Safety protection device, safety protection system, and safety protection method

Abstract

To update a safety rule to protect an autonomously controlled moving body which changes due to software update or the like or an autonomously controlled moving body which declares illegal performance information.SOLUTION: The safety protection device 100 comprises a first obtaining element 111 for obtaining performance information of a mobile 150a autonomously controlled by a 200a to be controlled, a second obtaining element 112 for obtaining performance information of the mobile 200b, a rule making element 113 for making a safety rule for reducing a risk by using the performance information of the mobile 200b and the performance information of the mobile 200a, a monitoring element 114 for monitoring whether the output data of the 150a to be controlled and / or the operation of the 200a to be controlled violates the safety rule, and a control element 115 for controlling the 150a to be controlled to be in a state of reducing the risk when the monitoring element 114 detects that the safety rule is violated.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a security device, a security system, and a security method. [Background technology]

[0002] To solve problems such as labor shortages, autonomously controlled mobile vehicles are becoming more widespread. Furthermore, as software becomes more prevalent, frequent software updates for autonomously controlled mobile vehicles are becoming possible and necessary. In this context, it is important to ensure the safety of autonomously controlled mobile vehicles whose behavior changes due to software updates.

[0003] For example, Patent Document 1 discloses a technology for ensuring the safety of a moving body. This publication describes an objective of the system, "to provide a processing system for ensuring driving accuracy in autonomous driving," and as a solution, it states that "in a processing device (1a) including a processor for performing processing related to the driving of a host vehicle (2) capable of communicating with a remote center (8), the processor is configured to monitor, in an autonomous driving host moving body, a safety envelope violation, which is a violation of a safety envelope set in accordance with a driving policy for the safety of intended functions, and, when it is determined that a safety envelope violation has occurred, to generate scene information representing a scene of the safety envelope violation so as to transmit it to the remote center, and to obtain, from the remote center, feedback information that is fed back based on the scene information." [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Publication No. 2024-20559 Summary of the Invention [Problem to be solved by the invention]

[0005] The performance characteristics of autonomously controlled mobile objects change with software updates. Patent Document 1 does not consider how an autonomously controlled mobile object will adapt to a new environment when safety protection is provided by a set safety rule or system. Also, while it is conceivable to design an autonomously controlled mobile object with a safety margin in advance, excessive safety measures may result in inefficiency, such as the object stopping immediately when a person approaches.

[0006] Another possible method is to ensure safety by obtaining performance information of an autonomously controlled mobile object with updated software through self-reporting or other means, and setting safety rules based on that information. Examples of safety rules include distance from an object, upper speed limits, and predetermined behavior. However, software that includes artificial intelligence, etc., may be designed with a data-centric approach. Furthermore, the software may be complex. Therefore, it may be difficult for software that includes artificial intelligence, etc., to provide accurate performance information, and it may sometimes output erroneous values. Even if the method of Patent Document 1 is used, this problem may not be resolved.

[0007] Therefore, an object of the present invention is to update safety rules to protect autonomously controlled mobile objects that change due to software updates or that declare fraudulent performance information. [Means for solving the problem]

[0008] In order to solve the above-mentioned problems, the safety protection device of the present invention is characterized by comprising: a first acquisition unit that acquires performance information of a first moving body that is autonomously controlled by a control unit to be monitored; a second acquisition unit that acquires performance information of a second moving body; a rule creation unit that uses the performance information of the second moving body and the performance information of the first moving body to create safety rules that maintain a distance between the first moving body and the second moving body so as to reduce risks that may occur between the first moving body and the second moving body; a monitoring unit that monitors whether the output information of the control unit and / or the operation of the first moving body violates the safety rules based on the safety rules created by the rule creation unit; and a control unit that controls the control unit to transition to a safe state when the monitoring unit detects that the output information of the control unit and / or the operation of the first moving body violates the safety rules.

[0009] The safety protection system of the present invention is characterized by comprising: a first acquisition unit that acquires performance information of a first moving body that is autonomously controlled by a control unit to be monitored; a second acquisition unit that acquires performance information of a second moving body; a rule creation unit that uses the performance information of the second moving body and the performance information of the first moving body to create safety rules for maintaining a distance between the first moving body and the second moving body so as to reduce risks that may occur between the first moving body and the second moving body; a monitoring unit that monitors whether the output information of the control unit and / or the operation of the first moving body violates the safety rules based on the safety rules created by the rule creation unit; and a control unit that controls the control unit to transition to a safe state when the monitoring unit detects that the output information of the control unit and / or the operation of the first moving body violates the safety rules.

[0010] The safety protection method of the present invention comprises the steps of: a first acquisition unit acquiring performance information of a first moving body that is autonomously controlled by a control unit to be monitored; a second acquisition unit acquiring performance information of a second moving body; a rule creation unit creating a safety rule for maintaining a distance between the first moving body and the second moving body using the performance information of the second moving body and the performance information of the first moving body so as to reduce a risk that may occur between the first moving body and the second moving body; a monitoring unit monitoring whether output information of the control unit and / or operation of the first moving body violates the safety rule based on the safety rule created by the rule creation unit; and a control unit controlling the control unit to transition to a safe state when the monitoring unit detects that the output information of the control unit and / or operation of the first moving body violates the safety rule. Other means will be described in the detailed description of the invention. [Effects of the Invention]

[0011] According to the present invention, safety rules are constructed and controlled based on performance information declared by or acquired from an autonomously controlled mobile body, and in particular, it is possible to detect the occurrence of abnormal situations such as deviations from the declared performance information or non-compliance with the safety rules, and transition the autonomously controlled mobile body to a safe state. [Brief explanation of the drawings]

