To solve this problem, Patent Document 1 includes: a generation unit that generates a predicted movement route for the operator based on the operator's location information history, and generates a predicted movement route for the machine based on the machine's location information history and / or a set operating range; a determination unit that predicts the positions of the operator and machine based on the current positions of the operator and machine in the work area, as well as the predicted movement routes generated by the generation unit, and determines whether the predicted positions are a predetermined positional relationship based on determination criteria; and a reporting unit that, if the determination unit determines that a predetermined positional relationship exists, notifies the user of information indicating this situation. Furthermore, it describes how sufficient safety can be ensured even when an operator and machine are working together in coordination.

[0005] Existing technical documents

[0006] Patent documents

[0007] Patent Document 1: Japanese Patent Application Publication No. 2020-96517 Summary of the Invention

[0008] The problem that the invention aims to solve

[0009] According to Patent Document 1, accident prevention measures, such as issuing alarms, can be implemented based on the positional relationship between the operator (person) and the machinery. However, since temporary responses are required whenever an accident risk occurs, it is difficult to fundamentally reduce the accident risk. Therefore, in Patent Document 1, if safety is prioritized too much in control, machinery downtime increases, leading to a decrease in work efficiency. Conversely, if work efficiency is prioritized too much, safety is compromised. Thus, the problem with Patent Document 1 is that it is difficult to achieve a balance between ensuring work efficiency and safety in environments where dissimilar systems coexist.

[0010] Methods for solving problems

[0011] To address the aforementioned issues, this invention performs adjustments in the order of "action adjustment" → "action plan adjustment" → "safety rule adjustment." More specifically, one example of the invention's configuration is a safety control device for controlling the actions of control objects in heterogeneous systems under multiple control systems. It comprises: an action adjustment unit that, in the event of a conflict arising where the actions of a control object deviate from the intended control outcome, outputs an action adjustment instruction to the control object regarding the actions of the control objects in different control systems; an action plan adjustment unit that, when the action adjustment meets predetermined conditions, adjusts a pre-stored action plan, which represents action rules for avoiding conflicts between the control objects and ensuring functionality; and a safety rule adjustment unit that, when the action plan adjustment meets predetermined conditions, adjusts a pre-stored safety rule, which represents action rules for avoiding conflicts between the control objects.

[0012] Furthermore, the present invention also includes a safety rule adjustment method and a safety control method using a safety control device, a computer program for executing the safety rule adjustment method, and a storage medium storing the computer program.

[0013] Invention Effects

[0014] According to the present invention, in an environment where heterogeneous systems coexist, the actions of the controlled object can ensure both operational efficiency and safety. Attached Figure Description

[0015] Figure 1 This is a diagram schematically illustrating the environment of application embodiment 1.

[0016] Figure 2 This is a system configuration diagram of Example 1.

[0017] Figure 3 This is a system configuration diagram of each moving body in Embodiment 1.

[0018] Figure 4This is a functional block diagram of Embodiment 1.

[0019] Figure 5A This is a diagram illustrating an example of constructing the security rules of Implementation 1 using a negative list.

[0020] Figure 5B This is a diagram illustrating an example of constructing the security rules of Implementation 1 using a positive list.

[0021] Figure 6A This is a diagram illustrating the action plan of Example 1.

[0022] Figure 6B It is a diagram that uses illustrations to represent the action plan.

[0023] Figure 7 This is a flowchart illustrating the processing sequence of Example 1.

[0024] Figure 8A This is a diagram illustrating a specific example (priority change) of the adjustment of the action plan in Implementation Example 1.

[0025] Figure 8B This is a diagram illustrating a specific example (condition addition) of the adjustment to the action plan of Example 1.

[0026] Figure 9A This is a diagram illustrating a specific example of the adjustment of the security rules consisting of a negative list in Embodiment 1.

[0027] Figure 9B This is a diagram illustrating a specific example of the adjustment of the security rules consisting of a positive list in Embodiment 1.

[0028] Figure 10 This is a top view showing the automated warehouse system implemented in Example 2.

[0029] Figure 11 This is a top view of the construction site 1000 where Example 3 was applied.

[0030] Figure 12 This is a diagram showing the movement path in Example 3.

[0031] Figure 13A This is a diagram illustrating an example of preventing collisions between machines and between machines and people in Embodiment 4.

[0032] Figure 13B This is a diagram illustrating an example of preventing mechanical collisions with people in Embodiment 4.

[0033] Figure 13C This is a diagram illustrating an example of preventing machine-to-machine collisions in Embodiment 4.

[0034] Figure 14This is a diagram showing the power grid using Example 5. Detailed Implementation

[0035] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. In the following embodiments, control is performed in an environment where multiple controlled objects, controlled under different systems or control architectures, coexist. Furthermore, this environment includes a control zone representing the geographical extent of the control.

[0036] Furthermore, in each embodiment, safety refers to avoiding conflicts with the controlled object. Furthermore, a conflict represents a state where the actions of the controlled object deviate from the intended control outcome. Therefore, conflicts include accidents, collisions, hazardous events (TTC (Time to Collision) events with a specified timeframe), obstacles, failure to achieve desired effects, and other events that impair the control outcome.

[0037] Furthermore, actions represent the functions possessed by the controlled object. Therefore, actions include the movement of moving bodies, cargo handling, construction, building, power generation, power distribution, power receiving and other electrical controls, as well as other operations and movements.

[0038] Furthermore, the control system also includes devices that autonomously perform control. Therefore, when there are multiple devices performing autonomous control, it is equivalent to a heterogeneous system. Thus, the systems in each embodiment are not necessarily limited to computer systems such as servers, but also include individual devices.

[0039] Example 1

[0040] Example 1 illustrates an example of the versatility of using a moving body as a controlled object. Furthermore, in this example, the movement of the moving body will be described as an action. Figure 1 This is a diagram schematically illustrating the environment in which various embodiments are applied. Figure 1 In this environment, there are various moving bodies that are controlled. It is assumed that moving bodies 1-(a) and 1-(b) are autonomously controlled, and are not under the control system of the security control server 5 described later. For example, moving body 1-(a) is a vehicle that moves according to the driver's operation or its own driving assistance or automatic driving functions, and moving body 1-(b) is a person.

