Multi-robot terminal-oriented multi-source instruction arbitration and safety degradation system

Abstract

The application discloses a multi-source instruction arbitration and safety degradation system for multi-robot terminals, and belongs to the technical field of embodied intelligence and industrial robot control. In order to solve the industry pain points that the priority parameter of the existing multi-source instruction arbitration scheme can be tampered with, the emergency instruction has no hardware isolation, the disconnection means losing control, and the interface is fragmented, the application adopts ROM / OTP to solidify five layers of priority and monitor tampering in real time; an independent hardware isolation path is configured for P0 atomic safety instruction, software non-preemption and hardware bypass dual protection are realized; based on heartbeat monitoring, differentiated disconnection degradation of all kinds of terminals such as unmanned aerial vehicles, ground robots, mechanical arms and underwater equipment is realized; and mainstream robot communication protocols are adapted through standardized control primitives and multi-protocol interfaces. The application can effectively eliminate multi-source instruction conflicts, improve the safety of unmanned system operation, and has strong universality and engineering landing value.

Description

Technical Field

[0001] This invention belongs to the fields of intelligent robots, embodied intelligence, autonomous unmanned systems, and industrial automatic control technology, specifically relating to a multi-source command arbitration system, arbitration method, and security degradation architecture. This invention is applicable to all categories of unmanned terminals, including wheeled, tracked, and quadrupedal bionic robots, drones, unmanned surface vessels, underwater vehicles, industrial collaborative robotic arms, service robots, and agricultural robots. Background Technology

[0002] With the rapid development of embodied intelligence and robotics, single robots often face the problem of concurrent conflicts between heterogeneous instructions from multiple sources in practical applications. Existing technologies suffer from the following core challenges: The command sources are mixed, leading to frequent conflicts. Multiple channels, such as operator near-field devices, robot sensors, remote control stations, cloud scheduling systems, and autonomous task planning modules, may simultaneously issue control commands to the robot, resulting in command conflicts. For example, if the operator issues a left turn command while the autonomous obstacle avoidance module issues a right turn command, it can easily cause the robot to shake or even go out of control.

[0003] Arbitration logic is crude and poses high security risks. Existing systems typically employ crude arbitration logic such as "last instruction takes precedence" or "manual takes precedence over automatic," lacking fine-grained priority division. Emergency safety instructions may be overridden by subsequent low-priority instructions, leading to security incidents.

[0004] Disconnection leads to loss of control and severe asset loss. When robots lose contact with operators, the lack of intelligent degradation strategies based on task status often results in crashes, getting lost, or asset loss.

[0005] Interface fragmentation leads to low R&D efficiency. Different types and manufacturers of robots use proprietary communication protocols, and the arbitration logic for multi-source commands cannot be reused, resulting in redundant development.

[0006] There is a lack of a universal, standardized underlying arbitration platform. Although robot operating systems (such as ROS / ROS2) provide basic instruction multiplexing mechanisms (such as cmd_mux), existing solutions generally suffer from fundamental limitations: (1) Software-based and tamperable: Priority is usually set through configuration files, which can be modified by upper-layer applications during runtime, making it impossible to achieve system-level anti-tampering. (2) No hardware-level security isolation: Emergency stop commands are still scheduled through the main control chip and do not use a physical hardware path independent of the main control chip; (3) Undifferentiated disconnection and degradation: No differentiated fallback strategy was designed for different forms such as drones, ground robots, and robotic arms; (4) No unified standardized interface: Private logic cannot be reused across platforms.

[0007] Therefore, there is an urgent need for a general-purpose multi-source instruction arbitration and security degradation system that features priority ROM / OTP hardening, hardware physical isolation of P0 instructions, differentiated disconnection and degradation capabilities, and support for multi-protocol adaptation. Summary of the Invention

[0008] I. Purpose of the Invention This invention aims to overcome the shortcomings of existing multi-source arbitration schemes, such as "software tamperability, lack of hardware isolation, lack of differentiated degradation, and fragmented interfaces," and provides a universal security control foundation. By defining five non-configurable hard priorities and introducing atomic instruction-based mandatory protection and differentiated disconnection degradation, it solves the conflict resolution and security fallback problems of multiple robot terminals under multi-source control. Technical solution

[0009] (i) A multi-source command arbitration system for multiple robot terminals This system includes a multi-source instruction interface layer, a conflict detection and arbitration engine, an atomic safety instruction protection module, a disconnection and degradation module, and a general execution interface layer.