[0012] [Figure 1] 1 is a configuration diagram of a safety protection device according to an embodiment of the present invention; [Figure 2] 3A to 3C are explanatory diagrams illustrating the operation of a moving body according to the first embodiment. [Figure 3] FIG. 2 is a configuration diagram of a first moving body and a second moving body. [Figure 4] FIG. 2 is a block diagram of a control unit and a safety protection device. [Figure 5] 10 is a flowchart executed by the safety protection device. [Figure 6]10A and 10B are explanatory diagrams of the operation of a moving body with a safety protection device and a moving body without a safety protection device according to a second embodiment. [Figure 7] FIG. 2 is a block diagram of a control unit and a safety protection device. [Figure 8] 10A and 10B are explanatory diagrams illustrating the operation of the integrated safety protection device and a plurality of moving objects according to the third embodiment. [Figure 9] 10A and 10B are diagrams illustrating an example of the operation of the robot and the control unit according to the fourth embodiment. [Figure 10] 1 is an explanatory diagram of the operation of the robot, the control unit, and the safety protection device. FIG. [Figure 11] FIG. 1 is a diagram illustrating a configuration of a robot, a control unit, and a safety protection device. [Figure 12] FIG. 1 is a diagram showing an exclusive control area of ​​a robot. DETAILED DESCRIPTION OF THE INVENTION

[0013] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. This embodiment mainly describes an example of monitoring and controlling a vehicle control unit or a robot system, and is optimal for these implementations. However, this does not prevent the present invention from being applied to control units including systems other than the above.

[0014] Fig. 1 is a configuration diagram of a safety protection device 100 according to this embodiment. Fig. 1 is a configuration diagram as a higher-level concept of each embodiment. 1 includes a first acquisition unit 111, a second acquisition unit 112, a rule creation unit 113, a monitoring unit 114, a control unit 115, and a recording unit 116. This safety protection device 100 reduces risks that occur between a moving object 200a that is autonomously controlled by a control unit 150a and a moving object 200b that is autonomously controlled by a control unit 150b.

[0015] The first acquisition unit 111 acquires performance information related to the moving object 200a from the control unit 150a that is to be controlled and monitored. The second acquisition unit 112 acquires performance information about the moving body 200b from the control unit 150b of another moving body 200b that affects the moving body 200a. The second acquisition unit 112 may also estimate the performance information of the other moving body 200b, but is not limited to this. The second acquisition unit 112 acquires the position of the moving body 200b.

[0016] The rule creating unit 113 creates a safety rule to reduce the risk of collision between the moving bodies 200a and 200b using the acquired performance information of the moving bodies 200a and 200b. Here, the safety rule is a safety rule regarding the distance d between the moving bodies 200a and 200b, and specifically, the distance d is set to the minimum distance d min The safety rules include a safety rule that maintains a distance between the moving body 200a and an obstacle. The safety rules also include a safety rule that maintains a speed below a predetermined value when the moving body 200a is moving alone or when another moving body is located ahead of the moving body 200a. When there is no need to particularly distinguish between the moving bodies, they may be simply referred to as the moving body 200.

[0017] The monitoring unit 114 monitors the output information of the control unit 150a and / or the operation of the moving object 200a based on the safety rules created by the rule creating unit 113. When the monitoring unit 114 detects that the output information of the control unit 150a and / or the operation of the moving object 200a violates a safety rule, the control unit 115 controls the control unit 150a to a risk reduction state. The recording unit 116 records the results of monitoring by the monitoring unit 114.

[0018] Furthermore, the control unit 150a is the primary control target, and the control unit 150b is the secondary control target.

[0019] First Embodiment The safety protection device of the first embodiment protects the safety of an automobile having an automatic driving function. An automobile having an automatic driving function is an autonomously controlled moving body. The safety protection device will be described in detail below with reference to the drawings.

[0020] FIG. 2 is a diagram illustrating the operation of the moving bodies 200a and 200b according to the first embodiment. Here, a moving body 200a equipped with a control unit 150a and autonomously controlled, and a moving body 200b equipped with a control unit 150b and autonomously controlled, are traveling in the same direction on a road, with moving body 200b representing the first moving body, which is a preceding vehicle. Moving body 200a represents an example of a second moving body, which is a following vehicle. The parameters are as follows:

[0021] a a_min_brake : Minimum deceleration of the first moving body a a_max_accel : Maximum acceleration of the first moving object v a :Speed ​​of the first moving object a b_min_brake : Maximum deceleration of the second moving body v b : Speed ​​of the second moving object d: Distance between the first and second moving bodies

[0022] FIG. 3 is a configuration diagram of a moving body 200a which is a first moving body and a moving body 200b which is a second moving body. The safety protection device 100a protects the safety of the primary moving object 200a. The safety protection device 100b protects the safety of the moving object 200b. The arrows indicate the exchange of information between them. The primary moving object 200a transmits performance information Asp shown in equation (1) to the safety protection device 100a.

number

[0023] The second moving body 200b transmits the performance information Bsp shown in equation (2) to the safety protection device 100b.

number

[0024] Then, the security protection device 100a transmits the performance information Asp to the security protection device 100b, and the security protection device 100b transmits the performance information Bsp to the security protection device 100a.

[0025] FIG. 4 is a configuration diagram of the safety protection devices 100a and 100b according to the first embodiment. Each of the safety protection devices 100a and 100b includes a first acquisition unit 111, a second acquisition unit 112, a rule creation unit 113, a monitoring unit 114, a control unit 115, and a recording unit 116. The safety protection device 100a reduces risks that occur between a moving object 200a autonomously controlled by a control unit 150a and a moving object 200b autonomously controlled by a control unit 150b. The safety protection device 100b reduces risks that occur between a moving object 200b autonomously controlled by a control unit 150b and a moving object 200a autonomously controlled by a control unit 150a.

[0026] The operation of each part of the safety protection device 100a will be described below: The first acquisition unit 111 of the safety protection device 100a acquires performance information about the moving object 200a from the control unit 150a that is to be controlled and monitored. The second acquisition unit 112 of the safety protection device 100a acquires performance information about the moving body 200b from the control unit 150b of another moving body 200b that affects the moving body 200a. The second acquisition unit 112 of the safety protection device 100a may also estimate the performance information of the other moving body 200b, but is not limited to this.