[0041] Furthermore, mobile bodies 2-(a) and 2-(b) have the function of moving under the control of the so-called system (the security control server 5 described later). Additionally, the infrastructure sensor device 3 detects the movement status of each mobile body, particularly mobile bodies 1-(a) and 1-(b), and notifies the security control server 5 of the results. Figure 1The number of moving bodies and infrastructure sensor devices 3 shown in the figure is not limited. For example, it is preferable to have multiple infrastructure sensor devices 3.

[0042] Next, use Figures 2-4 The system implementing Embodiment 1 is described, particularly the security control server 5 and the composition of each mobile unit. Figure 2 This is a system configuration diagram of Embodiment 1. Additionally, in Figure 2 Since mobile body 2-(a) and mobile body 2-(b) have the same structure, they are recorded together as mobile body 2. Furthermore, mobile body 1-(b) is omitted from the description because it is a person. Figure 2 In this embodiment, mobile body 1-(a), mobile body 2, infrastructure sensor device 3, and security control server 5 are connected via network 7. Furthermore, security rule DB6, which stores security rules 61, is connected to security control server 5. Alternatively, security rules 61 can also be stored in auxiliary storage device 54 of security control server 5. Furthermore, security rule DB6 can also be connected via network 7. Additionally, as described above, a server is not necessary in this embodiment's system. Therefore, the controlled object itself may possess the functions of security control server 5 as described in this embodiment.

[0043] exist Figure 2 In this system, the security control server 5 is implemented by a computer that functions as a security control device. Furthermore, the security control server 5 includes an I / F unit 51 (interface unit) for transmitting and receiving information such as communication with external devices, a processing unit 52 for performing various calculations, a main storage device 53 that can be implemented using memory, and an auxiliary storage device 54 that can be implemented using storage. Moreover, these components are interconnected via communication paths such as buses. Additionally, the I / F unit 51 can also separate input and output functions, consisting of an input I / F and an output I / F.

[0044] Here, the processing unit 52, implemented by a processor, CPU, etc., performs operations according to the various computer programs expanded into the main storage device 53. Furthermore, the main storage device 53 expands the computer programs and other information required for the operations, stored in the auxiliary storage device 54 or other storage media. Here, the computer programs expanded into the main storage device 53 include a security rule adjustment program 531, an action plan adjustment program 532, an action adjustment program 533, and a startup control program 534. Moreover, these computer programs may not be separate and independent programs; that is, they may be implemented as modules within the computer program.

[0045] Furthermore, the auxiliary storage device 54 can be implemented using a storage device such as an HDD (Hard Disk Drive) or an SSD (Solid State Drive). The auxiliary storage device 54 stores the action plan 541 as information. Additionally, the auxiliary storage device 54 can also store object information 542 detected by the infrastructure sensor device 3 or various moving objects.

[0046] Furthermore, the infrastructure sensor device 3 is a sensor installed in the control area of ​​roads, etc., to detect the movement of various moving bodies, especially moving bodies 1-(a) and 1-(b) that are not under the control system of the safety control server 5. Therefore, the infrastructure sensor device 3 can be implemented by various vehicle detectors. Vehicle detectors include lasers, loop coils, image recognition (cameras), beacons, etc., and there are no restrictions on their principles.

[0047] then, Figure 3 This is a system configuration diagram of each mobile body in Embodiment 1. Here, mobile body 1-(a) is controlled under a control system other than the security control server 5. Under the control system other than the security control server 5, it moves, for example, under control corresponding to autonomy or control in other control systems.

[0048] Figure 3 (a) shows the configuration of the mobile body 1-(a). The mobile body 1-(a) includes a mobile body controller 11, a mobile body sensor 12, a mobile body actuator 13, a driving device 14, and a communication unit 15. Furthermore, they are interconnected via an in-vehicle communication network 16.

[0049] Here, the movement controller 11 controls the movement and actions of the moving body 1-(a), which can be implemented by an ECU (Engine Control Unit, Electronic Control Unit). Therefore, the movement controller 11 includes an MCU 111 (Micro Controller Unit) with a CPU 1111 and a memory 1112, input I / F 112, output I / F 113, and storage medium 114. Furthermore, the CPU 1111 of the MCU 111 executes various operations according to the program in the memory 1112. Alternatively, the MCU 111 can also use FPGA (Field-Programmable Gate Array) technology to perform various operations. Additionally, the movement controller 11 can also have driving assistance functions and autonomous driving functions.

[0050] Furthermore, the moving body sensor 12 includes lasers or LiDAR (Light Detection and Ranging), millimeter-wave radar, cameras, etc., to detect obstacles and road conditions around the vehicle, and to measure the vehicle's distance and orientation from other moving bodies or obstacles. Moreover, the moving body sensor 12 can also be implemented using a combination of the aforementioned types.

[0051] Furthermore, the moving body actuator 13 is an actuator used to move the moving body 1-(a). Specifically, it has a prime mover 131, which is powered by an engine, motor, or battery, and a drive unit 132, which is powered by a drive shaft, brake, etc. That is, the moving body 1-(a) moves by being driven by the power from the prime mover 131 via the drive unit 132.

[0052] Furthermore, the driving device 14 controls the moving body 1-(a) through the driver's operation, including a steering device 141 such as a steering mechanism and a braking device 142 such as an accelerator pedal or a brake pedal. Additionally, the communication unit 15 communicates with external devices via network 7. Furthermore, the in-vehicle communication network 16 can be implemented using a so-called CAN (Controller Area Network).

[0053] also, Figure 3 (b) shows the configuration of mobile body 2. Mobile body 2 is a mobile body under the control system of the safety control server 5. Mobile body 2 has an on-board controller 21, a mobile body sensor 22, a mobile body actuator 23, and a communication unit 25. Furthermore, they are interconnected via an in-vehicle communication network 26. These configurations are the same as those of mobile body 1-(a), so their description is omitted. In addition, in this embodiment, mobile body 2 is described as an unmanned vehicle, but it can also be human-manned like mobile body 1-(a). That is, a driving device (not shown) can also be provided in mobile body 2.

