A physical body intelligent robot safety takeover system

Abstract

The application discloses a body intelligent robot safety takeover system, and relates to the technical field of robot control and safety engineering. The system comprises: an anomaly detection module for determining consistency detection results, time delay detection results and drift detection results; a fusion judgment module for determining large model anomaly detection results through fusion rules according to the consistency detection results, the time delay detection results and the drift detection results; and a safety takeover module for cutting off the writing authority of the large model by using a hardware control means, switching the control authority of the body intelligent robot to a cerebellum safety control module, and making the body intelligent robot enter a three-level control state when the large model anomaly detection results are greater than or equal to a three-level threshold or the consistency detection results, the time delay detection results and the drift detection results have serious anomalies. The application achieves the technical effect of quickly switching the control authority of the body intelligent robot to the cerebellum safety control module in necessary cases.

Description

Technical Field

[0001] This application relates to the field of robot control and safety engineering technology, and in particular to a safety takeover system for an embodied intelligent robot. Background Technology

[0002] Embodied Intelligence (EI) is a cutting-edge field at the intersection of artificial intelligence and robotics control. It emphasizes the dynamic interaction between an intelligent agent's body and its environment. Its core lies in the deep integration of perception, action, and cognition. With the continuous maturation of technology and the expansion of applications, embodied intelligence products play an important role in many fields such as intelligent manufacturing, smart homes, smart healthcare, and smart services.

[0003] Existing embodied intelligent robots are beginning to explore a collaborative framework system of "brain" and "cerebellum". Here, "brain" refers to the control system based on large models such as Large Language Model (LLM) and Vision-Language Model (VLM), while "cerebellum" refers to the control system based on traditional controllers. However, there is still a technical problem of lacking hard real-time takeover when the "brain" malfunctions. Summary of the Invention

[0004] This application provides a safety takeover system for an embodied intelligent robot, which achieves the technical effect of providing early warning of explicit errors in the output content of a large model, providing early warning of large model drift (i.e., implicit degradation), and quickly switching control of the embodied intelligent robot to the cerebellum safety control module when necessary.

[0005] In a first aspect, embodiments of this application provide a holographic intelligent robot safety takeover system, including: The anomaly detection module is used to determine the consistency detection result based on the output content of the large model, the state information of the embodied intelligent robot, and the constraints; to determine the latency detection result based on the request timestamp and response timestamp of the output content of the large model; and to determine the drift detection result based on the output content of the large model within the sliding window W. The fusion determination module is used to determine the large model anomaly detection result based on the consistency detection result, the delay detection result, and the drift detection result through fusion rules. The safety takeover module is used to cut off the write permission of the large model by hardware control when the anomaly detection result of the large model is greater than or equal to the level 3 threshold or when there are serious anomalies in the consistency detection result, delay detection result, or drift detection result. The control permission of the embodied intelligent robot is then switched to the cerebellum safety control module, and the embodied intelligent robot enters the level 3 control state. The cerebellum safety control module includes a PID controller, and the actions performed by the cerebellum safety control module include at least one of the following: blocking stop, damping deceleration, retreat to a safe area, hovering and parking, and speed and force limiting; The output of the large model includes at least one of the following: textual action instructions and structured action instructions.

[0006] Furthermore, the security takeover module uses hardware control to cut off the write permission of the large model and switches the control permission of the embodied intelligent robot to the cerebellum security control module with an operation delay of less than or equal to 10ms.

[0007] Furthermore, the security takeover module includes: The hard real-time triggering unit is used to cut off the write permissions of large models using hardware control methods; A control authority atomic switching unit is used to switch the control authority of the embodied intelligent robot to the cerebellum safety control module, and the embodied intelligent robot enters a level three control state. The hard real-time triggering unit includes: a field-programmable gate array (FPGA) and / or a microcontroller unit (MCU) with an interrupt controller.

[0008] Furthermore, it also includes a policy degradation module for: The anomaly detection results of the large model are compared with the first-level threshold, the second-level threshold, and the third-level threshold; In response to the large model anomaly detection result being greater than or equal to the first-level threshold and less than the second-level threshold, the output content of the large model is mapped to a template action, and the embodied intelligent robot enters the first-level control state. In response to the large model anomaly detection result being greater than or equal to the secondary threshold and less than the tertiary threshold, the software freezes the large model's write permissions, activates the pre-set emergency script library to generate control commands, and controls the embodied intelligent robot, which then enters the secondary control state. In response to the large model anomaly detection result being greater than or equal to the level 3 threshold, the safety takeover module (30) is activated, and the embodied intelligent robot enters the level 3 control state.