[0027] The rule creation unit 113 of the safety protection device 100a uses the acquired performance information of the moving body 200a and the performance information of the moving body 200b to create safety rules to reduce risks that may occur between the moving body 200a and the moving body 200b.

[0028] The monitoring unit 114 monitors the output information of the control unit 150a and / or the operation of the moving object 200a based on the safety rules created by the rule creating unit 113. When the monitoring unit 114 detects that the output information of the control unit 150a and / or the operation of the moving object 200a violates a safety rule, the control unit 115 controls the control unit 150a to a risk reduction state. The recording unit 116 records the results of monitoring by the monitoring unit 114.

[0029] Furthermore, for the safety protection device 100a, the control unit 150a is the primary control target, and the control unit 150b is the secondary control target.

[0030] The operation of each part of the safety protection device 100b will be described below. The first acquisition unit 111 of the safety protection device 100b acquires performance information about the moving object 200b from the control unit 150b that is to be controlled and monitored. The second acquisition unit 112 of the safety protection device 100b acquires performance information about the moving body 200a from the control unit 150a of another moving body 200a that affects the moving body 200b. The second acquisition unit 112 of the safety protection device 100b may also estimate the performance information of the other moving body 200a, but is not limited to this.

[0031] The rule creating unit 113 of the safety protection device 100b uses the acquired performance information of the moving body 200b and the performance information of the moving body 200a to create a safety rule to reduce risks that may occur between the moving body 200b and the moving body 200a.

[0032] The monitoring unit 114 monitors the output information of the control unit 150b and / or the operation of the moving body 200b based on the safety rules created by the rule creating unit 113. When the monitoring unit 114 detects that the output information of the control unit 150b and / or the operation of the moving object 200b violates a safety rule, the control unit 115 controls the control unit 150b to a risk reduction state. The recording unit 116 records the results of monitoring by the monitoring unit 114.

[0033] Furthermore, for the safety protection device 100b, the control unit 150b is the primary control target, and the control unit 150a is the secondary control target.

[0034] FIG. 5 is a flowchart of the operations performed by the safety protection device 100a. The safety protection device 100a executes the process shown in this flowchart when the performance information of the moving body 200a or the performance information of the moving body 200b, the environment around the moving body 200a, etc., changes. The environment around the moving body 200a changes when, for example, a control unit related to the control of the moving body is present or absent.

[0035] First, the first acquisition unit 111 of the safety protection device 100a acquires performance information of the first moving object from the control unit 150a (step S401). In this example, the first acquisition unit 111 acquires the performance information Asp of the first moving object using inter-system communication or the like.

[0036] Next, the second acquisition unit 112 acquires performance information Bsp of the second moving object from another control unit 150b using inter-system communication (step S402). The rule creation unit 113 creates safety rules from the acquired performance information Asp and Bsp (step S403). The method for creating safety rules will be described later.

[0037] Thereafter, the monitoring unit 114 monitors the control units 150a and 150b in accordance with the created safety rules (step S404), and then the monitoring unit 114 determines whether or not a violation of the safety rules has been detected (step S405).

[0038] As a result of the monitoring, if the control unit 150a detects a behavior that violates a safety rule (Yes), the control unit 115 executes control to transition the entire system, including the control unit that violated the safety rule, to a safe state (step S406). If the control unit 150a does not detect a behavior that violates a safety rule (No), the process proceeds to step S407.

[0039] Thereafter, the monitoring unit 114 determines whether or not there has been a change in the information regarding the safety rules (step S407). If there has been no change in the information regarding the safety rules (No), the process returns to step S404, and the monitoring unit 114 continues to monitor whether or not the control units 150a and 150b are violating the safety rules. If there has been a change in the information regarding the safety rules (Yes), the monitoring of the safety rules shown in Fig. 5 ends. In this case, for example, this operation flow is executed from the beginning, information is acquired again, and a safety rule is created, and monitoring and control are performed.

[0040] In particular, consider the case where another system enters the nearby area, or a new system is newly installed nearby, etc. In this case, by implementing the flowchart of the safety protection device 100, it is possible to realize new safety protection in cooperation with the newly added system.

[0041] How to create safety rules Here is an example of how to create a safety rule. First, define the safety distance as follows:

number

[0042] If the behavior of the first and second moving bodies correctly satisfies equation (3) and safety rules are observed, collisions can be prevented.

[0043] Here, the safety rule based on the above safety distance formula is as follows: Safety Rule #1: The distance d between the first and second mobiles is the minimum distance d min If the vehicle speed becomes less than the predetermined speed, the vehicle in front, which is the first moving body, will accelerate, and the vehicle behind, which is the second moving body, will decelerate.

[0044] In particular, even if the behavior is as shown in equation (3), if there are false and / or erroneous declarations of performance parameters, the safe state cannot be maintained, so this must be taken into consideration.

[0045] Safety rule #1 further requires that the distance d between the first moving body and the second moving body must be less than the minimum distance d min If the relative speed between the first moving body and the second moving body is less than a predetermined value, the relative speed between the first moving body and the second moving body is controlled to be equal to or less than a predetermined value.

[0046] Safety rule #1 further requires that the distance d between the first moving body and the second moving body must be less than the minimum distance d min If the distance d between the first and second moving bodies is less than the minimum distance d, and the second moving body is ahead of the first moving body, the speed or kinetic energy of the first moving body is controlled to be equal to or less than a predetermined value. min When the second moving body is behind the first moving body, the speed or kinetic energy of the first moving body is controlled to be equal to or greater than a predetermined value.