[0054] then, Figure 4 This is a functional block diagram of Embodiment 1. Figure 4 In the diagram, each of the following represents a functional block: mobile body 1-(a), mobile body 2, infrastructure sensor device 3, and security control server 5.

[0055] First, the mobile body 1-(a) has a mobile body controller 11 and a mobile body sensor 12. These are related to... Figure 3 The configuration is the same as described in the previous section. Here, the motion controller 11 has a sensor processing unit 11-1 that converts the signal detected by the motion sensor 12 into object information 542. Furthermore, the sensor processing unit 11-1 outputs the object information 542 to the security control server 5.

[0056] Additionally, since the motion actuator 13 does not perform actions based on instructions from the security control server 5, this description is omitted in this figure. Furthermore, the motion actuator 13 preferably has the function of controlling its actions based on object information 542 output by the sensor processing unit 11-1.

[0057] Next, the mobile body 2 has a mobile body actuator 23 that performs actions based on instructions from the vehicle controller 21, the mobile body sensor 12, and the safety control server 5. These are related to... Figure 3 The composition is the same as that recorded in the text.

[0058] The vehicle controller 21 includes a sensor processing unit 21-1, an action planning control unit 21-2, and an action control unit 21-3. Here, the sensor processing unit 21-1 has the same function as the sensor processing unit 11-1, that is, it converts the signal detected by the moving object sensor 22 into object information 542. Furthermore, the action planning control unit 21-2 and the action control unit 21-3 perform calculations for controlling the movement of the moving object 2 based on the output from the sensor processing unit 21-1 and the safety control server 5. These calculations will be explained later.

[0059] The infrastructure sensor device 3 includes an infrastructure sensor controller 31 and an infrastructure sensor 32. Here, the infrastructure sensor controller 31, like the moving body controller 11, includes a sensor processing unit 31-1. The infrastructure sensor 32 detects the movement of the moving body and outputs its signal to the sensor processing unit 31-1. Furthermore, the sensor processing unit 31-1 converts the detected signal into object information 542 and outputs it to the security control server 5.

[0060] Next, the security control server 5 will be described. The security control server 5 performs calculations to implement control of the mobile body 2 under this control system. Therefore, the security control server 5 uses security rule 61 stored in security rule DB6 and object information 542 from mobile body 1-(a), mobile body 2, and infrastructure sensor device 3.

[0061] Here, the security control server 5 includes a security rule adjustment unit 5310, an action plan adjustment unit 5320, an action adjustment unit 5330, and a startup control unit 5340. These correspond to... Figure 2 The processing unit 52 shown. More specifically, each unit performs calculations according to its respective computer program. The correspondence is shown below. Additionally, the control area observation unit 5350 is equivalent to... Figure 2 The I / F section 51 in the middle.

[0062] Safety Rule Adjustment Procedure 531: Safety Rule Adjustment Department 5310

[0063] Action Plan Adjustment Procedure 532: Action Plan Adjustment Department 5320

[0064] Operational Adjustment Procedure 533: Operational Adjustment Department 5330

[0065] Startup control program 534: Startup control unit 5340

[0066] The functions of each part are briefly explained below. Further details will be provided using flowcharts.

[0067] The activation control unit 5340 controls the activation of the safety rule adjustment unit 5310, the action plan adjustment unit 5320, and the action adjustment unit 5330. Furthermore, the control area observation unit 5350 obtains object information 542 from each moving body and infrastructure sensor device 3. Additionally, the safety rule adjustment unit 5310 accesses safety rule DB6 and uses the object information 542 to adjust (including correct) safety rule 61.

[0068] Furthermore, the action plan adjustment unit 5320 uses the safety rule 61 from the safety rule adjustment unit 5310 and the object information 542 from the control area observation unit 5350 to adjust (including the corrections) the action plan 541 of the moving body 2. The action plan adjustment unit 5320 also outputs an action plan adjustment instruction and a safety rule adjustment instruction for the moving body 2. Additionally, the output of the safety rule adjustment instruction can also be performed by the safety rule adjustment unit 5310. Furthermore, the action adjustment unit 5330 uses the safety rule 61 from the safety rule adjustment unit 5310 and the action plan 541 from the action plan adjustment unit 5320 to output an action adjustment instruction. The action adjustment instruction includes whether to continue or stop the action. Here, if the action continues, the action adjustment unit 5330 can also achieve this by suppressing the output of the action adjustment instruction. Furthermore, in Figure 4 The mobile body 1-(b) of this embodiment is not shown in the diagram, but the same configuration as mobile body 1-(a) can be provided on mobile body 1-(b) which is a human being. For example, it can be implemented by having a person carry a terminal device such as a wearable computer or a smartphone.

[0069] Next, use Figure 5A , Figure 5B , Figure 6A and Figure 6B The information used in this embodiment will be explained. Figure 5A and Figure 5B The symbol 61 represents the security rule 61 used in this embodiment. Security rule 61 is a rule that specifies the movement of the moving body 2. In this embodiment, security rule 61 establishes a correspondence between the conditions and actions in the action (movement) according to each security rule ID identified by security rule 61.

[0070] here, Figure 5A This diagram illustrates an example of security rule 61 in this embodiment being constructed using a negative list. Therefore, prohibitive conditions that are forbidden during the action are used as conditions for the action. As a result, in this negative list, a correspondence is established between the prohibited conditions and the actions performed when those conditions are met, i.e., the content of controls in progress.