[0009] Furthermore, it also includes a recovery assessment module for: In response to the embodied intelligent robot being in a K-level control state; Periodically determine the current anomaly detection results of the large model, and compare the anomaly detection results of the large model with the recovery conditions; In response to the large model anomaly detection result satisfying the recovery condition N times consecutively, the embodied intelligent robot is controlled to enter the K-1 level control state; Where K is an integer, and 1≤K≤3, the zero-level control state of the embodied intelligent robot is the control state of the embodied intelligent robot under the condition that the large model has full write permissions.

[0010] Furthermore, the recovery assessment module is also used for: In response to the embodied intelligent robot being in a K-1 level control state; If the large model anomaly detection result does not meet the recovery condition N times consecutively, the embodied intelligent robot is controlled to roll back to the K-level control state.

[0011] Furthermore, the system also includes an interface and log recording module, used for: Record the consistency detection results, the delay detection results, the drift detection results, the large model anomaly detection results, and the control state.

[0012] Furthermore, the constraints include dynamic constraints and / or static constraints; The dynamic constraints are the safety constraints required by the current environment or task state of the embodied intelligent robot; the static constraints are general safety constraints.

[0013] Furthermore, the length and step size of the sliding window W are set according to the scene in which the embodied intelligent robot is located; The scenarios include at least one of the following: fire rescue, high-voltage power line inspection, earthquake rescue, extreme weather rescue, and high-altitude operations.

[0014] Furthermore, the pre-set emergency script library includes at least one of the following: evacuation script, obstacle avoidance and relocation script, safe attitude locking script, speed and force limiting script, and return to safe point script.

[0015] The technical solution of this invention solves the technical problem of the lack of hard real-time takeover in existing embodied intelligent robots when the "brain" is abnormal by setting up an embodied intelligent robot safety takeover system. It achieves the effect of early warning for explicit errors in the output content of the large model, such as contradictions, out-of-bounds, and incompleteness in the output content of the large model. At the same time, the embodied intelligent robot safety takeover system can provide early warning for large model drift, i.e., implicit degradation, and quickly switch the control of the embodied intelligent robot to the cerebellum safety control module when necessary. The cerebellum safety control module has clear takeover criteria, configurable takeover conditions, and timely takeover speed. Thus, it achieves the technical effect of preventing the embodied intelligent robot from becoming incapacitated or causing danger when there are unpredictable spikes in the inference delay of the large model or other faults. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the specific embodiments of this application or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0017] Figure 1 This is a schematic diagram of the structure of a holographic intelligent robot safety takeover system provided in Embodiment 1 of this application; Figure 2 This is a schematic diagram of the anomaly detection module. Figure 3 This is a structural diagram of the safety takeover module; Figure 4 This is a structural schematic diagram of a holographic intelligent robot safety takeover system provided in Embodiment 2 of this application. Detailed Implementation

[0018] The technical solutions of this application will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0019] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0020] In the description of this invention, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, or the orientation or positional relationship commonly used when the product of this invention is in use. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this invention. In addition, the terms "first," "second," "third," etc., are only used to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0021] Furthermore, terms such as "horizontal" and "vertical" do not imply that the component must be absolutely horizontal or suspended, but rather that it can be slightly tilted. For example, "horizontal" simply means that its direction is more horizontal than "vertical," not that the structure must be completely horizontal, but can be slightly tilted. Similarly, terms such as "front," "back," "left," and "right" do not imply that the component must be absolutely front, back, left, or right, but can be slightly tilted.

[0022] In the description of this invention, it should also be noted that, unless otherwise explicitly specified and limited, the terms "set," "install," "connect," and "link" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0023] Example 1 Embossed intelligent robots, emphasizing a closed loop of "perception-thinking-action," are considered a crucial path towards general artificial intelligence. With the maturity of computer vision, speech, tactile, and motion planning technologies, embodied intelligent robots have become increasingly adept at performing fixed tasks in structured environments. However, their ability to perform tasks in semi-structured and unknown environments—that is, their generalization ability—still needs improvement. Large-scale language models and visual language models possess powerful semantic understanding and reasoning capabilities, enabling embodied intelligent robots to autonomously make high-level decisions in semi-structured or even unknown environments. However, the control systems of large models inherently suffer from high inference latency and significant output uncertainty. Therefore, to enhance the stability of embodied intelligent robots in semi-structured and unknown environments, this application provides an embodied intelligent robot safety takeover system, improving the safety control and fault tolerance performance of embodied intelligent robots in complex dynamic environments.