[0047] 《Safety monitoring》 Regarding the safety monitoring process, the monitoring unit 114 monitors by acquiring information from the main control unit 150a. Here, as an example of a violation of the safety rule #1, for example, the distance d between the moving bodies 200a and 200b is d min For example, if the moving object 200a does not behave correctly despite the fact that the difference is smaller than the threshold, and acceleration of the moving object 200a is detected, the monitoring unit 114 regards this as a violation of the safety rules. Then, the control unit 115 executes safe state transition control.

[0048] Another example is when a violation occurs in the declaration of the performance information Asp for creating the safety rules. For example, when the first moving object has a maximum acceleration a a_max_accel In addition, when the first moving body has a minimum deceleration force a a_min_brakeEven if safety rule #1 is not violated, if the parameters used to define safety rule #1 violate the state declared by the system, it is considered a safety rule violation. This makes it possible to detect abnormal states that are likely to cause a safety rule violation in the future, even before the safety rule is violated, and to transition to a safe state.

[0049] <Safety state transition control> A safe state refers to a state in which the risk value of the controlled moving object is equal to or less than a tolerable value. For example, a safe state refers to a state in which the relative speed between the controlled moving object and another moving object is equal to or less than a predetermined value. A safe state also refers to a state in which the speed or kinetic energy of the controlled moving object is equal to or less than a predetermined value when another moving object is ahead. A safe state refers to a state in which the distance between the controlled moving object and a dangerous object that is a risk source is equal to or greater than a predetermined value, or the controlled moving object is isolated. For example, when the other moving object is a leading vehicle, the control unit 115 can decelerate the moving object as a control to reduce the risk value, thereby enabling the moving object to transition to a safe state. Furthermore, when the other moving object is a following vehicle, the control unit 115 can accelerate the moving object as a control to reduce the risk value, thereby enabling the moving object to transition to a safe state.

[0050] Regarding the control of transition to the safe state, the control unit 115 transitions the moving body 200a to the safe state. In this example, if the moving body 200a, which is a vehicle, violates the safe state, the moving body 200a is brought to a safe stop on the shoulder of the road by, for example, gradually decelerating so as to comply with safety rule #1. Then, it is advisable to wait until the software update is completed.

[0051] In particular, it is preferable to set the above-mentioned safety rule ρ by safety monitoring, including the time from when an abnormality in the control unit 150a is detected to when a countermeasure is taken (for example, a Fault Tolerant Time Interval (FTTI), hereinafter referred to as the fault counter time interval) to when the control unit 115 subsequently transitions to a safe state transition control state. By monitoring in this manner, even if the control unit 150a performs erroneous control, it is possible to ensure the time required to detect this and transition to a safe state, and as a result, it is possible to maintain a safe state.

[0052] <<Identifying and dealing with abnormal systems through safety monitoring>> Regarding the monitoring and control of safety rules, if only violations of safety rules are observed, the distance d is the minimum distance d min If each control unit is put into a safe state (gentle shutdown) in a situation where the safety level is below the normal limit, there is a concern that the normal system will also stop operating, resulting in a decrease in efficiency. With this configuration, by putting only the control unit 150 that has violated a rule or has caused an abnormality such as an invalid parameter into a safe state, the other control units 150 can continue to operate, making it possible to increase overall efficiency.

[0053] <<Recording of safety monitoring results>> The results of safety monitoring by the monitoring unit 114 are recorded in the recording unit 116. This makes it possible to check which devices have violated safety rules or have not violated safety rules, and makes it possible to prove that the control unit has not violated any safety rules, and to check for details on future improvements, for example.

[0054] For example, when improving software during safe state transition control, the control unit 115 can check the record of which control unit violated the safety rules, identify the control unit with the abnormality, and update the software, thereby making it easier to efficiently improve the control units.

[0055] Second Embodiment Next, an example of an architecture pattern of the safety protection device of the second embodiment will be shown.

[0056] FIG. 6 is a diagram illustrating the operation of a moving body with a safety protection device according to the second embodiment and a moving body without a safety protection device. This is the case when an externally added control unit is used, or when the second moving object is a person or a human-driven vehicle that cannot be controlled in the first place. In this case, the safety protection device 100a cannot accurately acquire performance information about the second moving object, and it becomes necessary to acquire the performance information by, for example, querying another control unit 150b, or to estimate the performance information Bsp by observation.

[0057] In this case, since the safety protection device is not present on the second moving body, it is unclear whether the second moving body will be controlled safely or whether the person will behave correctly. Therefore, the safety protection device may need to take a somewhat pessimistic approach, such as adding a large margin to the safety rules (e.g., if the notified acceleration range is -4 m / s 2 ]~+4[m / s 2 ], with a margin of -6 [m / s 2 ]~+6[m / s 2 However, it is possible to ensure safety by combining other systems and people with other mechanisms or mechanisms, such as compulsory output control or a system that ensures safe human behavior, in combination with the safety protection device of the present invention.

[0058] As one example, performance information from another control unit is provided with trust information indicating that the performance information is reliable due to another mechanism or scheme, as described above. Or, in the case of a person, trust information is provided indicating that there is another mechanism or rule for protecting safety. This information does not need to be received directly from another control unit or person; it may be provided via another information path, such as information transmission from a control system (not shown). With such reliable performance information, there is no need to take the margin shown in the above formula. Furthermore, if such trust information cannot be obtained, the safety protection device adds a margin to the safety rule. By switching based on such trust information, it becomes possible to safely and efficiently reduce unnecessary margins.

[0059] FIG. 7 is a diagram showing the configuration of moving bodies 200a and 200c, a control unit 150a, and a safety protection device 100a. The safety protection device 100a includes a first acquisition unit 111, a second acquisition unit 112, a rule creation unit 113, a monitoring unit 114, a control unit 115, and a recording unit 116. The safety protection device 100 reduces risks that may occur between a moving object 200a that is autonomously controlled by a control unit 150a and a moving object 200b.

[0060] The first acquisition unit 111 acquires performance information related to the moving object 200a from the control unit 150a that is to be controlled and monitored. The second acquisition unit 112 estimates performance information of another moving body 200c that affects the moving body 200a.