[0071] Here, in Figure 5A In this context, the prohibition conditions include the start time (elapsed time), environmental conditions, and the preceding action. The start time indicates the elapsed time during which the moving body 2 performs the action. Furthermore, environmental conditions refer to conditions such as distances to other objects (including the moving body and obstacles). The preceding action further indicates the action of the moving body 2 within a certain period. These are examples; any conditions that constitute an action that should be prohibited or avoided in the actions of the moving body 2 can be included. Therefore, items other than the start time (elapsed time), environmental conditions, and the preceding action can be set, or some of them can be omitted. Furthermore, the action in safety rule 61 indicates the content of control over the moving body 2 under the condition that these conditions are met. Figure 5A In the example given, stopping is listed as an action, but in the case that the moving body 2 is a forklift crane, the details could be as follows: "Raise / lower the arm, which is moving in the direction of x° at (speed) m / s, by (height) cm, and then rotate it in the (counter)clockwise direction by y°."

[0072] Furthermore, Security Rule 61 is not limited to a negative list. An example of using a positive list to construct Security Rule 61 will be given next. Figure 5B This diagram illustrates an example of security rule 61 in this embodiment being constructed using a positive list. This positive list is related to... Figure 5A Compared to the negative list, the prohibition conditions have been changed to licensing conditions in form.

[0073] exist Figure 5B In this context, the permission conditions refer to the conditions under which actions included in the positive list (i.e., actions that are permitted) are carried out within the actions of mobile entity 2. Therefore, the environmental information in the negative list and the positive list presents opposite conditions. Furthermore, the actions themselves also differ.

[0074] Additionally, under security rule 61, an action can also be to provide a link as part of additional information.

[0075] Alternatively, security rule 61 can be implemented using a combination of negative and positive lists.

[0076] Next, in Figure 6AThe symbol 541 represents the action plan used in this embodiment. Action plan 541 is a plan of action based on information from security rule 61. Therefore, action plan 541 in this embodiment also has the nature of a positive list, but is not limited thereto.

[0077] Here, Action Plan 541 establishes a correspondence between action start conditions, action end conditions, and actions based on each action plan ID that identifies the action plan. The action start conditions are the same as the permission conditions in Security Rule 61. Furthermore, the action end conditions represent the conditions under which the corresponding action will end. Additionally, the actions are the same items as in Security Rule 61. Moreover, Action Plan 541 is not limited to... Figure 6A The content shown.

[0078] here, Figure 6B This is a diagram illustrating action plan 541. Figure 6B In the diagram, arrows represent actions of moving body 2. Circles indicate the start conditions of actions, and crosses indicate the end conditions. In this way, the set of arrows defines the overall action sequence of moving body 2. Therefore, the action immediately preceding action A in the diagram can be determined as "moving in the direction of X° at (velocity) m / s," as indicated by its arrow.

[0079] Furthermore, more preferably, safety rule 61 is information that takes into account safety in avoiding collisions and other conflicts with the mobile body 2, while action plan 541 is information that takes into account the efficiency of operations and business within the mobile body 2 in addition to safety. That is, safety rule 61 specifies action rules for avoiding conflicts with controlled objects, and action plan 541 represents action rules for avoiding conflicts with controlled objects and for performing functions.

[0080] This concludes the description of the information used in this embodiment. The following describes the details of the processing in this embodiment. Figure 7 This is a flowchart illustrating the processing sequence of this embodiment. Here, in the description... Figure 7 Previously, the premise of this flowchart was explained. In Figure 1 In the environment, each mobile body moves within the environment, which is called action. At this time, the mobile body and the infrastructure sensor device 3 detect the status of the movement (movement status). Specifically, mobile body 1-(a) uses its own mobile body sensor 12 to detect other objects such as obstacles and its own movement status.

[0081] Furthermore, the mobile body 2 also uses its own mobile body sensor 22 to detect other objects such as obstacles and its own movement status. Furthermore, the infrastructure sensor device 3 also uses its infrastructure sensor 32 to detect objects such as obstacles and the movement status of each mobile body. In addition, the movement status also includes detecting stationary objects and mobile bodies.

[0082] Furthermore, in each device, the sensor processing unit converts the signal indicating the movement status into object information 542, which is information that can be processed. Specifically, in the mobile body 1-(a), the sensor processing unit 11-1 of the mobile body controller 11 converts the signal detected by the mobile body sensor 12 into object information 542. Then, the object information 542 is output from the sensor processing unit 11-1 to the control area observation unit 5350 of the security control server 5 via the network 7.

[0083] Furthermore, in the mobile body 2, the sensor processing unit 21-1 of the vehicle controller 21 converts the signal detected by the mobile body sensor 22 into object information 542. Then, the object information 542 is output from the sensor processing unit 21-1 to the control area observation unit 5350 of the safety control server 5 via the network 7.

[0084] Furthermore, in the infrastructure sensor device 3, the sensor processing unit 31-1 of the infrastructure sensor controller 31 converts the signal detected by the infrastructure sensor 32 into object information 542. The object information 542 is then output from the sensor processing unit 31-1 to the control area observation unit 5350 of the security control server 5 via the network 7. Alternatively, the infrastructure sensor device 3 can be omitted. Furthermore, the use of motion sensors for each moving body can be omitted by limiting the use to the infrastructure sensor device 3; control of moving bodies that do not possess motion sensors can also be considered.

[0085] Furthermore, the mobile body 2 stores its own action plan 541 in a storage medium. The action plan control unit 21-2 then generates an action instruction based on the object information 542 from the sensor processing unit 21-1 and its own action plan 541. The action plan control unit 21-2 then outputs this action instruction to the action control unit 21-3. Upon receiving this instruction, the action control unit 21-3 outputs a control signal to the mobile body actuator 23. Thus, the mobile body 2 executes movement based on the action plan 541.

[0086] The following uses Figure 4 The functional block diagram explains the main body of each step. First, in step S01, the control area observation unit 5350 acquires object information 542 from each sensor processing unit.