[0024] Figure 1 This is a structural schematic diagram of a holographic intelligent robot safety takeover system provided in Embodiment 1 of this application, as shown below. Figure 1 As shown, the embodied intelligent robot safety takeover system includes an anomaly detection module 10, a fusion judgment module 20, and a safety takeover module 30. The anomaly detection module 10 is used to determine the consistency detection result based on the output content of the large model, the state information of the embodied intelligent robot, and the constraints; to determine the delay detection result based on the request timestamp and response timestamp of the output content of the large model; and to determine the drift detection result based on the output content of the large model within the sliding window W.

[0025] Optionally, the constraints include dynamic constraints and / or static constraints. The dynamic constraints are safety constraints required by the current environment or task state of the embodied intelligent robot; the static constraints are general safety constraints.

[0026] Figure 2 This is a schematic diagram of the structure of the anomaly detection module 10, as shown below. Figure 2 As shown, dynamic constraints refer to the safety constraints required for the current environment or task state of the embodied intelligent robot, such as the high-speed movement of a stationary embodied intelligent robot in a high-temperature environment. The function of dynamic constraints is to provide the anomaly detection module 10 with immediate and dynamic safety constraints, ensuring that the behavior of the embodied intelligent robot meets the safety requirements of the current environment. Static constraints are general safety constraints, such as the embodied intelligent robot's movement speed not exceeding 2 m / s in all environments or task states. By setting dynamic and static constraints, the impact of different environments and tasks on the embodied intelligent robot can be fully considered, enabling the embodied intelligent robot to have good adaptability to different tasks and work safely in different environments.

[0027] like Figure 2 As shown, the anomaly detection module 10 receives the output content of the large model, the state information of the embodied intelligent robot, and the dynamic constraints. It then performs input shaping and buffering on these components, and performs three-channel anomaly detection on the shaped and buffered output content, state information, and dynamic constraints. Specifically, it analyzes and processes the output content, state information, dynamic constraints, and static constraints, and outputs the consistency detection result through the first channel.

[0028] The output of the large model includes textual action instructions and / or structured action instructions. Textual action instructions refer to readable action instructions output by the large model that require further interpretation and serve a communicative purpose; while structured action instructions refer to a series of clear, quantifiable, and executable action instructions. For example, textual action instructions need to be further parsed into structured action instructions that the embodied intelligent robot can directly execute. For instance, the textual action instruction "Please move slowly to the table" needs to be parsed into the structured action instruction {"action": "move", "target": [1.2, 0.5,0.0], "speed": 0.3}. The consistency detection includes: mutual exclusion detection, boundary crossing detection, integrity detection, and / or threshold detection, etc. Mutual exclusion and conflict refer to contradictions in the output content of the large model itself. For example, the output content of the large model is that the embodied intelligent robot moves forward and backward. Boundary crossing detection refers to the embodied intelligent robot entering a restricted area or exceeding the preset workspace. For example, the status information of the embodied intelligent robot indicates that the current embodied intelligent robot is at the edge of the preset space, but the output content of the large model is that the embodied intelligent robot continues to move forward. Integrity refers to the semantic completeness of the output content of the large model. For example, "the embodied intelligent robot continues" is an incomplete output content of the large model. Threshold detection refers to confirming whether the action of the embodied intelligent robot indicated by the output content of the large model exceeds a threshold. For example, whether the moving speed exceeds the maximum speed that the embodied intelligent robot can withstand, or whether the torque exceeds the joint performance of the embodied intelligent robot.

[0029] The anomaly detection module 10 records the consistency detection results using flag bits. For example, an anomaly flag bit `flag_logic=1` indicates that the consistency detection result is abnormal. It can also record the degree of abnormality in the consistency detection results, for example, using the flag bit `score_logic` to record the degree of abnormality. The value of `score_logic` is between 0 and 1, with 1 indicating the highest degree of abnormality. It can also record constraints related to the consistency detection results. For example, if there are mutual exclusion conflicts in the output content of a large model, the relevant constraints are recorded in the flag bit `rule_hit_ids`. It should be noted that the names of the flag bits mentioned above are only examples and can be set as needed.