[0061] The rule creating unit 113 uses the acquired performance information of the moving body 200a and the performance information of the moving body 200c to create safety rules to reduce risks that may occur between the moving body 200a and the moving body 200c.

[0062] The monitoring unit 114 monitors the output information of the control unit 150a and / or the operation of the moving object 200a based on the safety rules created by the rule creating unit 113. When the monitoring unit 114 detects that the output information of the control unit 150a and / or the operation of the moving object 200a violates a safety rule, the control unit 115 controls the control unit 150a to transition to a safe state. The recording unit 116 records the results of monitoring by the monitoring unit 114. Moreover, the control unit 150a is the main control target.

[0063] Third Embodiment Alternatively, the safety protection devices may be integrated into a single device, and multiple control units may be protected by a single safety protection device.

[0064] FIG. 8 is a diagram illustrating the operation of the integrated safety protection device 100 and the plurality of moving bodies 200a and 200b according to the third embodiment. In this case, communication between the performance information Asp and Bsp is not necessary, and it becomes possible to centrally manage, monitor, and control safety rules. On the other hand, each configuration is physically separated, and it is assumed that, for example, one server remotely protects both. In this case, safety protection must be implemented taking into account the communication time between each mobile device and safety protection device, and safety design must also take into account the possibility of communication being interrupted.

[0065] Fourth Embodiment The fourth embodiment is an example of a control unit that controls multiple robots. Here, the multiple robots are autonomous control devices. The robot arms of the respective robots are autonomously controlled moving bodies.

[0066] FIG. 9 is a diagram showing an example of the operations of the robots 700a and 700b and the control units 151a and 151b according to the fourth embodiment. Here, a first robot arm 710a of a robot 700a controlled by a control unit 151a and a second robot arm 710b of a robot 700b controlled by another control unit 151b share a part of the work area, and the area is shared near the center of the figure. The meanings of the parameters are as follows:

[0067] a max_a : Maximum deceleration of the first robot arm v a : Speed ​​of the first robot arm a max_b : Maximum deceleration of the second robot arm v b : Speed ​​of the second robot arm d: Distance between the first and second robot arms

[0068] FIG. 10 is an explanatory diagram of the operation of the robot, the control unit, and the safety protection device. The safety protection device 100a protects the safety of the main control unit 151a. The safety protection device 100b protects the safety of the other control unit 151b. The arrows indicate the exchange of information. Here, the first robot arm 710a operates based on the performance information Asp. Equation (4) of the performance information Asp is shown below.

number

[0069] The second robot arm 710b operates based on the performance information Bsp. Each of the contents is shown in equation (5).

number

[0070] The operation flow of the safety protection device 100a is almost the same as that of the first embodiment. In this case, the safety rule is created by first determining the minimum distance d min Using the above parameters, and omitting the response time, we obtain the formula (6).

number

[0071] Here, the safety rule based on equation (6) is as follows: Safety Rule #2: The distance d between the arms is the minimum distance d minIf the arm speed is less than 1 / 2, a predetermined behavior is performed with an appropriate response time, for example, maximum deceleration is performed in the direction in which the arm moves away from the other arm.

[0072] The behavior of the safety monitoring is also mainly the same as in the first embodiment, and the distance d between the arms is the minimum distance d min The behavior of each system is monitored when it is below the threshold, and violations are detected.

[0073] Regarding the subsequent transition control to a safe state, after the above-mentioned deceleration, if necessary, the vehicle is moved to an area other than the shared area, i.e., a position where it will not collide with other systems, and then stopped.

[0074] Here, an example has been shown in which safety is ensured by controlling the safety control between robots based on their distance from each other, but it is also possible to combine this with, for example, exclusive control, which will be described later, and perform control by combining both. For example, a configuration is possible in which the safety control as the main function is performed by the distance control of this embodiment, and the safety control as a safety function (protection function) is performed by exclusive control, which will be described later. By doing so, it is possible to maintain safety even if there is a partial failure in one of the functions. In particular, by realizing safety protection using different methods, it is possible to ensure diversity in safety design, and safety is improved by a redundant configuration of the same function.

[0075] In particular, with regard to this embodiment, as described in the safety protection architecture above, an example of safety protection can be considered in which a person is considered to be an opponent that does not have a safety protection device like other control units. In that case, as with the above, by making a judgment using predictions of the person's actions and (separately acquired) performance information and / or reliability information of the person, each person can perform their work safely.

[0076] In this example, the speed is the current speed, but it can also be the maximum speed of the system. By doing so, the margin becomes larger due to the difference from the actual speed, but it becomes possible to eliminate the influence of the observation of the current speed and its errors (errors in the measurement values, delays, etc.).

[0077] FIG. 11 is a configuration diagram of safety protection devices 100a and 100b according to the fourth embodiment. The safety protection devices 100a and 100b are configured to include a first acquisition unit 111, a second acquisition unit 112, a rule creation unit 113, a monitoring unit 114, a control unit 115, and a recording unit 116. The safety protection device 100a reduces risks that occur between a first robot arm 710a controlled by a control unit 151a and a second robot arm 710b controlled by a control unit 151b. The safety protection device 100b reduces risks that occur between a second robot arm 710b controlled by a control unit 151b and a first robot arm 710a controlled by a control unit 151a.

[0078] The operation of each part of the safety protection device 100a will be described below. The first acquisition unit 111 of the safety protection device 100a acquires performance information about the first robot arm 710a from the control unit 151a that is to be controlled and monitored.

[0079] The second acquisition unit 112 of the safety protection device 100a acquires performance information relating to the second robot arm 710b from the control unit 151b of another second robot arm 710b that affects the first robot arm 710a.

[0080] The rule creation unit 113 of the safety protection device 100a uses the acquired performance information of the first robot arm 710a and the performance information of the second robot arm 710b to create safety rules to reduce risks that may occur between the first robot arm 710a and the second robot arm 710b.