[0087] Next, in step S02, the activation control unit 5340 is triggered by the acquisition of object information 542 in step S01, causing the action adjustment unit 5330 to start. Then, the action adjustment unit 5330 uses the object information 542 acquired in step S02 to determine whether a conflict has occurred among each of the moving bodies 2 (moving bodies 2-(a), 2-(b)). Here, the occurrence of a conflict can also be determined based on whether the value representing its probability is above a predetermined value. More specifically, the action adjustment unit 5330 determines which action of each moving body 2 represented by the object information 542 satisfies the prohibition condition of safety rule 61 or action plan 541. If not satisfied (No), the process proceeds to step S03. If satisfied (Yes), the process proceeds to step S04. Furthermore, while determining whether the prohibition condition is satisfied, the method used as safety rule 61... Figure 5B In the case of the positive list shown, it can also be determined based on whether the licensing conditions are not met.

[0088] Next, in step S03, the action adjustment unit 5330 sends an instruction to the vehicle controller 21 of the mobile body 2 via the network 7 to maintain the current action as an action adjustment instruction. At this time, the action adjustment unit 5330 preferably uses a configuration similar to the control area observation unit 5350, which has communication functions such as the I / F unit 51. The same applies to communication in the safety control server 5. Alternatively, in step S03, the action adjustment unit 5330 may perform a static observation process without sending an instruction. Next, we return to step S01.

[0089] Furthermore, in step S04, the action adjustment unit 5330 sends an instruction to the vehicle controller 21 of the mobile body 2 to stop its current action as an action adjustment instruction via the network 7. In this case, the action adjustment instruction described in the action of safety rule 61 or action plan 541 may also be sent as the action adjustment instruction. Thus, in this step, the movement of the mobile body 2 is changed.

[0090] As a result of these steps S03 and S04, the motion control unit 21-3 of the mobile body 2 generates a control signal that follows the motion adjustment instruction output from the motion adjustment unit 5330. Then, the motion control unit 21-3 outputs a control signal to the mobile body actuator 23. Thus, the mobile body 2 is able to move according to the motion adjustment instruction.

[0091] Next, in step S05, the activation control unit 5340 determines whether the action plan 541 needs to be adjusted. For example, the activation control unit 5340 determines whether the action adjustment in step S04 meets the prescribed conditions. As a result, if the prescribed conditions are not met (No), the process proceeds to step S06. Furthermore, if the prescribed conditions are met (Yes), the process proceeds to step S07. As an example of the prescribed conditions, this includes the number of times the action is adjusted within a prescribed period, i.e., the adjustment frequency. In this case, in this step, the activation control unit 5340 determines whether it exceeds a preset threshold.

[0092] Next, in step S06, the action plan is maintained, that is, no special processing is performed as is, and the process returns to step S01.

[0093] Furthermore, in step S07, the start control unit 5340 starts the action plan adjustment unit 5320. Next, the action plan adjustment unit 5320 adjusts the action plan 541. That is, the action plan adjustment unit 5320 modifies the action plan 541 stored in the auxiliary storage device 54. Furthermore, the action plan adjustment unit 5320 outputs the modified action plan 541 to each mobile body 2 via the network 7.

[0094] Furthermore, the execution timing of this step can be either within the same period as step S05 (real-time reflection) or at a different period (batch reflection). In the case of real-time reflection, the action plan adjustment unit 5320 may, for example, execute step S07 within the execution time or execution day of step S05. In the case of batch reflection, it is performed together with other adjustments after the control ends on the day following or on the same day of the execution day of step S05. In addition, in both real-time and batch reflection, it is preferable to change the judgment criteria of step S05. For example, in the case of a threshold, it is preferable to change the threshold for real-time reflection. By making the threshold for real-time reflection larger, the number of adjustments to the action plan during control can be suppressed.

[0095] Here, using Figure 8A and Figure 8B Explain specific examples of adjustments to Action Plan 541.

[0096] Figure 8A This diagram illustrates a specific example of a priority change made as an adjustment to the action plan in this embodiment. In this example, action plan 541 and... Figure 6A Compared to the action plan 541 shown, priorities have been added to each record. This indicates the priority of the action plan used when controlling the actions of each moving body 2.

[0097] In this step, the action plan adjustment unit 5320 determines the action that is the reason for adjusting the action plan. For example, the action plan adjustment unit 5320 determines the action that meets the conditions specified in step S05. Furthermore, the action plan adjustment unit 5320 determines the action plan that meets these conditions. That is, the action plan adjustment unit 5320 determines the action start condition in the prohibition conditions of step S02. For example, in... Figure 8A In the example, the action start condition for action plan ID=00011 is determined.

[0098] Next, the Action Plan Adjustment Department 5320 lowered the priority of the records containing the determined action initiation conditions. Figure 8A In the example, after the Action Plan Adjustment Department 5320 changed the priority from priority 2 to priority 3.

[0099] then, Figure 8B This diagram illustrates a specific example of additional conditions added as an adjustment to the action plan of this embodiment. (and) Figure 8A Similarly, in this example, the action plan adjustment unit 5320 also determines the action start condition in the prohibition conditions of step S02. In this example, the action start condition of action plan ID=00011 is also determined.

[0100] Next, the Action Plan Adjustment Department 5320 adds exclusive control to the start conditions of the determined action start conditions. This addition process can also be a process to make the exclusive control effective. In addition, the exclusive control includes so-called flag signals.

[0101] The above explains step S07, which concludes the explanation of the action plan adjustment. We then proceed to step S08. In step S08, the control unit 5340 determines whether an adjustment to safety rule 61 is necessary. For example, the control unit 5340 determines whether the action plan adjustment in step S07 meets specified conditions. If the specified conditions are not met (No), the process proceeds to step S09. Alternatively, if the specified conditions are met (Yes), the process proceeds to step S10. One example of these specified conditions is the number of times the action is adjusted within a specified period, i.e., the adjustment frequency. In this case, the control unit 5340 determines whether the threshold is higher than a pre-set threshold.

[0102] Next, in step S09, the action plan is maintained, that is, no special processing is performed as is, and the process returns to step S01.

[0103] Furthermore, in step S10, the start control unit 5340 starts the safety rule adjustment unit 5310. The safety rule adjustment unit 5310 then adjusts the safety rule 61. That is, the safety rule adjustment unit 5310 modifies the safety rule 61 stored in the safety rule DB6.