[0030] The latency detection result is determined based on the request and response timestamps of the output content of the large model. Here, latency refers to the time between the start of the large model's reasoning and the output content, i.e., the inference latency of the large model. The start time of the large model's reasoning is determined by the request timestamp. As those skilled in the art know, when the embodied intelligent robot sends a reasoning request to the large model, a hardware timer or operating system timestamp interface automatically records the request timestamp t_req; when the large model completes reasoning and generates its output content, a response timestamp t_rsp is recorded, and the difference between the two is Δt = t_rsp. t_req is the latency detection result described in this application. The anomaly detection module 10 records the latency detection result using a flag bit. For example, if Δt > T_crit, then the anomaly flag bit flag_latency = 1, indicating that the latency detection result is abnormal. The degree of anomaly in the latency detection result can also be recorded, for example, using the flag bit score_latency to record the degree of anomaly. The value of score_latency is between 0 and 1, with 1 indicating the highest degree of anomaly. Preferably, T_crit can be set according to the current environment or task state of the embodied intelligent robot. In dangerous environments, a smaller T_crit value can be set to ensure the timely response of the embodied intelligent robot. For example, in dangerous environments, T_crit = 300ms. Figure 2 As shown, the request timestamps and response timestamps recorded by the timestamp interface are analyzed and processed, and the latency detection results are output through the second channel.

[0031] The drift detection result is determined based on the output of the large model within the sliding window W. Large model drift refers to a significant change in the answer given by the large model to the same question within a short period of time. This change is not only due to the inherent randomness of the large model itself or minor differences in the way the user asks the question, but may also be due to a change in the large model itself. Therefore, in order to ensure the stability of the embodied intelligent robot's performance, it is necessary to detect the drift of the large model.

[0032] The sliding window W represents the detection range of the anomaly detection module 10 for the output content of the large model. The anomaly detection module 10 focuses on the output content of the large model within a recent period, i.e., only the output content of the large model within the sliding window W. Based on the output content of the large model within the sliding window W, the anomaly detection module 10 obtains indicators such as action category frequency, parameter distribution, and embedding vector statistics, and compares them with a standard distribution to obtain the drift detection result. For example, the standard distribution is the reference distribution P_ref, and the distribution of the output content of the large model within the current sliding window W is P_win. The difference value score_drift between P_win and P_ref is calculated using a difference function. The value of score_drift is between 0 and 1, with 1 indicating the greatest degree of difference. When score_drift > θ_drift, it indicates that the drift detection result is abnormal, and the anomaly flag flag_drift = 1. Figure 2 As shown, the output of the large model is analyzed and processed, and the drift detection results are output through the third channel.

[0033] Optionally, the length and step size of the sliding window W are set according to the scenario in which the embodied intelligent robot is located; wherein, the scenario includes at least one of the following: fire rescue, high-voltage power line inspection, earthquake rescue, extreme weather rescue, and high-altitude operation. A suitable sliding window W can be determined based on the current environment or task status of the embodied intelligent robot. For example, when the embodied intelligent robot is performing an extreme weather rescue mission, the training amount of the large model is insufficient, and drift detection anomalies are more likely to occur. In this case, the length of the sliding window W can be kept unchanged, but the step size can be reduced. A smaller step size means that the window slides more finely, the detection updates more frequently, and the real-time performance is higher, thereby improving the real-time performance and accuracy of the drift detection results output by the third channel. The advantage of this setting is that different sliding windows W are set according to different scenarios. In scenarios where the probability of large model drift is low, the computational load of the embodied intelligent robot performing drift detection is reduced; in scenarios where the probability of large model drift is high, the real-time performance and accuracy of the output drift detection results are improved.

[0034] The embodied intelligent robot safety takeover system includes a fusion determination module 20. This module determines the large model anomaly detection result based on the consistency detection result, the latency detection result, and the drift detection result, using a fusion rule. The fusion determination module 20 determines the fusion weights of the consistency detection result, latency detection result, and drift detection result to obtain the large model anomaly detection result, thus providing a basis for evaluating the health status of the large model. For example, the fusion rule is: score_total = w1·score_logic + w2·score_latency + w3·score_drift, where w1, w2, and w3 can be configured according to the current environment or task status of the embodied intelligent robot.

[0035] The embodied intelligent robot safety takeover system includes a safety takeover module 30. The safety takeover module 30 is used to cut off the write permission of the large model by means of hardware control when the anomaly detection result of the large model is greater than or equal to the level 3 threshold or when there are serious anomalies in the consistency detection result, delay detection result, or drift detection result. The control permission of the embodied intelligent robot is then switched to the cerebellum safety control module 40, and the embodied intelligent robot enters the level 3 control state.

