Mobile robot, server, mobile robot control system, and mobile robot control method

Abstract

A mobile robot (100) capable of autonomously moving is provided with: a reliability determination unit (156) that determines reliability relating to an autonomous travel function (130) of the mobile robot (100); a safe area acquisition unit (154) that acquires information relating to a safe area in which the mobile robot (100) can stop; and a control unit (110) that, when an abnormality of the mobile robot (100) is detected during autonomous movement of the mobile robot (100) and the safe area acquisition unit (154) determines that the autonomous travel function (130) is reliable, moves the mobile robot (100) to the safe area on the basis of the information relating to the safe area.

Description

Technical Field

[0001] The present disclosure relates to a mobile robot, a server, a mobile robot control system, and a mobile robot control method. Background Art

[0002] Due to labor shortages and increased logistics, the popularity of self-driving trucks and mobile robots that perform autonomous delivery is expected and increasingly important. Unlike traditional industrial robots that operate (work) in predetermined environments such as factories, this type of mobile robot is envisioned to operate in various environments such as public roads. Research and preparation are underway to address situations where mobile robots are difficult to control autonomously, remote monitoring by remote operators to achieve efficient operation of mobile robots, and fleet management systems that manage the status of remotely controlled robots and many robots. By using such a system, the remote work market can be expanded, and job opportunities can be provided for people who cannot work due to physical reasons, place of residence, working hours, etc., which can help solve many problems.

[0003] On the other hand, mobile robots have cyber security issues. For example, in the automotive field, there have been reports of cases where the vehicle network was remotely hacked and the vehicle was illegally (illegally and without authorization) controlled. In addition, there have been cases of attacks on ships by sending fake signals to the GPS (Global Positioning System) of the ship system to induce attacks.

[0004] When an abnormality is detected in such a mobile robot, it is desirable that the mobile robot move to a safe area where safety can be ensured without causing adverse effects on the surrounding environment and stop.

[0005] Conventional document 1 discloses a method in which a mobile robot autonomously drives when an abnormality is detected and then moves to a safe area and stops.

[0006] Prior art literature

[0007] Patent Document 1: Japanese Patent Application Publication No. 2020-115397 Summary of the invention

[0008] Problems to be solved by the invention

[0009] When an abnormality is detected in the mobile robot, it is desired to more reliably (surely) move the mobile robot to a safe area. The technology of Patent Document 1 has room for improvement in more reliably moving the mobile robot to a safe area.

[0010] Thus, the present disclosure provides a mobile robot, a server, a mobile robot control system, and a mobile robot control method that can more reliably move the mobile robot to a safe area when the mobile robot detects an abnormality.

[0011] Technical solutions to solve problems

[0012] A technical solution disclosed herein involves a mobile robot that is capable of autonomous movement and comprises: a first judgment unit for judging the reliability of the autonomous movement function of the mobile robot; a first information acquisition unit for acquiring information related to a safe area where the mobile robot can stop; and a first control unit for moving the mobile robot to the safe area based on the information related to the safe area when an abnormality of the mobile robot is detected during the autonomous movement (process) of the mobile robot and the first judgment unit judges that the autonomous movement function is reliable (trustworthy).

[0013] A technical solution disclosed in the present invention involves a server that is communicatively connected to a mobile robot capable of autonomous movement, and comprises: a second judgment unit for judging the reliability of the autonomous movement function of the mobile robot; a second information acquisition unit for acquiring information related to a safe area where the mobile robot can stop; and a second control unit for moving the mobile robot to the safe area based on the information related to the safe area when an abnormality of the mobile robot is detected during the autonomous movement of the mobile robot and the second judgment unit judges that the autonomous movement function is reliable.

[0014] A mobile robot control system involved in a technical solution disclosed in the present invention is a system comprising a mobile robot capable of autonomous movement and a server communicatively connected to the mobile robot, comprising: a judgment unit for judging the reliability of the autonomous movement function of the mobile robot; an information acquisition unit for acquiring information related to a safe area in which the mobile robot can stop; and a control unit for moving the mobile robot to the safe area based on the information related to the safe area when an abnormality of the mobile robot is detected during the autonomous movement of the mobile robot and the judgment unit determines that the autonomous movement function is reliable.

[0015] A technical solution disclosed herein involves a mobile robot control method, which is a method for controlling a mobile robot capable of autonomous movement, comprising: during the autonomous movement of the mobile robot, when an abnormality of the mobile robot is detected and it is determined that the autonomous movement function of the mobile robot is reliable, based on information related to a safe area where the mobile robot can stop, moving the mobile robot to the safe area.

[0016] Effects of the Invention

[0017] According to a technical solution of the present disclosure, it is possible to realize a mobile robot that can more reliably move the mobile robot to a safe area when the mobile robot detects an abnormality. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is a diagram showing the overall configuration (structure) of the mobile robot control system according to the embodiment.

[0019] Figure 2 It is a block diagram showing the functional structure of the mobile robot involved in the embodiment.

[0020] Figure 3 This is a block diagram showing the functional structure of a management server according to an embodiment.

[0021] Figure 4 This is a block diagram showing the functional structure of a monitoring server according to an embodiment of the present invention.

[0022] Figure 5 This is a block diagram showing the functional structure of the remote control terminal according to the embodiment.

[0023] Figure 6 It is a timing chart showing the operation (work) of the mobile robot control system in the case of autonomous driving according to the embodiment.

[0024] Figure 7 This is a timing chart showing the operation of the mobile robot control system in the case of remote control (remote control) driving according to the embodiment.

[0025] Figure 8 This is a diagram showing an example of a first remote control UI (User Interface) according to the embodiment.

[0026] Fig. 9 It is a timing chart showing the operation of the mobile robot control system during abnormality detection according to the embodiment.

[0027] Fig.10 This is a first sequence diagram showing the operation of the mobile robot control system when the safety area determination according to the embodiment fails.

[0028] Fig.11 It is a diagram showing an example of a safety area determination UI according to the embodiment.

[0029] Fig.12 This is a second sequence diagram showing the operation of the mobile robot control system when the safety area determination according to the embodiment fails.

[0030] Fig.13 This is a diagram showing an example of the second remote control UI according to the embodiment.

[0031] Fig.14 This is a first timing chart showing the operation of the mobile robot control system when the reliability of the autonomous driving function according to the embodiment is NG (unreliable).

[0032] Fig.15 It is a diagram showing an example of an emergency stop failure notification UI according to the embodiment.

[0033] Fig.16 This is a second timing chart showing the operation of the mobile robot control system when the autonomous driving function reliability is NG according to the embodiment.

[0034] Fig.17 This is a flowchart showing the operation of the mobile robot according to the embodiment. DETAILED DESCRIPTION

[0035] (How this disclosure was obtained)

[0036] As described in the "Background Technology", there are network security issues for mobile robots. For example, with regard to mobile robots, it is necessary not only to ensure the security of the control network, control APP (application), control device and sensor inside the mobile robot, but also to consider the possibility of unreliable (untrustworthy) surrounding environment of the mobile robot and physical access by malicious third parties. In addition, it is also necessary to consider the security of external devices that access the mobile robot, such as servers, terminals running client APPs, etc. As such, there are various security risks for mobile robots. Moreover, the security risks of mobile robots are not limited to the risks of information theft and poor service in previous IT (Information Technology) systems, but also to consider situations that affect people, objects, and the environment near the robot.

[0037] In the case where the mobile robot is attacked by network security, it is necessary not only to ensure the security of the control network, control APP, control device, sensor, etc. inside the mobile robot, as well as the external devices that access the mobile robot, such as servers, terminals running client APP, etc., but also to perform control to guide the mobile robot to a safe state so that the mobile robot itself will not cause adverse effects on the surrounding environment. For example, in the case where an abnormality is detected when the mobile robot moves to the middle of the crosswalk, if the mobile robot stops on the spot (in situ), it will block the lane, hinder the operation of cars, trucks, motorcycles, etc. traveling on the lane, and there is a risk of accidents. In addition, for example, in the case where an abnormality is detected when the mobile robot moves on the passage in a commercial building, if the mobile robot stops on the spot, the mobile robot will block the passage, hindering the movement of people in the commercial building and the passage of logistics. Assuming that a fire or fire occurs at the same time, there is a risk of loss of safety of people and objects.

[0038] In addition, according to the method of Patent Document 1, although the mobile robot can move to a safe area and stop by autonomous driving when an abnormality is detected, no countermeasures are proposed in the case of unreliable system. During the period when the mobile robot moves to the safe area, the control of the mobile robot may be remotely seized (forced control), causing harm to the surrounding environment. For example, consider the following situation: the control of the mobile robot is remotely seized, and when the mobile robot moves to a subway entrance set on the sidewalk and breaks in, the mobile robot will fall down from the stairs, etc., and be illegally remotely controlled to a dangerous area. In this way, in the method of Patent Document 1, there is room for improvement in more reliably moving the mobile robot to a safe area.

[0039] Therefore, the inventors of the present application have conducted intensive studies to more reliably move a mobile robot to a safe area, and have proposed a mobile robot and the like described below.

[0040] The first technical solution disclosed in the present invention involves a mobile robot that is capable of autonomous movement and comprises: a first judgment unit for judging the reliability of the autonomous movement function of the mobile robot; a first information acquisition unit for acquiring information related to a safe area where the mobile robot can stop; and a first control unit for moving the mobile robot to the safe area based on the information related to the safe area when an abnormality of the mobile robot is detected during the autonomous movement of the mobile robot and the first judgment unit judges that the autonomous movement function is reliable.

[0041] Thus, when the autonomous movement function is reliable, the mobile robot moves to the safe area, so it is possible to suppress the mobile robot from moving to a location different from the safe area while the control of the mobile robot is seized. Therefore, the mobile robot can move to the safe area more reliably than when the autonomous movement function is unreliable.

[0042] In addition, for example, in the mobile robot involved in the second technical solution of the present disclosure, in the mobile robot involved in the first technical solution, when the first control unit detects the abnormality during the autonomous movement of the mobile robot and the first judgment unit determines that the autonomous movement function is unreliable, the mobile robot can be stopped on the spot.

[0043] This can prevent the mobile robot from causing harm to the surrounding environment due to, for example, the control of the mobile robot being taken away by a remote controller.