[0081] The monitoring unit 114 monitors the output information of the control unit 150a and / or the operation of the first robot arm 710a based on the safety rules created by the rule creating unit 113. When the monitoring unit 114 detects that the output information of the control unit 151a and / or the operation of the first robot arm 710a violates a safety rule, the control unit 115 controls the control unit 151a to a risk reduction state. The recording unit 116 records the results of monitoring by the monitoring unit 114.

[0082] Furthermore, for the safety protection device 100a, the control unit 151a is the primary control target, and the control unit 151b is the secondary control target.

[0083] The operation of each part of the safety protection device 100b will be described below. The first acquisition unit 111 of the safety protection device 100b acquires performance information on the second robot arm 710b from the control unit 151b that is to be controlled and monitored.

[0084] The second acquisition unit 112 of the safety protection device 100b acquires performance information relating to the first robot arm 710a from the control unit 151a of the other first robot arm 710a that affects the second robot arm 710b.

[0085] The rule creation unit 113 of the safety protection device 100b uses the acquired performance information of the second robot arm 710b and the performance information of the first robot arm 710a to create safety rules to reduce risks that may occur between the second robot arm 710b and the first robot arm 710a.

[0086] The monitoring unit 114 monitors the output information of the control unit 150b and / or the operation of the second robot arm 710b based on the safety rules created by the rule creating unit 113. When the monitoring unit 114 detects that the output information of the control unit 151b and / or the operation of the second robot arm 710b violates a safety rule, the control unit 115 controls the control unit 151b to a risk reduction state. The recording unit 116 records the results of monitoring by the monitoring unit 114.

[0087] Furthermore, for the safety protection device 100b, the control unit 151b is the primary control target, and the control unit 151a is the secondary control target.

[0088] Next, FIG. 12 shows an example of a robot arm in which collision prevention is performed by exclusive control of an exclusive area 800. Here, a main control unit 151a and another control unit 151b perform collision prevention for the intersecting exclusive areas 800 by exclusive control of the exclusive areas. Here, exclusive control means that when one of them is inside the exclusive area 800, the other does not enter the exclusive area 800. The logical functional structure in this situation is the same as in the second embodiment.

[0089] In this case, if a player does not enter the exclusive area 800 when the other player is completely inside the exclusive area 800, it is safe but inefficient. There may also be cases where a conflict occurs when both players try to enter the exclusive area 800. Therefore, it is possible to improve efficiency and safety by avoiding an attempt to enter when the other player is about to enter, and by attempting to enter when the other player is about to leave the exclusive area 800.

[0090] In this case, safety protection is realized using operation parameters such as the speed and acceleration of each control unit in the same manner as in the first to third embodiments. For example, examples of safety rules are as follows: Safety Rule #3: Do not invade if your opponent is in the exclusive area 800. Safety Rule #4: Based on speed and acceleration performance, if the opponent is likely to enter the exclusive area 800 first, do not attempt to enter.

[0091] Here, we will not go into details about how to create an appropriate size exclusive area 800, but it is desirable to dynamically determine the size based on the parameters of each control unit, such as speed, maximum speed, acceleration, and maximum acceleration. Based on these parameters, the size is determined so that as long as each control unit adheres to the parameters and rules, there will be no collisions within the exclusive area 800 and each unit can operate with maximum efficiency. By doing so, efficient and safe exclusive control can be achieved.

[0092] In this case, too, safe and efficient control is possible by using the safety protection device of the present invention to monitor compliance with parameters and safety rules. According to the embodiment described above, the safety protection device can ensure safety by establishing safety rules and performing control based on performance information declared by or acquired from the control unit. The safety protection device can detect the occurrence of an abnormal situation, such as a deviation from the declared performance information or a failure to comply with the safety rules, and can transition the control unit to a safe state.

[0093] In particular, by detecting violations of the declarations of parameters used to create safety rules, the safety protection device can predict future abnormalities and safely shut down the control unit in advance even if no safety rules are violated. Furthermore, by recording information about the control unit that caused the abnormality, the safety protection device can identify the control unit that caused the abnormality, and software improvements can also be easily realized.

[0094] Furthermore, by performing a calculation that adds the time required to deal with a fault to the response time in the safety rules, it becomes possible to safely stop the control unit when the safety protection device detects the occurrence of a fault.

[0095] Furthermore, even when a system cooperates with other systems or people that do not have a safety protection device, the safety protection device can similarly determine the status of the other systems or people and take action to ensure safety. In particular, by determining performance information with the addition of trust information, it becomes possible to accurately predict the performance information of other systems or people and control them safely.

[0096] In another embodiment, the safety of the present invention can be further improved by combining not only the safe distance but also exclusive control.

[0097] The configuration and effects of the present invention will be described below.

[0098] [1] a first acquisition unit (111) that acquires performance information of a first moving body (moving body 200a) that is autonomously controlled by a control unit (150a) that is a monitoring target; a second acquisition unit (112) that acquires performance information of a second moving body (moving body 200b); a rule creation unit (113) that uses performance information of the second moving body (moving body 200b) and performance information of the first moving body (moving body 200a) to create a safety rule for maintaining a distance between the first moving body (moving body 200a) and the second moving body (moving body 200b) so as to reduce risks that may occur between the first moving body (moving body 200a) and the second moving body (moving body 200b); a monitoring unit (114) that monitors whether output information of the control unit (150a) and / or the operation of the first moving body (moving body 200a) violates the safety rule based on the safety rule created by the rule creating unit (113); a control unit (115) that controls the control unit (150a) to transition to a safe state when the monitoring unit (114) detects that the output information of the control unit (150a) and / or the operation of the first moving body (moving body 200a) violates the safety rule; and A safety protection device (100) comprising:

[0099] This makes it possible to construct and control safety rules based on performance information declared by or acquired from an autonomously controlled mobile body, and in particular to detect abnormal situations such as deviations from declared performance information or non-compliance with safety rules, thereby transitioning the autonomously controlled mobile body to a safe state.