[0010] Multi-source instruction interface layer It is used to receive instruction streams from different sources and standardize various heterogeneous instructions into unified control primitives, including velocity vectors, angular velocities, position coordinates, mode switching instructions, and emergency stop instructions.

[0011] Conflict Detection and Arbitration Engine (Core) Detect whether there are conflicting instructions targeting the same control dimension within the same time window, and execute a preset, non-configurable priority strategy.

[0012] The time window for collision detection ranges from 10ms to 100ms, with 50ms being the preferred value. Overall instruction conflict resolution latency ≤ 50ms.

[0013] Five hard priority levels (P0-P4): P0: Atomic safety commands (emergency stop, obstacle avoidance, low battery protection, collision response), atomic level, cannot be preempted, and cannot be overwritten; P1: Operator near-field interaction command; P2: Remote dispatch command; P3: Autonomous Mission Command; P4: Default state instruction.

[0014] Priority cannot be configured and locked: The priority hierarchy (P0>P1>P2>P3>P4) is configured by the system read-only memory (ROM) or one-time programmable memory (OTP) and cannot be modified by the user or application. Any attempt to modify the priority hierarchy will be rejected by the system and logged. The tampering log is stored in both local non-volatile memory and cloud server, and the local log is stored in a write-protected storage area, which prohibits deletion, overwriting, and formatting.

[0015] Atomic safety instruction protection module Unpreemptible: Once the P0 instruction is triggered, no subsequent instruction (including other instructions of the same priority) can overwrite or interrupt it.

[0016] Physical isolation of execution paths: The emergency stop button is directly connected to the enable pin of the motor driver without going through the main control chip; the hardware path of safety instructions and the regular instruction path adopt independent routing and independent interface design, and do not share the same bus, GPIO port or interrupt controller.

[0017] Response latency quantization: The response latency from triggering to completion of execution of a P0 atomic safety instruction is ≤ 100ms.

[0018] Disconnection and Degradation Module Heartbeat monitoring: The robot maintains a heartbeat connection with the operator's equipment. The heartbeat sending interval is ≤ 5 seconds. If no heartbeat packet is received for 30 consecutive seconds, it is determined that the communication connection is lost.

[0019] Differentiated degradation strategy: The configuration parameters of the degradation strategy are fixed parameters at the system factory and cannot be dynamically adjusted by the user.

[0020] Drones / Aircraft: Hover in place → Automatic return to home; Ground mobile robot: Decelerate to ≤ 1m / s → Stop → Reset to origin; Industrial robotic arm: Maintain current pose and lock → Return to zero according to preset trajectory; Underwater robot / unmanned surface vessel: Hovering / drifting in place → Automatically returning to the base station.

[0021] Timeout recovery: If the disconnection lasts for more than 5 minutes, the system will automatically execute a safe recovery strategy (return to home or alarm).

[0022] General execution interface The unified control primitives after arbitration are transformed into standard control instructions corresponding to the target robot. Supported instruction protocols include: ROS / ROS2, MAVLink, EtherCAT, PROFINET, and CANopen.

[0023] (II) A multi-source command arbitration method for multi-robot terminals When applied to the above system, the following steps are included: S1: Receive and standardize instruction streams from different sources; S2: Detect instruction conflicts under the same control dimension according to a preset time window of 10ms to 100ms; S3: Based on the five-level priority rule P0>P1>P2>P3>P4 fixed in the ROM / OTP hardware, complete instruction arbitration and output a unique execution instruction; S4: If the arbitration result is a P0 atomic safety instruction, enable the independent hardware path to execute the instruction; S5: The general execution interface layer completes the protocol conversion and sends the instructions to the robot terminal; S6: The disconnection degradation module monitors the communication status based on heartbeat packets. When the connection is lost, it executes the corresponding device's differentiated degradation and timeout recovery strategy. After the communication is restored, it returns to the normal control mode. Beneficial effects

[0024] High versatility: It does not depend on the specific robot form and can be used as a universal safety control base for various unmanned systems such as wheeled, tracked, quadruped, drones, and robotic arms.

[0025] High security: The P0 atomic instruction preemption mechanism ensures that safety instructions such as emergency stop and obstacle avoidance are not interfered with by any high-level logic; priority ROM / OTP hardening prevents user misoperation or malicious tampering.