[0104] Furthermore, the execution timing of this step is the same as that of step S07; it can be within the same period as step S08 (real-time reflection) or at different periods (batch reflection). In this case, similar to step S07, it is preferable to change the judgment criteria for real-time reflection and batch reflection.

[0105] Here, using Figure 9A and Figure 9B Provide specific examples of the adjustments to safety rule 61.

[0106] first, Figure 9A This diagram illustrates a specific example of adjusting security rule 61, which is constructed using a negative list, according to this embodiment. The security rule adjustment unit 5310 determines the action that is the reason for the security rule adjustment. For example, the security rule adjustment unit 5310 determines the action that satisfies the conditions specified in step S08. Furthermore, the security rule adjustment unit 5310 determines the security rule 61 that conforms to this. That is, the security rule adjustment unit 5310 determines the prohibition condition in step S02. Assume that the result determines… Figure 9A The prohibited condition is shown for security rule ID=000001.

[0107] Next, the Safety Rule Adjustment Department 5310 will add conditions such as Figure 9A The condition is added to the corresponding record. This addition condition is determined by the safety rule adjustment unit 5310, which records the condition that causes the safety rule adjustment. Furthermore, in control, it is preferable to treat the prohibition condition and the addition condition as an OR condition.

[0108] then, Figure 9B This diagram illustrates a specific example of adjusting safety rule 61, which is constructed using a positive list, according to this embodiment. The safety rule adjustment unit 5310 determines the action that causes the safety rule adjustment. For example, the safety rule adjustment unit 5310 determines the action that satisfies the conditions specified in step S08. Furthermore, the safety rule adjustment unit 5310 determines the safety rule 61 that conforms to this. That is, the safety rule adjustment unit 5310 determines the prohibition condition in step S02. Assume that the result determines… Figure 9B The prohibited condition is shown for security rule ID=000001.

[0109] Next, the Safety Rule Adjustment Section 5310 will include exceptions such as... Figure 9B The condition is added to the corresponding record. This exception condition is determined by the safety rule adjustment unit 5310, which records the condition that causes the safety rule adjustment. Furthermore, in control, it is preferable to treat prohibition conditions and exception conditions as AND conditions.

[0110] Thus, in this embodiment, when a conflict arises in the actions of the controlled object, adjustments are made in the order of action adjustment, action plan adjustment, and security rule adjustment. However, it is also possible to omit action plan adjustment after action adjustment and perform security rule adjustment instead.

[0111] Furthermore, in this embodiment, the activation control unit 5340 activates the safety rule adjustment unit 5310, the action plan adjustment unit 5320, and the action adjustment unit 5330, but the activation control unit 5340 may not be present. Furthermore, the activation control unit 5340 may activate at least one of the safety rule adjustment unit 5310, the action plan adjustment unit 5320, and the action adjustment unit 5330. In this case, it is preferable that the activation control unit 5340 activates the safety rule adjustment unit 5310 and the action plan adjustment unit 5320, and the action adjustment unit 5330 operates constantly. Additionally, in Figure 7 In this process, the process ends after step S10, but in the case of real-time reflection, similar to steps S03, S06 and S09, it is preferable to return to step S01.

[0112] Example 2

[0113] Next, Embodiment 2 of the present invention will be described. Figure 10 This is a top view showing the automated warehouse system implemented in this embodiment. Figure 10 The diagram illustrates the movement of truck cargo from a shared area 100 (which serves as a control zone) to a temporary storage area on the left side of the diagram, where it is inspected and transported to a warehouse (not shown). Therefore, the shared area 100 contains both heterogeneous systems: a truck loading / unloading system that unloads trucks unattended and moves them to the temporary storage area, and a warehouse management system that transports cargo to the warehouse.

[0114] Here, the truck loading and unloading system is composed of unmanned machinery 201-(a), represented by an automated forklift crane. Furthermore, the warehouse management system is composed of manned machinery 101-(a), represented by a forklift crane, and operators 101-(b). Infrastructure sensor devices 3-(a) and 3-(b) are also installed in the common area 100. In addition, the safety control server 5 is connected to these components via network 7.

[0115] Next, the safety control server 5 performs the processing described in Embodiment 1 in the automated warehouse system of this embodiment. Furthermore, the manned machine 101-(a) and the operator 101-(b) correspond to the mobile bodies 1-(a) and 1-(b) of Embodiment 1. Furthermore, the unmanned machine 201-(a) corresponds to the mobile body 2.

[0116] Example 3

[0117] Next, Embodiment 3 of the present invention will be described. This embodiment is an example of applying the present invention to a situation where construction machinery is carrying out construction on a section of a road in which vehicles are traveling. The processing in this embodiment is the same as in Embodiments 1 and 2, but the application objective is different. Figure 11 This is a top view showing the construction site 1000 where this embodiment is applied. Figure 11 In the construction site 1000, which is a controlled area, construction machinery is being used. Specifically, the construction machinery and surrounding workers are carrying out construction by blocking one side of the two-lane road.

[0118] Here, a group of human-driven cars (202-(a), 202-(b)) are traveling on a road. They are configured as a single control system for the car driving system. This system operates based on traffic rules set for its location (road, parking lot, etc.). Furthermore, each car 202-(a), 202-(b) within the system is connected to a safety control server 5 (not shown). It is assumed that the safety control server 5 distributes a wide range of movement paths to the motion controllers 11 of each car 202-(a), 202-(b), allowing for either autonomous driving or manual driving by the operator within the corresponding car.

[0119] Furthermore, the construction machinery 102-(a) driven by the operator is designed as a construction machinery system with a control system different from that of a car. Construction machinery 102-(a) performs excavation and other construction work sequentially while moving according to the construction plan, based on the construction plan or rules related to on-site occupational safety. Thus, different systems coexist at the construction site 1000.

[0120] Furthermore, the movement paths of each moving body (the group of vehicles in the automotive system, and construction machinery 102-(a) and the operator in the case of the construction machinery system) in their respective individual systems based on the fundamental rules of these systems are as follows: Figure 12 (a) Figure 12 As shown in (b). Additionally, in Figure 12 The movement path for lane changes in the vehicle system has been omitted.