[0100] [2] The control unit (115) controls the control unit (150a) so that the relative speed between the first moving body (moving body 200a) and the second moving body (moving body 200b) is equal to or less than a predetermined value, thereby controlling the control unit (150a) to transition to a safe state. 2. The safety protection device of claim 1.

[0101] This allows the control unit to control the speed of the autonomously controlled moving body to be equal to or less than a predetermined value.

[0102] [3] When the distance becomes equal to or less than a predetermined value, the control unit (115) controls the control unit (150a) so that the speed or kinetic energy of the first moving body (moving body 200a) becomes equal to or less than a predetermined value, thereby controlling the control unit (150a) to transition to a safe state. 3. The safety protection device of claim 2.

[0103] This allows the control unit to control the speed of the autonomously controlled moving body so that it is equal to or greater than a predetermined value.

[0104] [4] The second acquisition unit (112) acquires the position of the second moving body (moving body 200b), When the distance becomes equal to or less than a predetermined value and the second moving body (moving body 200b) is ahead of the first moving body (moving body 200a), the control unit (115) controls the speed or kinetic energy of the first moving body (moving body 200a) to become equal to or less than a predetermined value, and when the second moving body (moving body 200b) is behind the first moving body (moving body 200a), the control unit (115) controls the speed or kinetic energy of the first moving body (moving body 200a) to become equal to or more than a predetermined value. 3. The safety protection device of claim 2.

[0105] This allows the control unit to control the distance between the autonomously controlled first moving body and the second moving body so that it is equal to or greater than a predetermined value.

[0106] [5] The performance information of the first moving body (moving body 200a) and the performance information of the second moving body (moving body 200b) include at least one of a maximum speed or a minimum speed, a maximum acceleration or a minimum acceleration related to safety, 2. The safety protection device according to claim 1.

[0107] This makes it possible to create safety rules in an optimal manner.

[0108] [6] The monitoring unit (114) detects a violation of the safety rule by using a violation related to a parameter of the performance information used to create the safety rule. 2. The safety protection device according to claim 1.

[0109] This makes it possible to predict a fault between the first moving body and the second moving body simply by substituting the parameters of the performance information into a predetermined calculation formula.

[0110] [7] The rule creation unit (113) calculates a response time in the safety rule, including a time required to deal with a failure. 2. The safety protection device according to claim 1.

[0111] This prevents a failure from occurring even if the response is delayed by the time required to respond to the failure.

[0112] [8] The second acquisition unit (112) estimates performance information of the second moving body (moving body 200b) to acquire the performance information. 2. The safety protection device according to claim 1,

[0113] This makes it possible to create safety rules to prevent any problems from occurring between the first moving body and the second moving body, even if the second moving body does not have the function of notifying the first moving body of performance information.

[0114] [9] The second acquisition unit (112) estimates performance information of the second moving body (moving body 200b) using reliability information of the second moving body. 6. The safety protection device according to claim 5.

[0115] This makes it possible to appropriately predict performance information based on reliability information about the second moving body, and to create safety rules to prevent any problems from occurring between the second moving body and the first moving body.

[0116]

[10] The system further includes a recording unit (116) that records information about violations of safety rules detected by the monitoring unit (114). 2. The safety protection device according to claim 1.

[0117] This makes it possible to verify after the fact what safety rules were created between each moving object.

[0118]

[11] The monitoring unit (114) identifies violations of the safety rules; The control unit (115) controls the state in which the safety rule is violated to transition to a safe state. 2. The safety protection device according to claim 1.

[0119] This allows a safe distance to be maintained between each moving object.

[0120]

[12] a first acquisition unit (111) that acquires performance information of a first moving body (moving body 200a) that is autonomously controlled by a control unit (150a) that is a monitoring target; a second acquisition unit (112) that acquires performance information of a second moving body (moving body 200b); a rule creation unit (113) that uses performance information of the second moving body (moving body 200b) and performance information of the first moving body (moving body 200a) to create a safety rule for maintaining a distance between the first moving body (moving body 200a) and the second moving body (moving body 200b) so as to reduce risks that may occur between the first moving body (moving body 200a) and the second moving body (moving body 200b); a monitoring unit (114) that monitors whether output information of the control unit (150a) and / or the operation of the first moving body (moving body 200a) violates the safety rule based on the safety rule created by the rule creating unit (113); a control unit (115) that controls the control unit (150a) to transition to a safe state when the monitoring unit detects that the output information of the control unit (150a) and / or the operation of the first moving body (moving body 200a) violates the safety rule; A safety protection system comprising:

[0121] This makes it possible to construct and control safety rules based on performance information declared by or acquired from an autonomously controlled mobile body, and in particular to detect abnormal situations such as deviations from declared performance information or non-compliance with safety rules, thereby transitioning the autonomously controlled mobile body to a safe state.

[0122]

[13] A step in which a first acquisition unit (111) acquires performance information of a first moving body (moving body 200a) that is autonomously controlled by a control unit (150a) to be monitored; A step in which a second acquisition unit (112) acquires performance information of a second moving body (moving body 200b); a step in which a rule creation unit (113) creates a safety rule for maintaining a distance between the first moving body (moving body 200a) and the second moving body (moving body 200b) using performance information of the second moving body (moving body 200b) and performance information of the first moving body (moving body 200a) so as to reduce risks occurring between the first moving body (moving body 200a) and the second moving body (moving body 200b); a step in which a monitoring unit (114) monitors whether output information of the control unit (150a) and / or the operation of the first moving body (moving body 200a) violates the safety rule based on the safety rule created by the rule creating unit (113); When the monitoring unit (114) detects that the output information of the control unit (150a) and / or the operation of the first moving body (moving body 200a) violates the safety rule, a control unit (115) controls the control unit (150a) to transition to a safe state; A security method comprising:

[0123] This makes it possible to construct and control safety rules based on performance information declared by or acquired from an autonomously controlled mobile body, and in particular to detect abnormal situations such as deviations from declared performance information or non-compliance with safety rules, thereby transitioning the autonomously controlled mobile body to a safe state.