[0044] In addition, for example, the mobile robot involved in the third technical solution of the present disclosure may also, in the mobile robot involved in the first technical solution or the second technical solution, further include a first UI generating unit. When the abnormality is detected during the autonomous movement of the mobile robot and the first judgment unit determines that the autonomous movement function is unreliable, the first UI generating unit generates a first alarm UI for notifying (reporting, notifying) an alarm (alert) in a server communicatively connected to the mobile robot.

[0045] Thus, by prompting the first alarm UI generated by the mobile robot in the server, the remote operator of the mobile robot can be notified that the autonomous movement function is unreliable. When the remote operator who receives the notification responds to move to a safe area, the mobile robot can move to a safe area even in a state where the autonomous movement function is unreliable.

[0046] In addition, for example, the mobile robot involved in the fourth technical solution of the present disclosure may also be provided with a second UI generating unit in the mobile robot involved in any one of the first to third technical solutions. When the abnormality is detected during the autonomous movement of the mobile robot and the first judgment unit determines that the autonomous movement function is unreliable, the second UI generating unit generates a remote control UI for remotely controlling the mobile robot in a server communicatively connected to the mobile robot, and the first control unit moves the mobile robot to the safe area based on the input of the remote control UI in the server.

[0047] Thus, by presenting the first remote control UI generated by the mobile robot on the server, the remote operator of the mobile robot can perform remote control. When the remote operator performs remote control for movement to a safe area, the mobile robot can move to a safe area even when the autonomous movement function is unreliable.

[0048] In addition, for example, in the mobile robot involved in the 5th technical solution of the present disclosure, in the mobile robot involved in the 4th technical solution, the remote control UI may also have a suspicious action reporting function in addition to being used for remote control, and the suspicious action reporting function is a function of reporting the suspicious action when a suspicious action is confirmed in the movement of the mobile robot. When the first control unit is moving the mobile robot based on the input of the remote control UI in the server, if the first control unit recognizes (recognizes, acknowledges, determines) the input of the suspicious action reporting function of the remote control UI, the mobile robot is stopped on the spot.

[0049] As a result, if the mobile robot performs a suspicious action during remote control, the mobile robot can be stopped on the spot.

[0050] In addition, for example, in the mobile robot involved in the sixth technical solution of the present disclosure, in the mobile robot involved in the fifth technical solution, the second UI generating unit may also generate a second alarm UI for notifying the suspicious action when recognizing the input of the suspicious action reporting function of the remote control UI.

[0051] Thus, by prompting the second alarm UI generated by the mobile robot in the server, the input of the suspicious action reporting function can be notified to the remote operator of the mobile robot. The remote operator who receives the notification stops the mobile robot on the spot, thereby preventing the mobile robot from causing harm to the surrounding environment even if the autonomous movement function becomes unreliable during movement.

[0052] In addition, for example, in the mobile robot involved in the 7th technical solution of the present disclosure, in the mobile robot involved in any one of the 1st to 6th technical solutions, the mobile robot may have an autonomous mobility function and other functions other than the autonomous mobility function, and the first judgment unit may judge that the autonomous mobility function is reliable when no attack related to the autonomous mobility function is detected.

[0053] Thereby, the mobile robot is able to move to a safe area without detecting an attack related to the autonomous movement function.

[0054] In addition, for example, the mobile robot involved in the 8th technical solution of the present disclosure may also be provided with a first storage unit in the mobile robot involved in any one of the 1st to 7th technical solutions, wherein the first storage unit stores the destination of the mobile robot, and the first judgment unit judges that the autonomous movement function is reliable when no tampering of the destination is detected.

[0055] Thereby, the mobile robot can move to the safe area without detecting tampering of the destination, that is, when the possibility that the safe area has been tampered with is low.

[0056] In addition, for example, the mobile robot according to the ninth aspect of the present disclosure may be the mobile robot according to any one of the first to eighth aspects, and may further include an abnormality detection unit that detects the abnormality.

[0057] Thereby, the mobile robot can move to a safe area when an abnormality is detected in its own device.

[0058] In addition, the server involved in the 10th technical solution of the present disclosure is a server that is communicatively connected to a mobile robot capable of autonomous movement, and comprises: a second judgment unit, which judges the reliability related to the autonomous movement function of the mobile robot; a second information acquisition unit, which acquires information related to a safe area where the mobile robot can stop; and a second control unit, which moves the mobile robot to the safe area based on the information related to the safe area when an abnormality of the mobile robot is detected during the autonomous movement of the mobile robot and the second judgment unit judges that the autonomous movement function is reliable.

[0059] Thus, the mobile robot is moved to a safe area when the autonomous movement function is reliable, so that it is possible to suppress the mobile robot from moving to a location different from the safe area while the control of the mobile robot is seized. Therefore, the server can more reliably move the mobile robot to a safe area than when the mobile robot moves to a safe area when the autonomous movement function is unreliable.

[0060] In addition, for example, in the server involved in the 11th technical solution of the present disclosure, in the server involved in the 10th technical solution, when the second control unit detects the abnormality during the autonomous movement of the mobile robot and the second judgment unit determines that the autonomous movement function is unreliable, the mobile robot can be stopped on the spot.

[0061] This can prevent the mobile robot from causing harm to the surrounding environment due to, for example, the control of the mobile robot being taken away by a remote controller.

[0062] In addition, for example, the server involved in the 12th technical solution of the present disclosure, in the server involved in the 10th technical solution or the 11th technical solution, may also have a 3rd UI generating unit, and when the abnormality is detected during the autonomous movement of the mobile robot and the second judgment unit determines that the autonomous movement function is unreliable, the 3rd UI generating unit generates a 3rd alarm UI for notifying an alarm.

[0063] Thus, by presenting the first warning UI, the remote operator of the mobile robot can be notified that the autonomous mobility function is unreliable. When the notified remote operator takes measures to move to a safe area, the mobile robot can be moved to a safe area even when the autonomous mobility function is unreliable.

[0064] In addition, for example, the server involved in the 13th technical solution of the present disclosure, in the server involved in any one of the 10th technical solution to the 12th technical solution, may also be provided with a 4th UI generation unit, and when the abnormality is detected during the autonomous movement of the mobile robot and the second judgment unit determines that the autonomous movement function is unreliable, the 4th UI generation unit generates a remote control UI for remotely controlling the mobile robot, and the second control unit moves the mobile robot to the safe area based on the input of the remote control UI.

[0065] Thus, by presenting the first remote control UI, the remote operator of the mobile robot can remotely control the mobile robot. When the remote operator inputs the remote control for movement to the safe area, the mobile robot can be moved to the safe area even when the autonomous movement function is unreliable.

[0066] In addition, for example, in the server involved in the 14th technical solution of the present disclosure, in the server involved in the 13th technical solution, the remote control UI may also have a suspicious action reporting function in addition to being used for remote control, and the suspicious action reporting function is a function of reporting the suspicious action when a suspicious action is confirmed in the movement of the mobile robot. When the second control unit is moving the mobile robot based on the input of the remote control UI, if the second control unit recognizes the input of the suspicious action reporting function of the remote control UI, the mobile robot is stopped on the spot.

[0067] As a result, if the mobile robot performs a suspicious action during remote control, the mobile robot can be stopped on the spot.

[0068] In addition, for example, in the server involved in the 15th technical solution of the present disclosure, in the server involved in the 14th technical solution, the 4th UI generation unit may also generate the 4th alarm UI for notifying the suspicious action when recognizing the input of the suspicious action reporting function of the remote control UI.

[0069] Thus, by prompting the fourth alarm UI, the remote operator of the mobile robot can be notified of the input of the suspicious motion reporting function. The notified remote operator stops the mobile robot on the spot, thereby preventing the mobile robot from causing harm to the surrounding environment even if the autonomous mobility function becomes unreliable during movement.

[0070] In addition, for example, in the server involved in the 16th technical solution of the present disclosure, in the server involved in any one of the 10th technical solution to the 15th technical solution, the mobile robot may have an autonomous mobility function and other functions other than the autonomous mobility function, and the second judgment unit may judge that the autonomous mobility function is unreliable when no attack related to the autonomous mobility function is detected.

[0071] Thereby, the server is able to move the mobile robot to a safe area without detecting an attack related to the autonomous movement function.

[0072] In addition, for example, the server involved in the 17th technical solution of the present disclosure may also be provided with a second storage unit in the server involved in any one of the 10th to 16th technical solutions, wherein the second storage unit stores the destination of the mobile robot, and the second judgment unit judges that the autonomous mobile function is reliable when no tampering of the destination is detected.

[0073] As a result, the server can move the mobile robot to the safe area when no tampering of the destination is detected, that is, when the possibility that the safe area has been tampered with is low.

[0074] In addition, for example, the server according to the eighteenth technical solution of the present disclosure may be the server according to any one of the tenth technical solution to the seventeenth technical solution, and may further include an abnormality detection unit for detecting the abnormality.

[0075] As a result, the server can move the mobile robot to a safe area when an abnormality is detected.

[0076] In addition, the mobile robot control system involved in the 19th technical solution of the present disclosure is a system having a mobile robot capable of autonomous movement and a server communicatively connected to the mobile robot, and comprising: a judgment unit for judging the reliability of the autonomous movement function of the mobile robot; an information acquisition unit for acquiring information related to a safe area where the mobile robot can stop; and a control unit for moving the mobile robot to the safe area based on the information related to the safe area when an abnormality of the mobile robot is detected during the autonomous movement of the mobile robot and the judgment unit judges that the autonomous movement function is reliable. In addition, the mobile robot control method involved in the 20th technical solution of the present disclosure is a method for controlling a mobile robot capable of autonomous movement, comprising: moving the mobile robot to the safe area based on the information related to the safe area where the mobile robot can stop when an abnormality of the mobile robot is detected during the autonomous movement of the mobile robot and the judgment unit judges that the autonomous movement function of the mobile robot is reliable.

[0077] This achieves the same effect as the mobile robot or server described above.

[0078] In addition, these general or specific technical solutions may be implemented by a system, method, integrated circuit, computer program, or non-transient recording medium such as a computer-readable CD-ROM, or by any combination of the system, method, integrated circuit, computer program, or recording medium. The program may be pre-stored in a recording medium or provided to the recording medium via a wide area communication network including the Internet.

[0079] Hereinafter, with reference to the accompanying drawings, the mobile robot and the like involved in the embodiments of the present disclosure will be described. In addition, the embodiments described below all represent a preferred specific example of the present disclosure. That is to say, the numerical values, shapes, materials, constituent elements, configurations of constituent elements and connection forms, steps, the order of steps, etc. shown in the following embodiments are examples of the present disclosure and are not intended to limit the present disclosure. The present disclosure is determined based on the records of the claims. Therefore, the constituent elements of the independent claims representing the highest concepts that are not recorded in the present disclosure among the constituent elements in the following embodiments are not necessary to achieve the subject of the present disclosure, but are described as constituent elements that constitute a more preferred mode.