[0026] Robustness Enhancement: The disconnection and degradation strategy effectively prevents "loss of control upon disconnection," protecting high-value unmanned equipment assets.

[0027] Strong anti-tampering capability: Dual log storage in write-protected areas ensures the inviolability of system security policies.

[0028] Improved development efficiency: Robot manufacturers no longer need to repeatedly develop complex multi-source control conflict arbitration logic; they only need to interface with the standard interface of this system. Attached Figure Description

[0029] Figure 1 This is a schematic diagram of the overall system architecture of the present invention, showing the hierarchical relationship between the multi-source instruction interface layer, the conflict detection and arbitration engine, the atomic safety instruction protection module, the disconnection and degradation module, and the general execution interface layer.

[0030] Figure 2 This is a schematic diagram of the hardware physical isolation path for the P0 atomic security instruction of the present invention, showing the independent path structure of the emergency stop signal directly connected to the enable pin of the motor driver. Detailed Implementation

[0031] Example 1: Application Scenarios of Unmanned Aerial Vehicles The operator issues a left turn command (P1) via the control handle, while the onboard obstacle avoidance radar detects an obstacle and issues an obstacle avoidance command (P0). The arbitration engine identifies the conflict within 30ms and enforces the P0 command. Since the P0 command directly controls the motor power unit through an independent hardware path, the drone immediately avoids the obstacle. After the obstacle avoidance is completed, the P0 command is revoked, and the drone continues to execute the P1 manual command. If the image transmission signal is lost for more than 30 seconds, the drone automatically hovers and then initiates automatic return-to-home; if the disconnection lasts for more than 5 minutes, the drone executes the return-to-home strategy and flies back to the takeoff point. After communication is restored, a disconnection log is pushed to the operator.

[0032] Example 2: Industrial robotic arm application scenarios The robotic arm is in automatic operation mode. The local autonomous module issues a grasping operation command (P3); the remote scheduling platform issues a pause command (P2). The arbitration engine interrupts the P3 command and executes the P2 pause command. On-site personnel press the physical emergency stop button, triggering the P0 atomic safety command. This command bypasses the main control chip and directly cuts off the power enable, immediately locking the robotic arm's brake. At this point, both the P2 and P3 commands become invalid. After the emergency stop is released, the robotic arm resumes normal scheduling logic.

[0033] Example 3: Application Scenarios of Ground Service Robots The robot navigates indoors according to autonomous navigation instructions (P3), and remote location scheduling instructions (P2) are sent from the cloud. The system switches to execute P2 instructions. If a person enters and collision protection is triggered (P0), the robot immediately stops moving. If the remote communication is lost for 30 seconds, the robot decelerates to below 1m / s and gradually comes to a stop. If the disconnection timeout is 5 minutes, the robot automatically returns to the charging point.

[0034] Example 4: Application Scenarios of Underwater Robots / Unmanned Surface Vessels The underwater robot performs underwater inspection operations according to the remote dispatch command (P2). During operation, the body sensors detect obstacles ahead, triggering the P0 atomic safety obstacle avoidance command. The arbitration engine responds quickly and enforces the P0 command, allowing the robot to change its course in time to avoid the obstacle. If the underwater communication signal is interrupted by water interference and no heartbeat packet is received for 30 consecutive seconds, the system determines that the communication is lost, and the robot hovers in place. If the disconnection lasts for more than 5 minutes, the device automatically initiates a return-to-home strategy and heads towards the preset base station. After communication is restored, the system resumes normal control and reports the operational data during the disconnection period.

[0035] Example 5: Application Scenarios of Tracked Agricultural Operation Robots The tracked robot performs field operations based on local autonomous task instructions (P3). The cloud-based scheduling system issues route adjustment instructions (P2), and the system switches to execute the P2 instructions. If the robot encounters a sudden terrain obstacle during operation, the collision detection module triggers the P0 safety instruction, and the robot immediately stops moving. If the wireless communication in the field is lost for 30 seconds, the robot slows down and gradually comes to a stop; if the disconnection timeout exceeds 5 minutes, the device locks its current state and issues an audible and visual alarm, awaiting personnel intervention.