[0124] <<Variation>> The present invention is not limited to the above-described embodiments and includes various modifications. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and are not necessarily limited to those including all of the described configurations. It is possible to replace part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. Furthermore, it is also possible to add, delete, or replace part of the configuration of each embodiment with other configurations.

[0125] The above-described configurations, functions, processing units, processing means, etc. may be realized in part or in whole by hardware such as an integrated circuit. The above-described configurations, functions, etc. may be realized by software by a processor interpreting and executing a program that realizes each function. Information such as the programs, tables, and files that realize each function can be stored in a storage device such as a memory, a hard disk, or an SSD (Solid State Drive), or on a storage medium such as a flash memory card or a DVD (Digital Versatile Disk).

[0126] In each embodiment, the control lines and information lines shown are those that are considered necessary for the explanation, and not all control lines and information lines in the product are necessarily shown. In reality, it can be considered that almost all components are interconnected. As modified examples of the present invention, for example, the following (a) to (c) are available. (a) The safety rule may be a rule that the relative speed between the first moving body and the second moving body is equal to or less than a predetermined value. (b) The safety rule may be a rule that the speed or kinetic energy of the first moving object is equal to or less than a predetermined value when there is no following vehicle. (c) The safety rule may be a rule that the distance between the first moving body and an obstacle is equal to or greater than a predetermined value. In this case, the safety protection device has a function of detecting the obstacle. [Explanation of symbols]

[0127] 100,100a,100b Safety protection device 111 First Acquisition Department 112 Second Acquisition Department 113 Rule Creation Department 114 Monitoring Department 115 Control Unit 150, 150a, 150b control unit 200 Mobile 200a Mobile object (first mobile object) 200b Mobile body (second mobile body)

Claims

1. a first acquisition unit that acquires performance information of a first moving object that is autonomously controlled by a control unit to be monitored; a second acquisition unit that acquires performance information of the second moving object; a rule creation unit that uses performance information of the second moving body and performance information of the first moving body to create a safety rule for maintaining a distance between the first moving body and the second moving body so as to reduce risks that may occur between the first moving body and the second moving body; a monitoring unit that monitors whether output information of the control unit and / or a movement of the first moving object violates the safety rule based on the safety rule created by the rule creating unit; a control unit that controls the control unit to transition to a safe state when the monitoring unit detects that the output information of the control unit and / or the operation of the first moving object violates the safety rule; A safety protection device comprising:

2. The control unit controls the control unit so that the distance between the first moving body and the second moving body is equal to or greater than a predetermined value, thereby controlling the control unit to transition to a safe state.

10. The safety device of claim 1.

3. When the distance becomes equal to or less than a predetermined value, the control unit controls the control unit so that the relative speed between the first moving body and the second moving body becomes equal to or less than a predetermined value.

3. The safety device of claim 2.

4. the second acquisition unit acquires a position of the second moving object; When the distance becomes equal to or less than a predetermined value and the second moving body is ahead of the first moving body, the control unit controls the speed or kinetic energy of the first moving body to be equal to or less than a predetermined value, and when the second moving body is behind the first moving body, the control unit controls the speed or kinetic energy of the first moving body to be equal to or more than a predetermined value.

3. The safety device of claim 2.

5. The performance information of the first moving body and the performance information of the second moving body include at least one of a maximum speed or a minimum speed, a maximum acceleration or a minimum acceleration related to safety; 2. The safety protection device of claim 1.

6. the monitoring unit detects a violation of the safety rule by using a violation related to a parameter of performance information used in creating the safety rule.

2. The safety protection device of claim 1.

7. the rule creation unit calculates a response time in the safety rule including a time required to deal with a failure.

2. The safety protection device of claim 1.

8. The second acquisition unit estimates performance information of the second moving object to acquire the performance information.

2. The safety protection device according to claim 1,

9. The second acquisition unit estimates performance information of the second mobile object using reliability information of the second mobile object.

6. The safety protection device according to claim 5.

10. The system further includes a recording unit that records information regarding a violation of a safety rule detected by the monitoring unit.

2. The safety protection device of claim 1.

11. The monitoring unit identifies violations of the safety rules; The control unit controls the state in which the safety rule is violated to transition to a safe state.

2. The safety protection device of claim 1.

12. a first acquisition unit that acquires performance information of a first moving object that is autonomously controlled by a control unit to be monitored; a second acquisition unit that acquires performance information of the second moving object; a rule creation unit that uses performance information of the second moving body and performance information of the first moving body to create a safety rule for maintaining a distance between the first moving body and the second moving body so as to reduce risks that may occur between the first moving body and the second moving body; a monitoring unit that monitors whether output information of the control unit and / or a movement of the first moving object violates the safety rule based on the safety rule created by the rule creating unit; a control unit that controls the control unit to transition to a safe state when the monitoring unit detects that the output information of the control unit and / or the operation of the first moving object violates the safety rule; A safety protection system comprising:

13. a step in which a first acquisition unit acquires performance information of a first moving object that is autonomously controlled by a control unit to be monitored; a second acquisition unit acquiring performance information of the second moving object; a step in which a rule creation unit creates a safety rule for maintaining a distance between the first moving body and the second moving body using performance information of the second moving body and the performance information of the first moving body so as to reduce risks occurring between the first moving body and the second moving body; a step in which a monitoring unit monitors whether output information of the control unit and / or a movement of the first moving object violates the safety rule based on the safety rule created by the rule creating unit; When the monitoring unit detects that the output information of the control unit and / or the operation of the first moving object violates the safety rule, a control unit controls the control unit to transition to a safe state; A security method comprising:

Images