[0080] In addition, each figure is a schematic diagram and is not necessarily a strictly illustrated figure. Therefore, for example, the scales in each figure are not necessarily the same. In addition, in each figure, the same reference numerals are used for substantially the same structure, and repeated descriptions are omitted or simplified.

[0081] In the present specification, numerical values ​​and numerical ranges are not expressions that have strict meanings, but are expressions that mean substantially equivalent ranges, for example, including differences of approximately several percent (or approximately 10%).

[0082] In the present specification, ordinal numbers such as “first” and “second” do not mean the number or order of components unless otherwise specified, but are used to distinguish between components of the same kind to avoid confusion.

[0083] (Implementation Method)

[0084] Hereinafter, a mobile robot control method including a method for determining a safe area and a method for moving the mobile robot to a safe area when the system is unreliable will be described. Also, for example, a mobile robot control method for stopping the mobile robot in a safe place when a safety anomaly (safety threat) is detected in the mobile robot control system will be described below.

[0085] [1 Overall structure of mobile robot control system 1]

[0086] Figure 1 It is a diagram showing the overall configuration of a mobile robot control system 1 according to the embodiment.

[0087] like Figure 1 As shown, the mobile robot control system 1 is an information processing system for monitoring mobile robots 100a, 100b, and 100c, and includes the mobile robots 100a, 100b, and 100c, a network 200, a management server 300, a monitoring server 400, and a remote control terminal 500. Since the mobile robots 100a, 100b, and 100c have the same configuration, they are sometimes described together as the mobile robot 100 below. The management server 300, the monitoring server 400, and the remote control terminal 500 are arranged outside the mobile robot 100 and away from the mobile robot 100.

[0088] The mobile robot 100 is a mobile body capable of autonomous movement, and is a robot or vehicle capable of autonomous driving, or a flying body capable of autonomous flight (e.g., a drone, etc.), but is not limited to these. The mobile robot 100 may also be capable of performing predetermined services. Predetermined services include, but are not limited to, delivery services, door-to-door pickup services, and pick-up and drop-off services. In addition, the mobile robot 100 may travel on roads or on sidewalks.

[0089] The mobile robot 100 notifies the management server 300 and the monitoring server 400 of the robot status such as the control status, position information, and safety alarm of the mobile robot 100 via the network 200. In addition, the number of mobile robots 100 provided in the mobile robot control system 1 is not limited to three, as long as there is one or more. In addition, the mobile robots 100 provided in the mobile robot control system 1 may also include a variety of mobile bodies (such as robots, vehicles, flying bodies, etc.).

[0090] The network 200 may include the Internet or a dedicated line. The network 200 connects the mobile robot 100, the management server 300, the monitoring server 400, and the remote control terminal 500 to each other in a manner that allows them to communicate with each other. In addition, the communication method between the mobile robot 100, the management server 300, the monitoring server 400, and the remote control terminal 500 is not particularly limited, and may be wireless communication or wired communication. In addition, wireless communication and wired communication may also be combined between devices.

[0091] The management server 300 receives the robot status of the mobile robot 100 from the mobile robot 100, and provides an interface (interface) for managing whether the mobile robot 100 is operating properly to the remote operator of the mobile robot 100. In addition, when the mobile robot 100 needs to be remotely controlled, the management server 300 generates a remote control UI (UI is an abbreviation of User Interface) for remote control, and sends the remote control UI to the remote control terminal 500 via the network 200. The remote operator is equivalent to the above-mentioned remote operator, and remotely monitors the mobile robot 100 and performs remote control (remote operation) as needed.

[0092] The monitoring server 400 is a server that mainly monitors whether a security incident occurs in the mobile robot 100, receives security alerts from the mobile robot 100, and provides an interface for analysis and response to the security operation center or the security incident response team. For example, the monitoring server 400 can also provide an interface for analysis and response to the remote control terminal 500.

[0093] The remote control terminal 500 displays the received remote control UI on a monitor or the like, receives instructions from the remote control operator from the remote control UI, and sends the remote control instructions to the mobile robot 100 via the network 200 and the management server 300, thereby enabling remote control of the mobile robot 100. In addition, the remote control terminal 500 may also send the remote control instructions directly to the mobile robot 100 without going through the management server 300.

[0094] [2 Configuration of Mobile Robot 100]

[0095] Figure 2 It is a block diagram showing the functional structure of the mobile robot 100 according to the embodiment.

[0096] like Figure 2 As shown, the mobile robot 100 includes a control unit 110, a communication unit 112, a storage unit 116, an external sensor 132, an own position estimation unit 134, a drive unit 138, an obstacle detection unit 136, a detection unit 150, a safe area acquisition unit 154, and a reliability judgment unit 156. In addition, the part including the external sensor 132, the own position estimation unit 134, the obstacle detection unit 136, and the drive unit 138 is also recorded as an autonomous driving function 130 (autonomous driving function unit) for the mobile robot 100 to drive autonomously. The autonomous driving function 130 is an example of an autonomous movement function. The mobile robot 100 has a CPU (Central Processing Unit) and a memory, etc., and the various functions of the mobile robot 100 are realized by the CPU executing the program stored in the memory.

[0097] The control unit 110 is a control device for controlling each component of the mobile robot 100. Specifically, the control unit 110 relays the communication of the autonomous driving function 130, the communication unit 112, the storage unit 116, the detection unit 150, and the safety area acquisition unit 154 to control them. In addition, when the abnormality of the mobile robot 100 is detected during the autonomous driving of the mobile robot 100, or when the abnormality of the mobile robot 100 is detected and the reliability judgment unit 156 determines that the autonomous driving function 130 is reliable, the control unit 110 can control the drive unit 138 based on the information related to the safety area to move the mobile robot 100 to the safety area. In addition, when the abnormality of the mobile robot 100 is detected during the autonomous driving of the mobile robot 100 and the safety area acquisition unit 154 fails to acquire the information related to the safety area, or when the abnormality of the mobile robot 100 is detected and the reliability judgment unit 156 determines that the autonomous driving function 130 is unreliable, the control unit 110 can control the drive unit 138 to stop the mobile robot 100 on the spot. The control unit 110 is an example of a first control unit.

[0098] The communication unit 112 mainly communicates with the management server 300 and the monitoring server 400. The communication unit 112 performs data communication with the management server 300 and the monitoring server 400 via the network 200. The communication unit 112 is configured to include a communication circuit (communication module).

[0099] Storage unit 116 stores destination information indicating the destination of mobile robot 100, map information including the range of the destination of mobile robot 100, and the like. Storage unit 116 is implemented by, for example, a semiconductor memory, but is not limited thereto. Storage unit 116 is an example of a first storage unit.

[0100] The external sensor 132 obtains surrounding information including the state of the surroundings of the mobile robot 100. The external sensor 132 is, for example, a camera (e.g., a visible light camera), a laser rangefinder, a GPS sensor, etc. In addition, the visible light camera obtains the surrounding images of the mobile robot 100. The laser rangefinder obtains point cloud information around the mobile robot 100, etc. The GPS sensor obtains location information including the current latitude, longitude, and altitude of the mobile robot 100. In addition, AI (artificial intelligence) and the like can be used to analyze the surrounding images of the visible light camera, the point cloud information of the laser rangefinder, etc., to obtain objects such as people, motorcycles, and cars that exist around the mobile robot 100 as object information, or to generate the surrounding structure as three-dimensional information and add it to the surrounding information.

[0101] Thus, the surrounding information may include sensor information obtained by a sensor mounted on the mobile robot 100 or the current position information of the mobile robot 100, and may also include image information obtained by a camera mounted on the mobile robot 100. In addition, the surrounding information may also include map information pre-stored by the management server 300. In addition, the surrounding information may also include objects around the mobile robot 100, the state of the road on which the mobile robot 100 moves, and the like.

[0102] The self-position estimating unit 134 analyzes the position information and the like in the external information acquired by the external sensor 132, and estimates the current position of the mobile robot 100. The current position may be a relative position or an absolute position.

[0103] The obstacle detection unit 136 identifies and detects obstacles that hinder the vehicle's driving by analyzing the external information (eg, object information) acquired by the external sensor 132. For example, the obstacle detection unit 136 may identify an object that exists on the driving path during autonomous driving as an obstacle.

[0104] The driving unit 138 analyzes the current position estimated by the self-position estimating unit 134 and the obstacles detected by the obstacle detecting unit 136, and actually operates the propulsion functions such as wheels and propellers to move the mobile robot 100. At this time, the driving unit 138 moves the mobile robot 100 along the path for moving to the destination, but when it is determined that there is an obstacle on the path, it drives to avoid the obstacle and controls it in a way that it can eventually reach the destination. In actual driving, in addition to the propulsion functions such as tires and propellers and the steering system, electric-related power such as motors and batteries, engine-related power such as engines and fuel tanks, etc. are also required, but since it is not the essence of the present disclosure, the detailed description of the driving is omitted.

[0105] The detection unit 150 monitors whether there is a network attack on the mobile robot 100 throughout the mobile robot 100, and when a network attack is detected, it sends it as attack information to the monitoring server 400 via the network 200. It can also be said that the detection unit 150 determines whether there is a network attack on the mobile robot 100, and when it is determined that there is a network attack, it sends it as attack information to the monitoring server 400 via the network 200. The attack information includes, for example, information indicating the existence of a network attack and whether the network attack is detected by the autonomous driving function 130 or not. The detection unit 150 is an example of an abnormality detection unit. In addition, the method for determining whether there is a network attack by the detection unit 150 can also use any known technology.

[0106] The safety area acquisition unit 154 acquires information related to the safety area closest to the current location. For example, when the detection unit 150 detects an abnormality in the mobile robot 100 during autonomous driving of the mobile robot 100, the safety area acquisition unit 154 acquires information related to a safety area where the mobile robot 100 can stop (for example, can make an emergency stop), and the safety area is an area determined based on the surrounding conditions of the mobile robot 100. The surrounding conditions of the mobile robot 100 can be any conditions that can obtain information related to the safety area, and can be the surrounding conditions of the mobile robot 100 when the abnormality is detected, or the surrounding conditions of the mobile robot 100 when no abnormality is detected (for example, before the abnormality is detected). The safety area can be an area where the mobile robot 100 does not adversely affect the surrounding environment and the safety of the mobile robot 100 is ensured, or it can be an area where the mobile robot 100 can stop safely (for example, can make an emergency stop). The safety area acquisition unit 154 is an example of the first information acquisition unit.