[0121] Here, within the construction site 1000, which is a shared area, both vehicle systems and construction machinery systems coexist. Each vehicle (202-(a), 202-(b)) is unable to move in either of the two lanes on one side due to the construction machinery system. Therefore, vehicles (202-(a), 202-(b)) traveling in the lane blocked by the construction machinery system remain stationary even when vehicles are traveling in the opposite lane. Furthermore, if no more vehicles are traveling in the opposite lane, they overtake construction machinery 102-(a) using the opposite lane. Moreover, when the traffic volume in both lanes is equal, there is a high probability of congestion occurring on one side, leading to an extension of the task completion time in the vehicle system. Additionally, task completion refers to the movement of the vehicle, i.e., travel to its destination.

[0122] In this environment, the security control server 5, through the processing detailed in Example 1, creates security rule 61 as follows: Figure 12 (c) shows the shared movement path. In addition, in this embodiment, each vehicle (202-(a), 202-(b)) optimizes the safety and efficiency within the construction site 1000 through autonomous control or navigation display by the on-board device.

[0123] Example 4

[0124] Next, use Figures 13A-13B Embodiment 4 of the present invention will be described. Embodiment 4 is an example of applying the processing detailed in Embodiment 1 to an intersection on a road as a control zone. In this embodiment, it is assumed that pedestrians 103-(a), 103-(b) and cars 203-(a), 203-(b) approach an intersection equipped with traffic signals (203-(c), 203-(d)). In addition, pedestrians 103-(a) and 103-(b) include bicycles and non-motorized vehicles.

[0125] Here, pedestrians 103-(a) and 103-(b) are equivalent to the moving body 1 in Example 1.

[0126] Furthermore, vehicles 203-(a), 203-(b), and traffic signals 203-(c) and 203-(d) correspond to the moving body 2 in Embodiment 1. That is, it is assumed that vehicles 203-(a), 203-(b), and traffic signals 203-(c) and 203-(d) are under the control system of the safety control server 5. The infrastructure sensor device 3 monitors the area including the intersection and notifies the safety control server 5 of object information representing this content. Furthermore, traffic signals 203-(c) and 203-(d) are examples of traffic restriction devices, communicating with the safety control server 5 and controlling their display. Moreover, vehicles 203-(a), 203-(b), and traffic signals 203-(c) and 203-(d) communicate with the safety control server 5 via communication devices.

[0127] first, Figure 13A This example illustrates the prevention of accidents involving pedestrians 103-(a) and 103-(b) and vehicles 203-(a) and 203-(b), specifically preventing collisions between machinery and between machinery and pedestrians. Here, it is assumed that infrastructure sensor device 3 detects pedestrians 103-(a) and 103-(b) about to enter the intersection. In this case, safety control server 5 outputs action adjustment instructions to vehicles 203-(a) and 203-(b) and traffic signals 203-(c) and 203-(d). That is, safety control server 5 outputs braking instructions to vehicles 203-(a) and 203-(b). Furthermore, safety control server 5 outputs an instruction to output a red signal for the traffic signals facing the vehicles in traffic signals 203-(c) and 203-(d). Here, the above control is fine if only considering collisions between machinery and pedestrians, but in this state, sometimes vehicles moving in different directions may be stopped separately.

[0128] Therefore, in this embodiment, the safety control server 5 determines the direction of entry of pedestrians 103-(a) and 103-(b) towards the intersection. Furthermore, the safety control server 5 adjusts the traffic signals of vehicles with a high probability of accidents occurring in the determined entry direction to a red signal.

[0129] Furthermore, the security control server 5 makes the above-mentioned action adjustments, and executes action plan adjustments and security rule adjustments when the specified conditions are met. In addition, among the action plan adjustments and security rule adjustments, it is preferable to execute these adjustments while maintaining the overarching principle of pedestrian priority.

[0130] then, Figure 13B This diagram illustrates an example of an accident in this embodiment involving a collision between a vehicle 203-(a) and pedestrians 103-(a) and 103-(b) to prevent a collision between a machine and a person. This example is performed in... Figure 13AThe document describes the action adjustments prioritizing pedestrians 103-(a) and 103-(b), as well as subsequent adjustments to action plans and safety rules.

[0131] at last, Figure 13C This diagram illustrates an example of an accident involving a machine-to-machine collision, specifically between vehicles 203-(a) and 203-(b), as described in this embodiment. When a vehicle on the red signal side is speeding and has difficulty stopping at the intersection, the safety control server 5 performs an action adjustment. Specifically, as an action adjustment, it changes the blue and red traffic signals. Furthermore, if this action adjustment meets specified conditions, the safety control server 5 executes action plan adjustments, including changing the traffic signal change interval, and safety rule adjustments.

[0132] Furthermore, in this example, during the action adjustment and subsequent plan and safety rule adjustments, if congestion occurs on the red signal side and traffic volume is lower on the blue signal side, the traffic signal change action is performed. Then, the safety control server 5 subsequently executes the plan and safety rule adjustments. In this case, the action plan and safety rule adjustments include changing the traffic signal change interval. Moreover, this change interval change includes changing the interval differently over a time period.

[0133] Example 5

[0134] Next, use Figure 14 Example 5, which is another example of the application of the present invention, will be described. Example 5 is an example of applying the processing of Example 1 to the power grid 10000 in a control area. Figure 14 This indicates that the power grid 10000 is from Example 5. In Figure 14 In this system, demanders 104-(a) and 104-(b) from households, businesses, and factories are connected to the power grid 10000. Additionally, power plants 204-(a), 204-(b), and distributed power sources 204-(c) are also connected to the power grid 10000. Furthermore, the security control server 5 is connected to the control devices of power plants 204-(a), 204-(b), and distributed power sources 204-(c) via network 7. Additionally, smart meters from demanders 104-(a) and 104-(b) can also be connected to network 7.