[0036] When the large model anomaly detection result score_total ≥ S3, i.e., the large model anomaly detection result is greater than or equal to the level three threshold, the embodied intelligent robot enters the level three control state, sets the control state flag degrade_level to 3, and sets the takeover flag to 1. At this time, the large model's anomaly level is high, and the large model no longer has the ability to continue controlling the embodied intelligent robot. Therefore, hardware control means are used to cut off the large model's write permissions, and the control permissions of the embodied intelligent robot are switched to the cerebellum safety control module 40. Simultaneously, if there are serious anomalies in the consistency detection result, latency detection result, and drift detection result, the score_total ≥ S3 may not be satisfied, but the large model also has serious anomalies. It is necessary to promptly cut off the large model's write permissions and switch the control permissions of the embodied intelligent robot to the cerebellum safety control module 40. The level three control state is a safety takeover mode, i.e., the safety takeover module 30 switches the control of the embodied intelligent robot to the cerebellum safety control module 40 and executes safety actions.

[0037] Optionally, the serious anomalies in the consistency detection result, latency detection result, and drift detection result include at least one of the following: Δt > T_crit; a fatal anomaly exists in the consistency detection result; or at least two of the consistency detection result, latency detection result, and drift detection result have anomaly flags set to 1. Δt > T_crit indicates that the inference latency of the large model is too long. The specific determination of a fatal anomaly in the consistency detection result can be set according to the situation, such as if the output of the large model contains instructions that seriously compromise the safety of the embodied intelligent robot itself.

[0038] The cerebellum safety control module 40 includes a PID controller. The actions performed by the cerebellum safety control module 40 include at least one of the following: stall stop, damped deceleration, retreat to a safe area, hovering stop, and speed and force limiting. The PID (Proportional Integral Derivative) controller is a feedback controller used in industrial automation, possessing advantages such as simple structure, good stability, reliable operation, and convenient adjustment. Stall stop refers to controlling the embodied intelligent robot to stop its movement by applying resistance; damped deceleration refers to smoothly decelerating the embodied intelligent robot through a damping device; hovering stop refers to maintaining the embodied intelligent robot in its current state to prevent slippage, etc. It is understood that the cerebellum safety control module 40 may also include other traditional controllers, such as a Model Predictive Control (MPC) or a Linear Quadratic Regulator (LQR).

[0039] Optionally, the security takeover module 30 includes: a hard real-time triggering unit 31, used to cut off the write permission of the large model using hardware control means; and a control right atomic switching unit 32, used to switch the control permission of the embodied intelligent robot to the cerebellum security control module 40, so that the embodied intelligent robot enters a level three control state; wherein, the hard real-time triggering unit includes: a field-programmable gate array (FPGA) and / or a microcontroller unit (MCU) with an interrupt controller.

[0040] Figure 3This is a schematic diagram of the safety takeover module. The hard real-time triggering unit 31 uses a Field-Programmable Gate Array (FPGA) and / or a Microcontroller Unit (MCU) with an interrupt controller to preempt and cut off write access to the large model. The FPGA, as an independent safety monitoring chip, is solely responsible for the hard real-time triggering function, ensuring that this function is unaffected by other components of the embodied intelligent robot. Here, "hard real-time" refers to the use of a hardware interrupt mechanism to implement the hard real-time triggering function, preventing simple software polling interrupts from being easily interfered with by other running programs. The MCU with an interrupt controller refers to the MCU possessed by the embodied intelligent robot, which includes an independent hardware interrupt controller, thus ensuring the stability of the hard real-time triggering function. It should be noted that, in addition to FPGAs and MCUs, the hard real-time triggering unit 31 can also use a Digital Signal Processor (DSP) or a Programmable Logic Controller (PLC) with an interrupt controller. The "atomic switching of control" refers to an uninterrupted and indivisible switching process. The atomic switching unit 32 completes the transfer of control only after the cerebellum safety control module 40 confirms that the system is ready, and during the transfer, it blocks the output of the large model to avoid dual-channel conflicts. The advantage of this setting is that it ensures the real-time performance and stability of cutting off the large model's write permissions and the takeover by the cerebellum safety control module when necessary.

[0041] Optionally, the safety takeover module 30 uses hardware control to sever the large model's write permissions and switches the control permissions of the embodied intelligent robot to the cerebellum safety control module 40 with an operation latency of less than or equal to 10ms. Here, the operation latency is defined as the total time from the large model's anomaly detection result confirming the need to switch control permissions to the cerebellum safety control module, to the cerebellum safety control module taking effect. This operation latency includes the hardware switching latency, i.e., the time from severing the large model's write permissions to the cerebellum safety control module 40 taking effect. Since the operation latency is less than or equal to 10ms, a shorter hardware switching latency is required. By limiting the operation latency to within 10ms, it ensures that the embodied intelligent robot can achieve millisecond-level control switching in the event of a serious anomaly in the large model, reducing the probability of loss of control.