[0107] The reliability determination unit 156 determines whether the mobile robot 100 and the autonomous driving function 130 are in a reliable state for movement (e.g., driving) based on the attack information obtained by the detection unit 150 or the destination information stored in the storage unit 116. The reliability determination unit 156, for example, determines the reliability related to the autonomous driving function 130 of the mobile robot 100. When the attack information includes "there is a cyber attack in the autonomous driving function 130", the reliability determination unit 156 determines that the mobile robot 100 is in an unreliable state for movement, and when the attack information includes "there is a cyber attack in other functions (other functional units) other than the autonomous driving function 130", the reliability determination unit 156 determines that the mobile robot 100 is in a reliable state for movement. In this way, the reliability determination unit 156 may determine that the autonomous driving function 130 is unreliable when an attack related to the autonomous driving function 130 is detected.

[0108] In addition, the reliability determination unit 156 may determine whether the autonomous driving function 130 is reliable based on whether tampering of the destination information is detected. The reliability determination unit 156 may determine that the autonomous driving function 130 is unreliable when tampering of the destination indicated by the destination information is detected, and determine that the autonomous driving function 130 is reliable when tampering of the destination is not detected. The reliability determination unit 156 is an example of a first determination unit.

[0109] [3 Configuration of Management Server 300]

[0110] Figure 3 It is a block diagram showing the functional structure of the management server 300 according to the embodiment.

[0111] like Figure 3 As shown, the management server 300 includes a control unit 310, a communication unit 312, a storage unit 314, a robot management unit 320, and a UI generation unit 330. The management server 300 includes a CPU and a memory, and the CPU executes a program stored in the memory to implement various functions of the management server 300.

[0112] The control unit 310 is a control device that controls each component of the management server 300 , and specifically controls the communication unit 312 , the storage unit 314 , the robot management unit 320 , and the UI generation unit 330 .

[0113] The communication unit 312 mainly communicates with the mobile robot 100 and the remote control terminal 500. For example, the communication unit 312 transmits the robot management information of the robot management unit 320 to the mobile robot 100 and transmits various UIs generated by the UI generation unit 330 to the remote control terminal 500 via the network 200. The communication unit 312 is configured to include a communication circuit (communication module).

[0114] The storage unit 314 stores various UIs generated by the UI generation unit 330. The storage unit 314 is implemented by, for example, a semiconductor memory, but is not limited thereto.

[0115] The robot management unit 320 manages control information of the mobile robot 100. The control information includes, for example, a command for causing the mobile robot 100 to operate.

[0116] The UI generation unit 330 generates various UIs. For example, when an abnormality is detected during the autonomous driving of the mobile robot 100, and the safety area acquisition unit 154 fails to acquire information related to the safety area, or the reliability determination unit 156 determines that the autonomous driving function 130 is unreliable, the UI generation unit 330 may generate an alarm UI (an example of a third alarm UI) for notifying an alarm in a server (e.g., the management server 300) that is communicably connected to the mobile robot 100. The UI generated by the UI generation unit 330 will be described later. The UI generation unit 330 is an example of a third UI generation unit.

[0117] [4 Configuration of Monitoring Server 400]

[0118] Figure 4 It is a block diagram showing the functional structure of the monitoring server 400 according to the embodiment.

[0119] like Figure 4 As shown, monitoring server 400 includes control unit 410, communication unit 412, storage unit 414, analysis unit 416, and UI generation unit 418. Monitoring server 400 includes CPU and memory, and each function of monitoring server 400 is realized by CPU executing a program stored in the memory.

[0120] The control unit 410 is a control device that controls each component of the monitoring server 400 , and specifically controls the communication unit 412 , the storage unit 414 , the analysis unit 416 , and the UI generation unit 418 .

[0121] The communication unit 412 mainly communicates with the remote control terminal 500. The communication unit 412 transmits various UIs generated by the UI generation unit 418 to the remote control terminal 500 via the network 200, for example. The communication unit 412 is configured to include a communication circuit (communication module).

[0122] The storage unit 414 stores various UIs generated by the UI generation unit 418 and log information of the mobile robot 100 received by the communication unit 412. The log information includes robot states such as control state, position information, and safety alarms of the mobile robot 100. The storage unit 314 is implemented by, for example, a semiconductor memory, but is not limited thereto.

[0123] The analyzing unit 416 analyzes the log information of the mobile robot 100 stored in the storage unit 414 to detect abnormality of the mobile robot 100. The analyzing unit 416 analyzes the log information from the mobile robots 100a to 100c to detect abnormality of each of the mobile robots 100a to 100c.

[0124] The UI generation unit 418 generates various UIs.

[0125] [5 Configuration of remote control terminal 500]

[0126] Figure 5 1 is a block diagram showing a functional configuration of a remote control terminal 500 according to an embodiment. The remote control terminal 500 may be a stationary device such as a PC (personal computer) or a portable device such as a smartphone.

[0127] like Figure 5 As shown, the remote control terminal 500 includes a control unit 510, a communication unit 512, a presentation unit 514, an input unit 516, and a storage unit 518. The remote control terminal 500 includes a CPU and a memory, and the CPU executes a program stored in the memory to realize various functions of the remote control terminal 500.

[0128] The control unit 510 is a control device that controls each component of the remote control terminal 500 , and specifically controls the communication unit 512 , the presentation unit 514 , the input unit 516 , and the storage unit 518 .

[0129] The communication unit 512 is configured to include a communication circuit (communication module) mainly for communicating with the management server 300 and the monitoring server 400 .

[0130] The presentation unit 514 presents various UIs received from the management server 300 or the monitoring server 400. The presentation unit 514 is configured to include a display panel such as a liquid crystal panel, for example.

[0131] The input unit 516 receives input (operation) from the remote operator. For example, the input unit 516 receives input corresponding to the UI presented by the presentation unit 514. The input unit 516 is implemented by a joystick, a touch panel that receives touch operations, a sound collection device that receives voice input, and a camera that receives input using gestures.

[0132] The storage unit 518 stores various UIs and the like received from the management server 300 or the monitoring server 400. The storage unit 518 is implemented by, for example, a semiconductor memory, but is not limited thereto.

[0133] [6 Autonomous driving sequence]

[0134] Figure 6 1 is a timing chart showing the operation of the mobile robot control system 1 (mobile robot control method) in the case of autonomous driving according to the embodiment. Specifically, Figure 6 This is a timing chart of autonomous driving for explaining a situation in which the mobile robot 100 moves to a destination by autonomous driving.

[0135] ( S100 ) The management server 300 transmits the destination information (destination) stored in the storage unit 314 to the mobile robot 100 via the communication unit 312 .

[0136] ( S110 ) The mobile robot 100 receives the destination information from the management server 300 via the communication unit 112 , and the driving unit 138 moves the mobile robot 100 based on the received destination and the own position estimated by the own position estimating unit 134 .

[0137] (S120) When the mobile robot 100 arrives at the destination, the mobile robot 100 stops (normal stop) and notifies the management server 300 that the arrival is complete. In addition, the mobile robot 100 performs post-processing corresponding to the service. For example, in the case where the service is a delivery service that delivers bread from a bakery to the end user's home, the mobile robot 100 is notified to the end user that the mobile robot 100 has arrived. When the end user comes out of the house and approaches the mobile robot 100, the end user is further notified of the unlocking code of the cargo compartment of the mobile robot 100. Moreover, when the end user inputs the unlocking code into the code input unit for unlocking the cargo compartment, opens the door of the cargo compartment, takes out the delivered object, i.e., the bread, and closes the door of the cargo compartment, the mobile robot 100 sends a thank-you message to the end user, sends a message to the management server 300 that the delivery object has been received, and starts moving to the base of the mobile robot 100. Furthermore, when the mobile robot 100 arrives at the base of the mobile robot 100, a series of delivery services are terminated.

[0138] [7 Remote Control Driving Sequence]

[0139] Figure 7 This is a timing chart showing the operation of the mobile robot control system 1 (mobile robot control method) in the case of remote control driving according to the embodiment. Figure 7, which explains the situation where the mobile robot 100 switches from autonomous driving to remote-controlled driving while moving to the destination by autonomous driving. For example, when the planned route to the destination includes a crosswalk, when considering reaching the crosswalk by autonomous driving, the remote operator is requested to make a crosswalk judgment. In this case, the crosswalk judgment performed by the remote operator is performed based on whether the traffic light is green, whether it is possible to cross, whether there are no obstacles on the crosswalk, etc., and the status of cars, motorcycles, etc. that are driving on the lane and moving near the crosswalk.

[0140] In addition, the surrounding images of the mobile robot 100 may be analyzed by the management server 300 or the obstacle detection unit 136 of the mobile robot 100 to automatically perform a crossing judgment. On the other hand, depending on the performance and resolution of the sensor, it may be considered to request a remote operator to make a judgment. In the case where a crossing judgment is implemented and crossing is possible, the mobile robot 100 may either resume autonomous driving and move autonomously on the crosswalk, or continue driving based on remote control and move on the crosswalk. In addition, situations where the law requires a remote operator to make a crossing judgment and move by remote control are also considered.

[0141] The following describes the sequence of remote control driving. Figure 6 The same action labels as shown Figure 6 The same reference numerals are used and the description is omitted or simplified.

[0142] (S100) has been described above and is therefore omitted.

[0143] (S110) has been explained in the previous text and is therefore omitted.

[0144] (S200) When the mobile robot 100 is in an autonomous driving state and the mobile robot 100 is in a state requiring remote control, the control unit 110 of the mobile robot 100 detects that it is in a state requiring remote control. The control unit 110 determines whether remote control is required and driving is required, for example, based on the current position, the surrounding information obtained by the external sensor 132, and the own position estimated by the own position estimation unit 134. Moreover, when the control unit 110 determines that remote control is required, the mobile robot 100 stops autonomous driving and stops in place or reduces the moving speed (slows down). Furthermore, the control unit 110 entrusts the management server 300 to perform remote control. In addition, although the necessity of remote control is determined by the mobile robot 100, it can also be configured so that the management server 300 makes the determination.