Claims

1. A multi-source command arbitration system for multiple robot terminals, characterized in that, include: The multi-source instruction interface layer is used to receive multiple heterogeneous instruction streams and convert them into standard control primitives. The conflict detection and arbitration engine is used to detect instruction conflicts within a preset time window and output a unique execution instruction based on a priority strategy. The atomic safety instruction protection module is used to enforce protection on the highest priority safety instructions; The disconnection degradation module is used to monitor the communication status and execute differentiated degradation strategies when the connection is lost; The general execution interface layer is used to send the arbitrated instructions to the robot terminal; The priority strategy consists of five fixed priority levels, which are fully embedded in the system read-only memory (ROM) or one-time programmable memory (OTP). It is a low-level hard-coded configuration that prohibits users, upper-level applications, and the operating system from modifying it during runtime. The system monitors the priority configuration area in real time, and when it detects tampering, it rejects the operation and performs log recording.

2. The system according to claim 1, characterized in that, The five priority levels, from highest to lowest, are as follows: P0: Atomic safety commands, including emergency stop, active obstacle avoidance, low battery protection, collision emergency response, and power cut-off; P1: Operator near-field interaction command; P2: Remote dispatching and cloud-based management commands; P3: Robot local autonomous task instructions; P4: Device default status command; The P0 atomic safety instruction has the characteristic of being atomically non-preemptible; once executed, it cannot be overwritten or interrupted by any subsequent priority instructions.

3. The system according to claim 1, characterized in that, The performance metrics of the conflict detection and arbitration engine meet the following requirements: The time window for collision detection ranges from 10ms to 100ms, with 50ms being the preferred value. Overall instruction conflict resolution latency ≤ 50ms; A high-priority instruction can directly interrupt a low-priority instruction, and the interrupted low-priority instruction is stored in the instruction wait queue.

4. The system according to claim 1, characterized in that, The atomic security instruction protection module includes a hardware physical isolation path: The signal routing of the physical emergency stop button is independent of the main control chip and is directly connected to the enable pin of the motor driver or power unit; The response delay from triggering to completion of a P0 atomic safety instruction is ≤100ms; The hardware path for safety instructions uses independent routing and interface design from the regular instruction path, and does not share the same bus, GPIO port or interrupt controller.

5. The system according to claim 1, characterized in that, The disconnection and degradation module uses a heartbeat mechanism to monitor communication status. The heartbeat packet sending interval is ≤5 seconds. If no heartbeat packet is received for 30 consecutive seconds, it is determined that the communication connection is lost. After communication is lost, a differentiated degradation strategy is executed based on the device configuration. The configuration parameters of the degradation strategy are factory-fixed parameters and cannot be dynamically adjusted by the user.

6. The system according to claim 5, characterized in that, The differentiated downgrade strategy includes: The drone / aircraft performs a hovering maneuver followed by an automatic return to home. The ground mobile robot decelerates to ≤1m / s, stops moving, and resets to its origin. The industrial robotic arm performs pose lock-up and trajectory return to zero. The underwater robot / unmanned surface vessel performs a hovering maneuver and returns to the base station.

7. The system according to claim 1, characterized in that, The tampering logs are stored in both local non-volatile memory and cloud server, with the local logs stored in a write-protected storage area, which prohibits deletion, overwriting, and formatting.

8. The system according to claim 1, characterized in that, The communication protocols supported by the general execution interface layer include at least one of ROS, ROS2, MAVLink, EtherCAT, PROFINET, and CANopen.

9. The system according to claim 1, characterized in that, The robot terminal includes at least one of the following: wheeled robot, tracked robot, quadrupedal bionic robot, drone, unmanned surface vessel, underwater vehicle, industrial collaborative robotic arm, service robot, and agricultural robot.

10. A multi-source instruction arbitration method for multiple robot terminals, applied to the system described in any one of claims 1-9, characterized in that, Includes the following steps: S1: The multi-source instruction interface layer receives multiple heterogeneous instruction streams and converts them into standard control primitives. S2: Detect instruction conflicts under the same control dimension according to a preset time window of 10ms to 100ms; S3: Based on the five-level priority rule P0>P1>P2>P3>P4 fixed in the ROM / OTP hardware, complete instruction arbitration and output a unique execution instruction; S4: If the arbitration result is a P0 atomic safety instruction, enable the independent hardware path to execute the instruction; S5: The general execution interface layer completes the protocol conversion and sends the instructions to the robot terminal; S6: The disconnection degradation module monitors the communication status based on heartbeat packets. When the connection is lost, it executes the corresponding device's differentiated degradation and timeout recovery strategy. After the communication is restored, it returns to the normal control mode.

Images