[0042] The technical solution of this embodiment solves the technical problem of the lack of hard real-time takeover in existing embodied intelligent robots when the "brain" is abnormal by setting up an embodied intelligent robot safety takeover system. It achieves the effect of warning for explicit errors in the output content of the large model, such as contradictions, out-of-bounds, and incompleteness in the output content of the large model. At the same time, the embodied intelligent robot safety takeover system can warn of large model drift, i.e., implicit degradation, and quickly switch the control of the embodied intelligent robot to the cerebellum safety control module when necessary. The cerebellum safety control module has clear takeover criteria, configurable takeover conditions, and timely takeover speed. Thus, it achieves the technical effect of preventing the embodied intelligent robot from becoming incapacitated or causing danger when there are unpredictable spikes in the inference delay of the large model or other faults.

[0043] Example 2 Figure 4 This is a structural schematic diagram of a unibody intelligent robot safety takeover system provided in Embodiment 2 of this application. Figure 4 As shown, compared to the embodied intelligent robot safety takeover system described in Embodiment 1, the embodied intelligent robot safety takeover system described in Embodiment 2 further includes a policy degradation module 40, used for: The anomaly detection result of the large model is compared with the first-level threshold, the second-level threshold, and the third-level threshold. In response to the large model anomaly detection result being greater than or equal to the first-level threshold and less than the second-level threshold, the output content of the large model is mapped to a template action, and the embodied intelligent robot enters the first-level control state. In response to the large model anomaly detection result being greater than or equal to the second-level threshold and less than the third-level threshold, the large model's write permissions are frozen at the software level, and a pre-set emergency script library is used to generate control commands to control the embodied intelligent robot, which then enters the second-level control state. In response to the large model anomaly detection result being greater than or equal to the third-level threshold, the safety takeover module 30 is activated, and the embodied intelligent robot enters the third-level control state.

[0044] The embodied intelligent robot can be configured with four control states. The first control state is when the large model exhibits a minor anomaly. In this state, the output of the large model is mapped to template actions; that is, when the output of the large model is a non-template action, it is replaced with a corresponding or similar template action. Template actions can include instructing the embodied intelligent robot to stop, decelerate, retreat to a safe point, observe in place, or maintain a distance while cruising. These template actions can be customized according to the environment or task status. The second control state is when the large model exhibits a moderate anomaly. In this state, write permissions to the large model are frozen at the software level, and a pre-set emergency script library is used to generate control commands to control the embodied intelligent robot. In the second control state, the hardware bus does not switch. This state can be used in scenarios where the risk to the embodied intelligent robot is controllable and there is still hope for self-rescue, such as occasional anomalies in the large model. The control commands in the emergency script library can be customized according to the environment or task status. The Level 3 control state represents the control state of the embodied intelligent robot when a severe anomaly exists in the large model. In this state, the safety takeover module 30 is activated, switching control of the embodied intelligent robot to the cerebellum safety control module 40. In this Level 3 control state, the hardware bus switches control, and the large model is physically isolated. This can be used in scenarios where the embodied intelligent robot might immediately collide with a person or crash. In scenarios where a severe anomaly exists in the large model, control of the embodied intelligent robot is switched in millisecond-level hard real-time, with the cerebellum safety control module 40 instantly taking over control. By setting the strategy degradation module 40, the anomaly levels of the large model are categorized, preventing the embodied intelligent robot from overreacting to minor anomalies and frequently switching control.

[0045] Optionally, when determining whether the embodied intelligent robot enters a first-level or second-level control state, a continuous confirmation principle is adopted. Specifically, when the large model anomaly detection result is greater than or equal to the first-level threshold and less than the second-level threshold for M consecutive times, the embodied intelligent robot enters a first-level control state; when the large model anomaly detection result is greater than or equal to the second-level threshold and less than the third-level threshold for M consecutive times, the embodied intelligent robot enters a second-level control state. The advantage of this setting is that using the continuous confirmation principle of M consecutive times, for example, when M=3~5, can effectively suppress misjudgments caused by transient noise and prevent frequent switching of the embodied intelligent robot's control state due to occasional misjudgments. However, due to the urgency of the situation, the continuous confirmation principle is not adopted for the third-level control state.

[0046] Optionally, the pre-set emergency script library includes at least one of the following: evacuation script, obstacle avoidance and relocation script, safe posture locking script, speed and force limiting script, and return to safe point script. Since the embodied intelligent robot exhibits a moderate degree of anomaly when in secondary control mode, the control commands executed by the embodied intelligent robot should be relatively safe. Several examples of pre-set emergency scripts are provided here. These control commands can keep the embodied intelligent robot in a relatively stable state, waiting for the performance of the large model to recover or for the embodied intelligent robot to perform other operations.