[0145] (S210) When receiving a remote control request from the mobile robot 100 via the communication unit 312, the robot management unit 320 of the management server 300 generates a first remote control UI through the UI generation unit 330. The first remote control UI may be, for example, a UI that displays an image around a crosswalk and is provided with a button for confirming whether or not the crosswalk can be crossed.

[0146] Figure 8 : is a diagram showing an example of the first remote control UI involved in the implementation method. U100 is the entire UI area displayed on the monitor. The first display area U110 is an area where the front image of the mobile robot 100 is displayed. By receiving the image of the visible light camera, etc. by the external sensor 132 of the mobile robot 100 and displaying it in the first display area U110, the remote operator can confirm the surrounding conditions of the mobile robot 100. The second display area U112 is an area where the left image of the mobile robot 100 is displayed. The third display area U114 is an area where the right image of the mobile robot 100 is displayed. The fourth display area U116 is an area where the rear image of the mobile robot 100 is displayed. Similar to the first display area U110, the second display area U112, the third display area U114 and the fourth display area U116 are also realized by cooperation with the external sensor 132 of the mobile robot 100. In addition, the front is, for example, the moving direction of the mobile robot 100 , and the rear is, for example, the opposite direction to the moving direction of the mobile robot 100 .

[0147] In addition, the first button U120 is a button for instructing the mobile robot 100 to move forward. Similarly, the second button U122 is a button for instructing movement backward, the third button U124 is a button for instructing movement to the left, and the fourth button U126 is a button for instructing movement to the right. The remote operator can remotely control the mobile robot 100 by pressing these buttons. In addition, although buttons for indicating remote control are configured on the screen of these UI overall areas U100, instructions for remote control can also be given through a different device connected to the remote control terminal 500 instead of through the screen of the UI overall area U100. For example, a controller for a video game, an operating device for a flight simulator, etc. can be used as a device for remote control.

[0148] In addition, the fifth button U130 is a button for specifying that the robot 100 can cross. When the mobile robot 100 stops in front of a pedestrian crossing, the remote operator confirms the images of the mobile robot 100 in the first display area U110, the second display area U112, the third display area U114, and the fourth display area U116. After confirming that the mobile robot 100 will not fall into a dangerous state such as a car or motorcycle approaching from a distance, and judging that there is no problem with safety, the fifth button U130 is pressed. As a result, the mobile robot 100 can move. In this case, the mobile robot 100 can continue to move by remote control, or the remote control can be terminated and switched to autonomous driving, and the mobile robot 100 can move.

[0149] Re-reference Figure 7 , continue with the description.

[0150] (S220) When the remote control terminal 500 receives the first remote control UI from the management server 300, the prompt unit 514 (e.g., a monitor) prompts the first remote control UI to request the remote operator's judgment. When the remote operator inputs that the crosswalk can be crossed using the first remote control UI (e.g., the remote operator operates the fifth button U130), the remote control terminal 500 sends the remote control instruction, in this case, a notification that the crosswalk can be crossed, to the mobile robot 100.

[0151] ( S230 ) When receiving a remote control instruction, in this case, a traversable notification, from remote control terminal 500 via management server 300 , mobile robot 100 starts remote control driving.

[0152] ( S111 ) When the mobile robot 100 finishes traveling on the crosswalk, it switches to autonomous traveling and starts moving again by autonomous traveling.

[0153] (S120) has been explained in the previous text and is therefore omitted.

[0154] [8 Timing of abnormality detection]

[0155] Fig. 9 This is a timing chart showing the operation of the mobile robot control system 1 (mobile robot control method) during abnormality detection according to the embodiment. Fig. 9 , illustrating the following sequence: while the mobile robot 100 is moving to the destination by autonomous driving, an abnormality is detected, a safe area is determined, the reliability of the autonomous driving function is judged, and the mobile robot 100 is moving to the safe area by autonomous driving.

[0156] (S100) has been described above and is therefore omitted.

[0157] (S110) has been explained in the previous text and is therefore omitted.

[0158] (S300) During autonomous driving, when the detection unit 150 of the mobile robot 100 recognizes (determines, recognizes) illegal access to the system of the mobile robot 100, such as illegal login to an account, the mobile robot 100, for example, stops autonomous driving and stops at the spot or drives slowly. Then, as an abnormal state, the detection unit 150 notifies the safe area acquisition unit 154. In addition, "recognize" means that it occurs obviously (clearly), such as detected. For example, recognizing illegal access means that illegal access has obviously occurred, such as detected by the detection unit 150.

[0159] (S400) The safe area acquisition unit 154 attempts to acquire information related to the safe area based on the surrounding information acquired by the external sensor 132. If the information related to the safe area is successfully acquired, the reliability determination unit 156 is notified.

[0160] (S411) The reliability determination unit 156 determines whether the current position of the mobile robot 100 estimated by the own position estimation unit 134 is within the safe area. If it is determined that the current position is within the safe area, the process proceeds to step S130 (for example, see the following description). Fig.17 ). If it is determined that the current position is outside the safety area, the process proceeds to step S500.

[0161] (S500) The reliability determination unit 156 determines whether the autonomous driving function 130 is reliable in implementing autonomous driving based on the autonomous driving function 130 and the abnormal state. If it is determined to be reliable, the control unit 110 instructs the drive unit 138 to autonomously drive to a safe area.

[0162] ( S600 ) The driving unit 138 moves to a safe area by autonomous driving.

[0163] (S130) When the vehicle moves to the safe area, post-processing such as notifying the management server 300 that the emergency stop in the safe area has been successfully completed is performed.

[0164] [9Secure area determination failed, first sequence]

[0165] Fig.10 This is a first sequence diagram showing the operation of the mobile robot control system 1 (mobile robot control method) when the safety area determination according to the embodiment fails. Fig.10, describing the following sequence: when the mobile robot 100 moves to the destination by autonomous driving, an abnormality is detected and the determination of the safe area fails, the management server 300 or the remote control terminal 500 determines the safe area, and then determines the reliability of the autonomous driving function 130 of the mobile robot 100, and moves to the safe area by autonomous driving. Fig. 9 The same action labels as shown Fig. 9 The same reference numerals are used and the description is omitted or simplified.

[0166] (S100) has been described above and is therefore omitted.

[0167] (S110) has been explained in the previous text and is therefore omitted.

[0168] (S300) has been described in the previous text and is therefore omitted.

[0169] (S410) The safe area acquisition unit 154 attempts to acquire information related to the safe area based on the surrounding information acquired by the external sensor 132. If the information related to the safe area cannot be acquired, the management server 300 is notified of the failure to acquire the information related to the safe area (acquisition failure).

[0170] ( S420 ) Upon receiving information that the secure area cannot be acquired (acquisition failure) via the communication unit 312 , the UI generation unit 330 of the management server 300 generates a secure area determination UI for acquiring (determining) the secure area, and transmits it to the remote control terminal 500 .

[0171] Fig.11 It is a diagram showing an example of a safety area determination UI according to the embodiment. Fig.11 The safety area determination UI shown is an example of a remote control UI for designating information related to a safety area.

[0172] U200 is the entire UI area displayed on the monitor. The fifth display area U210 is an area for displaying the front image of the mobile robot 100. The image of the visible light camera, etc. is received by the external sensor 132 of the mobile robot 100 and displayed in the fifth display area U210. Therefore, the remote operator can determine the safe area by specifying a location that can be judged as a safe area from the image displayed in the fifth display area U210 with a pointer (cursor) or the like. The sixth display area U212 is an area for displaying the left image of the mobile robot 100. The seventh display area U214 is an area for displaying the right image of the mobile robot 100. The eighth display area U216 is an area for displaying the rear image of the mobile robot 100. Similar to the fifth display area U210, the sixth display area U212, the seventh display area U214 and the eighth display area U216 are also realized by cooperation with the external sensor 132 of the mobile robot 100, etc.

[0173] The time information U220 shows the playback time of the surrounding images. In addition, the sixth button U222 is a button for moving the playback time of the image forward. Similarly, the seventh button U224 is a button for moving the playback time of the image backward. The safe area is searched by displaying the surrounding images stored in the management server 300 in the UI overall area U200. However, if there is no safe area in the displayed image, it is possible to further trace back to the past, or move the playback time of the image forward or backward to search for a safe area from the surrounding images at other times.

[0174] In this way, the UI generator 330 generates a safe area determination UI for acquiring information related to the safe area based on the surrounding information of the mobile robot 100 . Fig.11 The safety area determination UI shown is an example of an acquisition UI.

[0175] Re-reference Fig.10 , continue with the description.

[0176] (S430) The prompting unit 514 of the remote control terminal 500 receives the safety zone determination UI via the communication unit 512, and prompts the received safety zone UI to the remote operator. In addition, the input unit 516 obtains the input of the remote operator to the prompted safety zone determination UI. Thus, when the safety zone is determined, the information related to the safety zone is sent to the mobile robot 100.

[0177] (S411) The reliability determination unit 156 determines whether the current position of the mobile robot 100 estimated by the own position estimation unit 134 is within the safe area. If the reliability determination unit 156 determines that the current position is within the safe area, the process proceeds to step S130 (see below). Fig.17). In addition, when the reliability determination unit 156 determines that the current position is outside the safety area, the process proceeds to step S500.

[0178] (S500) has been described in the previous text and is therefore omitted.

[0179] (S600) has been described in the previous text and is therefore omitted.

[0180] (S130) has been described in the previous text and is therefore omitted.

[0181] [10Second sequence when safety area determination fails]

[0182] Fig.12 This is a second sequence diagram showing the operation of the mobile robot control system 1 (mobile robot control method) when the safety area determination according to the embodiment fails. Fig.12 , describing the following sequence: while the mobile robot 100 is moving to the destination by autonomous driving, an abnormality is detected, the determination of the safe area within the mobile robot 100 fails, and the determination of the safe area in the management server 300 or the remote control terminal 500 also fails, and the mobile robot 100 moves to the safe area while searching for the safe area through remote control driving.

[0183] (S100) has been described above and is therefore omitted.

[0184] (S110) has been explained in the previous text and is therefore omitted.

[0185] (S300) has been described in the previous text and is therefore omitted.

[0186] (S410) has been explained in the previous text and is therefore omitted.

[0187] (S420) has been explained in the previous text and is therefore omitted.

[0188] (S431) The presentation unit 514 of the remote control terminal 500 receives the safety zone determination UI via the communication unit 512, and presents the received safety zone UI to the remote operator. In addition, the input unit 516 obtains the input of the remote operator to the safety zone determination UI. When the determination of the safety zone fails, the control unit 510 notifies the management server 300 of information indicating that the safety zone acquisition failed.