[0135] Furthermore, devices equivalent to the safety control server 5 can be installed at the demand side 104-(a), 104-(b), power plant 204-(a), 204-(b), and distributed power source 204-(c). In this embodiment, the demand side 104-(a) and 104-(b) are equivalent to the mobile body 1 in Embodiment 1. Similarly, the power plant 204-(a), 204-(b), and distributed power source 204-(c) are equivalent to the mobile body 2 in Embodiment 1. Thus, in this embodiment, a system (control system) on the power supply side and a system (control system) on the demand side coexist. In this case, the action adjustments, action plan adjustments, and safety rule adjustments described later are performed on either the supply side or the demand side system. However, each power plant and factory can also be managed as a single system. The action adjustments, action plan adjustments, and safety rule adjustments described later can also be applied to these systems.

[0136] Here, in power grid 10000, a conflict occurs, resulting in either power shortage (including power outages) or power surplus. Therefore, in the event of such a conflict, the safety control server 5 outputs power control instructions, i.e., action adjustment instructions, to power plants 204-(a), 204-(b), and distributed power sources 204-(c). This controls the power generation of power plants 204-(a), 204-(b), and distributed power sources 204-(c). If the action adjustment indicated by this control meets the specified conditions, the safety control server 5 executes action plan adjustments and safety rule adjustments. These action plan adjustments and safety rule adjustments include the creation and modification of the power generation dispatch table.

[0137] Furthermore, in this embodiment, the power generation of the power plant and power source is controlled as an action adjustment, but it can also control the actions of substations, etc. Moreover, the safety control server 5 can also control the smart meters installed on the demand side, executing control over their demand as an action adjustment.

[0138] This concludes the description of the embodiments of the present invention. The present invention is not limited to the examples described above and can also be applied to other conflicting applications.

[0139] Label Explanation

[0140] 1…Mobile body; 11…Mobile body controller; 11-1…Sensor processing unit; 12…Mobile body sensor; 2…Mobile body; 21…On-board controller; 21-1…Sensor processing unit; 21-2…Action plan control unit; 21-3…Action control unit; 22…Mobile body sensor; 23…Mobile body actuator; 3…Infrastructure sensor device; 31…Infrastructure sensor controller; 31-1…Sensor processing unit; 32…Infrastructure sensor; 5…Security control server; 5310…Security rule adjustment unit; 5320…Action plan adjustment unit; 5330…Action adjustment unit; 5340…Start control unit; 5350…Control area observation unit; 6…Security rule DB.

Claims

1. A safety control device for controlling the actions of controlled objects in heterogeneous systems under multiple control systems, wherein, have: The Action Adjustment Department, in the event of a conflict where the actions of a control object deviate from the intended control outcome, outputs action adjustment instructions to the aforementioned control object to adjust its actions, regarding control objects with different control systems. The Action Plan Adjustment Department adjusts the pre-stored action plan when the aforementioned action adjustment meets the prescribed conditions. This action plan represents the action rules used to avoid conflicts with the aforementioned controlled objects and to ensure the proper functioning of the system. as well as The security rules adjustment department, when the aforementioned action plan adjustment meets the prescribed conditions, adjusts the pre-stored security rules, which represent the action rules used to avoid conflicts with the aforementioned controlled objects. The aforementioned action plan adjustment department implements the adjustment of the action plan by lowering the priority of the action plan corresponding to the action that is the reason for the adjustment, or by adding an exclusive condition to the action start condition represented by the action plan corresponding to the action that is the reason for the adjustment.

2. The safety control device as described in claim 1, wherein, The aforementioned security rules establish a correspondence between the actions of the controlled objects and their prohibited conditions; The aforementioned safety rule adjustment department implements the adjustment of the aforementioned safety rules by adding additional conditions to the prohibition conditions corresponding to the actions that are the reasons for the adjustment of the aforementioned action plan, wherein the aforementioned prohibition conditions and the aforementioned additional conditions are treated as OR conditions.

3. The safety control device as described in claim 1, wherein, The aforementioned security rules establish a correspondence between the actions of the controlled objects and their permitted conditions; The aforementioned security rule adjustment department implements the adjustment of the aforementioned security rules by adding exception conditions to the permission conditions corresponding to the actions that are the reasons for the adjustment of the aforementioned action plan, wherein the aforementioned permission conditions and the aforementioned exception conditions are treated as conditions.

4. A method for adjusting safety rules, using a safety control device for controlling the actions of controlled objects in heterogeneous systems under multiple control systems, wherein, Through the action adjustment unit, when a conflict occurs where the actions of a control object deviate from the intended control result, action adjustment instructions are output to the control object to adjust its actions, for control objects with different control systems. Through the action plan adjustment department, when the aforementioned action adjustment meets the prescribed conditions, the pre-stored action plan is adjusted. This action plan represents the action rules used to avoid conflicts with the aforementioned controlled objects and to ensure that the functions are performed. as well as The security rules adjustment department adjusts pre-stored security rules, which represent action rules used to avoid conflicts with the controlled objects, when the adjustment of the aforementioned action plan meets the prescribed conditions. In adjusting the aforementioned action plan, the adjustment is carried out by lowering the priority of the action plan corresponding to the action that is the cause of the adjustment, or by adding an exclusive condition to the action start condition represented by the action plan corresponding to the action that is the cause of the adjustment.

5. The security rule adjustment method as described in claim 4, wherein, The aforementioned security rules establish a correspondence between the actions of the controlled objects and their prohibited conditions; The aforementioned safety rule adjustment department implements the adjustment of the aforementioned safety rules by adding additional conditions to the prohibition conditions corresponding to the actions that are the reason for the adjustment of the aforementioned action plan, wherein the aforementioned prohibition conditions and the aforementioned additional conditions are treated as OR conditions.

6. The security rule adjustment method as described in claim 4, wherein, The aforementioned security rules establish a correspondence between the actions of the controlled objects and their permitted conditions; The aforementioned security rule adjustment department implements the adjustment of the aforementioned security rules by adding exception conditions to the permission conditions corresponding to the actions that are the reason for the adjustment of the aforementioned action plan, wherein the aforementioned permission conditions and the aforementioned exception conditions are treated as conditions.

Images