[0047] Optionally, the embodied intelligent robot further includes a recovery evaluation module 50, used to: respond to the embodied intelligent robot being in a K-level control state; periodically determine the current large model anomaly detection result, compare the large model anomaly detection result with the recovery conditions; and control the embodied intelligent robot to enter a K-1 level control state in response to the large model anomaly detection result satisfying the recovery conditions N times consecutively; wherein, K is an integer, and 1≤K≤3, and the zero-level control state of the embodied intelligent robot is the control state of the embodied intelligent robot when the large model has full write permissions.

[0048] When the embodied intelligent robot is in a Level 1, Level 2, or Level 3 control state, the recovery evaluation module 50, after determining that the large model meets the requirements, gradually restores the large model's control over the embodied intelligent robot. That is, Level 3 control state is restored to Level 2 control state, Level 2 control state is restored to Level 1 control state, and Level 1 control state is restored to Level 0 control state. For example, the recovery conditions can be flag_logic=0, Δt≤T_crit, score_drift≤θ_drift, and score_total less than a first threshold. By setting the recovery evaluation module 50 and using a gradual recovery method to restore the large model's control over the embodied intelligent robot, the switching of control is more cautious, preventing large-scale transitions in the embodied intelligent robot's control state.

[0049] Optionally, the recovery evaluation module 50 is further configured to: respond to the embodied intelligent robot being in a K-1 level control state; and respond to the large model anomaly detection result not meeting the recovery condition N consecutive times, control the embodied intelligent robot to roll back to a K-level control state. By setting a rollback mechanism, if the large model experiences another anomaly during the process of restoring control of the embodied intelligent robot from the large model, the control state of the embodied intelligent robot rolls back to the previous level. For example, if the large model experiences another anomaly during the process of restoring control from a level two control state to a level one control state, the control state of the embodied intelligent robot rolls back to a level three control state. In special cases, the embodied intelligent robot can also roll back from any control state to a level three control state. By setting a rollback mechanism, the switching of control is made more cautious, preventing the embodied intelligent robot from losing control due to anomalies in the large model.

[0050] Optionally, the embodied intelligent robot safety takeover system further includes an interface and log recording module 60, used to record the consistency detection result, the delay detection result, the drift detection result, the large model anomaly detection result, and the control status.

[0051] The interface and log recording module 60 is responsible for the structured storage of consistency detection results, latency detection results, drift detection results, large model anomaly detection results, and control status, facilitating subsequent review and verification. The interface and log recording module 60 can also record other events related to large model anomalies, including but not limited to the complete evidence chain (evidence_log) of the large model anomaly detection results. The complete evidence chain (evidence_log) can include hit rules, threshold configurations, time-series links, and action execution trajectory summaries. By setting up the interface and log recording module 60, the embodied intelligent robot safety takeover system has the ability to record system workflows and periodically report them, constructing a deterministic safety closed loop for the embodied intelligent robot with the participation of a large model, significantly improving safety, verifiability, and long-term reliability in hazardous environments or near-human collaborative scenarios.

[0052] The technical solution of this embodiment further improves the safety of the embodied intelligent robot controlled by the large model by adding a strategy degradation module 40, a recovery evaluation module 50, and an interface and log recording module 60.

[0053] Based on the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0054] It is worth noting that in the embodiments of the search device described above, the various units and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of each functional unit are only for easy differentiation and are not used to limit the scope of protection of the present invention.

[0055] Note that the above description is merely a preferred embodiment of the present invention and the technical principles employed. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments, and may include many other equivalent embodiments without departing from the concept of the present invention, the scope of which is determined by the scope of the appended claims.