[0189] ( S440 ) Upon receiving the notification of safety zone acquisition failure via the communication unit 312 , the UI generator 330 of the management server 300 generates a second remote control UI for searching for a safety zone while performing remote control driving, and transmits it to the remote control terminal 500 .

[0190] Fig.13 : is a diagram showing an example of the second remote control UI involved in the implementation method. U300 is the entire UI area displayed on the monitor. The 9th display area U310 is an area for displaying the front image of the mobile robot 100. By receiving the image of the visible light camera, etc. by the external sensor 132 of the mobile robot 100 and displaying it in the 9th display area U310, the remote operator can confirm the surrounding conditions of the mobile robot 100. The 10th display area U312 is an area for displaying the left image of the mobile robot 100. The 11th display area U314 is an area for displaying the right image of the mobile robot 100. The 12th display area U316 is an area for displaying the rear image of the mobile robot 100. Similar to the 9th display area U310, the 10th display area U312, the 11th display area U314 and the 12th display area U316 are also realized by cooperation with the external sensor 132 of the mobile robot 100, etc.

[0191] In addition, the 8th button U320 is a button for instructing the mobile robot 100 to move forward. Similarly, the 9th button U322 is a button for instructing movement backward, the 10th button U324 is a button for instructing movement to the left, and the 11th button U326 is a button for instructing movement to the right. The remote operator can remotely control the mobile robot 100 by pressing these buttons. In addition, although buttons for indicating remote control are configured on the screen of these UI overall areas U300, instructions for remote control can also be given through a different device connected to the remote control terminal 500 instead of through the screen of the UI overall area U300. As such a device, for example, a controller for a video game, an operating device for a flight simulator, etc. can be used as a device for remote control.

[0192] In addition, the 12th button U330 is a button for instructing switching to autonomous driving. The remote operator confirms the images of the mobile robot 100 in the front, back, left, and right directions of the 8th button U320, the 9th button U322, the 10th button U324, and the 11th button U326, and after determining the safe area, presses the 12th button U330, thereby switching the mobile robot 100 to autonomous driving and moving.

[0193] In addition, the 13th button U340 is a button for notifying an abnormal state. The remote operator compares the input of the movement instruction buttons of the 8th button U320, the 9th button U322, the 10th button U324, and the 11th button U326 with the surrounding information of the mobile robot 100 in the 9th display area U310, the 10th display area U312, the 11th display area U314, and the 12th display area U316, and when an abnormal state is recognized, the abnormal state notification button of the 13th button U340 is pressed to notify the management server 300 and the mobile robot 100 of the abnormality.

[0194] In addition, the second remote control UI may also have a suspicious action reporting function (e.g., the 13th button U340) for reporting suspicious actions when suspicious actions are confirmed regarding the movement of the mobile robot 100, in addition to being used for remote control. In this case, the control unit 110 may also stop the mobile robot 100 on the spot when the input of the suspicious action reporting function of the second remote control UI is recognized (detected) while the mobile robot 100 is being moved based on the input of the second remote control UI in the server. During the movement of the mobile robot 100 (e.g., movement by remote control), when suspicious actions are confirmed regarding the movement, such as when it is illegally controlled, the mobile robot 100 can be stopped on the spot (e.g., emergency stop). In addition, the pressing of the button for notifying an abnormal state of the 13th button U340 is an example of recognizing (detecting) the input of the suspicious action reporting function of the remote control UI. In the later-described Fig.17 The relevant actions are recorded in the description.

[0195] Furthermore, when the UI generator 330 recognizes the input of the suspicious action reporting function of the remote operation UI, it may also generate a fourth warning UI for notifying the suspicious action. The fourth warning UI is presented to the remote operator by the presentation unit 514. The UI generator 330 is an example of a fourth UI generator.

[0196] Re-reference Fig.12 , continue with the description.

[0197] (S450) The prompting unit 514 of the remote control terminal 500 receives the second remote control UI via the communication unit 512, and prompts the received second remote control UI to the remote operator. In addition, the input unit 516 obtains the input of the remote operator to the prompted second remote control UI. When the operation information is input via the input unit 516, the control unit 510 sends the operation information to the mobile robot 100. In addition, when the information related to the safety area information is input, the control unit 510 sends the information related to the safety area information to the mobile robot 100.

[0198] (S460) When the driving unit 138 of the mobile robot 100 receives the operation information from the remote control terminal 500, the mobile robot 100 moves according to the operation information. In other words, the control unit 110 controls the driving unit 138 to move the mobile robot 100 based on the information input to the remote control UI in the server. In addition, during the movement, external sensor information is also received, the second remote control UI is updated, and the remote operator can visually confirm the environment around the mobile robot 100 in real time.

[0199] When the safety area acquisition unit 154 receives information related to the safety area based on the information input to the remote control UI, the mobile robot 100 may continue to travel by remote control as it is, or may switch to autonomous travel. Fig.12 The flow is shown in the case where the vehicle continues to travel by remote control, but on the other hand, when switching to autonomous travel, the reception of operation information may be terminated, and the drive unit 138 may autonomously travel with the safe area as the destination.

[0200] (S130) has been described in the previous text and is therefore omitted.

[0201] [11 The first sequence of autonomous driving function reliability NG]

[0202] Fig.14 This is a first sequence diagram showing the operation of the mobile robot control system 1 (mobile robot control method) when the autonomous driving function reliability is NG according to the embodiment. Fig.14 , describing the following sequence: while the mobile robot 100 is moving to the destination by autonomous driving, an abnormality is detected, a safe area is determined, and the reliability of the autonomous driving function is judged. If the result is unreliable, the mobile robot 100 stops on the spot.

[0203] (S100) has been described above and is therefore omitted.

[0204] (S110) has been explained in the previous text and is therefore omitted.

[0205] (S300) has been described in the previous text and is therefore omitted.

[0206] (S400) has been described above and is therefore omitted.

[0207] (S411) The reliability determination unit 156 determines whether the current position of the mobile robot 100 estimated by the own position estimation unit 134 is within the safe area. If the reliability determination unit 156 determines that the current position is within the safe area, the process proceeds to step S130 (see below). Fig.17). In addition, when the reliability determination unit 156 determines that the current position is outside the safety area, the process proceeds to step S510.

[0208] (S510) The reliability determination unit 156 determines whether the autonomous driving function 130 is reliable in implementing autonomous driving based on the abnormal state of the autonomous driving function 130. If the abnormal state may affect the autonomous driving function 130 and the reliability determination unit 156 determines that the autonomous driving function 130 is unreliable, the process proceeds to step S140.

[0209] (S140) The mobile robot 100 cannot move to the safe area and stops on the spot. The mobile robot 100 notifies the management server 300 of the emergency stop failure. The management server 300 generates an emergency stop failure notification UI and sends it to the remote control terminal 500. The remote control terminal 500 prompts the emergency stop failure notification UI. Generally speaking, the emergency stop failure notification UI includes an alarm indicating that an emergency situation exists and a display or a contact function of the contact method of the emergency (emergency assistance) service.

[0210] As a result, emergency personnel (operators) will arrive quickly and move the mobile robot 100 that has stopped in an unsafe area, thereby avoiding a dangerous situation.

[0211] Fig.15 1 is a diagram showing an example of an emergency stop failure notification UI according to an implementation method. U400 is an overall UI area displayed on the monitor. The description area U410 is an area that describes the status of the mobile robot 100. The 14th button U420 represents a notification button. When the 14th button U420 is pressed, the contracted emergency service operator or the like is automatically contacted, and an operator who moves the mobile robot 100 to a safe area sets out from the emergency service operator standby area closest to the location where the mobile robot 100 stops. The operator carries the mobile robot 100 to a safe area. The contact method area U430 displays the contact method of the police or the like. The remote operator contacts the police or the like, thereby taking care of the safety of the environment surrounding the mobile robot 100.

[0212] [12 Second sequence of autonomous driving function reliability NG]

[0213] Fig.16 This is a second timing chart showing the operation of the mobile robot control system 1 (mobile robot control method) when the autonomous driving function reliability is NG according to the embodiment. Fig.16, describing the following sequence: while the mobile robot 100 is moving to the destination by autonomous driving, an abnormality is detected, a safe area is determined, and the reliability of the autonomous driving function is judged. If the result is unreliable, the management server 300 and the remote control terminal 500 search for the safe area while moving to the safe area by remote control.

[0214] (S100) has been described above and is therefore omitted.

[0215] (S110) has been explained in the previous text and is therefore omitted.

[0216] (S300) has been described in the previous text and is therefore omitted.

[0217] (S400) has been described above and is therefore omitted.

[0218] (S411) The reliability determination unit 156 determines whether the current position of the mobile robot 100 estimated by the own position estimation unit 134 is within the safe area. If it is determined that the current position is within the safe area, the process proceeds to step S130 (see below). Fig.17 ). If it is determined that the current position is outside the safety area, the process proceeds to step S511.

[0219] (S511) The reliability determination unit 156 determines whether the autonomous driving function 130 is reliable in implementing the autonomous driving according to the abnormal state of the autonomous driving function 130 based on the detection result of the detection unit 150. If the abnormal state may affect the autonomous driving function 130 and the reliability determination unit 156 determines that it is unreliable, the management server 300 is notified of the reliability determination NG.

[0220] (S520) When receiving the reliability determination NG via the communication unit 312, the UI generation unit 330 of the management server 300 generates a second remote control UI for searching for a safe area while performing remote control driving, and transmits it to the remote control terminal 500. In this way, during the autonomous driving of the mobile robot 100, when an abnormality is detected in the mobile robot 100 and the reliability determination unit 156 determines that the autonomous driving function 130 is unreliable, the UI generation unit 330 generates a second remote control UI (an example of a remote control UI) for remote control of the mobile robot 100 in a server (e.g., the management server 300) communicatively connected to the mobile robot 100. The UI generation unit 330 functions as a third UI generation unit.

[0221] (S530) The prompting unit 514 of the remote control terminal 500 receives the second remote control UI via the communication unit 512, and prompts the received second remote control UI to the remote operator. In addition, the input unit 516 obtains the input of the remote operator to the prompted second remote control UI. When the operation information is input, the control unit 510 sends the operation information to the mobile robot 100. In addition, when the information related to the safety area information is input, the control unit 510 sends the information related to the safety area information to the mobile robot 100.