Claims

1. A holographic intelligent robot safety takeover system, characterized in that, include: The anomaly detection module is used to determine the consistency detection result based on the output content of the large model, the state information of the embodied intelligent robot, and the constraints. The latency detection result is determined based on the request and response timestamps of the output content of the large model; The drift detection result is determined based on the output of the large model within the sliding window W; The fusion determination module is used to determine the large model anomaly detection result based on the consistency detection result, the delay detection result, and the drift detection result through fusion rules. The safety takeover module is used to cut off the write permission of the large model by hardware control when the anomaly detection result of the large model is greater than or equal to the level 3 threshold or when there are serious anomalies in the consistency detection result, delay detection result, or drift detection result. The control permission of the embodied intelligent robot is then switched to the cerebellum safety control module, and the embodied intelligent robot enters the level 3 control state. The cerebellum safety control module includes a PID controller, and the actions performed by the cerebellum safety control module include at least one of the following: blocking stop, damping deceleration, evacuation to a safe area, and speed and force limiting; The output of the large model includes at least one of the following: textual action instructions and structured action instructions; The consistency detection includes at least one of mutual exclusion conflict detection, boundary crossing detection, integrity detection, and threshold detection. Mutual exclusion conflict detection refers to detecting whether there is a contradiction in the output content of the large model itself. Boundary crossing detection refers to whether the output content of the large model indicates that the embodied intelligent robot enters a restricted area or exceeds a preset workspace. Integrity detection refers to detecting whether the semantics of the output content of the large model are complete. Threshold detection refers to detecting whether the action of the embodied intelligent robot indicated by the output content of the large model exceeds a threshold. Based on the output of the large model within the sliding window W, the frequency of action categories, parameter distribution, and embedding vector statistics are obtained and compared with the standard distribution to obtain the drift detection results. The fusion rule is score_total = w1·score_logic + w2·score_latency + w3·score_drift, where w1, w2, and w3 are configured according to the current environment or task status of the embodied intelligent robot, score_total is the large model anomaly detection result, score_logic is the consistency detection result, score_latency is the latency detection result, and score_drift is the drift detection result. The serious anomalies in the consistency detection results, latency detection results, and drift detection results include at least one of the following: the inference latency of the large model is greater than the threshold; there is a fatal anomaly in the consistency detection results; at least two of the consistency detection results, latency detection results, and drift detection results have anomaly flags of 1; the specific determination of the fatal anomaly in the consistency detection results is set according to the circumstances.

2. The system according to claim 1, characterized in that, The security takeover module uses hardware control to cut off the write permission of the large model and switches the control permission of the embodied intelligent robot to the cerebellum security control module. The operation delay is less than or equal to 10ms.

3. The system according to claim 2, characterized in that, The secure takeover module includes: The hard real-time triggering unit is used to cut off the write permissions of large models using hardware control methods; The control authority atomic switching unit is used to switch the control authority of the embodied intelligent robot to the cerebellum safety control module (40), and the embodied intelligent robot enters the third-level control state. The hard real-time triggering unit includes: a field-programmable gate array (FPGA) and / or a microcontroller unit (MCU) with an interrupt controller.

4. The system according to claim 3, characterized in that, It also includes a policy degradation module, used for: The anomaly detection results of the large model are compared with the first-level threshold, the second-level threshold, and the third-level threshold; In response to the large model anomaly detection result being greater than or equal to the first-level threshold and less than the second-level threshold, the output content of the large model is mapped to a template action, and the embodied intelligent robot enters the first-level control state. In response to the large model anomaly detection result being greater than or equal to the secondary threshold and less than the tertiary threshold, the software freezes the large model's write permissions, activates the pre-set emergency script library to generate control commands, and controls the embodied intelligent robot, which then enters the secondary control state. In response to the large model anomaly detection result being greater than or equal to the level 3 threshold, the safety takeover module is activated, and the embodied intelligent robot enters the level 3 control state.

5. The system according to claim 4, characterized in that, It also includes a recovery assessment module for: In response to the embodied intelligent robot being in a K-level control state; Periodically determine the current anomaly detection results of the large model, and compare the anomaly detection results of the large model with the recovery conditions; In response to the large model anomaly detection result satisfying the recovery condition N times consecutively, the embodied intelligent robot is controlled to enter the K-1 level control state; Where K is an integer, and The zero-level control state of the embodied intelligent robot is the control state of the embodied intelligent robot under the condition that the large model has full write permissions.

6. The system according to claim 5, characterized in that, The recovery assessment module is also used for: In response to the embodied intelligent robot being in a K-1 level control state; If the large model anomaly detection result does not meet the recovery condition N times consecutively, the embodied intelligent robot is controlled to roll back to the K-level control state.

7. The system according to claim 6, characterized in that, The system also includes an interface and log recording module for: Record the consistency detection results, the delay detection results, the drift detection results, the large model anomaly detection results, and the control state.

8. The system according to claim 1, characterized in that, The constraints include dynamic constraints and / or static constraints; The dynamic constraints are the safety constraints required by the current environment or task state of the embodied intelligent robot; the static constraints are general safety constraints.

9. The system according to claim 1, characterized in that, The length and step size of the sliding window W are set according to the scene in which the embodied intelligent robot is located; The scenarios include at least one of the following: fire rescue, high-voltage power line inspection, earthquake rescue, extreme weather rescue, and high-altitude operations.

10. The system according to claim 4, characterized in that, The pre-built emergency script library includes at least one of the following: evacuation script, obstacle avoidance and relocation script, safe attitude lock script, speed and force limit script, and return to safe point script.

Images