[0222] (S540) When the driving unit 138 of the mobile robot 100 receives the operation information from the remote control terminal 500, it moves the mobile robot 100 according to the operation information. It can also be said that the control unit 110 moves the mobile robot 100 to the safe area based on the input of the second remote control UI in the server. In addition, during this movement, external sensor information is also received, the second remote control UI is updated, and the remote operator can visually confirm the surrounding environment of the mobile robot 100 in real time.

[0223] Furthermore, when receiving information related to the safety area, mobile robot 100 may continue to travel by remote control as it is, or may switch to autonomous travel. Fig.16 The flow is shown in the case where the vehicle continues to travel by remote control, but on the other hand, when switching to autonomous travel, the reception of operation information may be terminated, and the drive unit 138 may autonomously travel with the safe area as the destination.

[0224] (S130) has been described in the previous text and is therefore omitted.

[0225] [13 Overall flow chart of mobile robot 100]

[0226] Fig.17 This is a flowchart showing the operation of mobile robot 100 (mobile robot control method) according to the embodiment.

[0227] (S110) has been explained in the previous text and is therefore omitted.

[0228] (S120) has been explained in the previous text and is therefore omitted.

[0229] (S130) has been described in the previous text and is therefore omitted.

[0230] (S140) has been explained in the previous text and is therefore omitted.

[0231] (S300) During autonomous driving, when the detection unit 150 of the mobile robot 100 recognizes illegal access to the system of the mobile robot 100, such as illegal login to an account ("Yes" in S300), it notifies the safety area acquisition unit 154 as an abnormal state, and proceeds to step S400 / S410. When no abnormality is detected ("No" in S300), proceed to step S120 and perform post-processing. In addition, the judgment of step S300 may be performed at predetermined time intervals during the autonomous driving of the mobile robot 100, and when the judgments at each predetermined time interval are all "No", proceed to step S120.

[0232] (S400 / S410) The safe area acquisition unit 154 attempts to acquire information related to the safe area based on the surrounding information acquired by the external sensor 132. When the safe area acquisition unit 154 successfully acquires information related to the safe area ("Yes" in S400 / S410), the process proceeds to step S411. On the other hand, when the safe area acquisition unit 154 fails to acquire information related to the safe area ("No" in S400 / S410), the safe area acquisition unit 154 notifies the management server 300 that the information related to the safe area cannot be acquired (acquisition failure), and the process proceeds to step S900.

[0233] (S411) The reliability determination unit 156 determines whether the current position of the mobile robot 100 estimated by the self-position estimation unit 134 is within the safe area. If the current position of the mobile robot 100 is within the safe area ("Yes" in S411), the mobile robot 100 stops on the spot and proceeds to step S130. On the other hand, if the current position of the mobile robot 100 is outside the safe area ("No" in S411), the mobile robot 100 proceeds to step S500 / S510.

[0234] (S500 / S510) The reliability determination unit 156 determines whether the autonomous driving function 130 is reliable in implementing the autonomous driving function 130 based on the abnormal state of the autonomous driving function 130. If the reliability determination unit 156 determines that it is reliable (for example, in the case of step S500), the reliability determination unit 156 instructs the drive unit 138 to autonomously drive to a safe area, and the process proceeds to step S600. In addition, if the abnormal state may affect the autonomous driving function 130 and the reliability determination unit 156 determines that it is unreliable (for example, in the case of step S511), the reliability determination unit 156 notifies the management server 300 of the reliability determination NG, and the process proceeds to step S540.

[0235] (S540) has been explained in the previous text and is therefore omitted.

[0236] (S600) has been described in the previous text and is therefore omitted.

[0237] (S900) When the UI generation unit 330 of the management server 300 receives the information that the information related to the safety area cannot be obtained (acquisition failure) through the communication unit 312, it generates a safety area determination UI for determining the safety area and sends it to the remote control terminal 500. The prompt unit 514 of the remote control terminal 500 receives the safety area determination UI through the communication unit 512 and prompts it on a monitor or the like. In addition, the input unit 516 obtains the input of the remote operator to the safety area determination UI. Thus, when the safety area is determined ("Yes" in S900), the information related to the safety area is sent to the mobile robot 100, and the process proceeds to step S411. On the other hand, when the determination of the safety area fails ("No" in S900), the failure to obtain the safety area is notified to the management server 300, and the process proceeds to step S540.

[0238] (S910) During the remote control driving of step S540, the remote operator compares the surrounding information presented by the second remote control UI with the remote control instruction input to the second remote control UI. As a result, when it is recognized that there is a suspicious state in the movement of the mobile robot 100, the remote operator presses the button for notifying the abnormal state of the 13th button U340. When the button for notifying the abnormal state of the 13th button U340 is pressed ("Yes" in S910), the second remote control UI notifies the management server 300 and the mobile robot 100 of the abnormality, and enters step S140. When there is no suspicious state in the movement of the mobile robot 100, the button for notifying the abnormal state of the 13th button U340 is not pressed ("No" in S910), and the remote control driving is continued.

[0239] [Effects of 14 Embodiments]

[0240] In the mobile robot control method of the embodiment, the cause of the safety anomaly can be analyzed based on the safety anomaly detected in the robot system and the current robot control state, and a safe control mode can be selected, which is effective in realizing a safe robot system.

[0241] [15 Other embodiments]

[0242] At least a part of the functional configuration of mobile robot 100 according to the above embodiment may be realized by management server 300 or monitoring server 400. Hereinafter, an example in which management server 300 includes at least a part of the functional configuration of mobile robot 100 will be described.

[0243] The control unit 310 may also be capable of executing at least a part or all of the functions of the control unit 110. When the control unit 310 is capable of executing at least a part or all of the functions of the control unit 110, the control unit 310 is an example of a second control unit. In addition, the storage unit 314 may also store at least a part or all of the information stored in the storage unit 116. When the storage unit 314 stores at least a part or all of the information stored in the storage unit 116, the storage unit 314 is an example of a second storage unit.

[0244] In addition, the management server 300 may also be able to execute at least a part or all of the functions of the detection unit 150. The processing unit that the management server 300 has and that can execute at least a part or all of the functions of the detection unit 150 is an example of the abnormality detection unit. In addition, the management server 300 may also be able to execute at least a part or all of the functions of the security area acquisition unit 154. The processing unit that the management server 300 has and that can execute at least a part or all of the functions of the security area acquisition unit 154 is an example of the second information acquisition unit. In addition, the management server 300 may also be able to execute at least a part or all of the functions of the reliability judgment unit 156. The processing unit that the management server 300 has and that can execute at least a part or all of the functions of the reliability judgment unit 156 is an example of the second judgment unit.

[0245] For example, when an abnormality of the mobile robot 100 is detected during autonomous driving of the mobile robot 100, or when an abnormality of the mobile robot 100 is detected and the second determination unit determines that the autonomous driving function 130 is reliable, the control unit 310 functioning as the second control unit may also send control information to the mobile robot 100 via the communication unit 312. The control information is information for controlling the drive unit 138 so that the mobile robot 100 moves to the safe area based on the information related to the safe area. In addition, when an abnormality is detected during autonomous driving of the mobile robot 100 and the second information acquisition unit fails to acquire the information related to the safe area, the control unit 310 functioning as the second control unit may stop the mobile robot 100 on the spot, or may move the mobile robot based on the information input to the remote control UI in the server.

[0246] Furthermore, at least a part of the functional configuration of the management server 300 or the monitoring server 400 according to the above-described embodiment may be realized by the mobile robot 100. Hereinafter, an example in which the mobile robot 100 includes at least a part of the functional configuration of the management server 300 will be described.

[0247] The mobile robot 100 may also be able to execute at least a part or all of the functions of the UI generator 330. The processing unit of the mobile robot 100 that can execute at least a part or all of the functions of the UI generator 330 is an example of the first UI generator, or an example of the first UI generator and the second UI generator.

[0248] During the autonomous driving of the mobile robot 100, when an abnormality is detected and the first judgment unit determines that the autonomous driving function 130 is unreliable, or when an abnormality is detected and the first information acquisition unit fails to acquire information related to the safety area, the first UI generation unit generates a first alarm UI for notifying an alarm in a server (e.g., the management server 300) that is communicatively connected to the mobile robot 100, and sends the generated first alarm UI to the management server 300 via the communication unit 112.

[0249] When an abnormality is detected during the autonomous driving of the mobile robot 100 and the first determination unit determines that the autonomous driving function 130 is unreliable, the second UI generation unit generates a remote control UI for remotely controlling the mobile robot 100 in a server (e.g., the management server 300) communicatively connected to the mobile robot 100, and transmits the generated remote control UI to the management server 300 via the communication unit 112. In addition, the remote control UI generated by the second UI generation unit may have a suspicious action reporting function for reporting a suspicious action when a suspicious action is confirmed in the movement of the mobile robot 100, in addition to being used for remote control.

[0250] [Other Modifications]

[0251] In addition, although the present disclosure has been described based on the above-mentioned embodiments, the present disclosure is not limited to the above-mentioned embodiments. The following cases are also included in the present disclosure.

[0252] (1) In the above embodiments, although no specific service or application is specified for the robot system, the robot used as the object may be any robot. For example, the robot may be an autonomous vehicle, a mobile robot such as a ship system or an unmanned aerial vehicle, or a robot that performs a specific task such as an industrial robot or a humanoid robot. As an industrial robot, it may also be an agricultural machine used in agriculture, a construction machine used in construction, etc.

[0253] (2) In the above embodiment, the robot has two control methods: autonomous control and remote control, but it is not necessarily required to have two control units. For example, as in remote control and autonomous control, at least two control units are sufficient. In addition, the control units are not limited to these two. For example, the robot may also have a collaborative control mode in which it works in collaboration with other robots, and a control mode in which it works according to commands from a control center.

[0254] (3) In the above embodiment, the mobile robot control system is described in which the functions are separated into the management server and the monitoring server. However, the functions of the management server and the monitoring server may be integrated.

[0255] (4) In the above embodiment, the remote operator performs remote control, but in addition to the remote operator, there may also be a staff member who monitors the mobile robot control system. For example, the position is called a system manager or a system operator, and the notification of the alarm recorded in the above embodiment may also be a notification to the system manager or the system operator.

[0256] (5) Specifically, each device in the above-mentioned embodiment is a computer system composed of a microprocessor, ROM, RAM, hard disk unit, display unit, keyboard, mouse, etc. The RAM or hard disk unit records a computer program. The microprocessor operates according to the computer program, and each device realizes its function. Here, the computer program is composed of a combination of multiple command codes representing instructions to the computer in order to realize a predetermined function.

[0257] (6) Some or all of the components of each device in the above-mentioned embodiment may be constituted by a system LSI (Large Scale Integration). System LSI is a multifunctional LSI manufactured by integrating multiple components into one chip, and specifically, is a computer system composed of a microprocessor, ROM, RAM, etc. The RAM records a computer program. The microprocessor operates according to the computer program, and the system LSI realizes its functions.

[0258] In addition, each unit of the components constituting each of the above-mentioned devices may be individually integrated into a single chip, or a part or all of the components may be integrated into a single chip.

[0259] In addition, although it is set as system LSI here, it is sometimes also called IC, LSI, super LSI, and extra LSI depending on the degree of integration. In addition, the method of integrated circuit is not limited to LSI, and it can also be realized by a dedicated circuit or a general-purpose processor. It is also possible to use a programmable FPGA (Field Programmable Gate Array) after LSI manufacturing and a reconfigurable processor that can reconfigure the connection and setting of the circuit unit inside the LSI.

[0260] Furthermore, if integrated circuit technology that replaces LSI emerges due to advances in semiconductor technology or other derived technologies, then it is of course possible to use this technology to integrate functional blocks. Applications in biotechnology, etc. are also possible.

[0261] (7) A part or all of the components constituting each of the above-mentioned devices may also be constituted by an IC card or a single module that can be loaded and unloaded on each device. The IC card or the module is a computer system composed of a microprocessor, ROM, RAM, etc. The IC card or the module may also include the above-mentioned super-multifunctional LSI. The IC card or the module realizes its function by the microprocessor operating according to the computer program. The IC card or the module may also have tamper-proof properties.

[0262] (8) The present disclosure may also be the methods shown above. In addition, the present disclosure may also be a computer program that implements these methods by a computer, or a digital signal formed by the computer program. For example, in addition, a technical solution of the present disclosure may also be to enable a computer to execute Figure 6 , Figure 7 , Fig. 9 , Fig.10 , Fig.12 , Fig.14 , Fig.16 as well as Fig.17 A computer program comprising the characteristic steps of the mobile robot control method shown in any one of the above.

[0263] In addition, the present disclosure may also record the computer program or the digital signal on a computer-readable recording medium such as a floppy disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD-ROM, a DVD-RAM, a BD (Blu-ray (registered trademark) Disc), a semiconductor memory, etc. In addition, the present disclosure may also be the digital signal recorded on these recording media.

[0264] In addition, the present disclosure may also transmit the computer program or the digital signal via an electric communication line, a wireless or wired communication line, a network represented by the Internet, data broadcasting, or the like.

[0265] Furthermore, the present disclosure may be a computer system including a microprocessor and a memory, wherein the memory stores the computer program and the microprocessor operates according to the computer program.

[0266] Furthermore, the program or the digital signal may be transferred by recording it on the recording medium, or may be transferred via the network or the like, thereby being implemented by another independent computer system.

[0267] (9) In addition, the order in which each step in the flowchart is executed is exemplified for the purpose of specifically explaining the present disclosure, and may be an order other than the above. In addition, part of the above steps may be executed simultaneously (in parallel) with other steps, or part of the above steps may not be executed.

[0268] (10) In addition, the division of the functional blocks in the block diagram is an example, and multiple functional blocks may be implemented as one functional block, one functional block may be divided into multiple blocks, or a part of the functions may be transferred to other functional blocks. In addition, a single hardware or software may process the functions of multiple functional blocks having similar functions in parallel or in a time-division manner.

[0269] (11) The above-mentioned embodiments and the above-mentioned variations may be combined respectively. In addition, as long as they do not depart from the main purpose of the present disclosure, technical solutions obtained by implementing various variations that can be conceived by those skilled in the art on the present embodiment, and technical solutions constructed by combining constituent elements in different embodiments are also included in the present disclosure.

[0270] Industrial Applicability

[0271] The present disclosure is useful for ensuring safety when a safety abnormality occurs while a mobile robot is moving, in a mobile robot control system.

[0272] Description of Reference Numerals

[0273] 1 mobile robot control system; 100, 100a, 100b, 100c mobile robots; 110, 310, 410, 510 control unit; 112, 312, 412, 512 communication unit; 116, 314, 414, 518 storage unit; 130 autonomous driving function; 132 external sensor; 134 own position estimation unit; 136 obstacle detection unit; 138 driving unit; 150 detection unit (abnormality detection unit); 154 safety area acquisition unit (first information acquisition unit); 156 reliability judgment unit (first judgment unit); 200 network; 300 management server; 320 robot management unit; 330 UI generation unit (third UI generation unit, fourth UI generation unit); 400 monitoring server; 416 analysis unit; 418 UI generation unit; 500 remote control terminal; 514 prompt unit; 516 input unit.

Claims

1. A mobile robot capable of autonomous movement, having: a first determination unit for determining reliability related to the autonomous movement function of the mobile robot; A first information acquisition unit that acquires information related to a safe area in which the mobile robot can stop; and The first control unit moves the mobile robot to the safety area based on information related to the safety area when an abnormality of the mobile robot is detected during the autonomous movement of the mobile robot and the first judgment unit judges that the autonomous movement function is reliable.

2. The mobile robot according to claim 1, When the first control unit detects the abnormality during the autonomous movement of the mobile robot and the first determination unit determines that the autonomous movement function is unreliable, the first control unit stops the mobile robot on the spot.

3. The mobile robot according to claim 2, It also includes a first user interface generating unit. When the abnormality is detected during the autonomous movement of the mobile robot and the first judgment unit determines that the autonomous movement function is unreliable, the first user interface generating unit generates a first alarm user interface for notifying an alarm in a server communicatively connected to the mobile robot.

4. The mobile robot according to claim 2, The invention further comprises a second user interface generating unit, which generates a remote control user interface for remotely controlling the mobile robot in a server communicatively connected to the mobile robot when the abnormality is detected during the autonomous movement of the mobile robot and the first judging unit judges that the autonomous movement function is unreliable. The first control unit moves the mobile robot to the safety area based on an input of the remote control user interface in the server.

5. The mobile robot according to claim 4, In addition to being used for remote control, the remote control user interface also has a suspicious action reporting function, which is a function of reporting a suspicious action when a suspicious action is confirmed in the movement of the mobile robot. When the first control unit is moving the mobile robot based on the input of the remote control user interface in the server, if the first control unit recognizes the input of the suspicious action reporting function of the remote control user interface, the first control unit stops the mobile robot on the spot.

6. The mobile robot according to claim 5, The second user interface generation unit further generates a second warning user interface for reporting the suspicious action when recognizing an input to the suspicious action reporting function of the remote manipulation user interface.

7. The mobile robot according to any one of claims 1 to 5, The mobile robot has an autonomous movement function and other functions besides the autonomous movement function. The first determination unit determines that the autonomous mobility function is reliable when no attack related to the autonomous mobility function is detected.

8. The mobile robot according to any one of claims 1 to 5, further comprising a first storage unit storing a destination of the mobile robot, The first determination unit determines that the autonomous mobility function is reliable when no tampering of the destination is detected.

9. The mobile robot according to any one of claims 1 to 5, The device further includes an abnormality detection unit for detecting the abnormality.

10. A server, which is communicatively connected to a mobile robot capable of autonomous movement, comprising: a second determination unit for determining reliability related to the autonomous movement function of the mobile robot; A second information acquisition unit that acquires information related to a safe area in which the mobile robot can stop; and The second control unit moves the mobile robot to the safety area based on information related to the safety area when an abnormality of the mobile robot is detected during the autonomous movement of the mobile robot and the second judgment unit judges that the autonomous movement function is reliable.

11. The server according to claim 10, When the second control unit detects the abnormality during the autonomous movement of the mobile robot and the second determination unit determines that the autonomous movement function is unreliable, the second control unit stops the mobile robot on the spot.

12. The server according to claim 11, It also includes a third user interface generating unit. When the abnormality is detected during the autonomous movement of the mobile robot and the second judging unit judges that the autonomous movement function is unreliable, the third user interface generating unit generates a third alarm user interface for notifying an alarm.

13. The server according to claim 11, The invention further comprises a fourth user interface generating unit, which generates a remote control user interface for remotely controlling the mobile robot when the abnormality is detected during the autonomous movement of the mobile robot and the second judging unit judges that the autonomous movement function is unreliable. The second control unit moves the mobile robot to the safety area based on an input of the remote control user interface.

14. The server according to claim 13, In addition to being used for remote control, the remote control user interface also has a suspicious action reporting function, which is a function of reporting a suspicious action when a suspicious action is confirmed in the movement of the mobile robot. When the second control unit is moving the mobile robot based on the input of the remote control user interface, if the second control unit recognizes the input of the suspicious action reporting function of the remote control user interface, the second control unit stops the mobile robot on the spot.

15. The server according to claim 14, The fourth user interface generation unit further generates a fourth warning user interface for reporting the suspicious action when recognizing an input to the suspicious action reporting function of the remote manipulation user interface.

16. The server according to any one of claims 10 to 14, The mobile robot has an autonomous movement function and other functions besides the autonomous movement function. The second determination unit determines that the autonomous mobility function is unreliable when an attack related to the autonomous mobility function is not detected.

17. The server according to any one of claims 10 to 14, further comprising a second storage unit storing a destination of the mobile robot, The second determination unit determines that the autonomous mobility function is reliable when no tampering of the destination is detected.

18. The server according to any one of claims 10 to 14, The device further includes an abnormality detection unit for detecting the abnormality.

19. A mobile robot control system, comprising a mobile robot capable of autonomous movement and a server communicatively connected to the mobile robot, comprising: a determination unit configured to determine reliability related to the autonomous movement function of the mobile robot; an information acquisition unit that acquires information related to a safe area in which the mobile robot can stop; and The control unit moves the mobile robot to the safety area based on information related to the safety area when an abnormality of the mobile robot is detected during the autonomous movement of the mobile robot and the judgment unit judges that the autonomous movement function is reliable.

20. A mobile robot control method is a method for controlling a mobile robot capable of autonomous movement, comprising: During the autonomous movement of the mobile robot, when an abnormality of the mobile robot is detected and it is determined that the autonomous movement function of the mobile robot is reliable, the mobile robot is moved to the safe area based on information related to the safe area where the mobile robot can stop.

Images